joyce8/EMBER2024-capa huggingface dataset:
Function at 0x560ad8
Capabilities:
Get file system object information

Disassembly:
push 0x6f8
mov eax, 0x59767e
call fcn.00569fe9
mov ebx, ecx
mov ecx, dword [ebp + 0x14]
xor esi, esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x700], edi
test ecx, ecx
je 0x560c69
mov eax, dword [ebp + 0x10]
sub eax, esi
je 0x560c3b
sub eax, 1
je 0x560b57
sub eax, 1
je 0x560b2f
sub eax, 1
je 0x560b57
push 0x5d43e4
mov ecx, edi
call fcn.0040a2e0
mov eax, edi
call fcn.00569f98
ret 0x10
push 0x408
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push esi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x560b19
lea eax, [ebp - 0x4e8]
push eax
jmp 0x560b1e
lea eax, [ebp - 0x218]
push eax
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x560b19
push esi
lea eax, [ebp - 0x448]
mov dword [ebp - 0x448], esi
push eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x444], esi
push eax
mov dword [ebp - 0x440], esi
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x434], esi
call fcn.0053b9b7
test eax, eax
je 0x560b19
lea ecx, [ebp - 0x700]
call fcn.004036d0
cmp dword [ebp + 0x10], 1
mov dword [ebp - 4], esi
jne 0x560bf1
test byte [ebp - 0x428], 0x18
jne 0x560c13
mov eax, dword [ebx]
lea ecx, [ebp - 0x700]
push ecx
push dword [ebp - 0x42c]
mov esi, dword [eax + 0x1a0]
mov ecx, esi
push dword [ebp - 0x430]
call dword [0x5999dc]
mov ecx, ebx
call esi
jmp 0x560c13
mov eax, dword [ebx]
lea ecx, [ebp - 0x700]
push ecx
lea ecx, [ebp - 0x440]
push ecx
mov esi, dword [eax + 0x1a4]
mov ecx, esi
call dword [0x5999dc]
mov ecx, ebx
call esi
mov eax, dword [ebp - 0x700]
add eax, 0xfffffff0
push eax
call fcn.0040b08e
pop ecx
mov ecx, dword [ebp - 0x700]
add eax, 0x10
mov dword [edi], eax
lea ecx, [ecx - 0x10]
call fcn.00403db0
jmp 0x560b25
push 0x208
push 0x2b4
lea eax, [ebp - 0x6fc]
push eax
push esi
push dword [ecx + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x560b19
lea eax, [ebp - 0x6f0]
jmp 0x560b54
call fcn.0044a0ce
int3

Function at 0x560de1
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.00568f05
call fcn.00439e31
cmp dword [eax + 0x14], 0
jne 0x560dfc
mov ecx, esi
pop esi
jmp fcn.005600fa
pop esi
ret

Function at 0x564e02
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x5f4ff0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2bc], esi
test eax, eax
je 0x564e6c
push 0x208
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
push 0
push dword [eax + 4]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, esi
test eax, eax
je 0x564e51
lea eax, [ebp - 0x2ac]
push eax
jmp 0x564e56
push 0x5c9a98
call fcn.0040a2e0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00569b0f
leave
ret 8
call fcn.0044a0ce
int3

Function at 0x565351
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00401d20
call fcn.00439e31
cmp dword [eax + 0x14], 0
jne 0x56536c
mov ecx, esi
pop esi
jmp fcn.00564bac
pop esi
ret
Function at 0x56aa98
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x56aad7
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x56aad7
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x56aad7
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x56aad7
cmp dword [ecx + 0x74], 0xe
jbe 0x56aad7
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x5810c6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00580d43

Function at 0x5863e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x58640d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x58640d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402200
Capabilities:
Create directory

