joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48d804
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x48], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x10]
mov edx, dword [0x418940]
call fcn.00404fc8
xor eax, eax
push ebp
push 0x48d948
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4eb260], 0
jne 0x48d857
mov ecx, dword [0x4f2878]
mov dl, 1
mov eax, dword [0x407dc8]
call fcn.0040d510
call fcn.00403c18
lea eax, [ebp - 0x20]
xor ecx, ecx
mov edx, 0x10
call fcn.00402dec
mov eax, ebx
call fcn.00404bf0
mov dword [ebp - 0x1c], eax
push esi
push edi
mov esi, 0x48d958
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0xc]
call fcn.00406084
xor eax, eax
mov dword [ebp - 8], eax
mov eax, ebx
call fcn.00404c00
test eax, eax
jle 0x48d8ef
mov dword [ebp - 4], 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x48d8e8
lea eax, [ebp - 0x44]
mov edx, ebx
call fcn.00404534
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
lea edx, [ebp - 0x40]
mov ecx, 0x10
call fcn.0040451c
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00408d4c
test eax, eax
jne 0x48d8e8
mov ebx, 0x15
jmp 0x48d8f4
mov ebx, 0x10
jmp 0x48d8f4
mov ebx, 0x15
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0x20]
push eax
push ebx
push 0
push esi
call dword [0x4eb260]
call fcn.0048d75c
mov eax, dword [ebp - 8]
call fcn.0048d75c
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.0040609c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48d94f
lea eax, [ebp - 0x48]
mov edx, 2
call fcn.004042c0
lea eax, [ebp - 0x10]
mov edx, dword [0x418940]
call fcn.00405098
ret

Function at 0x48f418
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
mov edi, eax
xor esi, esi
mov eax, ebx
call fcn.004076e8
cmp ax, 0xffff
jne 0x48f439
neg ebx
mov eax, ebx
shr eax, 4
and eax, 0xffff
inc eax
and ebx, 0xf
mov dword [ebp - 8], ebx
push 6
push eax
push edi
call sub.kernel32.dll_FindResourceA
test eax, eax
je 0x48f4ba
push eax
push edi
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x48f4ba
push eax
call sub.kernel32.dll_LockResource
mov ebx, eax
mov eax, dword [ebp - 8]
dec eax
test eax, eax
jl 0x48f480
inc eax
movzx edx, word [ebx]
add edx, edx
add ebx, edx
add ebx, 2
dec eax
jne 0x48f473
movzx esi, word [ebx]
add ebx, 2
cmp dword [ebp - 4], 0
je 0x48f4ba
cmp dword [ebp + 8], 0
jle 0x48f4ba
mov eax, dword [ebp + 8]
dec eax
mov edx, esi
call fcn.0042fa50
mov esi, eax
test esi, esi
jle 0x48f4b1
mov ecx, esi
add ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004076fc
mov eax, dword [ebp - 4]
mov word [eax + esi*2], 0
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x49010c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x490170
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040451c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.004094d0
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490177
lea eax, [ebp - 0xc]
call fcn.0040429c
ret

Function at 0x4901cc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffec
mov esi, edx
lea edi, [esp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, dword [esp + 8]
test ebx, ebx
je 0x490228
push esp
push 0x40
push 6
push ebx
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x4901f7
call fcn.0040ea98
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
mov ecx, 6
call fcn.00402990
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push 6
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
jne 0x490228
call fcn.0040ea98
add esp, 0x14
pop edi
pop esi
pop ebx
ret

Function at 0x4991e4
Capabilities:
Set global application hook

Disassembly:
mov eax, dword [0x4f2d98]
cmp dword [eax], 2
je 0x499202
mov ecx, 0x304
mov edx, 0x499234
mov eax, 0x499270
call fcn.004041f8
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
push 0x499184
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x4f3fe4], eax
cmp dword [0x4f3fe4], 0
jne 0x499229
call fcn.0040ea98
ret

