joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a2a0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ecx]
cmp esi, 0x10
je 0x47a2b7
cmp esi, 0x20
jne 0x47a48b
shr esi, 2
mov edx, 4
cmp esi, edx
mov dword [ebp - 0xc], esi
mov eax, esi
cmovb eax, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [eax*4 + 0x1c]
mov dword [ebp - 8], eax
test edi, edi
je 0x47a48a
mov dword [edi], 0x10
push ebx
mov dword [edi + 4], eax
xor ebx, ebx
add edi, 8
test esi, esi
je 0x47a322
lea edx, [ecx + 5]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
movzx eax, byte [edx - 4]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
mov dword [edi + ebx*4], ecx
inc ebx
cmp ebx, esi
jl 0x47a2f5
mov eax, dword [ebp - 8]
mov ebx, dword [edi + ebx*4 - 4]
mov ecx, esi
cmp esi, eax
jge 0x47a40a
mov dword [ebp + 8], 0
mov dword [ebp - 4], edi
lea ebx, [ebx]
mov eax, ecx
cdq
idiv esi
test edx, edx
jne 0x47a3a0
mov eax, dword [ebp + 8]
cdq
idiv esi
mov dl, byte [eax + 0x4a17b0]
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx esi, byte [eax + str.cw]
movzx eax, dl
xor esi, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl esi, 8
movzx eax, byte [eax + str.cw]
xor esi, eax
movzx eax, bl
shl esi, 8
shr ebx, 0x18
movzx eax, byte [eax + str.cw]
xor esi, eax
movzx ebx, byte [ebx + str.cw]
shl esi, 8
xor ebx, esi
mov esi, dword [ebp - 0xc]
jmp 0x47a3ed
cmp esi, 6
jbe 0x47a3ed
cmp edx, 4
jne 0x47a3ed
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + str.cw]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
xor edx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl edx, 8
movzx eax, byte [eax + str.cw]
xor edx, eax
movzx eax, bl
shl edx, 8
movzx ebx, byte [eax + str.cw]
xor ebx, edx
mov eax, dword [ebp - 4]
inc dword [ebp + 8]
xor ebx, dword [eax]
add eax, 4
mov dword [edi + ecx*4], ebx
inc ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
cmp ecx, eax
jl 0x47a340
xor esi, esi
sub ecx, 1
js 0x47a489
lea eax, [edi + eax*4]
mov dword [ebp + 8], eax
mov ebx, dword [edi + ecx*4]
cmp esi, 4
jl 0x47a479
cmp ecx, 4
jb 0x47a479
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx edx, byte [eax + str.cw]
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [edx*4 + 0x4a2dd0]
movzx eax, byte [eax + str.cw]
xor edx, dword [eax*4 + 0x4a31d0]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
xor edx, dword [eax*4 + 0x4a29d0]
movzx eax, bl
movzx eax, byte [eax + str.cw]
xor edx, dword [eax*4 + 0x4a35d0]
mov eax, dword [ebp + 8]
jmp 0x47a47b
mov edx, ebx
mov dword [eax], edx
inc esi
add eax, 4
sub ecx, 1
mov dword [ebp + 8], eax
jns 0x47a417
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x47af60
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 8
push ebx
push esi
push edi
test ecx, ecx
je 0x47b138
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x47b138
test bl, 3
jne 0x47b138
lea eax, [ebx - 1]
xor edx, edx
add eax, ecx
mov dword [ebp - 8], edx
cmp byte [eax], 0x3d
jne 0x47afaa
inc edx
dec eax
mov dword [ebp - 8], edx
cmp edx, 2
ja 0x47b138
cmp byte [eax], 0x3d
je 0x47af97
shr ebx, 2
xor edi, edi
mov dword [ebp + 8], edi
mov dword [ebp + 0x10], ebx
test ebx, ebx
je 0x47b12d
lea esi, [ecx + 2]
mov dword [ebp - 4], esi
mov al, byte [esi - 2]
lea ecx, [eax - 0x41]
cmp cl, 0x19
ja 0x47afd2
sub al, 0x41
jmp 0x47b001
lea ecx, [eax - 0x61]