Disassembly:
push esi
push ebx
sub esp, 0x44
mov dword [esp + 8], 0
mov dword [esp + 4], 0x44b0c0
mov dword [esp], eax
call fcn.00426d00
mov ebx, eax
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll__stati64]
test eax, eax
jne 0x402256
mov dword [esp + 4], str._rwx
mov dword [esp], ebx
call fcn.004300a0
test eax, eax
jne 0x40229a
mov dword [esp], ebx
call sub.libgcrypt_20.dll_gcry_free
add esp, 0x44
pop ebx
pop esi
ret
mov esi, dword [sym.imp.msvcrt.dll__errno]
call esi
cmp dword [eax], 2
jne 0x402234
mov dword [esp + 4], str._rwx
mov dword [esp], ebx
call fcn.00430080
test eax, eax
jne 0x4022cd
cmp dword [0x45a9a8], 0
jne 0x402234
mov dword [esp], str.directory__s_created_n
call sub.libgpg_error_0.dll__gpg_w32_gettext
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0042d870
jmp 0x402234
call dword [sym.imp.msvcrt.dll__errno]
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp], str.cant_set_permissions_of__s:__s_n
mov esi, eax
call sub.libgpg_error_0.dll__gpg_w32_gettext
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0042d9c0
jmp 0x402248
call esi
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp], str.cant_create_directory__s:__s_n
mov esi, eax
call sub.libgpg_error_0.dll__gpg_w32_gettext
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0042d9c0
jmp 0x402234