Function at 0x4995cc
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, dword [0x4f290c]
cmp byte [eax], 0
jne 0x4995fa
mov ecx, 0xad
mov edx, 0x499648
mov eax, 0x499684
call fcn.004041f8
mov eax, ebx
call fcn.004049b8
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyW
shl eax, 0x10
test eax, eax
je 0x499639
push 0x200
lea edx, [ebp - 0x202]
push edx
push eax
call sub.user32.dll_GetKeyNameTextW
mov eax, ebx
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00404b58
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x499698
Capabilities:
Log keystrokes

Disassembly:
push ebx
mov ebx, eax
mov eax, dword [0x4f290c]
cmp byte [eax], 0
jne 0x4996b9
mov ecx, 0xb9
mov edx, 0x4996d0
mov eax, 0x49970c
call fcn.004041f8
push 2
movzx eax, bx
push eax
call sub.user32.dll_MapVirtualKeyW
pop ebx
ret
Function at 0x4afcb8
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4afd41
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4f40c4
push 0x101
call sub.wsock32.dll_WSAStartup
mov ebx, eax
test ebx, ebx
je 0x4afd2b
lea edx, [ebp - 0x1c]
mov eax, ebx
call fcn.0040cc1c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0xb
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
mov eax, 0x4afd58
mov dword [ebp - 8], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x18]
push eax
push 2
mov ecx, dword [0x4f2c70]
mov dl, 1
mov eax, dword [0x4af4bc]
call fcn.0040d54c
call fcn.00403c18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afd48
lea eax, [ebp - 0x1c]
call fcn.0040429c
ret

Function at 0x4b03f4
Capabilities:
Connect socket

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, ebx
call fcn.004b0318
mov cl, 1
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403648
push 0x10
lea eax, [ebx + 0x18]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.wsock32.dll_connect
mov edx, 0x4b0458
call fcn.004afc00
mov byte [ebx + 0x29], 0
test byte [ebx + 0x28], 0x10
jne 0x4b044a
cmp dword [ebx + 4], 0xffffffff
setne al
mov byte [ebx + 8], al
mov cl, 2
mov edx, ebx
mov eax, ebx
mov si, 0xffff
call fcn.00403648
pop esi
pop ebx
ret

