joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4987f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x498821
dec al
je 0x49885c
dec al
je 0x4988a1
dec al
je 0x49890a
jmp 0x498994
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x498994
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x498831
jmp 0x498994
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x498994
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x49886c
jmp 0x498994
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x498994
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x4988d0
xor ebp, ebp
jmp 0x4988e0
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x4988e9
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x4988b1
jmp 0x498994
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x498994
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x498963
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.004942b0
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x49891e
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a53fc
Capabilities:
Allocate or change rwx memory
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a559e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [esi + 5], eax
mov byte [esi], 0
xor ecx, ecx
mov edx, 6
mov eax, ebx
call fcn.004a5324
test al, al
je 0x4a5468
mov eax, dword [0x554780]
cmp byte [eax], 0
je 0x4a5459
mov ecx, 0x40a3
mov edx, 0x4a55b8
mov eax, 0x4a5634
call fcn.00405428
push 0x4a5678
call sub.kernel32.dll_OutputDebugStringW
jmp 0x4a5583
mov eax, ebx
call fcn.004a4f9c
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 5
push esi
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_ReadProcessMemory
test eax, eax
je 0x4a5583
mov byte [ebp - 0xd], 0xe9
sub edi, ebx
sub edi, 5
mov dword [ebp - 0xc], edi
movzx eax, byte [esi]
cmp al, byte [ebp - 0xd]
jne 0x4a5538
push 0x4a56a0
call sub.kernel32.dll_OutputDebugStringW
movzx eax, byte [esi]
mov byte [ebp - 0xd], al
mov byte [esi], 0
xor edi, edi
xor eax, eax
mov dword [ebp - 0x14], eax
cmp byte [ebp - 0xd], 0xe9
jne 0x4a54e2
mov edi, ebx
add edi, 5
add edi, dword [esi + 1]
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push edi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_ReadProcessMemory
lea eax, [ebp - 0x1c]
push eax
movzx eax, byte [ebp - 0xd]
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov dword [ebp - 0x2c], edi
mov byte [ebp - 0x28], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0
lea edx, [ebp - 0x34]
mov ecx, 2
mov eax, 0x4a56dc
call fcn.0040ea8c
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
mov edx, 0x4a5714
call fcn.00406720
mov eax, dword [ebp - 0x18]
mov ecx, 0x40ca
mov edx, 0x4a55b8
call fcn.00405428
jmp 0x4a5583
mov dword [esi + 5], ebx
lea eax, [ebp - 0x14]
push eax
push 0x40
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
lea eax, [ebp - 4]
push eax
push 5
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WriteProcessMemory
mov esi, eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
test esi, esi
je 0x4a5583
push 5
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a55a5
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00406244
ret
Function at 0x4a5750
Capabilities:
Allocate or change rwx memory
Print debug messages

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
cmp byte [esi], 0
je 0x4a57fc
test ebx, ebx
je 0x4a57fc
xor ecx, ecx
mov edx, 6
mov eax, ebx
call fcn.004a5324
test al, al
je 0x4a57a7
mov eax, dword [0x554780]
cmp byte [eax], 0
je 0x4a579b
mov ecx, 0x40e9
mov edx, 0x4a5810
mov eax, 0x4a588c
call fcn.00405428
push 0x4a58d0
call sub.kernel32.dll_OutputDebugStringW
jmp 0x4a57fc
mov eax, ebx
call fcn.004a4f9c
mov ebx, eax
test ebx, ebx
je 0x4a57fc
lea eax, [esp + 4]
push eax
push 0x40
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
push esp
push 5
push esi
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_WriteProcessMemory
mov edi, eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 8]
push eax
push 5
push ebx
call sub.kernel32.dll_VirtualProtect
test edi, edi
je 0x4a57f9
push 5
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_FlushInstructionCache
mov byte [esi], 0
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4ab1d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ab23f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x4ab258
call fcn.0040ea8c
mov eax, dword [ebp - 4]
call fcn.004062d8
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab246
lea eax, [ebp - 4]
call fcn.0040623c
ret