Function at 0x402a00
Capabilities:
Delete file

Disassembly:
mov eax, dword [0x45a028]
test eax, eax
je 0x402a10
ret
push ebx
sub esp, 0x18
mov dword [0x45a028], 1
call fcn.00413af0
mov eax, dword [0x45a0d0]
or eax, dword [0x45a0cc]
jne 0x402a90
mov eax, dword [0x45a0c8]
test eax, eax
je 0x402a3e
cmp byte [eax], 0
jne 0x402a95
cmp dword [0x45aa34], 1
jle 0x402a55
mov eax, dword [0x45a0c0]
test eax, eax
je 0x402a55
cmp byte [eax], 0
jne 0x402ad0
cmp dword [0x45aa38], 1
jle 0x402a6c
mov eax, dword [0x45a0b8]
test eax, eax
je 0x402a6c
cmp byte [eax], 0
jne 0x402ab0
mov eax, dword [0x45a0b0]
test eax, eax
je 0x402a90
cmp byte [eax], 0
je 0x402a90
mov ebx, dword [0x45a0ac]
test ebx, ebx
cmove ebx, eax
mov dword [esp], ebx
call fcn.0042ff20
mov byte [ebx], 0
add esp, 0x18
pop ebx
ret
mov ebx, dword [0x45a0c4]
test ebx, ebx
cmove ebx, eax
mov dword [esp], ebx
call fcn.0042ff20
mov byte [ebx], 0
jmp 0x402a3e
mov ebx, dword [0x45a0b4]
test ebx, ebx
cmove ebx, eax
mov dword [esp], ebx
call fcn.0042ff20
mov byte [ebx], 0
jmp 0x402a6c
mov ebx, dword [0x45a0bc]
test ebx, ebx
cmove ebx, eax
mov dword [esp], ebx
call fcn.0042ff20
mov byte [ebx], 0
jmp 0x402a55
Function at 0x4135d0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [0x45a0fc]
mov eax, dword [esp + 4]
test ecx, ecx
je 0x4135f2
mov edx, dword [0x45a0f0]
test edx, edx
je 0x4135f2
mov eax, dword [eax + 0x98]
test eax, eax
jne 0x4135f3
ret
jmp fcn.004134b0
Function at 0x424ff0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esi
mov eax, 0x74
push ebx
sub esp, 0x434
mov esi, dword [esp + 0x444]
mov ebx, dword [esp + 0x440]
mov word [esp + 0x56], ax
mov dword [esp + 0x3c], 0
mov dword [esi], 0
mov eax, ebx
mov dword [esp + 0x40], 0
mov dword [esp + 0x46], 0x49544547
mov dword [esp + 0x4a], 0x204f464e
mov dword [esp + 0x4e], 0x64726163
mov dword [esp + 0x52], 0x73696c5f
call fcn.004230c0
test eax, eax
je 0x425060
add esp, 0x434
pop ebx
pop esi
ret
lea eax, [esp + 0x3c]
mov dword [esp + 0x18], 0x423b30
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x46]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 8]
mov dword [esp], eax
call sub.libassuan_0.dll_assuan_transact
test eax, eax
jne 0x4250d3
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x40]
test ecx, ecx
jne 0x425110
mov dword [esi], edx
mov edx, dword [ebx + 0xc]
mov ecx, dword [edx + 0xc]
cmp ecx, 1
jne 0x425114
mov dword [edx + 0xc], 0
add esp, 0x434
pop ebx
pop esi
ret
mov edx, dword [esp + 0x40]
mov dword [esp], edx
mov dword [esp + 0x2c], eax
call fcn.00427e70
mov edx, dword [ebx + 0xc]
mov eax, dword [esp + 0x2c]
mov ecx, dword [edx + 0xc]
cmp ecx, 1
je 0x4250c3
mov dword [esp + 4], ecx
mov dword [esp], str.unlock_scd:_invalid_lock_count___d__n
mov dword [esp + 0x2c], eax
call fcn.0042d9c0
mov edx, dword [ebx + 0xc]
mov eax, dword [esp + 0x2c]
jmp 0x4250c3
mov eax, ecx
jmp 0x4250d7
mov dword [esp + 4], ecx
mov dword [esp], str.unlock_scd:_invalid_lock_count___d__n
call fcn.0042d9c0
mov edx, dword [ebx + 0xc]
mov eax, 0x400003f
jmp 0x4250c3
Function at 0x427670
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0xd4
mov eax, dword [esp + 0xe0]
test eax, eax
je 0x427720
mov dword [esp], eax
mov dword [esp + 0x10], eax
call sub.msvcrt.dll_strlen
mov esi, eax
mov eax, dword [esp + 0xe4]
mov dword [esp + 0x14], eax
test eax, eax
je 0x4276d6
mov dword [esp], eax
mov ebx, 1
call sub.msvcrt.dll_strlen
add esi, eax
jmp 0x4276c4
mov dword [esp], eax
call sub.msvcrt.dll_strlen
add esi, eax
cmp ebx, 0x2f
je 0x427740
add ebx, 1
mov eax, dword [esp + ebx*4 + 0xe0]
mov dword [esp + ebx*4 + 0x10], eax
test eax, eax
jne 0x4276b5
add esi, 1
mov dword [esp], esi
call sub.libgcrypt_20.dll_gcry_malloc
test eax, eax
je 0x42774c
mov edx, dword [esp + 0x10]
test edx, edx
je 0x427712
lea esi, [esp + 0x14]
mov ebx, eax
jmp 0x4276fe
add ebx, 1
mov byte [ebx - 1], cl
add edx, 1
movzx ecx, byte [edx]
test cl, cl
jne 0x4276f5
add esi, 4
mov edx, dword [esi - 4]
mov byte [ebx], 0
test edx, edx
jne 0x4276fe
add esp, 0xd4
pop ebx
pop esi
ret
mov dword [esp], 0x455293
call sub.libgcrypt_20.dll_gcry_xstrdup
test eax, eax
je 0x42774c
add esp, 0xd4
pop ebx
pop esi
ret
mov dword [esp], 0x16
call sub.libgpg_error_0.dll_gpg_err_set_errno
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 0x16
mov dword [esp], 2
je 0x427790
call dword [0x44a5a4]
mov dword [esp + 8], 0x16
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str._nfatal:_out_of_memory_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call sub.msvcrt.dll_exit
call dword [0x44a5a4]
mov dword [esp + 8], 0x25
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str._nfatal:_too_many_args_for_xstrconcat_n
call sub.msvcrt.dll_fwrite
jmp 0x427784