Function at 0x4b047c
Capabilities:
Resolve dns

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, edx
mov eax, ebx
call fcn.0040476c
push eax
call sub.wsock32.dll_gethostbyname
mov ebx, eax
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 4
call fcn.00402dec
test ebx, ebx
je 0x4b04c7
mov eax, ebx
mov edx, dword [eax + 0xc]
mov edx, dword [edx]
mov cl, byte [edx]
mov byte [esp + 4], cl
mov cl, byte [edx + 1]
mov byte [esp + 5], cl
mov cl, byte [edx + 2]
mov byte [esp + 6], cl
mov al, byte [edx + 3]
mov byte [esp + 7], al
mov eax, dword [esp + 4]
mov dword [esp], eax
mov eax, dword [esp]
pop ecx
pop edx
pop ebx
ret
Function at 0x4b05a4
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4b05d5
mov ecx, dword [0x4f2b70]
mov dl, 1
mov eax, dword [0x4af4bc]
call fcn.0040d510
call fcn.00403c18
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 4], ebx
inc ebx
jne 0x4b0602
mov ecx, dword [0x4f2ae8]
mov dl, 1
mov eax, dword [0x4af4bc]
call fcn.0040d510
call fcn.00403c18
xor eax, eax
push ebp
push 0x4b067e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xffff
call fcn.00403648
cmp byte [ebp + 8], 0
je 0x4b065a
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004b050c
mov eax, dword [ebp - 4]
lea esi, [ebp - 0x18]
lea edi, [eax + 0x18]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.004b03f4
jmp 0x4b0674
mov eax, dword [ebp + 0x10]
push eax
mov ax, word [ebp + 0xc]
push eax
push 0
push 1
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004afeec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4b069b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4b0860
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004b01b4
xor eax, eax
push ebp
push 0x4b09d1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4b09bb
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0xffffffff
je 0x4b08ab
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4b08b5
call fcn.00403cc4
jmp 0x4b09d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041e4c0
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x1010]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov ecx, 0x1000
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
jle 0x4b09b0
push 0
push ebx
lea eax, [ebp - 0x1010]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x4b0963
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2733
je 0x4b0950
lea eax, [ebp - 0x10]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403648
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
push ebp
call fcn.004b0818
pop ecx
mov eax, dword [ebp - 4]
mov dl, byte [0x4b09e4]
cmp dl, byte [eax + 0x28]
je 0x4b09b7
call fcn.0040d428
jmp 0x4b09b7
mov eax, dword [ebp - 0xc]
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041e4e0
jmp 0x4b09b7
cmp ecx, ebx
jge 0x4b097f
mov eax, dword [ebp - 0xc]
add eax, ecx
cdq
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041e4e0
jmp 0x4b08b5
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [eax]
call dword [edx]
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
call fcn.0041e4c0
cmp edx, dword [esp + 4]
jne 0x4b099f
cmp eax, dword [esp]
pop edx
pop eax
jne 0x4b08b5
push ebp
call fcn.004b0818
pop ecx
jmp 0x4b09b7
push ebp
call fcn.004b0818
pop ecx
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b09d8
mov eax, dword [ebp - 4]
call fcn.004b01c0
ret
mov al, byte [ebp - 5]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b09e8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b0b0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004b01b4
xor eax, eax
push ebp
push 0x4b0aed
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4b0a38
call fcn.00403cc4
jmp 0x4b0af4
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4b0ad7
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4b0ad7
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403648
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4b0ad7
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040cc1c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4b0b24
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4f2c70]
mov dl, 1
mov eax, dword [0x4af4bc]
call fcn.0040d54c
call fcn.00403c18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0af4
mov eax, dword [ebp - 4]
call fcn.004b01c0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0b11
lea eax, [ebp - 0x28]
call fcn.0040429c
ret
Function at 0x4b0b70
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4b0cba
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004b01b4
xor eax, eax
push ebp
push 0x4b0c9d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x4b0bd5
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x4b0bd5
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x4b0c87
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x4b0be8
call fcn.00403cc4
jmp 0x4b0ca4
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x4b0c87
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x4b0c87
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00403648
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x4b0c87
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.0040cc1c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0xb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0
mov eax, 0x4b0cd4
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x24]
push eax
push 2
mov ecx, dword [0x4f2c70]
mov dl, 1
mov eax, dword [0x4af4bc]
call fcn.0040d54c
call fcn.00403c18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0ca4
