joyce8/EMBER2024-capa huggingface dataset:
Function at 0x497a90
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x4f0dd0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x497ab8
mov eax, dword [ebp - 4]
jmp 0x497b93
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.MSVCR71.dll_wcscpy]
add esp, 8
push 0x4cbaa0
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.MSVCR71.dll_wcscat]
add esp, 8
lea eax, [ebp - 0x468]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0xffffffff
jne 0x497b0c
mov eax, dword [ebp - 4]
jmp 0x497b93
mov edx, dword [ebp - 0x468]
and edx, 0x10
je 0x497b19
jmp 0x497b61
lea eax, [ebp - 0x43c]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s_s
lea edx, [ebp - 0x670]
push edx
call dword [sym.imp.MSVCR71.dll_swprintf]
add esp, 0x10
push 0x80
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [ebp - 0x670]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
lea eax, [ebp - 0x468]
push eax
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x497b0c
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0049f127
mov esp, ebp
pop ebp
ret
Function at 0x49e1f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
mov eax, dword [0x4f0dd0]
push esi
push edi
mov dword [esp + 0x21c], eax
xor esi, esi
xor eax, eax
mov word [esp + 0x10], si
mov ecx, 0x81
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x10]
push 0x5c
push ecx
call dword [sym.imp.MSVCR71.dll_wcsrchr]
push 0xc
lea edx, [esp + 0x1c]
push str.APConfig.ini
push edx
mov word [eax + 2], si
call dword [sym.imp.MSVCR71.dll_wcsncat]
add esp, 0x14
lea eax, [esp + 0x10]
push eax
push 2
lea ecx, [esp + 0x14]
push ecx
push 0x4c434c
push str.Replaced
push str.AutoRepair
mov word [esp + 0x24], si
mov word [esp + 0x26], si
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.MSVCR71.dll__wtoi]
mov ecx, dword [esp + 0x220]
add esp, 4
call fcn.0049f127
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x49e2b0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x218
mov eax, dword [0x4f0dd0]
push esi
push edi
mov dword [esp + 0x21c], eax
xor esi, esi
xor eax, eax
mov word [esp + 0x10], si
mov ecx, 0x81
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x10]
push 0x5c
push ecx
call dword [sym.imp.MSVCR71.dll_wcsrchr]
push 0xc
lea edx, [esp + 0x1c]
push str.APConfig.ini
push edx
mov word [eax + 2], si
call dword [sym.imp.MSVCR71.dll_wcsncat]
add esp, 0x14
lea eax, [esp + 0x10]
push eax
push 2
lea ecx, [esp + 0x14]
push ecx
push 0x4c434c
push str.Restored
push str.AutoRepair
mov word [esp + 0x24], si
mov word [esp + 0x26], si
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.MSVCR71.dll__wtoi]
mov ecx, dword [esp + 0x220]
add esp, 4
call fcn.0049f127
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49e370
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x4f0dd0]
push edi
mov dword [esp + 0x21c], eax
xor eax, eax
mov word [esp + 0x10], 0
mov ecx, 0x81
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x10]
push 0x5c
push ecx
call dword [sym.imp.MSVCR71.dll_wcsrchr]
push 0xc
lea edx, [esp + 0x1c]
push str.APConfig.ini
push edx
mov word [eax + 2], 0
call dword [sym.imp.MSVCR71.dll_wcsncat]
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
push 5
lea edx, [esp + 0xc]
push edx
push 0x4c434c
xor eax, eax
push str.CrashTimes
mov dword [esp + 0x1a], eax
push str.AutoRepair
mov word [esp + 0x1c], 0
mov dword [esp + 0x22], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 4]
push eax
call dword [sym.imp.MSVCR71.dll__wtoi]
xor ecx, ecx
add esp, 4
cmp eax, 3
setge cl
mov eax, ecx
mov ecx, dword [esp + 0x21c]
call fcn.0049f127
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x49e440
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x230
mov eax, dword [0x4f0dd0]
push esi
push edi
mov dword [esp + 0x234], eax
xor esi, esi
xor eax, eax
