joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463e10
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x502da8]
cmp dword [eax + 0x30], 0
je 0x463eba
cmp dword [ebx + 0x94], 0
jne 0x463eb4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x463da0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x463eb4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x463e7a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x463eb4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041c60c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x463e89
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x464a18
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x464a4d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004050ac
jmp 0x464a5a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00405010
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x465b94
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x465bd5
mov eax, esi
call fcn.0044beec
test al, al
je 0x465bd5
mov eax, dword [ebx + 0x84]
call fcn.0044bbe8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x465bd5
push 0
mov eax, dword [ebx + 0x84]
call fcn.0044bbe8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4692c4
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4692f2
mov eax, ebx
call fcn.00469d78
cmp dword [ebx + 0x40], 0
je 0x4692eb
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x469363
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x469355
cmp dword [ebx + 8], 0
je 0x469314
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x469326
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x469355
cmp dword [ebx + 8], 0
je 0x469307
cmp eax, 3
je 0x469339
dec eax
jne 0x469307
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x469307
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x469307
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x469381
cmp dword [ebx + 0x14], 0xcc
je 0x469381
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.0046938c
pop ebx
ret
Function at 0x47b288
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.0047ae54
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.0040547c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x47b2e6
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4ff8ac]
mov dl, 1
mov eax, dword [0x47ace0]
call fcn.004102c8
call fcn.0040494c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x47b2f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040547c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x47b348
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4ffcd0]
mov dl, 1
mov eax, dword [0x47ace0]
call fcn.004102c8
call fcn.0040494c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.0047ae84
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x486a70
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4194d4]
call fcn.004059bc
xor eax, eax
push ebp
push 0x486bb4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4f73ec], 0
jne 0x486ac3
mov ecx, dword [0x4ff40c]
mov dl, 1
mov eax, dword [0x40ac90]
call fcn.0041028c
call fcn.0040494c
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00403a2c
mov eax, ebx
call fcn.00405868
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x486bc4
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406c48
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00405878
test eax, eax
jle 0x486b5b
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x486b54
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00405244
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.0040522c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.0040bb98
test eax, eax
jne 0x486b54
mov ebx, 0x15
jmp 0x486b60
mov ebx, 0x10
jmp 0x486b60
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4f73ec]
call fcn.004868e8
mov eax, dword [ebp - 8]
call fcn.004868e8
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.00406c60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486bbb
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.00404fe0
lea eax, [ebp - 0x10]
mov edx, dword [0x4194d4]
call fcn.00405a8c
ret

Function at 0x48e7e8
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x48e871
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x502f2c
push 0x202
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x48e85b
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040f988
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x48e888
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x4ffae4]
mov dl, 1
mov eax, dword [0x48dfe8]
call fcn.004102c8
call fcn.0040494c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48e878
lea eax, [ebp - 0x1c]
call fcn.00404fbc
ret
Function at 0x48ef2c
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.0048ee48
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.004043b4
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, eax
mov ecx, 0x48ef94
mov eax, ebx
call fcn.0048e72c
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x48ef86
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.004043b4
pop esi
pop ebx
ret

Function at 0x48f064
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff4
mov ebx, edx
mov eax, ebx
call fcn.0040547c
push eax
call sub.wsock32.dll_gethostbyname
mov dword [esp + 4], eax
lea eax, [esp + 8]
xor ecx, ecx
mov edx, 4
call fcn.00403a2c
cmp dword [esp + 4], 0
je 0x48f0b6
mov eax, dword [esp + 4]
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 8], cl
mov cl, byte [edx + 1]
mov byte [esp + 9], cl
mov cl, byte [edx + 2]
mov byte [esp + 0xa], cl
mov al, byte [edx + 3]
mov byte [esp + 0xb], al
mov eax, dword [esp + 8]
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0xc
pop ebx
ret

