joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d600
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55866d
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x62aabc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
movzx eax, word [ebp + 0xc]
xorps xmm0, xmm0
mov ebx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x18]
movlpd qword [ebp - 0x38], xmm0
push 0x55a7a4
push eax
movlpd qword [ebp - 0x30], xmm0
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x48], 0x502
call fcn.004064e0
add esp, 0xc
mov eax, ebx
cmp dword [ebx + 0x14], 0x10
jb 0x48d679
mov eax, dword [ebx]
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x48]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x48d6fe
mov eax, dword [ebp - 0x1c]
push dword [eax + 0xc]
push dword [eax + 8]
push dword [eax + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov edx, dword [ebp - 0x1c]
mov dword [esi + 4], eax
push dword [edx + 0x10]
push dword [edx + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x48d719
push 4
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 1
push eax
push 1
push 6
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_setsockopt]
push dword [ebp - 0x1c]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov byte [esi + 8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054f742
mov esp, ebp
pop ebp
ret 8
push str.Resolve_failed
lea ecx, [ebp - 0x54]
call fcn.0040b580
push 0x61dba8
lea eax, [ebp - 0x54]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18]
mov eax, dword [0x62da44]
mov eax, dword [eax]
mov edi, dword [eax + 4]
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, ebx
mov esi, dword [eax]
call fcn.00410e60
push esi
push eax
push str.Could_not_connect_to__s._Error__d
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.http
call fcn.00409c70
push 0x49
sub esp, 0x18
mov dword [ebp - 4], 0
mov ecx, esp
push str.D:UsersphiliDropboxDevelopmentSpotConnectcommoncspotcspot_bellmainioincludeTCPSocket.h
call fcn.00409c70
push dword [0x62da44]
mov dword [ebp - 4], 0xffffffff
call edi
add esp, 0x44
lea ecx, [ebp - 0x60]
push str.Resolve_failed
call fcn.0040b580
push 0x61dba8
lea eax, [ebp - 0x60]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x491c60
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 4
xor edi, edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
push dword [ebp + 0x10]
mov dword [ebp + 8], eax
mov dword [eax], edi
call fcn.004932a0
push dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 8], esi
call fcn.00493250
push esi
push eax
mov dword [ebp - 0xc], eax
call fcn.00493350
mov esi, dword [ebp + 0x1c]
add esp, 0x14
mov dword [ebp - 4], eax
test esi, esi
je 0x491ce4
cmp dword [esi], edi
je 0x491ce4
push 0x10
push eax
call fcn.00493340
add esp, 4
push eax
call fcn.00493f90
mov edi, eax
push edi
push dword [ebp + 8]
call fcn.00494460
mov ecx, dword [esi]
add esp, 0x10
test ecx, ecx
je 0x491ce4
push ecx
push edi
call fcn.00493ef0
mov ecx, dword [esi + 4]
lea esi, [esi + 4]
add esp, 8
test ecx, ecx
jne 0x491cd0
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x491cf3
push eax
call fcn.004932a0
jmp 0x491cfb
push dword [ebx + 0x24]
call fcn.00493340
add esp, 4
push eax
push dword [ebp + 0x14]
push dword [ebp - 4]
call fcn.00493340
add esp, 4
push eax
call fcn.00494050
mov esi, eax
push esi
push dword [ebp + 8]
mov dword [ebp + 0x1c], esi
call fcn.00494460
push esi
push dword [ebp - 8]
call fcn.00494010
add esp, 0x1c
mov dword [ebp + 0x18], eax
push eax
push str._t_services_a_dns_sd
call fcn.00493340
add esp, 4
push eax
call fcn.00494010
push ebx