cmp cl, 0x19
ja 0x47afde
sub al, 0x47
jmp 0x47b001
lea ecx, [eax - 0x30]
cmp cl, 9
ja 0x47afea
add al, 4
jmp 0x47b001
cmp al, 0x2b
jne 0x47aff2
mov al, 0x3e
jmp 0x47b001
cmp al, 0x2f
jne 0x47affa
mov al, 0x3f
jmp 0x47b001
cmp al, 0x3d
sete al
sub al, 1
mov dl, byte [esi - 1]
lea ecx, [edx - 0x41]
cmp cl, 0x19
ja 0x47b011
sub dl, 0x41
jmp 0x47b045
lea ecx, [edx - 0x61]
cmp cl, 0x19
ja 0x47b01e
sub dl, 0x47
jmp 0x47b045
lea ecx, [edx - 0x30]
cmp cl, 9
ja 0x47b02b
add dl, 4
jmp 0x47b045
cmp dl, 0x2b
jne 0x47b034
mov dl, 0x3e
jmp 0x47b045
cmp dl, 0x2f
jne 0x47b03d
mov dl, 0x3f
jmp 0x47b045
cmp dl, 0x3d
sete dl
dec dl
mov bl, byte [esi]
lea ecx, [ebx - 0x41]
cmp cl, 0x19
ja 0x47b054
sub bl, 0x41
jmp 0x47b088
lea ecx, [ebx - 0x61]
cmp cl, 0x19
ja 0x47b061
sub bl, 0x47
jmp 0x47b088
lea ecx, [ebx - 0x30]
cmp cl, 9
ja 0x47b06e
add bl, 4
jmp 0x47b088
cmp bl, 0x2b
jne 0x47b077
mov bl, 0x3e
jmp 0x47b088
cmp bl, 0x2f
jne 0x47b080
mov bl, 0x3f
jmp 0x47b088
cmp bl, 0x3d
sete bl
dec bl
mov ah, byte [esi + 1]
mov cl, ah
sub cl, 0x41
cmp cl, 0x19
ja 0x47b09a
sub ah, 0x41
jmp 0x47b0d2
mov cl, ah
sub cl, 0x61
cmp cl, 0x19
ja 0x47b0a9
sub ah, 0x47
jmp 0x47b0d2
mov cl, ah
sub cl, 0x30
cmp cl, 9
ja 0x47b0b8
add ah, 4
jmp 0x47b0d2
cmp ah, 0x2b
jne 0x47b0c1
mov ah, 0x3e
jmp 0x47b0d2
cmp ah, 0x2f
jne 0x47b0ca
mov ah, 0x3f
jmp 0x47b0d2
cmp ah, 0x3d
sete ah
dec ah
cmp al, 0xff
je 0x47b138
cmp dl, 0xff
je 0x47b138
cmp bl, 0xff
je 0x47b138
cmp ah, 0xff
je 0x47b138
mov esi, dword [ebp + 0xc]
mov cl, dl
shl al, 2
shr cl, 4
or cl, al
shl dl, 4
mov byte [edi + esi], cl
mov al, bl
mov ecx, esi
shr al, 2
mov esi, dword [ebp - 4]
or al, dl
shl bl, 6
add esi, 4
or bl, ah
mov dword [ebp - 4], esi
mov byte [edi + ecx + 1], al
mov eax, dword [ebp + 8]
inc eax
mov byte [edi + ecx + 2], bl
add edi, 3
mov dword [ebp + 8], eax
cmp eax, dword [ebp + 0x10]
jb 0x47afc3
mov edx, dword [ebp - 8]
sub edi, edx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47b430
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
push edi
je 0x47b5a3
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x47b5a3
mov eax, 0xaaaaaaab
mov ecx, edi
mul edi
push ebx
mov ebx, edx
shr ebx, 1
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebx + ebx*2]
sub ecx, eax
mov eax, 0
mov dword [ebp - 4], ecx
setne al
add eax, ebx
shl eax, 2
mov dword [ebp - 8], eax
test esi, esi
je 0x47b59c
xor eax, eax
test ebx, ebx
je 0x47b500
mov edi, dword [ebp + 8]
add edi, 2
lea ebx, [ebx]
movzx ecx, byte [edi - 2]
lea edi, [edi + 3]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx edx, byte [edi - 5]
movzx ecx, byte [edi - 4]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
movzx edx, byte [edi - 4]
movzx ecx, byte [edi - 3]
and edx, 0xf
shr ecx, 6
shl edx, 2
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 2], cl
movzx ecx, byte [edi - 3]
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 3], cl
add eax, 4
sub ebx, 1
jne 0x47b490
mov ecx, dword [ebp - 4]
mov edi, dword [ebp + 0x10]
sub ecx, 1
je 0x47b567
sub ecx, 1
jne 0x47b599
mov ebx, dword [ebp + 8]
movzx ecx, byte [ebx + edi - 2]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx edx, byte [ebx + edi - 2]
movzx ecx, byte [ebx + edi - 1]
and edx, 3
shr ecx, 4
shl edx, 4
or edx, ecx
movzx ecx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
