joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f5f0
Capabilities:
Create service
Persist via windows service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404144
mov eax, dword [ebp - 8]
call fcn.00404144
mov eax, dword [ebp - 0xc]
call fcn.00404144
mov eax, dword [ebp + 8]
call fcn.00404144
xor eax, eax
push ebp
push 0x40f779
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
or ecx, 0xffffffff
mov edx, 4
mov eax, dword [ebp - 4]
call fcn.0040fa38
test eax, eax
je 0x40f74e
xor eax, eax
mov dword [ebp - 0x10], eax
push 0xf003f
push 0
push 0x40f78c
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x14], eax
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404154
push eax
push 0
push 2
push 0x20
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.00404154
push eax
mov eax, dword [ebp - 4]
call fcn.00404154
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CreateServiceA
mov dword [ebp - 0x18], eax
mov eax, dword [0x41e0b4]
cmp dword [eax], 0
je 0x40f73a
lea eax, [ebp - 0x20]
push eax
mov ecx, 0x400
mov edx, 1
mov eax, dword [ebp + 8]
call fcn.004041b4
mov eax, 4
call fcn.0040286c
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
call fcn.00403f54
inc eax
call fcn.0040286c
mov ebx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], ebx
xor eax, eax
push ebp
push 0x40f733
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
mov edx, dword [ebp - 0x20]
call fcn.004055d0
mov eax, dword [ebp - 0x1c]
push eax
push 1
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [0x41e0b4]
mov eax, dword [eax]
call eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f73a
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
call fcn.0040289c
mov eax, dword [ebp - 0x1c]
call fcn.0040289c
ret
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f780
lea eax, [ebp - 0x20]
call fcn.00403dac
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403dd0
lea eax, [ebp + 8]
call fcn.00403dac
ret
Function at 0x40fa38
Capabilities:
Check for time delay via gettickcount
Delete service
Modify service
Query service status
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404144
xor eax, eax
push ebp
push 0x40fbcc
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov ebx, eax
test ebx, ebx
je 0x40fbb6
push 0xf01ff
mov eax, dword [ebp - 4]
call fcn.00404154
push eax
push ebx
call sub.advapi32.dll_OpenServiceA
mov esi, eax
test esi, esi
jne 0x40faa2
push ebx
call sub.advapi32.dll_CloseServiceHandle
or edi, 0xffffffff
jmp 0x40fbb6
mov eax, dword [ebp - 8]
cmp eax, 5
ja case.0x40faae.0
jmp dword [eax*4 + 0x40fab5]
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceA
mov edi, eax
jmp case.0x40faae.0
lea eax, [ebp - 0x2c]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
mov edi, eax
jmp case.0x40faae.0
lea eax, [ebp - 0x2c]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
mov edi, eax
test edi, edi
jne 0x40fb1b
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
jmp 0x40fbb6
lea eax, [ebp - 0x10]
push eax
push 0
push esi
call sub.advapi32.dll_StartServiceA
mov edi, eax
jmp case.0x40faae.0
lea eax, [ebp - 0x2c]
push eax
push 1
push esi
call sub.advapi32.dll_ControlService
test eax, eax
je case.0x40faae.0
call sub.kernel32.dll_GetTickCount
mov edi, eax
jmp 0x40fb62
cmp dword [ebp - 0x28], 1
je 0x40fb70
push 0x3e8
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount
sub eax, edi
cmp eax, 0x1d4c0
ja 0x40fb70
lea eax, [ebp - 0x2c]
push eax
push esi
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x40fb44
call sub.kernel32.dll_GetTickCount
sub eax, edi
cmp eax, 0x1d4c0
jbe 0x40fb82
xor edi, edi
jmp case.0x40faae.0
push esi
call sub.advapi32.dll_DeleteService
mov edi, eax
jmp case.0x40faae.0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
mov eax, dword [ebp - 0xc]
push eax
push 0xffffffffffffffff
push esi
call sub.advapi32.dll_ChangeServiceConfigA
mov edi, eax
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fbd3
lea eax, [ebp - 4]
call fcn.00403dac
ret

Function at 0x40ff80
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404144
xor eax, eax
push ebp
push 0x40fff1
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [0x420524], 0
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004059c8
mov edx, dword [ebp - 8]
mov eax, 0x420528
call fcn.00403e00
push 0
push 0x40febc
call sub.user32.dll_EnumWindows
mov bl, byte [0x420524]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fff8
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403dd0
ret
Function at 0x410008
Capabilities:
Acquire debug privileges