mov dword [ebp - 8], eax
call fcn.00474730
add esp, 0xc
lea esi, [ebx + 0x14]
test edi, edi
je 0x491d61
push edi
push esi
call fcn.004942a0
add esp, 8
push dword [ebp + 0x1c]
push esi
call fcn.004942a0
mov edi, dword [ebp + 0x18]
push edi
push esi
call fcn.004942a0
push dword [ebp - 8]
push esi
call fcn.004942a0
lea eax, [ebx + 0x18]
push edi
push eax
call fcn.00494460
lea eax, [ebx + 0x1c]
push edi
push eax
call fcn.00494460
push ebx
call fcn.004749e0
push dword [ebp - 4]
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
call esi
push dword [ebp - 0xc]
call esi
add esp, 0x34
push 0
push 1
push 0x559958
push dword [ebx + 0xc]
call dword [sym.imp.WS2_32.dll_send]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x491e60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Start tcp server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x62aabc]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ebp + 0xc]
push ebx
push esi
push edi
push 0x28
mov byte [0x62db14], al
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, dword [sym.imp.WS2_32.dll_socket]
add esp, 4
mov edi, eax
xorps xmm0, xmm0
push 0
movups xmmword [edi], xmm0
push 1
movups xmmword [edi + 0x10], xmm0
push 2
movq qword [edi + 0x20], xmm0
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x492011
xorps xmm0, xmm0
mov eax, 2
push 0
movlpd qword [ebp - 0xc], xmm0
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htons]
push 0x7f000001
mov word [ebp - 0x12], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push 0x10
push eax
push ebx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x49200a
push 1
push ebx
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x49200a
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x49200a
push 0
push 1
push 2
call esi
mov dword [edi + 0xc], eax
cmp eax, 0xffffffff
je 0x49200a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x49200a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.WS2_32.dll_accept]
mov dword [edi + 8], eax
cmp eax, 0xffffffff
jne 0x491f7e
push dword [edi + 0xc]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push ebx
mov dword [edi + 0xc], 0xffffffff
call esi
jmp 0x492011
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
push dword [ebp + 8]
call fcn.004912f0
add esp, 4
mov dword [edi + 4], eax
test eax, eax
jns 0x491f9e
push str.unable_to_create_recv_socket_n
jmp 0x492016
push 0
push edi
call fcn.004744f0
lea eax, [ebp - 0x1c]
push eax
call fcn.00475860
lea eax, [ebp - 0x1c]
push 1
push eax
call fcn.00475920
push edi
push 0x491530
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.00474240
add esp, 0x24
test eax, eax
je 0x491ff7
push edi
call fcn.00474620
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f742
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f742
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
push str.pipe__:__m_n
push 1
call fcn.00491bc0
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.0054f742
mov esp, ebp
pop ebp
ret
Function at 0x492040
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4920f3
push esi
push 0
push 1
push 0x559958
mov dword [edi + 0x10], 1
push dword [edi + 0xc]
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0x7a120
call dword [sym.imp.WS2_32.dll_send]
cmp dword [edi + 0x10], 2
je 0x49209a
mov esi, dword [sym.imp.WS2_32.dll_select]
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
call esi
cmp dword [edi + 0x10], 2
jne 0x492086
push dword [edi + 8]
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push dword [edi + 0xc]
call esi
push edi
call fcn.00474620
push dword [edi + 0x14]
call fcn.004943a0
