joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1000337f
pop dword [ebp - 0x2c]
mov eax, 0x1000337f
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0x3d0ba496
add dword [ebp - 0x3c], 0x1146a0b5
mov dword [ebp - 0x38], 0x70040e34
sub dword [ebp - 0x38], 0x3dd0c1ef
mov dword [ebp - 0x34], 0xba8f65ad
add dword [ebp - 0x34], 0x91bcde81
mov dword [ebp - 0x30], 0x8d49e954
sub dword [ebp - 0x30], 0x8d49e954
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xcc0aa777
add eax, 0x43f70899
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xc985dc80
sub dword [ebp - 0x3c], 0x5513732a
mov dword [ebp - 0x38], 0x47b04979
sub dword [ebp - 0x38], 0x643e804
mov dword [ebp - 0x34], 0xd21ac1e1
sub dword [ebp - 0x34], 0x6eab5575
mov dword [ebp - 0x30], 0x91c08fa3
sub dword [ebp - 0x30], 0x91c08fa3
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x40ef8
push 0
call eax
mov ecx, 0x5290
mov ebx, eax
mov edx, 0xb20f7f4d
sub edx, 0xa20ccf4d
add edx, dword [ebp - 0x2c]
mov edi, 0xe52406aa
sub dword [ebp - 0x24], 0xb7c61665
mov esi, dword [edx]
add dword [ebp - 0x18], 0x287dbb56
xor esi, edi
mov dword [ebx], esi
xor dword [ebp - 0x1c], 0x9d91ce02
add ebx, 0xe26caf99
sub ebx, 0xe26caf95
add edx, 0x478a0f52
add edx, 0xb875f0b2
loop 0x1000348b
add eax, 0xdc5dc41f
add eax, 0x23a378f4
xor ebx, ebx
add ebx, eax
add eax, 0xb20b8484
sub eax, 0xb20b847f
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x6d3555dd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x6d3555ec
pop dword [ebp - 0x38]
mov eax, 0x6d3555ec
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x21d74887
add dword [ebp - 0x48], 0x2c7afcc4
mov dword [ebp - 0x44], 0x55ff052d
add dword [ebp - 0x44], 0xdc344718
mov dword [ebp - 0x40], 0x323644e7
add dword [ebp - 0x40], 0x1a15ff47
mov dword [ebp - 0x3c], 0x3ce130b1
add dword [ebp - 0x3c], 0xc31ecf4f
lea eax, [ebp - 0x48]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0xe1d62d56
sub dword [ebp - 0x48], 0x6d63c400
mov dword [ebp - 0x44], 0xdc9a780f
sub dword [ebp - 0x44], 0x9b2e169a
mov dword [ebp - 0x40], 0xe80c91c6
sub dword [ebp - 0x40], 0x849d255a
mov dword [ebp - 0x3c], 0xcb1d6ad6
sub dword [ebp - 0x3c], 0xcb1d6ad6
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x37378
push 0
call eax
mov ecx, 0x4879
xor esi, esi
add esi, eax
mov edi, 0x8e5a7596
add edi, 0xdedb726a
add edi, dword [ebp - 0x38]
mov ebx, 0x86f0b08c
sub ebx, 0xdf9edb5e
xor dword [ebp - 0x2c], edi
mov edx, dword [edi]
add dword [ebp - 0x10], esi
xor edx, ebx
xor dword [ebp - 0x30], esi
mov dword [esi], edx
sub dword [ebp - 8], 0x8c661bd2
add esi, 0xdaa854cb
add esi, 0x2557ab39
add edi, 0x306953de
add edi, 0xcf96ac26
loop 0x6d3556fb
add eax, 0xe7665f1d
sub eax, 0xe7654a66
xor ebx, ebx
add ebx, eax
add eax, 0x8b273ece
add eax, 0x74d8c137
mov ecx, 0xc0856a0d
sub ecx, 0x53506a0d
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x6d3578c4
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x6d3578ce
repz ret
jmp fcn.6d357caf
Function at 0x40632d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40633c
pop dword [ebp - 0x20]
mov eax, 0x40633c
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xff8e1270
sub dword [ebp - 0x30], 0xb13bcd25
mov dword [ebp - 0x2c], 0x4a2aad6c
add dword [ebp - 0x2c], 0xe8089ed9
mov dword [ebp - 0x28], 0x1c9de465
add dword [ebp - 0x28], 0x2fae5fc9
mov dword [ebp - 0x24], 0x57df8c38
sub dword [ebp - 0x24], 0x57df8c38
lea eax, [ebp - 0x30]
push eax
mov eax, 0xe60233f1
sub eax, 0xe5c1c391
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x8480e87d
sub dword [ebp - 0x30], 0x100e7f27
mov dword [ebp - 0x2c], 0x751ea4b2
sub dword [ebp - 0x2c], 0x33b2433d
mov dword [ebp - 0x28], 0xb9c5cf66
add dword [ebp - 0x28], 0xa9a99d06
mov dword [ebp - 0x24], 0xa0edbcfc
sub dword [ebp - 0x24], 0xa0edbcfc
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3889d
push 0
call eax
mov ecx, 0x4fae
xor ebx, ebx
add ebx, eax
mov esi, 0x410000