Function at 0x42e400
Capabilities:
Initialize winsock library

Disassembly:
push ebx
sub esp, 0x1a8
mov dword [esp], 0x42e2c0
mov eax, dword [esp + 0x1b0]
mov dword [0x45a340], eax
call fcn.004014c0
mov dword [esp], 0
call fcn.00428e40
lea eax, [esp + 0x10]
mov dword [esp], 0x202
mov dword [esp + 4], eax
call dword [sym.imp.WS2_32.dll_WSAStartup]
sub esp, 8
mov dword [esp], str.1.7.0
call sub.libgcrypt_20.dll_gcry_check_version
test eax, eax
je 0x42e4a8
call sub.libgpg_error_0.dll_gpg_err_init
mov dword [esp], sub.libgcrypt_20.dll_gcry_realloc
call sub.libgpg_error_0.dll_gpgrt_set_alloc_func
mov dword [esp], 0
call sub.libgpg_error_0.dll__gpgrt_get_std_stream
mov dword [esp], 1
call sub.libgpg_error_0.dll__gpgrt_get_std_stream
mov dword [esp], 2
call sub.libgpg_error_0.dll__gpgrt_get_std_stream
mov dword [esp], 0x42e300
call fcn.00429ef0
mov dword [esp], fcn.00431200
call fcn.0042cf30
add esp, 0x1a8
pop ebx
ret
mov dword [esp], 0
call sub.libgcrypt_20.dll_gcry_check_version
mov dword [esp], str._s_is_too_old__need__s__have__s__n
mov ebx, eax
call sub.libgpg_error_0.dll__gpg_w32_gettext
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str.1.7.0
mov dword [esp + 4], str.libgcrypt
mov dword [esp], eax
call fcn.0042db30
nop
nop
Function at 0x430340
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
lea eax, [esp + 0x16]
mov esi, dword [esp + 0x34]
mov dword [esp + 8], 0xa
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
sub esp, 0xc
mov edx, dword [esp + 0x38]
test edx, edx
setne dl
mov edi, edx
test eax, eax
je 0x430392
test dl, dl
jne 0x430392
mov dword [esp], ebx
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4303b8
add esp, 0x20
xor eax, eax
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
sub esp, 8
test eax, eax
je 0x4303f7
mov dword [esp], ebx
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4303b8
mov eax, edi
test al, al
je 0x430389
test ebx, ebx
je 0x4303f7
test esi, esi
je 0x4303f7
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0x456071
mov dword [esp], ebx
call fcn.00427590
test eax, eax
je 0x4303f0
mov dword [esp], eax
call sub.msvcrt.dll__putenv
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov eax, 0xffffffff
jmp 0x4303e8
mov dword [esp], 0x16
call sub.libgpg_error_0.dll_gpg_err_set_errno
mov eax, 0xffffffff
jmp 0x4303e8

Function at 0x430410
Capabilities:
Set environment variable

Disassembly:
push ebx
sub esp, 0x18
mov ebx, dword [esp + 0x20]
mov dword [esp + 4], 0
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
sub esp, 8
test eax, eax
je 0x43044d
test ebx, ebx
je 0x43044d
mov dword [esp], ebx
call sub.libgcrypt_20.dll_gcry_strdup
test eax, eax
je 0x430459
mov dword [esp + 0x20], eax
add esp, 0x18
pop ebx
jmp sub.msvcrt.dll__putenv
mov dword [esp], 0x16
call sub.libgpg_error_0.dll_gpg_err_set_errno
add esp, 0x18
mov eax, 0xffffffff
pop ebx
ret