mov word [esp + 0x28], si
mov ecx, 0x81
lea edi, [esp + 0x2a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x28]
push 0x5c
push ecx
call dword [sym.imp.MSVCR71.dll_wcsrchr]
push 0xc
lea edx, [esp + 0x34]
push str.APConfig.ini
push edx
mov word [eax + 2], si
call dword [sym.imp.MSVCR71.dll_wcsncat]
add esp, 0x14
lea eax, [esp + 0x28]
push eax
push 8
lea ecx, [esp + 0x18]
push ecx
push str.ReplaceTime
push str.AutoRepair
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStructW]
test eax, eax
je 0x49e51e
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
sub ecx, esi
sbb eax, edx
cmp eax, 0x580
jl 0x49e51e
jg 0x49e507
cmp ecx, 0x28e44000
jbe 0x49e51e
mov eax, 1
mov ecx, dword [esp + 0x234]
call fcn.0049f127
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x234]
xor eax, eax
call fcn.0049f127
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x49e540
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x420
mov eax, dword [0x4f0dd0]
push esi
push edi
mov dword [esp + 0x424], eax
call fcn.0049e1f0
test eax, eax
jne 0x49e575
mov ecx, dword [esp + 0x424]
call fcn.0049f127
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.0049e370
test eax, eax
jne 0x49e63a
call fcn.0049e440
test eax, eax
jne 0x49e63a
xor esi, esi
mov word [esp + 0x10], si
mov ecx, 0x81
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [esp + 0x218], si
mov ecx, 0x81
lea edi, [esp + 0x21a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str...ServerConfig.ini
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x220]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 0x218]
push eax
push 2
lea ecx, [esp + 0x14]
push ecx
push 0x4c434c
push str.Restore
push str.ServerConfig
mov word [esp + 0x24], si
mov word [esp + 0x26], si
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.MSVCR71.dll__wtoi]
add esp, 4
neg eax
sbb eax, eax
neg eax
mov ecx, dword [esp + 0x424]
call fcn.0049f127
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x424]
mov eax, 1
call fcn.0049f127
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x49e7d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa14
mov eax, dword [0x4f0dd0]
push edi
mov dword [esp + 0xa14], eax
xor eax, eax
mov word [esp + 8], 0
mov ecx, 0x81
lea edi, [esp + 0xa]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [esp + 0xc]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 8]
push 0x5c
push ecx
call dword [sym.imp.MSVCR71.dll_wcsrchr]
push 0xd
lea edx, [esp + 0x14]
push str.TDPRepair.exe
push edx
mov word [eax + 2], 0
call dword [sym.imp.MSVCR71.dll_wcsncat]
mov eax, dword [ebp + 8]
push eax
lea ecx, [esp + 0x228]
push str.__dir_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x20
push 2
lea edx, [esp + 0x214]
push edx
lea eax, [esp + 0x10]
push eax
call dword [0x4cfae8]
call fcn.0049e1f0
test eax, eax
je 0x49e887
call fcn.0049e2b0
test eax, eax
jne 0x49e887
push eax
push eax
push 0x49e660
call dword [sym.imp.MSVCR71.dll__beginthread]
add esp, 0xc
mov ecx, dword [esp + 0xa14]
call fcn.0049f127
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x49e8a0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x414
mov eax, dword [0x4f0dd0]
mov dword [esp + 0x410], eax
call fcn.0049e2b0
test eax, eax
jne 0x49e913
call fcn.0049e540
test eax, eax
je 0x49e92b
push 0x104
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str..TDPRepair.exe
lea edx, [esp + 4]
push edx
lea eax, [esp + 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0
push 0
push 0
lea ecx, [esp + 0x214]
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, 1
mov ecx, dword [esp + 0x410]
call fcn.0049f127
add esp, 0x414
ret
mov ecx, dword [esp + 0x410]
xor eax, eax
call fcn.0049f127
add esp, 0x414
ret
Function at 0x49f3cc
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x4ccef0
call fcn.0049f2f8
xor edi, edi