lea ecx, [eax + 2]
movzx eax, byte [ebx + edi - 1]
and eax, 0xf
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + esi], al
mov eax, dword [ebp - 8]
mov byte [ecx + esi + 1], 0x3d
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
movzx ecx, byte [edx + edi - 1]
shr ecx, 2
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi], cl
movzx ecx, byte [edx + edi - 1]
and ecx, 3
shl ecx, 4
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + esi + 1], cl
mov word [eax + esi + 2], 0x3d3d
mov eax, dword [ebp - 8]
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x47b8e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49320c
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4b74b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4bfae4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x4bf8bc]
cmp eax, dword [ecx + 4]
jg 0x47b953
jmp 0x47b934
mov al, byte [ecx]
inc ecx
test al, al
je 0x47ba58
jmp 0x47b927
mov eax, 0x4bf8a4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00487877
mov esp, ebp
pop ebp
ret
push 0x4bf8bc
call fcn.00487d52
add esp, 4
cmp dword [0x4bf8bc], 0xffffffff
jne 0x47b934
mov byte [ebp - 0x34], 0x69
mov byte [ebp - 0x33], 0x6f
mov byte [ebp - 0x32], 0x4e
mov byte [ebp - 0x31], 0x69
mov byte [ebp - 0x30], 0x2c
mov byte [ebp - 0x2f], 0x11
mov byte [ebp - 0x2e], 0x25
mov byte [ebp - 0x2d], 0x4e
mov byte [ebp - 0x2c], 0x7d
mov byte [ebp - 0x2b], 0x2c
mov byte [ebp - 0x2a], 0x11
mov byte [ebp - 0x29], 0x2c
mov byte [ebp - 0x28], 0x54
mov byte [ebp - 0x27], 0x26
mov byte [ebp - 0x26], 0x18
mov byte [ebp - 0x25], 0x68
mov byte [ebp - 0x24], 0x3a
mov byte [ebp - 0x23], 0x18
mov byte [ebp - 0x22], 4
mov byte [ebp - 0x21], 0x3a
mov byte [ebp - 0x20], 0x25
mov byte [ebp - 0x1f], 0x4e
mov byte [ebp - 0x1e], 0x6f
mov byte [ebp - 0x1d], 0x6f
mov byte [ebp - 0x1c], 0x12
mov byte [ebp - 0x1b], 4
mov byte [ebp - 0x1a], 0x3a
mov byte [ebp - 0x19], 0x18
mov byte [ebp - 0x18], 0x7c
mov byte [ebp - 0x17], 4
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x25
mov byte [ebp - 0x14], 0
mov al, byte [ebp - 0x34]
mov byte [ebp - 0x13], 0
cmp byte [ebp - 0x13], 0
mov dword [ebp - 4], 0
jne 0x47ba32
xor ecx, ecx
mov byte [ebp - 0x13], 1
lea esi, [ecx + 0x7f]
jmp 0x47ba10
mov al, byte [ebp + ecx - 0x34]
movsx eax, al
sub eax, 0x6c
imul eax, eax, 0x13
cdq
idiv esi
lea eax, [edx + 0x7f]
cdq
idiv esi
mov byte [ebp + ecx - 0x34], dl
inc ecx
cmp ecx, 0x20
jb 0x47ba10
jmp 0x47ba32
lea ecx, [ebp - 0x34]
mov dword [0x4bf8b4], 0
mov dword [0x4bf8b8], 0xf
lea edx, [ecx + 1]
mov byte [0x4bf8a4], 0
jmp 0x47b927
sub ecx, edx
lea eax, [ebp - 0x34]
push ecx
push eax
mov ecx, 0x4bf8a4
call fcn.00413d00
push 0x494e70
call fcn.00487c0a
push 0x4bf8bc
call fcn.00487d08
add esp, 8
jmp 0x47b934
Function at 0x47ec20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493708
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x4b74b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp dword [edi + 0x28], 0
je 0x47ee1c
push 0x11
xor eax, eax
mov dword [ebp - 0x18], 0
push str.ciphertextversion
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
call fcn.00404550
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00479030
push eax
lea eax, [ebp - 0x48]
mov byte [ebp - 4], 1
push eax
call fcn.0047b5b0
push eax