Function at 0x48f19c
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x48f1cd
mov ecx, dword [0x4ff92c]
mov dl, 1
mov eax, dword [0x48dfe8]
call fcn.0041028c
call fcn.0040494c
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x48f1fa
mov ecx, dword [0x4ff844]
mov dl, 1
mov eax, dword [0x48dfe8]
call fcn.0041028c
call fcn.0040494c
xor eax, eax
push ebp
push 0x48f276
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.004043b4
cmp byte [ebp + 8], 0
je 0x48f252
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0048f104
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.0048ef2c
jmp 0x48f26c
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.0048ea1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x48f293
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x48f47c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0048ece0
xor eax, eax
push ebp
push 0x48f5ee
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x48f5d8
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x48f4c8
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x48f4d2
call fcn.004049f8
jmp 0x48f5f5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041f128
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x48f5cd
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov edi, eax
cmp edi, 0xffffffff
jne 0x48f580
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x48f56d
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004043b4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.0048f434
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x48f600]
cmp dl, byte [eax + 0x28]
je 0x48f5d4
call fcn.004101a4
jmp 0x48f5d4
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041f148
jmp 0x48f5d4
cmp edi, ebx
jge 0x48f59c
mov eax, dword [ebp - 0xc]
add eax, edi
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041f148
jmp 0x48f4d2
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041f128
cmp edx, dword [esp + 4]
jne 0x48f5bc
cmp eax, dword [esp]
pop edx
pop eax
jne 0x48f4d2
push ebp
call fcn.0048f434
pop ecx
jmp 0x48f5d4
push ebp
call fcn.0048f434
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f5f5
mov eax, dword [ebp - 4]
call fcn.0048ecec
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x48f604
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48f726
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0048ece0
xor eax, eax
push ebp
push 0x48f709
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x48f654
call fcn.004049f8
jmp 0x48f710
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x48f6f3
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x48f6f3
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004043b4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x48f6f3
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040f988
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x48f740
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4ffae4]
mov dl, 1
mov eax, dword [0x48dfe8]
call fcn.004102c8
call fcn.0040494c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f710
mov eax, dword [ebp - 4]
call fcn.0048ecec
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f72d
lea eax, [ebp - 0x28]
call fcn.00404fbc
ret
Function at 0x48f78c
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48f8d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0048ece0
xor eax, eax
push ebp
push 0x48f8b9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x48f7f1
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x48f7f1
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x48f8a3
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x48f804
call fcn.004049f8
jmp 0x48f8c0
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x48f8a3
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x48f8a3
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.004043b4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x48f8a3
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040f988
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x48f8f0
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4ffae4]
mov dl, 1
mov eax, dword [0x48dfe8]
call fcn.004102c8
call fcn.0040494c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f8c0
mov eax, dword [ebp - 4]
call fcn.0048ecec
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f8dd
lea eax, [ebp - 0x28]
call fcn.00404fbc
ret
Function at 0x49015c
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0x4f78e8
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x490220
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x490194
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x490237
dec edx
je 0x490278
jmp 0x4902d5
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x4902d5
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x490338
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x490355
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x490467
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x490388
je 0x4903d4
sub ecx, 0x2b
je 0x4903ca
sub ecx, 4
je 0x4903cf
dec ecx
sub ecx, 0xa
jb 0x4903b9
jmp 0x4903d7
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x49039a
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4903a8
jmp 0x4903d7
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4903d7
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4903d7
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4903d7
mov byte [eax], 0x3e
jmp 0x4903d7
mov byte [eax], 0x3f
jmp 0x4903d7
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x490367
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x490427
cmp byte [esp + 3], 0xff
jne 0x490427
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x49045f
cmp dl, 0xff
je 0x49045f
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x490360
add esp, 0xc
pop ebp
pop edi
pop esi
ret
Function at 0x492858
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 4], 0
jne 0x492882
mov ecx, 0x4928e8
mov dl, 1
mov eax, dword [0x491aec]
call fcn.004101d0
call fcn.0040494c
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp + 8]
test esi, esi
jle 0x4928d5
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x10]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x38]
mov eax, dword [ebp - 8]
mov al, byte [eax]
mov edx, dword [ebx + 0x14]
xor al, byte [edx]
mov edx, dword [ebp - 0xc]
mov byte [edx], al
mov ecx, dword [ebx + 0x18]
dec ecx
mov edx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x10]
inc eax
call fcn.00403218
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
mov edx, dword [ebx + 0x10]
add edx, dword [ebx + 0x18]
dec edx
mov byte [edx], al
inc dword [ebp - 8]
inc dword [ebp - 0xc]
dec esi
jne 0x492892
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x492900
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 4], 0
jne 0x49292a
mov ecx, 0x492994
mov dl, 1
mov eax, dword [0x491aec]
call fcn.004101d0
call fcn.0040494c
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov esi, dword [ebp + 8]
test esi, esi
jle 0x492983
mov eax, dword [ebp - 8]
mov al, byte [eax]
mov byte [ebp - 0xd], al
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x10]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x38]
mov eax, dword [ebp - 8]
mov al, byte [eax]
mov edx, dword [ebx + 0x14]
xor al, byte [edx]
mov edx, dword [ebp - 0xc]
mov byte [edx], al
mov ecx, dword [ebx + 0x18]
dec ecx
mov edx, dword [ebx + 0x10]
mov eax, dword [ebx + 0x10]
inc eax
call fcn.00403218
mov eax, dword [ebx + 0x10]
add eax, dword [ebx + 0x18]
dec eax
mov dl, byte [ebp - 0xd]
mov byte [eax], dl
inc dword [ebp - 8]
inc dword [ebp - 0xc]
dec esi
jne 0x49293a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x492f3c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jle 0x492f5c
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x492f4a
pop edi
pop esi
pop ebx
ret