mov dword [ebp - 0x20], edi
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call ebx
cmp word [eax], 0x5a4d
jne 0x49f40c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x49f40c
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x49f424
cmp eax, 0x20b
je 0x49f411
mov dword [ebp - 0x1c], edi
jmp 0x49f438
cmp dword [ecx + 0x84], 0xe
jbe 0x49f40c
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x49f432
cmp dword [ecx + 0x74], 0xe
jbe 0x49f40c
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x53afd0], 0xffffffff
or dword [0x53afd4], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x53afb4]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x53afb0]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x53afcc], eax
call fcn.0049f806
call fcn.00412fe0
cmp dword [0x4f0df0], edi
jne 0x49f498
push fcn.00412fe0
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.0049f894
push 0x4ed0cc
push 0x4ed0c8
call sub.MSVCR71.dll__initterm
push 0x49f84a
call fcn.0049f1d6
mov eax, dword [0x53afac]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x53afa8]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___wgetmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, edi
jge 0x49f4ec
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x4ed0c4
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__wcmdln]
mov esi, dword [eax]
cmp esi, edi
jne 0x49f516
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x49f5d0
mov dword [ebp - 0x24], esi
mov ax, word [esi]
cmp ax, 0x20
ja 0x49f585
cmp ax, di
je 0x49f52c
cmp dword [ebp - 0x20], edi
jne 0x49f585
mov ax, word [esi]
cmp ax, di
je 0x49f541
cmp ax, 0x20
ja 0x49f541
inc esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x49f52c
mov dword [ebp - 0x58], edi
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
test byte [ebp - 0x58], 1
je 0x49f55d
movzx eax, word [ebp - 0x54]
jmp 0x49f560
push 0xa
pop eax
push eax
push esi
push edi
push edi
call ebx
push eax
call fcn.00410f9b
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], edi
jne 0x49f57d
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x49f5ca
cmp ax, 0x22
jne 0x49f596
xor eax, eax
cmp dword [ebp - 0x20], edi
sete al
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x49f516
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0049f333
ret

Function at 0x49f9c6
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax], 0
and dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
ret
Function at 0x4a0614
Capabilities:
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x460]
sub esp, 0x4e0
mov eax, dword [0x4f0dd0]
mov ecx, dword [ebp + 0x46c]
xor eax, ebp
mov dword [ebp + 0x45c], eax
mov eax, dword [ebp + 0x468]
test eax, eax
push ebx
mov dword [ebp - 0x80], ecx
je 0x4a06e3
cmp word [eax], 0
je 0x4a06e3
push 0x4b8894
push eax
call dword [sym.imp.MSVCR71.dll__wfopen]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jne 0x4a0668
inc eax
jmp 0x4a06e6
push esi
lea eax, [ebp - 0x7c]
push edi
push eax
call fcn.0049f9c6
mov esi, dword [sym.imp.MSVCR71.dll_fread]
push ebx
mov edi, 0x400
push edi
lea eax, [ebp + 0x5c]
push 1
push eax
call esi
add esp, 0x14
jmp 0x4a06a8
push eax
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.004a0376
push ebx
push edi
lea eax, [ebp + 0x5c]
push 1
push eax
call esi
add esp, 0x1c
test eax, eax
ja 0x4a068d
push dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
push eax
call fcn.004a0415
push 0xd8
xor esi, esi
lea eax, [ebp - 0x7c]
push esi
push eax
call sub.MSVCR71.dll_memset
add esp, 0x14
test byte [ebx + 0xc], 0x20
je 0x4a06d5
push 2
pop esi
push ebx
call dword [sym.imp.MSVCR71.dll_fclose]
pop ecx
pop edi
mov eax, esi
pop esi
jmp 0x4a06e6
push 3
pop eax
mov ecx, dword [ebp + 0x45c]
xor ecx, ebp
pop ebx
call fcn.0049f127
add ebp, 0x460
leave
ret
Function at 0x4a06fc