push 0
push dword [edi + 0x18]
call fcn.004944c0
push 0
push dword [edi + 0x1c]
call fcn.004944c0
push 0
push dword [edi + 0x20]
call fcn.004944c0
mov eax, dword [edi + 0x24]
add esp, 0x20
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test eax, eax
je 0x4920ec
push eax
call esi
add esp, 4
push edi
call esi
add esp, 4
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x492340
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
add edx, 0xc0
push esi
push edi
mov ecx, ebx
mov edi, 4
nop dword [eax]
mov esi, 4
mov al, byte [edx]
inc edx
xor byte [ecx], al
inc ecx
sub esi, 1
jne 0x492365
sub edi, 1
jne 0x492360
mov byte [ebp + 0xb], 0xb
nop dword [eax]
movzx eax, byte [ebx + 9]
mov esi, ebx
mov cl, byte [ebx + 0xd]
mov edi, 4
mov byte [ebx + 0xd], al
movzx eax, byte [ebx + 5]
mov byte [ebx + 9], al
movzx eax, byte [ebx + 1]
mov byte [ebx + 5], al
movzx eax, byte [ebx + 0xa]
mov byte [ebx + 1], cl
mov cl, byte [ebx + 2]
mov byte [ebx + 2], al
movzx eax, byte [ebx + 0xe]
mov byte [ebx + 0xa], cl
mov cl, byte [ebx + 6]
mov byte [ebx + 6], al
movzx eax, byte [ebx + 7]
mov byte [ebx + 0xe], cl
mov cl, byte [ebx + 3]
mov byte [ebx + 3], al
movzx eax, byte [ebx + 0xb]
mov byte [ebx + 7], al
movzx eax, byte [ebx + 0xf]
mov byte [ebx + 0xb], al
mov byte [ebx + 0xf], cl
nop word [eax + eax]
mov ecx, esi
mov edx, 4
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x566f70]
mov byte [ecx - 4], al
sub edx, 1
jne 0x4923f0
inc esi
sub edi, 1
jne 0x4923e0
mov ch, byte [ebp + 0xb]
mov eax, ebx
movzx edx, ch
mov edi, 4
shl edx, 4
add edx, dword [ebp + 0xc]
nop dword [eax]
mov esi, 4
mov cl, byte [edx]
inc edx
xor byte [eax], cl
inc eax
sub esi, 1
jne 0x492425
sub edi, 1
jne 0x492420
test ch, ch
je 0x49244a
push ebx
call fcn.00492450
add esp, 4
dec byte [ebp + 0xb]
jmp 0x492380
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4a00e0
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov eax, dword [0x62aabc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x62dcb4], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
jne 0x4a013b
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4a0131
pop edi
pop esi
mov eax, 0xffffffbe
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f742
mov esp, ebp
pop ebp
ret
mov dword [0x62dcb4], 1
mov ecx, dword [ebp + 0x14]
mov edx, 0x11
xorps xmm0, xmm0
mov dword [ebp - 0x1b8], 0
movlpd qword [ebp - 0x1a8], xmm0
movlpd qword [ebp - 0x1a0], xmm0
lea eax, [ecx - 1]
mov dword [ebp - 0x1b4], 0
neg eax
sbb eax, eax
add eax, 2
cmp ecx, 1
mov dword [ebp - 0x1b0], eax
mov eax, 6
cmove eax, edx
mov dword [ebp - 0x1ac], eax
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x1b8]
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x4a01bb
pop edi
pop esi
mov eax, 0xffffffae
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f742
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x198]
mov edi, 0xffffffae
test esi, esi
je 0x4a0215
nop word [eax + eax]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx], eax
test eax, eax
jns 0x4a01ec
mov edi, 0xffffffbe
jmp 0x4a020a
push dword [esi + 0x10]
push dword [esi + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x4a0213
push dword [ebx]
call dword [sym.imp.WS2_32.dll_closesocket]
mov edi, 0xffffffbc
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x4a01d0
jmp 0x4a0215
xor edi, edi
push dword [ebp - 0x198]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054f742
mov esp, ebp
pop ebp
ret
Function at 0x4ac4a0
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x62aabc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov edx, 1