add esi, dword [ebp - 0x20]
mov edi, 0x5a7c006
xor dword [ebp - 4], 0x5e41a85c
mov edx, dword [esi]
sub edx, edi
sub dword [ebp - 0xc], 0x1cdcb018
mov dword [ebx], edx
xor dword [ebp - 0x10], ebx
add ebx, 0x440bd567
add ebx, 0xbbf42a9d
add esi, 4
loop 0x406444
add eax, 0x1c24aa22
sub eax, 0x1c237897
mov ebx, eax
add eax, 5
mov ecx, 0xc38125a4
add ecx, 0x3cbeda5c
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x48549e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov byte [ebp - 0x2c], 0x53
mov byte [ebp - 0x2b], 0x68
mov byte [ebp - 0x17], 0x46
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x6c
mov byte [ebp - 0x2a], 0x65
mov byte [ebp - 0x29], 0x6c
mov byte [ebp - 0x28], 0x6c
mov byte [ebp - 0x27], 0x33
mov byte [ebp - 0x13], 0x65
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0x11], 0x50
mov byte [ebp - 0x10], 0x61
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0x1a], 0x47
mov byte [ebp - 0x19], 0x65
mov byte [ebp - 0x18], 0x74
mov byte [ebp - 0x26], 0x32
mov byte [ebp - 0x25], 0x2e
mov byte [ebp - 0x24], 0x64
mov byte [ebp - 0x23], 0x6c
mov byte [ebp - 0x1b], 0x48
mov byte [ebp - 0x22], 0x6c
mov byte [ebp - 0x21], 0
mov byte [ebp - 0xe], 0x68
mov byte [ebp - 0xd], 0x41
mov byte [ebp - 0x14], 0x64
mov byte [ebp - 0xf], 0x74
mov byte [ebp - 0xc], 0
lea eax, [ebp - 0x2c]
push eax
call fcn.0108946c
Function at 0x492e5c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov byte [ebp - 0x10], 0
xor eax, eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov byte [ebp - 0xd0], 0x46
mov byte [ebp - 0xcf], 0x3d
mov byte [ebp - 0xce], 0x33
mov byte [ebp - 0xcd], 0x1a
mov byte [ebp - 0xcc], 0x17
mov byte [ebp - 0xcb], 0x66
mov byte [ebp - 0xca], 0xaa
mov byte [ebp - 0xc9], 0x27
mov byte [ebp - 0xc8], 0x24
mov byte [ebp - 0xc7], 0x7f
mov byte [ebp - 0xc6], 0x22
mov byte [ebp - 0xc5], 0x83
mov byte [ebp - 0xc4], 0x58
mov byte [ebp - 0xc3], 0x60
mov byte [ebp - 0xc2], 0
mov byte [ebp - 0xc1], 0x9f
cmp dword [ebp + 8], 0
je 0x492ef7
cmp dword [ebp + 0x10], 0
jne 0x492f01
mov eax, 0x10d
jmp 0x492f90
lea ecx, [ebp - 0xd0]
push ecx
lea edx, [ebp - 0xc0]
push edx
call fcn.00493150
add esp, 8
cmp dword [ebp + 0xc], 0x10
jbe 0x492f29
mov dword [ebp - 0xd4], 0x10
jmp 0x492f32
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xd4], eax
mov ecx, dword [ebp - 0xd4]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x10]
push eax
call fcn.004d3d70
add esp, 0xc
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0xc0]
push edx
call fcn.004932eb
add esp, 8
cmp dword [ebp + 0x14], 0x10
jae 0x492f6d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xd8], eax
jmp 0x492f77
mov dword [ebp - 0xd8], 0x10
mov ecx, dword [ebp - 0xd8]
push ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.004d3d70
add esp, 0xc
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x493150
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
jmp 0x493176
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 4
jge 0x4931c6
mov dword [ebp - 0x18], 0
jmp 0x493197
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x18], 4
jge 0x4931c4
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0x14]
mov al, byte [edx]
mov byte [ecx], al
mov ecx, dword [ebp - 0x18]
lea edx, [ebp + ecx*4 - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
mov al, byte [eax]
mov byte [edx + ecx], al
jmp 0x493185
jmp 0x49316d
cmp dword [ebp - 0x14], 0xb0
jge 0x4932e6
mov dword [ebp - 0x18], 0
jmp 0x4931e5
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 4
jge 0x49321a
mov edx, dword [ebp - 0x18]
add edx, 1
and edx, 0x80000003
jns 0x4931fe
dec edx
or edx, 0xfffffffc
inc edx
xor eax, eax
mov al, byte [ebp + edx*4 - 0xd]
mov ecx, dword [ebp - 0x18]
mov dl, byte [ebp + ecx*4 - 0x10]
xor dl, byte [eax + str.cw]
mov eax, dword [ebp - 0x18]
mov byte [ebp + eax*4 - 0x10], dl
jmp 0x4931dc
mov ecx, dword [ebp - 0x20]
mov dl, byte [ebp - 0x10]
xor dl, byte [ecx*4 + 0x50c9ac]