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x4a0743
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x4a0743
xor edx, edx
mov eax, esi
shl eax, 3
push 6
pop ecx
div ecx
lea ecx, [eax + eax*2]
shl ecx, 1
mov edx, ecx
mov ecx, esi
shl ecx, 3
sub ecx, edx
dec ecx
dec ecx
je 0x4a0736
dec ecx
dec ecx
jne 0x4a0739
inc eax
inc eax
jmp 0x4a0739
add eax, 3
mov ecx, dword [ebp + 0xc]
inc eax
cmp dword [ecx], eax
jae 0x4a074a
mov dword [ecx], eax
push 0xfffffffffffffff0
pop eax
pop edi
pop esi
leave
ret
push ebx
xor edx, edx
push 3
pop ecx
mov eax, esi
div ecx
mov ecx, dword [ebp + 8]
xor edx, edx
lea eax, [eax + eax*2]
test eax, eax
jbe 0x4a07d0
push 3
dec eax
pop esi
div esi
inc eax
lea edx, [eax + eax*2]
mov dword [ebp - 4], edx
movzx esi, byte [edi]
inc edi
movzx edx, byte [edi]
mov ebx, esi
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc edi
mov dword [ebp + 0x10], edx
movzx edx, byte [edi]
mov byte [ecx], bl
mov ebx, dword [ebp + 0x10]
shr ebx, 4
shl esi, 4
add ebx, esi
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc edi
inc ecx
mov byte [ecx], bl
mov ebx, dword [ebp + 0x10]
mov esi, edx
shr esi, 6
lea esi, [esi + ebx*4]
and esi, 0x3f
mov bl, byte [esi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], bl
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], dl
inc ecx
dec eax
jne 0x4a076d
mov esi, dword [ebp + 0x14]
mov edx, dword [ebp - 4]
cmp edx, esi
jae 0x4a0825
movzx eax, byte [edi]
inc edx
cmp edx, esi
jae 0x4a07e2
movzx edi, byte [edi + 1]
jmp 0x4a07e4
xor edi, edi
mov ebx, eax
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
shl eax, 4
mov ebx, edi
shr ebx, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edx, esi
jae 0x4a081d
and edi, 0xf
mov al, byte [edi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
jmp 0x4a0820
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov edx, dword [ebp + 0xc]
mov eax, ecx
sub eax, dword [ebp + 8]
pop ebx
mov dword [edx], eax
mov byte [ecx], 0
xor eax, eax
jmp 0x4a0746
Function at 0x4a083a
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
push ebx
push esi
push edi
je 0x4a0950
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x4a0950
xor esi, esi
xor ebx, ebx
xor edx, edx
test edi, edi
jbe 0x4a094c
mov eax, edi
sub eax, edx
cmp eax, 2
jb 0x4a087b
cmp byte [edx + ecx], 0xd
jne 0x4a087b
cmp byte [edx + ecx + 1], 0xa
je 0x4a08b6
mov al, byte [edx + ecx]
cmp al, 0xa
je 0x4a08b6
cmp al, 0x3d
jne 0x4a0890
inc ebx
cmp ebx, 2
ja 0x4a0950
cmp al, 0x7f
ja 0x4a0950
movzx eax, al
mov al, byte [eax + 0x4ccfb0]
cmp al, 0x7f
je 0x4a0950
cmp al, 0x40
jae 0x4a08b5
test ebx, ebx
jne 0x4a0950
inc esi
inc edx
cmp edx, edi
jb 0x4a0865
test esi, esi
je 0x4a094c
mov ecx, dword [ebp + 0xc]
lea eax, [esi + esi*2]
lea eax, [eax + eax + 7]
shr eax, 3
cmp dword [ecx], eax
jae 0x4a08da
mov dword [ecx], eax
push 0xfffffffffffffff0
jmp 0x4a0952
mov ecx, dword [ebp + 8]
push 3
xor ebx, ebx
xor esi, esi
test edx, edx
pop edi
jbe 0x4a0944
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0xd
je 0x4a093c
cmp al, 0xa
je 0x4a093c
movzx eax, al
movzx eax, byte [eax + 0x4ccfb0]
xor edx, edx
cmp al, 0x40
sete dl
shl ebx, 6
and eax, 0x3f
or eax, ebx
mov ebx, eax
sub edi, edx
inc esi
cmp esi, 4
jne 0x4a093c
xor esi, esi
test edi, edi
jbe 0x4a0927
shr eax, 0x10
mov byte [ecx], al
inc ecx
cmp edi, 1
jbe 0x4a0934
mov eax, ebx
shr eax, 8
mov byte [ecx], al
inc ecx
cmp edi, 2
jbe 0x4a093c
mov byte [ecx], bl
inc ecx
inc dword [ebp + 0x10]
dec dword [ebp - 4]
jne 0x4a08eb
sub ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
xor eax, eax
jmp 0x4a0953
push 0xffffffffffffffee
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4a0f43
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [ebp + 0x10]
sub eax, 0x80
push edi
je 0x4a0f7f
sub eax, 0x40
je 0x4a0f74
sub eax, 0x40
je 0x4a0f69