nop dword [eax]
mov al, dl
mov dword [ebp + esi*4 - 0x804], edx
add al, al
mov dword [ebp + edx*4 - 0x404], esi
movzx ecx, al
movzx eax, dl
and dl, 0x80
xor ecx, eax
movzx eax, dl
neg eax
sbb eax, eax
inc esi
and eax, 0x1b
xor ecx, eax
mov edx, ecx
cmp esi, 0x100
jl 0x4ac4c0
mov edx, 1
mov esi, 0x630158
nop
mov eax, edx
mov dword [esi], edx
and al, 0x80
movzx ecx, al
neg ecx
sbb ecx, ecx
add dl, dl
and ecx, 0x1b
movzx edx, dl
add esi, 4
xor edx, ecx
cmp esi, 0x630180
jl 0x4ac500
mov ecx, 1
mov byte [0x62df58], 0x63
mov byte [0x62f0bb], 0
mov dword [ebp - 0x808], ecx
nop dword [eax + eax]
mov ecx, dword [ebp + ecx*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx ecx, cl
mov al, cl
xor ebx, ecx
add al, al
shr ecx, 7
movzx edx, al
or edx, ecx
xor ebx, edx
mov al, dl
add al, al
mov dword [ebp - 0x80c], ebx
movzx ebx, al
shr edx, 7
or ebx, edx
mov al, bl
add al, al
movzx ecx, al
mov eax, ebx
shr eax, 7
or ecx, eax
mov eax, dword [ebp - 0x80c]
xor ecx, 0x63
xor ecx, ebx
xor eax, ecx
mov ecx, dword [ebp - 0x808]
mov byte [ecx + 0x62df58], al
mov byte [eax + 0x62f058], cl
inc ecx
mov dword [ebp - 0x808], ecx
cmp ecx, 0x100
jl 0x4ac540
xor edi, edi
mov dword [ebp - 0x808], 0xff
nop dword [eax + eax]
mov cl, byte [edi + 0x62df58]
movzx esi, cl
mov eax, esi
movzx ebx, byte [edi + 0x62f058]
and al, 0x80
mov dword [ebp - 0x80c], ebx
movzx edx, al
neg edx
sbb edx, edx
add cl, cl
and edx, 0x1b
movzx eax, cl
xor edx, eax
mov eax, edx
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, edx
mov dword [edi*4 + 0x62e058], eax
rol eax, 8
mov dword [edi*4 + 0x62e458], eax
rol eax, 8
mov dword [edi*4 + 0x62e858], eax
rol eax, 8
mov dword [edi*4 + 0x62ec58], eax
test ebx, ebx
je 0x4ac6a9
mov eax, dword [ebp + ebx*4 - 0x404]
mov esi, 0xff
add eax, dword [ebp - 0x3d8]
cdq
idiv esi
mov eax, dword [ebp + ebx*4 - 0x404]
add eax, dword [ebp - 0x3d0]
mov ecx, dword [ebp + edx*4 - 0x804]
cdq
idiv esi
mov eax, dword [ebp + ebx*4 - 0x404]
mov ebx, 0xff
add eax, dword [ebp - 0x3e0]
mov esi, dword [ebp + edx*4 - 0x804]
cdq
idiv ebx
mov eax, dword [ebp - 0x80c]
mov eax, dword [ebp + eax*4 - 0x404]
add eax, dword [ebp - 0x3cc]
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv dword [ebp - 0x808]
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x4ac6b1
xor ecx, ecx
xor esi, esi
xor ebx, ebx
xor eax, eax
shl ecx, 8
xor ecx, esi
shl ecx, 8
xor ecx, ebx
shl ecx, 8
xor ecx, eax
mov dword [edi*4 + 0x62f158], ecx
rol ecx, 8
mov dword [edi*4 + 0x62f558], ecx
rol ecx, 8
mov dword [edi*4 + 0x62f958], ecx
rol ecx, 8
mov dword [edi*4 + 0x62fd58], ecx
inc edi
cmp edi, 0x100
jl 0x4ac5d0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054f742
mov esp, ebp
pop ebp
ret
Function at 0x4acf10
Capabilities:
Encode data using add xor sub operations

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x62aabc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x11c]
push esi
mov esi, dword [ebp + 0xc]
push edi
push pe_nt_image_headers32
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push dword [ebp + 0x10]
lea eax, [ebp - 0x11c]
mov dword [ebx + 4], 0
push esi
push eax
lea edi, [ebx + 8]
call fcn.004ad130
add esp, 0x18
mov dword [ebp - 0x120], eax
test eax, eax
jne 0x4ad0ff
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x114]
mov ecx, dword [ebp - 0x118]
mov dword [ebx], edx
lea ecx, [ecx + edx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
sub ecx, 0x10
mov dword [edi + 0xc], eax
add edi, 0x10
mov esi, dword [ebx]
dec esi
test esi, esi
jle 0x4ad0e9
nop dword [eax + eax]
movzx eax, byte [ecx + 3]
dec esi
movzx edx, byte [eax + 0x62df58]