mov byte [ebp - 0x10], dl
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 1
jmp 0x493245
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 4
jge 0x49328f
mov dword [ebp - 0x18], 0
jmp 0x49325d
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 4
jge 0x49328d
mov eax, dword [ebp - 0x18]
lea ecx, [ebp + eax*4 - 0x10]
mov edx, dword [ebp - 0x18]
lea eax, [ebp + edx*4 - 0x10]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
mov cl, byte [ecx + edx]
xor cl, byte [eax + esi - 1]
mov edx, dword [ebp - 0x18]
lea eax, [ebp + edx*4 - 0x10]
mov edx, dword [ebp - 0x1c]
mov byte [eax + edx], cl
jmp 0x493254
jmp 0x49323c
mov dword [ebp - 0x1c], 0
jmp 0x4932a1
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x4932e1
mov dword [ebp - 0x18], 0
jmp 0x4932b9
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 4
jge 0x4932df
mov edx, dword [ebp - 0x18]
lea eax, [ebp + edx*4 - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x1c]
mov al, byte [eax + edx]
mov byte [ecx], al
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x4932b0
jmp 0x493298
jmp 0x4931c6
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4932eb
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004933d9
add esp, 8
mov dword [ebp - 4], 1
jmp 0x493313
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0xa
jge 0x49337f
mov dword [ebp - 8], 0
jmp 0x49332b
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x10
jge 0x49334b
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 8]
xor edx, edx
mov dl, byte [ecx]
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 8]
mov cl, byte [edx + str.cw]
mov byte [eax], cl
jmp 0x493322
push 0
mov edx, dword [ebp + 0xc]
push edx
call fcn.0049341a
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.00493482
add esp, 4
mov ecx, dword [ebp - 4]
shl ecx, 4
mov edx, dword [ebp + 8]
add edx, ecx
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.004933d9
add esp, 8
jmp 0x49330a
mov dword [ebp - 0xc], 0
jmp 0x493391
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x10
jge 0x4933b1
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
mov dl, byte [eax + str.cw]
mov byte [ecx], dl
jmp 0x493388
push 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.0049341a
add esp, 8
mov ecx, dword [ebp + 8]
add ecx, 0xa0
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004933d9
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x4935dc
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
add eax, 0xa0
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004933d9
add esp, 8
mov dword [ebp - 8], 0
jmp 0x493609
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0x10
jge 0x493629
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 8]
xor ecx, ecx
mov cl, byte [eax]
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 8]
mov al, byte [ecx + 0x50c8ac]
mov byte [edx], al
jmp 0x493600
push 0x10
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0049341a
add esp, 8
mov dword [ebp - 4], 9
jmp 0x493649
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
jle 0x4936b5
mov eax, dword [ebp - 4]
shl eax, 4
mov ecx, dword [ebp + 8]
add ecx, eax
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004933d9
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
call fcn.004936c9
add esp, 4
mov dword [ebp - 0xc], 0
jmp 0x493685
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x10
jge 0x4936a5
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xc]
xor eax, eax
mov al, byte [edx]
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xc]
mov dl, byte [eax + 0x50c8ac]
mov byte [ecx], dl
jmp 0x49367c
push 0x10
mov eax, dword [ebp + 0xc]
push eax
call fcn.0049341a
add esp, 8
jmp 0x493640
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.004933d9
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x4afaf9
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xefcdab89
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x98badcfe