or eax, 0xffffffff
jmp 0x4a105f
mov edi, dword [ebp + 8]
mov dword [edi], 0xe
jmp 0x4a0f88
mov edi, dword [ebp + 8]
mov dword [edi], 0xc
jmp 0x4a0f88
mov edi, dword [ebp + 8]
mov dword [edi], 0xa
push esi
push dword [ebp + 0x10]
lea eax, [ebp - 0x118]
push dword [ebp + 0xc]
lea esi, [edi + 8]
push eax
mov dword [edi + 4], esi
call fcn.004a0cc7
mov eax, dword [ebp - 0x118]
shl eax, 4
add eax, dword [ebp - 0x114]
add esp, 0xc
mov ecx, dword [eax]
mov dword [esi], ecx
push 4
pop ecx
add eax, ecx
mov edx, dword [eax]
add esi, ecx
mov dword [esi], edx
add eax, ecx
mov edx, dword [eax]
add esi, ecx
mov dword [esi], edx
add eax, ecx
mov edx, dword [eax]
add esi, ecx
mov dword [esi], edx
mov edi, dword [edi]
add esi, ecx
dec edi
sub eax, 0x1c
test edi, edi
jle 0x4a1042
mov dword [ebp + 0x10], edi
push ebx
mov edx, ecx
movzx edi, byte [eax + 3]
movzx edi, byte [edi + str.cw]
movzx ebx, byte [eax + 2]
movzx ebx, byte [ebx + str.cw]
mov edi, dword [edi*4 + 0x4cee30]
xor edi, dword [ebx*4 + 0x4cea30]
movzx ebx, byte [eax + 1]
movzx ebx, byte [ebx + str.cw]
xor edi, dword [ebx*4 + 0x4ce630]
mov ebx, dword [eax]
and ebx, 0xff
movzx ebx, byte [ebx + str.cw]
xor edi, dword [ebx*4 + 0x4ce230]
add eax, ecx
mov dword [esi], edi
add esi, ecx
dec edx
jne 0x4a0fe4
sub eax, 0x20
dec dword [ebp + 0x10]
jne 0x4a0fe2
pop ebx
mov edx, dword [eax]
mov dword [esi], edx
add eax, ecx
mov edx, dword [eax]
add esi, ecx
mov dword [esi], edx
add esi, ecx
add eax, ecx
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, dword [eax + 4]
mov dword [esi + 4], eax
xor eax, eax
pop esi
pop edi
leave
ret
Function at 0x4a1df7
Capabilities:
Delete file

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esi + 8]
call fcn.004a594e
xor ebx, ebx
mov dword [esi + 0x53c], ebx
mov eax, dword [sym.imp.MSVCP71.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
push dword [eax]
lea ecx, [esi + 0x540]
push ebx
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::erase_unsigned_int__unsigned_int_]
lea edi, [esi + 0x594]
mov eax, dword [edi]
cmp eax, 0xffffffff
mov dword [esi + 0x598], ebx
mov dword [esi + 0x59c], ebx
je 0x4a1e66
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [edi], 0xffffffff
cmp dword [esi + 0x58c], ebx
je 0x4a1e66
lea eax, [esi + 0x578]
cmp dword [eax + 0x18], 8
jb 0x4a1e5c
mov eax, dword [eax + 4]
jmp 0x4a1e5f
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [sym.imp.MSVCP71.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
push dword [eax]
lea ecx, [esi + 0x55c]
push ebx
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::erase_unsigned_int__unsigned_int_]
mov eax, dword [sym.imp.MSVCP71.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
push dword [eax]
lea ecx, [esi + 0x578]
push ebx
call dword [sym.imp.MSVCP71.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::erase_unsigned_int__unsigned_int_]
pop edi
pop esi
pop ebx
ret

Function at 0x4a21f5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x1c], 0xc8
push esi
mov esi, ecx
jne 0x4a2296
push ebx
push edi
mov edi, dword [ebp + 0x14]
xor ebx, ebx
cmp edi, ebx
je 0x4a2294
mov eax, dword [ebp + 0x20]
mov byte [eax], bl
lea eax, [esi + 0x598]
add dword [eax], edi
adc dword [eax + 4], ebx
cmp dword [esi + 0x594], 0xffffffff
jne 0x4a225f
lea eax, [esi + 0x578]
cmp dword [eax + 0x18], 8
jb 0x4a2240
mov eax, dword [eax + 4]
jmp 0x4a2243
add eax, 4
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x594], eax
mov eax, dword [esi + 0x594]
cmp eax, 0xffffffff
je 0x4a2286
push ebx
lea ecx, [ebp + 0xc]
push ecx
push edi
push dword [ebp + 0x10]
mov dword [ebp + 0xc], ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4a2286
cmp dword [ebp + 0xc], edi
je 0x4a2294
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, esi
push eax
call fcn.004a1e9e
pop edi
pop ebx
pop esi
pop ebp
ret 0x1c