Function at 0x430d40
Capabilities:
Create directory

Disassembly:
mov eax, dword [0x45a4f0]
test eax, eax
je 0x430d50
ret
push esi
push ebx
sub esp, 0x124
call fcn.00430930
cmp byte [0x45a4fd], 0
je 0x430d90
mov dword [esp + 8], 0
mov dword [esp + 4], str.home
mov dword [esp], eax
call fcn.00427670
mov dword [0x45a4f0], eax
add esp, 0x124
pop ebx
pop esi
ret
lea ebx, [esp + 0x1c]
mov eax, 0x801a
mov edx, ebx
call fcn.00430b90
test eax, eax
jns 0x430db5
mov dword [0x45a4f0], str.c:_gnupg
mov eax, str.c:_gnupg
jmp 0x430d83
mov edx, ebx
mov ecx, dword [edx]
add edx, 4
lea eax, [ecx - 0x1010101]
not ecx
and eax, ecx
and eax, 0x80808080
je 0x430db7
mov ecx, eax
shr ecx, 0x10
test eax, 0x8080
cmove eax, ecx
lea ecx, [edx + 2]
cmove edx, ecx
mov ecx, eax
add cl, al
sbb edx, 3
sub edx, ebx
add edx, 7
mov dword [esp], edx
call sub.libgcrypt_20.dll_gcry_xmalloc
mov dword [esp + 4], ebx
mov dword [esp], eax
mov esi, eax
call fcn.00427450
mov edx, 0x6770
mov dword [0x45a4f0], esi
mov dword [eax], 0x756e675c
mov word [eax + 4], dx
mov byte [eax + 6], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.msvcrt.dll__access
test eax, eax
jne 0x430e40
mov eax, dword [0x45a4f0]
jmp 0x430d83
mov eax, dword [0x45a4f0]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
sub esp, 8
jmp 0x430e2f
Function at 0x430e60
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov dword [esp], str.GNUPGHOME
call sub.msvcrt.dll_getenv
test eax, eax
je 0x430e7e
cmp byte [eax], 0
mov ebx, eax
jne 0x430ea2
mov ebx, dword [0x45a3b8]
test ebx, ebx
je 0x430f10
movzx edx, byte [ebx]
test dl, dl
jne 0x430ea2
mov esi, str.c:_gnupg
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, ebx
call fcn.00430810
mov dword [esp + 4], 0
test eax, eax
mov esi, eax
cmove esi, ebx
mov dword [esp], esi
call fcn.00426d40
mov dword [esp + 4], 0
mov dword [esp], str.c:_gnupg
mov ebx, eax
call fcn.00426d40
mov dword [esp], ebx
mov dword [esp + 4], eax
mov edi, eax
call fcn.00426d80
mov dword [esp], edi
mov ebp, eax
call sub.libgcrypt_20.dll_gcry_free
mov dword [esp], ebx
call sub.libgcrypt_20.dll_gcry_free
test ebp, ebp
je 0x430e98
mov byte [0x45a4fe], 1
add esp, 0x2c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], str.HomeDir
mov dword [esp + 4], str.SoftwareGNUGnuPG
mov dword [esp], 0
call fcn.00441b10
mov ebx, eax
test eax, eax
je 0x430f88
movzx edx, byte [eax]
test dl, dl
je 0x430f80
mov dword [esp], eax
mov byte [esp + 0x1f], dl
call sub.msvcrt.dll_strlen
movzx edx, byte [esp + 0x1f]
lea eax, [ebx + eax - 1]
cmp ebx, eax
jae 0x430f73
cmp byte [eax], 0x5c
je 0x430f65
jmp 0x430f73
cmp byte [eax], 0x5c
jne 0x430f70
sub eax, 1
mov byte [eax + 1], 0
cmp ebx, eax
jne 0x430f60
movzx edx, byte [ebx]
mov dword [0x45a3b8], ebx
jmp 0x430e8f
mov dword [esp], eax
call sub.libgcrypt_20.dll_gcry_free
mov ebx, dword [0x45a3b8]
test ebx, ebx
jne 0x430e8c
call fcn.00430d40
mov ebx, eax
mov dword [0x45a3b8], eax
test eax, eax
je 0x430e93
jmp 0x430e8c

Function at 0x431120
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x45a3b4]
test eax, eax
je 0x431130
ret
push ebx
sub esp, 0x128
lea ebx, [esp + 0x1c]
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
sub eax, 1
sub esp, 8
cmp eax, 0x102
jbe 0x431172
mov dword [esp], 0x45617b
call sub.libgcrypt_20.dll_gcry_xstrdup
mov dword [0x45a3b4], eax
add esp, 0x128
pop ebx
ret
mov dword [esp], ebx
call sub.libgcrypt_20.dll_gcry_xstrdup
mov dword [0x45a3b4], eax
jmp 0x43116a
Function at 0x43c640
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp], str.ASSUAN_DEBUG
call sub.msvcrt.dll_getenv
test eax, eax
je 0x43c690
mov dword [esp], eax
call sub.msvcrt.dll_atoi
mov dword [0x45a5d8], eax
mov dword [0x45a5d4], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], 0x43c390
add esp, 0x14
pop ebx
pop esi
jmp 0x445f98
mov dword [0x45a5d8], 0x80
jmp 0x43c66a
jmp dword [sym.imp.libassuan_0.dll_assuan_set_log_cb]
Function at 0x446580
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x45a960]
test esi, esi
jle 0x446690
mov edi, dword [0x45a964]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x4465b4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x446635
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x4465a0
mov dword [esp], eax
mov ebx, eax
call fcn.00446e70
test eax, eax
mov edi, eax
je 0x4466b7
mov eax, dword [0x45a964]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call fcn.00446f70
add eax, dword [edi + 0xc]
mov edx, dword [0x45a964]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x446697
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x44662e
sub eax, 4
and eax, 0xfffffffb
jne 0x446640
add dword [0x45a960], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x45a964]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x44662e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call fcn.00449520
lea esi, [esi]
xor esi, esi
jmp 0x4465be
mov eax, dword [0x45a964]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call fcn.00449520
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call fcn.00449520
lea esi, [esi]
nop