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 2
push eax
call fcn.00478da0
mov edx, dword [ebp - 0x34]
add esp, 0x18
cmp edx, 0x10
jb 0x47ecee
mov ecx, dword [ebp - 0x48]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x47ece4
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47ed6e
push edx
push ecx
call fcn.00487869
add esp, 8
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xf
mov byte [ebp - 0x48], 0
cmp edx, 0x10
jb 0x47ed30
mov ecx, dword [ebp - 0x60]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x47ed26
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47ed6e
push edx
push ecx
call fcn.00487869
add esp, 8
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0xf
mov byte [ebp - 0x60], 0
cmp edx, 8
jb 0x47ed7e
mov ecx, dword [ebp - 0x30]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47ed74
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x47ed74
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00487869
add esp, 8
cmp dword [edi + 0x2c], 8
lea esi, [edi + 0x18]
mov ecx, esi
jb 0x47ed8b
mov ecx, dword [esi]
cmp dword [ebp - 0x64], 8
lea eax, [ebp - 0x78]
push ecx
cmovae eax, dword [ebp - 0x78]
lea ecx, [ebp - 0x18]
push 4
push ecx
push 0
push eax
push str.Support
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x47edb7
mov word [edi + 0x38], 0x101
jmp 0x47ede0
cmp dword [esi + 0x14], 8
jb 0x47edbf
mov esi, dword [esi]
push esi
push 4
lea eax, [ebp - 0x18]
push eax
push 0
push str.ciphertextversion
push str.Support
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x47ede0
mov byte [edi + 0x39], 1
mov edx, dword [ebp - 0x64]
cmp edx, 8
jb 0x47ee1c
mov ecx, dword [ebp - 0x78]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47ee12
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x47ee12
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00487869
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00487877
mov esp, ebp
pop ebp
ret
Function at 0x481230
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48b7f8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4b74b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4bfae4]
mov ebx, dword [ebp + 8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x4bf934]
cmp eax, dword [ecx + 4]
jg 0x4813eb
cmp dword [0x4b72f4], 0
jne 0x481397
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], cx
mov dword [ebp - 4], ecx
cmp eax, 1
jl 0x48131c
jne 0x4812bc
push 2
push 0x497a60
jmp 0x481311
xor esi, esi
mov edi, 0x112
lea eax, [edi + esi]
cdq
sub eax, edx
mov edx, dword [ebp - 0x2c]
sar eax, 1
lea ecx, [eax + eax*2]
sub edx, dword [ecx*4 + 0x4a003c]
jns 0x4812de
mov edi, eax
jmp 0x4812e4
test edx, edx
jle 0x4812ef
mov esi, eax
mov eax, edi
sub eax, esi
cmp eax, 1
jg 0x4812c3
jmp 0x481319
lea eax, [eax + eax*2]
mov edx, dword [eax*4 + 0x4a0038]
mov ecx, edx
lea esi, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x481300
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00404550
mov esi, dword [ebp - 0x18]
mov edx, dword [0x4b72f8]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x481365
mov ecx, dword [0x4b72e4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x48135b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x48135b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00487869
add esp, 8
mov eax, dword [ebp - 0x28]