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0x10325476
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0xc3d2e1f0
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0
push 0x40
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x1c
push ecx
call fcn.00479ea6
add esp, 0xc
pop ebp
ret 4
Function at 0x4cbc05
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x4cbbb6
mov eax, dword [ebp + 0x14]
add eax, 2
cdq
mov ecx, 3
idiv ecx
lea edx, [eax*4 + 1]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004bcb33
add esp, 8
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x4cbbc3
xor eax, eax
jmp 0x4cbd3e
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x10]
mov byte [edx], 0
cmp dword [ebp + 0xc], 0
jne 0x4cbbdd
mov eax, dword [ebp - 4]
jmp 0x4cbd3e
jmp 0x4cbbf1
mov eax, dword [ebp + 0x14]
sub eax, 3
mov dword [ebp + 0x14], eax
mov ecx, dword [ebp + 0xc]
add ecx, 3
mov dword [ebp + 0xc], ecx
cmp dword [ebp + 0x14], 2
jle 0x4cbc6c
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 1]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 2]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
jmp 0x4cbc39
mov ecx, dword [ebp - 0xc]
shr ecx, 6
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], 0
jle 0x4cbc5e
mov edx, dword [ebp - 0xc]
and edx, 0x3f
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 8]
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x4cbc30
mov eax, dword [ebp + 0x10]
add eax, 4
mov dword [ebp + 0x10], eax
jmp 0x4cbbdf
mov ecx, dword [ebp + 0x10]
mov byte [ecx], 0
cmp dword [ebp + 0x14], 0
jle 0x4cbd3b
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
jmp 0x4cbc95
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x14]
jge 0x4cbcba
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
jmp 0x4cbc8c
jmp 0x4cbcc5
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 3
jge 0x4cbcd6
mov eax, dword [ebp - 0xc]
shl eax, 8
mov dword [ebp - 0xc], eax
jmp 0x4cbcbc
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x4cbcea
mov edx, dword [ebp - 0xc]
shr edx, 6
mov dword [ebp - 0xc], edx
cmp dword [ebp - 8], 0
jle 0x4cbd0f
mov eax, dword [ebp - 0xc]
and eax, 0x3f
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 8]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
jmp 0x4cbce1
mov dword [ebp - 8], 3
jmp 0x4cbd21
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x14]
jle 0x4cbd34
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 8]
mov byte [eax], 0x3d
jmp 0x4cbd18
mov ecx, dword [ebp + 0x10]
mov byte [ecx + 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4cbccb
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x4cbbb6
mov eax, dword [ebp + 0x14]
add eax, 2
cdq
mov ecx, 3
idiv ecx
lea edx, [eax*4 + 1]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004bcb33
add esp, 8
mov dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x4cbbc3
xor eax, eax
jmp 0x4cbd3e
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 0x10]
mov byte [edx], 0
cmp dword [ebp + 0xc], 0
jne 0x4cbbdd
mov eax, dword [ebp - 4]
jmp 0x4cbd3e
jmp 0x4cbbf1
mov eax, dword [ebp + 0x14]
sub eax, 3
mov dword [ebp + 0x14], eax
mov ecx, dword [ebp + 0xc]
add ecx, 3
mov dword [ebp + 0xc], ecx
cmp dword [ebp + 0x14], 2
jle 0x4cbc6c
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 1]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx + 2]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 4
jmp 0x4cbc39
mov ecx, dword [ebp - 0xc]
shr ecx, 6
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], 0
jle 0x4cbc5e
mov edx, dword [ebp - 0xc]
and edx, 0x3f
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
add ecx, dword [ebp - 8]
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x4cbc30
mov eax, dword [ebp + 0x10]
add eax, 4
mov dword [ebp + 0x10], eax
jmp 0x4cbbdf
mov ecx, dword [ebp + 0x10]
mov byte [ecx], 0
cmp dword [ebp + 0x14], 0
jle 0x4cbd3b
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
jmp 0x4cbc95