Function at 0x4ab374
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ab3d1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0xc]
xor ecx, ecx
mov eax, 0x4ab3e8
call fcn.0040ea8c
mov eax, dword [ebp - 4]
call fcn.004062d8
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab3d8
lea eax, [ebp - 4]
call fcn.0040623c
ret
Function at 0x4ab498
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x4ab72a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x55a404], 0
je 0x4ab70f
mov ebx, dword [0x55a404]
call fcn.00404358
mov eax, ebx
call fcn.00404678
or edx, 0xffffffff
call fcn.00404404
xor eax, eax
push ebp
push 0x4ab708
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x55a404]
mov edx, dword [eax + 0x30]
mov dword [ebp - 8], edx
mov edx, dword [eax + 0x34]
mov dword [ebp - 4], edx
xor eax, eax
push ebp
push 0x4ab60d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x55a404]
xor edx, edx
mov dword [eax + 0x38], edx
mov eax, dword [0x55a404]
mov edx, dword [0x48fe70]
mov dword [eax + 0x34], edx
mov dword [eax + 0x30], 0x4a0974
mov eax, dword [0x55a404]
call fcn.004aa1b8
mov eax, dword [0x55a404]
mov edx, dword [ebp - 8]
mov dword [eax + 0x30], edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x34], edx
mov eax, dword [0x55a404]
mov ebx, dword [eax + 0x38]
cmp byte [0x55a44c], 0
je 0x4ab5a2
test ebx, ebx
je 0x4ab5a2
xor edi, edi
test ebx, ebx
je 0x4ab5a2
cmp dword [ebx + 4], 0xfffffffe
jne 0x4ab59b
inc edi
push 0x4ab744
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0040d29c
push dword [ebp - 0x14]
push 0x4ab784
push dword [ebx]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00406804
mov eax, dword [ebp - 0x10]
call fcn.004062d8
push eax
call sub.kernel32.dll_OutputDebugStringW
mov ebx, dword [ebx + 0x18]
test ebx, ebx
jne 0x4ab560
mov eax, dword [0x55a404]
mov ebx, dword [eax + 0x38]
test ebx, ebx
je 0x4ab5e4
mov esi, dword [ebx + 0x18]
xor eax, eax
mov dword [ebx + 0x18], eax
mov dword [ebx + 4], 0xfffffffe
mov dword [ebx + 8], 0xe6
mov dword [ebx + 0xc], 0xe6
mov byte [ebx + 0x14], 0
mov edx, dword [ebx + 0x10]
mov ecx, ebx
mov eax, dword [0x55a404]
call fcn.004aa474
mov ebx, esi
test ebx, ebx
jne 0x4ab5ae
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab614
mov eax, dword [0x55a404]
xor edx, edx
mov dword [eax + 0x38], edx
mov eax, dword [0x55a404]
mov edx, dword [ebp - 8]
mov dword [eax + 0x30], edx
mov edx, dword [ebp - 4]
mov dword [eax + 0x34], edx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ab731
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00406244
ret

Function at 0x4c64e4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.0040367c
ret
Function at 0x4c9e14
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4c9eae
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x4c9e33
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4c9ec4
dec edx
je 0x4c9ef9
jmp 0x4c9f4a
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4c9f4a
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_cw]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ca02c
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x4ca04b
add edx, 3
sar edx, 2
test edx, edx
jle 0x4ca159
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
movzx ecx, byte [edi + esi]
cmp ecx, 0x3d
jg 0x4ca080
je 0x4ca0c3
sub ecx, 0x2b
je 0x4ca0b9
sub ecx, 4
je 0x4ca0be
dec ecx
sub ecx, 0xa
jb 0x4ca0ab
jmp 0x4ca0c6
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4ca092
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x4ca09d
jmp 0x4ca0c6
movzx ecx, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x4ca0c6
movzx ecx, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x4ca0c6
movzx ecx, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x4ca0c6
mov byte [eax], 0x3e
jmp 0x4ca0c6
mov byte [eax], 0x3f
jmp 0x4ca0c6
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4ca063
movzx eax, byte [esp + 4]
add eax, eax
add eax, eax
movzx edx, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
movzx edx, byte [esp + 6]
cmp dl, 0xff
je 0x4ca117
cmp byte [esp + 7], 0xff
jne 0x4ca117
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x4ca14e
cmp dl, 0xff
je 0x4ca14e
movzx eax, byte [esp + 5]
shl eax, 4
movzx edx, dl
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
movzx edx, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x4ca05a
add esp, 0x10
pop ebp
pop edi
pop esi
ret

Function at 0x4cad88
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x4cada9
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4cad96
pop edi
pop esi
pop ebx
ret

Function at 0x4cbdd0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
movzx ebx, dl
dec ebx
test ebx, ebx
jb 0x4cbe24
inc ebx
xor edx, edx
mov ecx, edx
add ecx, ecx
add ecx, ecx
movzx esi, byte [eax + ecx]
lea esi, [esi*4 + 0x54da74]
mov esi, dword [esi]
movzx edi, byte [eax + ecx + 1]
lea edi, [edi*4 + 0x54de74]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 2]
lea edi, [edi*4 + 0x54e274]
xor esi, dword [edi]
movzx edi, byte [eax + ecx + 3]
lea edi, [edi*4 + 0x54e674]
xor esi, dword [edi]
lea ecx, [eax + ecx]
mov dword [ecx], esi
inc edx
dec ebx
jne 0x4cbdde
pop edi
pop esi
pop ebx
ret
Function at 0x4ccb4c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, dword [ebp + 8]
mov eax, ebx
xor edx, edx
call fcn.0040624c
push 0
push edi
lea eax, [ebp - 0x20a]
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040644c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4ccb94
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040644c
add esp, 0x200
pop ebx
ret