mov eax, dword [ebp - 4]
call fcn.004b01c0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0cc1
lea eax, [ebp - 0x28]
call fcn.0040429c
ret
Function at 0x4b2580
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x4b261e
xor edx, edx
mov dl, byte [esi + ebx]
shr edx, 2
mov dl, byte [edx + 0x4eb40c]
mov byte [ebp + edi], dl
mov dl, byte [esi + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
xor ecx, ecx
mov cl, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
mov dl, byte [edx + 0x4eb40c]
push edx
pop edx
mov byte [ebp + edi + 1], dl
mov dl, byte [esi + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
xor ecx, ecx
mov cl, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
mov dl, byte [edx + 0x4eb40c]
push edx
pop edx
mov byte [ebp + edi + 2], dl
mov dl, byte [esi + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edx + 0x4eb40c]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x4b259f
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x4b2634
dec edx
je 0x4b2669
jmp 0x4b26ba
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x4eb40c]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [eax + 0x4eb40c]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x4b26ba
xor eax, eax
mov al, byte [esi + ebx]
shr eax, 2
mov al, byte [eax + 0x4eb40c]
mov byte [ebp + edi], al
mov al, byte [esi + ebx]
and al, 3
and eax, 0xff
shl eax, 4
xor edx, edx
mov dl, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [eax + 0x4eb40c]
mov byte [ebp + edi + 1], al
mov al, byte [esi + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [eax + 0x4eb40c]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4b271c
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ecx, ecx
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x4b273b
add edx, 3
sar edx, 2
test edx, edx
jle 0x4b286c
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
xor ebx, ebx
mov bl, byte [edi + esi]
cmp ebx, 0x3d
jg 0x4b2771
je 0x4b27b1
sub ebx, 0x2b
je 0x4b27a7
sub ebx, 4
je 0x4b27ac
dec ebx
sub ebx, 0xa
jb 0x4b279a
jmp 0x4b27b4
add ebx, 0xffffffbf
sub ebx, 0x1a
jb 0x4b2783
add ebx, 0xfffffffa
sub ebx, 0x1a
jb 0x4b278d
jmp 0x4b27b4
mov bl, byte [edi + esi]
sub bl, 0x41
mov byte [eax], bl
jmp 0x4b27b4
mov bl, byte [edi + esi]
sub bl, 0x61
add bl, 0x1a
mov byte [eax], bl
jmp 0x4b27b4
mov bl, byte [edi + esi]
sub bl, 0x30
add bl, 0x34
mov byte [eax], bl
jmp 0x4b27b4
mov byte [eax], 0x3e
jmp 0x4b27b4
mov byte [eax], 0x3f
jmp 0x4b27b4
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4b2753
xor eax, eax
mov al, byte [esp + 4]
shl eax, 2
and eax, 0xff
mov edx, dword [esp + 8]
xor ebx, ebx
mov bl, byte [esp + 5]
shr ebx, 4
or al, bl
mov byte [edx + ecx], al
lea eax, [ecx + 1]
mov dl, byte [esp + 6]
cmp dl, 0xff
je 0x4b2817
cmp byte [esp + 7], 0xff
jne 0x4b2817
xor eax, eax
mov al, byte [esp + 5]
shl eax, 4
and eax, 0xff
mov ebx, dword [esp + 8]
lea ebx, [ebx + ecx + 1]
push ebx
and edx, 0xff
shr edx, 2
or al, dl
pop edx
mov byte [edx], al
lea eax, [ecx + 2]
inc ecx
jmp 0x4b2861
cmp dl, 0xff
je 0x4b2861
xor eax, eax
mov al, byte [esp + 5]
shl eax, 4
and eax, 0xff
and edx, 0xff
shr edx, 2
mov ebx, dword [esp + 8]
lea ebx, [ebx + ecx + 1]
push ebx
or al, dl
pop edx
mov byte [edx], al
xor eax, eax
mov al, byte [esp + 6]
shl eax, 6
and eax, 0xff
mov edx, dword [esp + 8]
or al, byte [esp + 7]
mov byte [edx + ecx + 2], al
lea eax, [ecx + 3]
add ecx, 2
inc ecx
dec dword [esp + 0xc]
jne 0x4b274a
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x4b49f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x4b4a1a
mov ecx, 0x4b4a78
mov dl, 1
mov eax, dword [0x4b4058]
call fcn.0040d454
call fcn.00403c18
mov dword [ebp - 8], edx
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
test eax, eax
jle 0x4b4a67
mov dword [ebp - 0xc], eax
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebp - 8]
mov al, byte [eax]
mov edx, dword [ebx + 0x40]
xor al, byte [edx]
mov byte [esi], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.00402990
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
mov dl, byte [esi]
mov byte [eax], dl
inc dword [ebp - 8]
inc esi
dec dword [ebp - 0xc]
jne 0x4b4a2a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4b4a90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x4b4aba
mov ecx, 0x4b4b20
mov dl, 1
mov eax, dword [0x4b4058]
call fcn.0040d454
call fcn.00403c18
mov esi, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x4b4b0f
mov dword [ebp - 0x10], eax
mov al, byte [esi]
mov byte [ebp - 9], al
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebx + 0x40]
mov al, byte [eax]
xor al, byte [esi]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.00402990
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
mov dl, byte [ebp - 9]
mov byte [eax], dl
inc esi
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x4b4acc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4b50d8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4b515a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x4b437c]
mov eax, 0x14
call fcn.00405404
mov edi, eax
mov dword [edi + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00408ba8
mov edx, dword [ebp - 4]
lea eax, [edi + 4]
call fcn.004042f0
mov eax, esi
call dword [eax + 0x30]
mov dword [edi + 8], eax
mov eax, dword [0x4f4270]
mov dword [edi], eax
mov byte [edi + 0x10], bl
mov dword [0x4f4270], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b5161
lea eax, [ebp - 8]
mov edx, 2
call fcn.004042c0
ret