Disassembly:
mov dl, 1
mov eax, 0x410020
call fcn.00410034
ret

Function at 0x410214
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404144
xor eax, eax
push ebp
push 0x410271
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00410008
mov eax, dword [ebp - 4]
call fcn.00405738
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410278
lea eax, [ebp - 4]
call fcn.00403dac
ret

Function at 0x4103d8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x41044c
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x410445
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x41041c
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.00403edc
jmp 0x410423
mov eax, ebx
call fcn.00403dac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41044c
cmp dword [ebp - 4], 0
je 0x41043f
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_CloseClipboard
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x410450
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404144
xor eax, eax
push ebp
push 0x41056e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, dword [ebp - 4]
call fcn.00403f54
mov ebx, eax
inc ebx
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x410558
xor eax, eax
push ebp
push 0x410551
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_EmptyClipboard
push ebx
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x410522
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x410511
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404154
mov edx, dword [ebp - 0x10]
mov ecx, ebx
call fcn.00402a14
mov eax, dword [ebp - 0xc]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410518
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GlobalUnlock
mov byte [ebp - 5], 1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410575
lea eax, [ebp - 4]
call fcn.00403dac
ret
Function at 0x4109d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff50
push ebx
xor edx, edx
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0xa8], edx
mov dword [ebp - 0xac], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x410bb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403dac
lea eax, [ebp - 0xa4]
mov dword [ebp - 4], eax
mov edx, 0x9c
mov eax, dword [ebp - 4]
call fcn.00405394
mov dword [ebp - 0xa4], 0x9c
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetVersionExA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x410a53
mov dword [ebp - 0xa4], 0x94
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x410b99
mov eax, dword [ebp - 0x94]
dec eax
je 0x410b3f
dec eax
jne 0x410b99
lea eax, [ebp - 0xa8]
lea edx, [ebp - 0x90]
mov ecx, 0x80
call fcn.00403f18
push dword [ebp - 0xa8]
push 0x410bcc
lea edx, [ebp - 0xac]
mov eax, dword [ebp - 0x98]
call fcn.00405a64
push dword [ebp - 0xac]
push 0x410be0
mov eax, ebx
mov edx, 4
call fcn.00404014
mov dl, 1
mov eax, dword [0x40cfe0]
call fcn.0040d05c
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x410b38
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0040d0e8
xor ecx, ecx
mov edx, 0x410bec
mov eax, dword [ebp - 8]
call fcn.0040d204
push dword [ebx]
push 0x410c24
lea ecx, [ebp - 0xb0]
mov edx, 0x410c34
mov eax, dword [ebp - 8]
call fcn.0040d7d0
push dword [ebp - 0xb0]
push 0x410c48
mov eax, ebx
mov edx, 4
call fcn.00404014
mov eax, dword [ebp - 8]
call fcn.0040d0c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410b99
mov eax, dword [ebp - 8]
call fcn.00403368
ret
mov eax, ebx
call fcn.00403dac
cmp dword [ebp - 0xa0], 4
jne 0x410b72
cmp dword [ebp - 0x9c], 0
jne 0x410b72
mov al, byte [ebp - 0x8f]
cmp al, 0x43
je 0x410b66
cmp al, 0x42
jne 0x410b72
mov eax, ebx
mov edx, 0x410c54
call fcn.00403e00
cmp dword [ebp - 0xa0], 4
jne 0x410b99
cmp dword [ebp - 0x9c], 0xa
jne 0x410b99
cmp byte [ebp - 0x8f], 0x41
jne 0x410b99
mov eax, ebx
mov edx, 0x410c64
call fcn.00403e00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410bbe
lea eax, [ebp - 0xb0]
mov edx, 3
call fcn.00403dd0
ret
Function at 0x41141c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov eax, 0x411494
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov eax, ebx
call fcn.00403dac
xor eax, eax
push ebp
push 0x411485
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040286c
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x41146f
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00403edc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41148c
mov eax, dword [ebp - 4]
call fcn.0040289c
ret

Function at 0x411498
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
mov eax, 0x411514
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x10
mov eax, ebx
call fcn.00403dac
xor eax, eax
push ebp
push 0x411506
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040286c
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x4114eb
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.00403edc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41150d
mov eax, dword [ebp - 4]
call fcn.0040289c
xor eax, eax
mov dword [ebp - 4], eax
ret