movzx eax, byte [ecx + 2]
mov edx, dword [edx*4 + 0x62fd58]
movzx eax, byte [eax + 0x62df58]
xor edx, dword [eax*4 + 0x62f958]
movzx eax, byte [ecx + 1]
movzx eax, byte [eax + 0x62df58]
xor edx, dword [eax*4 + 0x62f558]
movzx eax, byte [ecx]
movzx eax, byte [eax + 0x62df58]
xor edx, dword [eax*4 + 0x62f158]
mov dword [edi], edx
movzx eax, byte [ecx + 7]
movzx edx, byte [eax + 0x62df58]
movzx eax, byte [ecx + 6]
mov edx, dword [edx*4 + 0x62fd58]
movzx eax, byte [eax + 0x62df58]
xor edx, dword [eax*4 + 0x62f958]
movzx eax, byte [ecx + 5]
movzx eax, byte [eax + 0x62df58]
xor edx, dword [eax*4 + 0x62f558]
movzx eax, byte [ecx + 4]
movzx eax, byte [eax + 0x62df58]
xor edx, dword [eax*4 + 0x62f158]
mov dword [edi + 4], edx
movzx eax, byte [ecx + 0xb]
movzx edx, byte [eax + 0x62df58]
movzx eax, byte [ecx + 0xa]
mov edx, dword [edx*4 + 0x62fd58]
movzx eax, byte [eax + 0x62df58]
xor edx, dword [eax*4 + 0x62f958]
movzx eax, byte [ecx + 9]
movzx eax, byte [eax + 0x62df58]
xor edx, dword [eax*4 + 0x62f558]
movzx eax, byte [ecx + 8]
movzx eax, byte [eax + 0x62df58]
xor edx, dword [eax*4 + 0x62f158]
mov dword [edi + 8], edx
movzx eax, byte [ecx + 0xf]
movzx edx, byte [eax + 0x62df58]
movzx eax, byte [ecx + 0xe]
mov edx, dword [edx*4 + 0x62fd58]
movzx eax, byte [eax + 0x62df58]
xor edx, dword [eax*4 + 0x62f958]
movzx eax, byte [ecx + 0xd]
movzx eax, byte [eax + 0x62df58]
xor edx, dword [eax*4 + 0x62f558]
movzx eax, byte [ecx + 0xc]
sub ecx, 0x10
movzx eax, byte [eax + 0x62df58]
xor edx, dword [eax*4 + 0x62f158]
mov dword [edi + 0xc], edx
add edi, 0x10
test esi, esi
jg 0x4acfb0
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0xc], eax
lea eax, [ebp - 0x11c]
push pe_nt_image_headers32
push eax
call fcn.004b66d0
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, dword [ebp - 0x120]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0054f742
mov esp, ebp
pop ebp
ret
Function at 0x4afd30
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x18]
sub esp, 0xc
test ecx, ecx
jne 0x4afd48
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, 0xaaaaaaab
mul ecx
xor eax, eax
shr edx, 1
push edi
lea edi, [edx + edx*2]
cmp ecx, edi
setne al
add eax, edx
cmp eax, 0x3fffffff
jbe 0x4afd78
mov eax, dword [ebp + 0x10]
pop edi
mov dword [eax], 0xffffffff
mov eax, 0xffffffd6
mov esp, ebp
pop ebp
ret
lea edx, [eax*4 + 1]
cmp dword [ebp + 0xc], edx
jb 0x4afebb
mov eax, dword [ebp + 8]
test eax, eax
je 0x4afebb
push ebx
xor edx, edx
push esi
mov esi, eax
test edi, edi
je 0x4afe35
lea ecx, [edi - 1]
mov eax, 0xaaaaaaab
mov edi, dword [ebp + 0x14]
mul ecx
mov eax, edx
shr eax, 1
inc eax
mov dword [ebp - 8], eax
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
nop dword [eax]
mov al, byte [edi + 2]
mov bl, byte [edi]
mov bh, byte [edi + 1]
add edi, 3
mov byte [ebp - 1], al
mov al, bl
shr al, 2
movzx eax, al
push eax
call fcn.004beb60
mov byte [esi], al
mov al, bh
shr al, 4
shl bl, 4
add bl, al
and bl, 0x3f
movzx eax, bl
push eax
call fcn.004beb60
mov bl, byte [ebp - 1]
mov byte [esi + 1], al
mov al, bl
shr al, 6
shl bh, 2
add al, bh
and al, 0x3f
movzx eax, al
push eax
call fcn.004beb60
mov byte [esi + 2], al
and bl, 0x3f
movzx eax, bl
push eax
call fcn.004beb60
mov byte [esi + 3], al
add esp, 0x10
add esi, 4
sub dword [ebp - 8], 1
jne 0x4afdc0
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 0xc]
jmp 0x4afe38
mov edi, dword [ebp + 0x14]
cmp edx, ecx
jae 0x4afea5
mov al, byte [edi]
inc edx
mov byte [ebp - 1], al
mov dword [ebp - 0xc], edx
cmp edx, ecx
jae 0x4afe4f
movzx ebx, byte [edi + 1]
jmp 0x4afe51
xor ebx, ebx