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x14]
jge 0x4cbcba
mov ecx, dword [ebp - 0xc]
shl ecx, 8
mov edx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [edx]
or ecx, eax
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
jmp 0x4cbc8c
jmp 0x4cbcc5
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 3
jge 0x4cbcd6
mov eax, dword [ebp - 0xc]
shl eax, 8
mov dword [ebp - 0xc], eax
jmp 0x4cbcbc
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
jmp 0x4cbcea
mov edx, dword [ebp - 0xc]
shr edx, 6
mov dword [ebp - 0xc], edx
cmp dword [ebp - 8], 0
jle 0x4cbd0f
mov eax, dword [ebp - 0xc]
and eax, 0x3f
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp - 8]
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
jmp 0x4cbce1
mov dword [ebp - 8], 3
jmp 0x4cbd21
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0x14]
jle 0x4cbd34
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 8]
mov byte [eax], 0x3d
jmp 0x4cbd18
mov ecx, dword [ebp + 0x10]
mov byte [ecx + 4], 0
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0xf4d560
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0xf4d66c
test eax, eax
je 0xf4d66c
push esi
push edi
mov ecx, 0x10
mov esi, 0xf69008
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0xf4d653
lea edi, [eax + 4]
jmp 0xf4d5b7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0xf4d5cc
mov dword [ebp - 4], 2
jmp 0xf4d5ed
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0xf4d5e3
mov dword [ebp - 4], 1
jmp 0xf4d5ed
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0xf4d663
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0xf4d626
mov byte [ecx], 0x3d
jmp 0xf4d632
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0xf4d63d
mov byte [ecx], 0x3d
jmp 0xf4d643
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0xf4d5b4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xf50fb0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov esi, eax
mov ebx, ecx
jne 0xf50fd9
push esi
call fcn.00f50920
test al, al
jne 0xf50fd9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x48]
push eax
push ecx
call fcn.00f4b150
mov edi, eax
call fcn.00f4b510
add esp, 4
push eax
mov eax, 0x40
call fcn.00f4efc0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0xc0]
push edx
push eax
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 4], 0x40
call fcn.00f4d560
mov ecx, dword [ebp - 4]
add esp, 0x10
xor eax, eax
push 4
lea edx, [ebp - 4]
push edx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x7c], eax
mov byte [ebp - 0x80], al
push 0x10
mov eax, esi
mov byte [ebp + ecx - 0xc0], 0
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
mov dword [ebp - 0x20], 0xc3d2e1f0
call fcn.00f4d2d0
test al, al
je 0xf5106b
mov edi, dword [ebp - 4]
jmp 0xf5106e
or edi, 0xffffffff
push 4
lea eax, [ebp - 4]
push eax
push 0xc
mov eax, esi
call fcn.00f4d2d0
test al, al
je 0xf51086
mov eax, dword [ebp - 4]
jmp 0xf51089
or eax, 0xffffffff
push edi
push eax
push esi
lea esi, [ebp - 0x80]
call fcn.00f4d7e0
cmp byte [ebp - 0x80], 0
mov dword [ebp - 4], 0x40
jne 0xf510aa
call fcn.00f4dd10
mov byte [ebp - 0x80], 1
xor eax, eax
lea esp, [esp]
mov ecx, dword [ebp + eax*4 - 0x30]
bswap ecx
mov dword [ebp + eax*4 - 0x1c], ecx
inc eax
cmp eax, 5
jb 0xf510b0
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x100]
push eax
lea ecx, [ebp - 0x1c]
push 0x14
push ecx
call fcn.00f4d560
mov edx, dword [ebp - 4]
add esp, 0x10
cmp byte [ebp + 0xc], 0
mov byte [ebp + edx - 0x100], 0
mov eax, 0xf693dc
jne 0xf510f4
mov eax, 0xf693f4
push 0
push eax
mov edi, ebx
call fcn.00f50e30
mov eax, dword [ebp + 8]
push 1
push eax
call fcn.00f50e30
push 0
push 0xf6940c
call fcn.00f50e30
push 1
lea ecx, [ebp - 0xc0]
push ecx
call fcn.00f50e30
push 0
push 0xf69414
call fcn.00f50e30
push 1
lea edx, [ebp - 0x100]
push edx
call fcn.00f50e30
cmp byte [ebp + 0xc], 0
je 0xf51148
call fcn.00f50f10
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 8