Function at 0x41199c
Capabilities:
Set socket configuration

Disassembly:
push ebx
add esp, 0xfffffff8
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebx, eax
push 4
lea eax, [esp + 4]
push eax
push 0x1005
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
push 4
lea eax, [esp + 4]
push eax
push 0x1006
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
push 4
lea eax, [esp + 8]
push eax
push 0x1002
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
push 4
lea eax, [esp + 8]
push eax
push 0x1001
push 0xffff
push ebx
call sub.wsock32.dll_setsockopt
pop ecx
pop edx
pop ebx
ret

Function at 0x411a90
Capabilities:
Get socket status

Disassembly:
push esi
push edi
add esp, 0xfffffef4
mov esi, ecx
lea edi, [esp]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 8], 1
mov dword [esp + 0xc], eax
test dl, dl
je 0x411ac2
push esp
push 0
push 0
lea eax, [esp + 0x14]
push eax
push 0
call sub.wsock32.dll_select
jmp 0x411ad3
push esp
push 0
lea eax, [esp + 0x10]
push eax
push 0
push 0
call sub.wsock32.dll_select
add esp, 0x10c
pop edi
pop esi
ret
Function at 0x411bc4
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404144
xor eax, eax
push ebp
push 0x411cbf
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov byte [edi + 5], 0
lea eax, [edi + 0x2c]
xor ecx, ecx
mov edx, 0x10
call fcn.00402f54
mov word [edi + 0x2c], 2
push esi
call sub.wsock32.dll_htons
mov word [edi + 0x2e], ax
mov eax, dword [ebp - 4]
call fcn.00404154
push eax
call sub.wsock32.dll_inet_addr
mov esi, eax
mov dword [edi + 0x30], esi
inc esi
jne 0x411c49
mov eax, dword [ebp - 4]
call fcn.00404154
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x411ca9
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [edi + 0x30], eax
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [edi + 0x3c], esi
cmp esi, 0xffffffff
je 0x411ca9
push 0x10
lea eax, [edi + 0x2c]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x411ca1
mov ax, word [edi + 0x2e]
push eax
call sub.wsock32.dll_ntohs
movzx eax, ax
mov dword [edi + 0x24], eax
push dword [edi + 0x30]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [edi + 0x28]
call fcn.00403edc
mov edx, dword [edi + 0x3c]
mov eax, edi
call fcn.00411bac
mov bl, 1
mov byte [edi + 5], 1
jmp 0x411ca9
lea eax, [edi + 0x3c]
call fcn.00411a0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411cc6
lea eax, [ebp - 4]
call fcn.00403dac
ret

Function at 0x411cd0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov ebx, eax
xor eax, eax
cmp dword [ebx + 0x3c], 0xffffffff
je 0x411d56
cmp edi, 1
jl 0x411d56
mov esi, edi
mov dword [esp], edx
mov eax, ebx
call fcn.00412538
test al, al
je 0x411d42
push 0
mov edx, dword [ebx + 0x1c]
mov eax, esi
call fcn.00405490
push eax
mov eax, dword [esp + 8]
push eax
mov eax, dword [ebx + 0x3c]
push eax
call sub.wsock32.dll_send
cmp eax, 0xffffffff
jne 0x411d35
call sub.wsock32.dll_WSAGetLastError
cmp eax, 0x2733
jne 0x411d2a
push 1
call sub.kernel32.dll_Sleep_1
jmp 0x411d42
xor edx, edx
mov eax, ebx
call fcn.00412500
jmp 0x411d42
test eax, eax
jle 0x411d3b
sub esi, eax
test esi, esi
jle 0x411d42
add dword [esp], eax
test esi, esi
je 0x411d52
cmp byte [ebx + 5], 0
je 0x411d52
cmp dword [ebx + 0x3c], 0xffffffff
jne 0x411cea
mov eax, edi
sub eax, esi
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x41246c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
mov eax, edi
call fcn.00403dac
mov eax, dword [ebx + 0x3c]
cmp eax, 0xffffffff
je 0x4124be
push 2
xor edx, edx
mov dl, byte [0x41d7ec]
push edx
mov edx, dword [ebx + 0xc]
push edx
push eax
call sub.wsock32.dll_recv
mov esi, eax
cmp esi, 0xffffffff
je 0x4124be
test esi, esi
jle 0x4124be
mov eax, edi
mov edx, esi
call fcn.00404284
mov eax, edi
call fcn.004041ac
mov edx, eax
mov eax, dword [ebx + 0xc]
mov ecx, esi
call fcn.00402a14
pop edi
pop esi
pop ebx
ret