Function at 0x446af0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x45a978
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x45a970]
sub esp, 4
test ebx, ebx
je 0x446b45
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x446b3e
test esi, esi
je 0x446b3e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x446b20
mov dword [esp], 0x45a978
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x449520
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call fcn.004481f0
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sub.msvcrt.dll_fwrite
mov dword [esp], 2
call fcn.004481f0
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
jmp fcn.004014e0
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40596d
pop dword [ebp - 0x50]
mov eax, 0x5daeff35
sub eax, 0x5d6ea5c8
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x2e26e9f6
add dword [ebp - 0x60], 0x202b5b55
mov dword [ebp - 0x5c], 0xe551a046
add dword [ebp - 0x5c], 0x4ce1abff
mov dword [ebp - 0x58], 0xcc56ad3a
sub dword [ebp - 0x58], 0x800a690c
mov dword [ebp - 0x54], 0x235fd77
sub dword [ebp - 0x54], 0x235fd77
lea eax, [ebp - 0x60]
push eax
mov eax, 0x6ec443bd
add eax, 0x917c2ca3
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xea426fc7
sub dword [ebp - 0x60], 0x75d00671
mov dword [ebp - 0x5c], 0xdc81717a
add dword [ebp - 0x5c], 0x64eaeffb
mov dword [ebp - 0x58], 0x1169a258
sub dword [ebp - 0x58], 0xadfa35ec
mov dword [ebp - 0x54], 0xc4d7f32d
add dword [ebp - 0x54], 0x3b280cd3
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xa4487084
sub eax, 0xa407ff84
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3775f
push 0
call eax
mov ecx, 0x17098fb8
sub ecx, 0x170944be
mov ebx, eax
mov esi, 0xe7230f91
sub esi, 0xe6e20f91
add esi, dword [ebp - 0x50]
mov edx, 0xac8e2fae
sub edx, 0x4cb0acf6
sub dword [ebp - 0x34], 0x3aeb6ce5
mov edi, dword [esi]
add dword [ebp - 4], 0x8b315728
add edi, edx
mov dword [ebx], edi
xor dword [ebp - 0x34], edx
add ebx, 0x8a72f2ad
add ebx, 0x758d0d57
add esi, 0xb8093613
add esi, 0x47f6c9f1
loop 0x405a8f
add eax, 0x954d0654
add eax, 0x6ab41867
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x5f8ab1
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.005f8b30
jae 0x5f8abd
xor ecx, ecx
call fcn.005f8b30
jae 0x5f8ae7
xor eax, eax
call fcn.005f8b30
jae 0x5f8af8
mov al, 0x10
call fcn.005f8b30
adc al, al
jae 0x5f8ad9
jne 0x5f8b25
stosb byte es:[edi], al
jmp 0x5f8abe
call fcn.005f8b3c
dec ecx
loop 0x5f8b04
mov eax, ebp
call fcn.005f8b3a
jmp 0x5f8b26
lodsb al, byte [esi]
shr eax, 1
je 0x5f8b4c
adc ecx, 2
mov ebp, eax
jmp 0x5f8b26
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.005f8b3a
cmp eax, 0x7d00
jae 0x5f8b24
cmp eax, 0x500
jae 0x5f8b25
cmp eax, 0x7f
ja 0x5f8b26
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x5f8abe
pop ebp
ret 8
Function at 0x408966
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x4085d8
or edi, edi
call fcn.00408985
xor dword [edx], ebx
or edi, esi
inc edx
sub edi, edi
sub esi, 0xcb077a18
cmp edx, eax
jne fcn.00408966
ret