Function at 0x4ccbc4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push esp
push 0xff
call sub.kernel32.dll_GetTempPathW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040644c
add esp, 0x200
pop ebx
ret

Function at 0x4ccbf0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, edx
push 0xff
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.0040644c
add esp, 0x200
pop ebx
ret

Function at 0x4ccc20
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
mov ebx, eax
mov eax, ebx
xor edx, edx
call fcn.0040624c
mov dword [ebp - 4], 0x104
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.advapi32.dll_GetUserNameW
test eax, eax
je 0x4ccc5d
mov eax, ebx
lea edx, [ebp - 0x20c]
call fcn.004063f8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4ccc64
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ccce0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
jbe 0x4cccc7
push ebx
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.0040644c
mov eax, dword [ebp - 0x20c]
mov ecx, 2
mov edx, 1
call fcn.004069f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ccce7
lea eax, [ebp - 0x20c]
call fcn.0040623c
ret
Function at 0x4cd688
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cd7eb
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4cd706
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x23
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
add eax, 8
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.0040644c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cd731
xor eax, eax
push ebp
push 0x4cd773
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1a
lea eax, [ebp - 0x212]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 4]
add eax, 4
lea edx, [ebp - 0x212]
mov ecx, 0x105
call fcn.0040644c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4cd79e
lea edx, [ebp - 0x224]
xor eax, eax
call fcn.004033e8
mov eax, dword [ebp - 0x224]
lea edx, [ebp - 0x220]
call fcn.0040df00
mov edx, dword [ebp - 0x220]
mov eax, dword [ebp - 4]
add eax, 0xc
call fcn.0040624c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cd7f2
lea eax, [ebp - 0x224]
mov edx, 4
call fcn.00406244
ret

Function at 0x4d02cc
Capabilities:
Hash data with md5

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004d0e84
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
pop ebx
ret

Function at 0x4d0d80
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff20
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x40
jle 0x4d0dc5
lea eax, [ebp - 0x60]
call fcn.004d02cc
mov edx, ebx
lea eax, [ebp - 0x60]
mov ecx, dword [ebp + 0xc]
call fcn.004d02f4
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004d03c8
mov dword [ebp + 0xc], 0x10
mov esi, dword [ebp + 8]
jmp 0x4d0dc7
mov esi, ebx
xor ecx, ecx
lea eax, [ebp - 0xa0]
lea edx, [ebp - 0xe0]
lea ebx, [ecx + 1]
cmp ebx, dword [ebp + 0xc]
jg 0x4d0df0
movzx ebx, byte [esi]
xor bl, 0x36
mov byte [eax], bl
movzx ebx, byte [esi]
xor bl, 0x5c
mov byte [edx], bl
inc esi
jmp 0x4d0df6
mov byte [eax], 0x36
mov byte [edx], 0x5c
inc ecx
inc edx
inc eax
cmp ecx, 0x40
jne 0x4d0dd5
lea eax, [ebp - 0x60]
call fcn.004d02cc
lea edx, [ebp - 0xa0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.004d02f4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x60]
mov ecx, dword [ebp - 8]
call fcn.004d0c68
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004d03c8
lea eax, [ebp - 0x60]
call fcn.004d02cc
lea edx, [ebp - 0xe0]
lea eax, [ebp - 0x60]
mov ecx, 0x40
call fcn.004d02f4
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x60]
mov ecx, 0x10
call fcn.004d02f4
lea edx, [ebp - 0x60]
mov eax, dword [ebp + 8]
call fcn.004d03c8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4d89e4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406234
xor eax, eax
push ebp
push 0x4d8aa2
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x4d8a84
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004086b4
mov eax, dword [ebp - 8]
test eax, eax
je 0x4d8a2c
sub eax, 4
mov eax, dword [eax]
mov esi, eax
lea eax, [esi + 4]
mov dword [edi], eax
mov eax, dword [edi]
push eax
call fcn.00408578
pop ecx
mov dword [ebx], eax
mov ebx, dword [ebx]
mov eax, edi
mov edx, ebx
mov ecx, 4
call fcn.0040322c
add ebx, 4
lea eax, [ebp - 8]
call fcn.00405d34
mov ecx, esi
mov edx, ebx
call fcn.0040322c
mov ecx, esi
dec ecx
test ecx, ecx
jl 0x4d8a84
inc ecx
xor esi, esi
mov eax, esi
mov edi, 0x16
cdq
idiv edi
movzx eax, byte [edx + 0x552564]
xor byte [ebx], al
inc ebx
inc esi
dec ecx
jne 0x4d8a6c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d8aa9
lea eax, [ebp - 8]
call fcn.004054fc
lea eax, [ebp - 4]
call fcn.0040623c
ret