Function at 0x4124c4
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, dword [esi + 0x3c]
cmp eax, 0xffffffff
je 0x4124f8
push 2
push 1
mov edx, dword [esi + 0xc]
push edx
push eax
call sub.wsock32.dll_recv
sub eax, 0xffffffff
je 0x4124f8
dec eax
jne 0x4124f3
xor edx, edx
mov eax, esi
call fcn.00412500
jmp 0x4124f8
mov eax, dword [esi + 0xc]
mov bl, byte [eax]
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4125bc
Capabilities:
Encode data using base64
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov edi, 0x41d7f0
lea ecx, [esp + 8]
mov dword [ecx], eax
mov eax, dword [esp]
mov dword [esp + 0xc], eax
xor ebx, ebx
xor esi, esi
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
test eax, eax
jle 0x412680
mov edx, dword [ecx]
movzx edx, byte [edx + ebx]
shr edx, 2
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx]
and dl, 3
and edx, 0xff
shl edx, 4
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 1]
shr ebp, 4
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 1], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 1]
and dl, 0xf
and edx, 0xff
shl edx, 2
mov ebp, dword [ecx]
movzx ebp, byte [ebp + ebx + 2]
shr ebp, 6
add edx, ebp
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 2], dl
mov edx, dword [ecx]
mov dl, byte [edx + ebx + 2]
and dl, 0x3f
and edx, 0xff
mov dl, byte [edi + edx]
mov ebp, dword [esp + 0xc]
mov byte [ebp + esi + 3], dl
add esi, 4
add ebx, 3
dec eax
jne 0x4125f4
mov eax, dword [esp + 4]
mov ebp, 3
cdq
idiv ebp
dec edx
je 0x412697
dec edx
je 0x4126d8
jmp 0x412735
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 2], 0x3d
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
jmp 0x412735
mov eax, dword [ecx]
movzx eax, byte [eax + ebx]
shr eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi], al
mov eax, dword [ecx]
mov al, byte [eax + ebx]
and al, 3
and eax, 0xff
shl eax, 4
mov edx, dword [ecx]
movzx edx, byte [edx + ebx + 1]
shr edx, 4
add eax, edx
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 1], al
mov eax, dword [ecx]
mov al, byte [eax + ebx + 1]
and al, 0xf
and eax, 0xff
shl eax, 2
mov al, byte [edi + eax]
mov edx, dword [esp + 0xc]
mov byte [edx + esi + 2], al
mov eax, dword [esp + 0xc]
mov byte [eax + esi + 3], 0x3d
mov eax, dword [esp + 4]
add eax, 2
mov ecx, 3
cdq
idiv ecx
shl eax, 2
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x412798
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp + 4], eax
mov dword [esp + 8], edx
xor esi, esi
xor edi, edi
xor eax, eax
mov ebp, ecx
test ebp, ebp
jns 0x4127b5
add ebp, 3
sar ebp, 2
test ebp, ebp
jle 0x4128c7
mov edx, 4
mov eax, esp
mov ecx, dword [esp + 4]
movzx ecx, byte [ecx + esi]
cmp ecx, 0x3d
jg 0x4127e8
je 0x412834
sub ecx, 0x2b
je 0x41282a
sub ecx, 4
je 0x41282f
dec ecx
sub ecx, 0xa
jb 0x412819
jmp 0x412837
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x4127fa
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x412808
jmp 0x412837
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x412837
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x412837
mov ecx, dword [esp + 4]
mov cl, byte [ecx + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x412837
mov byte [eax], 0x3e
jmp 0x412837
mov byte [eax], 0x3f
jmp 0x412837
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x4127c7
mov al, byte [esp]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 1]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi], al
lea eax, [edi + 1]
mov dl, byte [esp + 2]
cmp dl, 0xff
je 0x412887
cmp byte [esp + 3], 0xff
jne 0x412887
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
lea eax, [edi + 2]
inc edi
jmp 0x4128bf
cmp dl, 0xff
je 0x4128bf
mov al, byte [esp + 1]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + edi + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 2]
shl edx, 6
or dl, byte [esp + 3]
mov byte [eax + edi + 2], dl
lea eax, [edi + 3]
add edi, 2
inc edi
dec ebp
jne 0x4127c0
add esp, 0xc
pop ebp
pop edi
pop esi
ret

Function at 0x412c5c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x412cad
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x412c94
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x412c84
jmp 0x412cad
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x412c95
pop ebx
mov esp, ebp
pop ebp
ret