shr al, 2
movzx eax, al
push eax
call fcn.004beb60
mov cl, byte [ebp - 1]
mov byte [esi], al
mov eax, ebx
shr eax, 4
shl cl, 4
add al, cl
and al, 0x3f
movzx eax, al
push eax
call fcn.004beb60
mov byte [esi + 1], al
add esp, 8
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x18]
jae 0x4afe99
and bl, 0xf
shl bl, 2
movzx eax, bl
push eax
call fcn.004beb60
add esp, 4
jmp 0x4afe9b
mov al, 0x3d
mov byte [esi + 2], al
mov byte [esi + 3], 0x3d
add esi, 4
mov eax, dword [ebp + 0x10]
mov ecx, esi
sub ecx, dword [ebp + 8]
mov dword [eax], ecx
xor eax, eax
mov byte [esi], 0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
pop edi
mov dword [eax], edx
mov eax, 0xffffffd6
mov esp, ebp
pop ebp
ret
Function at 0x4b4950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x62aabc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x320], edi
cmp ebx, 0x180
jbe 0x4b4993
pop edi
pop esi
mov eax, 0xffffffc8
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0054f742
mov esp, ebp
pop ebp
ret
push 0x1a0
lea eax, [ebp - 0x204]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x31c]
push eax
call fcn.004acef0
mov eax, ebx
mov byte [ebp - 0x1f1], bl
shr eax, 0x18
mov byte [ebp - 0x1f4], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0x1f3], al
mov eax, ebx
shr eax, 8
push ebx
mov byte [ebp - 0x1f2], al
lea eax, [ebp - 0x1ec]
push esi
push eax
mov byte [ebp - 0x1ed], 0x30
call sub.VCRUNTIME140.dll_memcpy
lea esi, [ebx + 0x19]
mov byte [ebp + ebx - 0x1ec], 0x80
add esp, 0x1c
mov dword [ebp - 0x328], esi
xor eax, eax
mov byte [ebp + eax - 0x64], al
inc eax
cmp eax, 0x20
jl 0x4b4a04
push 0x100
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x31c]
push eax
call fcn.004ad130
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x4b4b2b
mov dword [ebp - 0x324], eax
lea ebx, [eax + 0x10]
nop dword [eax]
xorps xmm0, xmm0
mov edi, esi
movups xmmword [ebp - 0x14], xmm0
test esi, esi
je 0x4b4ab4
lea esi, [ebp - 0x204]
lea eax, [ebp - 0x14]
sub esi, eax
xor eax, eax
nop word [eax + eax]
lea edx, [ebp - 0x14]
add edx, eax
inc eax
mov cl, byte [esi + edx]
xor byte [edx], cl
cmp eax, 0x10
jl 0x4b4a60
add esi, 0x10
mov eax, edi
cmp edi, 0x10
cmovae eax, ebx
sub edi, eax
lea eax, [ebp - 0x14]
push eax
push eax
lea eax, [ebp - 0x31c]
push 1
push eax
call fcn.004aca00
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x4b4b25
lea ebx, [eax + 0x10]
test edi, edi
jne 0x4b4a58
movups xmm0, xmmword [ebp - 0x14]
mov eax, dword [ebp - 0x324]
mov esi, dword [ebp - 0x328]
inc byte [ebp - 0x201]
movups xmmword [ebp + eax - 0x44], xmm0
add eax, 0x10
mov dword [ebp - 0x324], eax
cmp eax, 0x30
jl 0x4b4a40
push 0x100
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x31c]
push eax
call fcn.004ad130
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x4b4b25
mov esi, dword [ebp - 0x320]
xor edi, edi
lea eax, [ebp - 0x24]
push eax
push eax
lea eax, [ebp - 0x31c]
push 1
push eax
call fcn.004aca00
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x4b4b25
movups xmm0, xmmword [ebp - 0x24]
add edi, 0x10
movups xmmword [esi], xmm0
add esi, 0x10
cmp edi, 0x30
jl 0x4b4af7
mov edi, dword [ebp - 0x320]
lea eax, [ebp - 0x31c]
push eax
call fcn.004aced0
lea eax, [ebp - 0x204]
push 0x1a0
push eax
call fcn.004b66d0
lea eax, [ebp - 0x44]
push 0x30
push eax
call fcn.004b66d0
lea eax, [ebp - 0x64]
push 0x20
push eax
call fcn.004b66d0
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.004b66d0
add esp, 0x24
test ebx, ebx
je 0x4b4b7b
push 0x30
push edi
call fcn.004b66d0
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054f742
mov esp, ebp
pop ebp
ret