mov dword [0x4b72e4], eax
mov eax, dword [ebp - 0x24]
mov dword [0x4b72e8], eax
mov eax, dword [ebp - 0x20]
mov dword [0x4b72ec], eax
mov eax, dword [ebp - 0x1c]
mov dword [0x4b72f0], eax
mov eax, dword [ebp - 0x14]
mov dword [0x4b72f4], esi
mov dword [0x4b72f8], eax
test esi, esi
je 0x4813b9
mov eax, dword [ebx + 4]
push 0x4b72e4
cmp eax, dword [ebx + 8]
je 0x4813b1
mov ecx, eax
call fcn.00401ff0
add dword [ebx + 4], 0x18
jmp 0x4813b9
push eax
mov ecx, ebx
call fcn.0040e430
mov ecx, dword [ebx + 4]
mov eax, 0x2aaaaaab
sub ecx, dword [ebx]
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00487877
mov esp, ebp
pop ebp
ret
push 0x4bf934
call fcn.00487d52
add esp, 4
cmp dword [0x4bf934], 0xffffffff
jne 0x48127e
push 0x495030
call fcn.00487c0a
push 0x4bf934
call fcn.00487d08
add esp, 8
jmp 0x48127e
Function at 0x481be0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x493ba1
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x4b74b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x74], 0
test esi, esi
je 0x481d0c
cmp dword [esi], 0x3c
jne 0x481d0c
test byte [esi + 4], 0xc
jne 0x481d35
mov eax, dword [esi + 0xc]
test eax, eax
je 0x481d0c
cmp word [eax], 0
je 0x481d0c
mov eax, dword [esi + 0x10]
test eax, eax
je 0x481d0c
cmp word [eax], 0
je 0x481d0c
push eax
lea ecx, [ebp - 0x28]
call fcn.00401970
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push str..exe
push eax
mov dword [ebp - 0x74], 1
call fcn.00484650
add esp, 8
test al, al
je 0x481cb3
push str.open
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
je 0x481caf
push str.runas
push dword [esi + 0xc]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x481cb3
mov bl, 1
jmp 0x481cb5
xor bl, bl
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x481cf8
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x481cee
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x481cee
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00487869
add esp, 8
mov eax, dword [esi + 0x10]
push eax
test bl, bl
je 0x481d29
call fcn.00482340
add esp, 4
test eax, eax
jne 0x481d35
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00487877
mov esp, ebp
pop ebp
ret
call fcn.004826a0
add esp, 4
test eax, eax
je 0x481d0c
push str.kSafeRunProcess
lea ecx, [ebp - 0x28]
call fcn.00401970
push dword [esi + 0x14]
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 1
push dword [esi + 0x10]
lea ecx, [ebp - 0x70]
push eax
call fcn.00481780
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
cmp edx, 8
jb 0x481d9e
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x481d94
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x481d94
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00487869
add esp, 8
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, eax
cmp dword [ebp - 0x60], 0
mov dword [ebp - 4], 2
je 0x481dbe
push 1
lea ecx, [ebp - 0x70]
call fcn.00483bf0
lea ecx, [ebp - 0x40]
call fcn.00401c10
lea ecx, [ebp - 0x58]
call fcn.00401c10
lea ecx, [ebp - 0x70]
call fcn.00401c10
mov eax, esi
jmp 0x481d0e
Function at 0x484400
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x30]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
pop ebp
ret

Function at 0x484430
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret

Function at 0x485440
Capabilities:
Decode data using base64 via dword translation table
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esi - 1]
add eax, ecx
cmp byte [eax], 0x3d
jne 0x485461
lea eax, [eax - 1]
dec esi
cmp byte [eax], 0x3d
je 0x485455
mov dword [ebp + 0xc], esi
xor eax, eax
test esi, esi
je 0x485518
push ebx
mov edx, 1
mov dword [ebp + 8], 2
lea ebx, [esi - 1]
sub edx, ecx
shr ebx, 2
push edi
lea edi, [ecx + 2]
mov dword [ebp - 4], edx
inc ebx
jmp 0x485490
movsx ecx, byte [edi - 1]
mov dh, byte [ecx + 0x4a4220]
movsx ecx, byte [edi - 2]
mov dl, byte [ecx + 0x4a4220]
mov cl, dh
sar cl, 4
and cl, 3
shl dl, 2
or dl, cl
mov ecx, dword [ebp + 0x10]
mov byte [eax + ecx], dl
inc eax
mov ecx, dword [ebp + 8]
cmp ecx, esi
jae 0x485504
movsx ecx, byte [edi]
mov esi, dword [ebp + 0x10]
shl dh, 4
mov dl, byte [ecx + 0x4a4220]
mov cl, dl
sar cl, 2
and cl, 0xf
or cl, dh
mov byte [eax + esi], cl
inc eax
mov ecx, dword [ebp - 4]
mov esi, dword [ebp + 0xc]
add ecx, edi
cmp ecx, esi
jae 0x485501
movsx ecx, byte [edi + 1]
shl dl, 6
mov cl, byte [ecx + 0x4a4220]
and cl, 0x3f
or cl, dl
mov edx, dword [ebp + 0x10]
mov byte [eax + edx], cl
inc eax
mov ecx, dword [ebp + 8]
add ecx, 4
add edi, 4
mov dword [ebp + 8], ecx
sub ebx, 1
jne 0x485490
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x486080
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0
push 8
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x486252
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x3f0
jne 0x486252
push edi
mov ecx, esi
call fcn.00486cd0
mov edi, eax
cmp edi, 0xffffffff
je 0x486249
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0xffffffff
push eax
push 0x20008
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x486235
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
test edi, edi
je 0x48622b
test eax, eax
je 0x48622b
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x486136
call ebx
cmp eax, 0x7a
jne 0x48622b
push dword [ebp - 4]
call fcn.004879c0
add esp, 4
mov ebx, eax
lea eax, [ebp - 4]
mov dword [ebp - 0x18], ebx
push eax
push dword [ebp - 4]
push ebx
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x486222
mov eax, dword [ebx]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x486222
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x486222
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 0
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x4861a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x48622b
push dword [ebp - 4]
call fcn.004879c0
add esp, 4
mov dword [ebp - 8], eax
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 4]
push eax
push 1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x48620f
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x48620f
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x48620f
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x18]
cmp eax, 1
sete bl
call fcn.004879c9
push dword [ebp - 8]
call fcn.004879c9
add esp, 8
test bl, bl
jne 0x486235
jmp 0x48622b
push ebx
call fcn.004879c9
push dword [ebp - 8]
call fcn.004879c9
add esp, 8
jmp 0x48622b
push ebx
call fcn.004879c9
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
mov byte [esi], 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov eax, dword [ebp - 0xc]
cmp eax, 0xffffffff
je 0x486249
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret