joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482291
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4822c9
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048031e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004802f6
jmp 0x4822d5
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x483987
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4839c9
call fcn.004896fc
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4839c9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4839c0
xor eax, eax
jmp 0x4839d1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004839d7
pop edi
pop esi
pop ebx
ret 4

Function at 0x489c2c
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x489c5a
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x489c78
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00489b92
jmp 0x489c78
mov eax, dword [esi + 0x14]
test eax, eax
je 0x489c78
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00489b92
test edi, edi
mov eax, edi
jne 0x489c62
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4060d1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add esp, 4
pop ecx
push ecx
push ebx
add esp, 4
call 0x405e33
add byte [edx], dh
xor cl, byte [edx + 0x33]
dec edi
inc eax
add esp, 4
add ecx, 0x5d34
jmp 0x405e42
pop ecx
jmp 0x406076
push eax
add eax, 0xdcc9
pop eax
push edx
push eax
add esp, 4
add edx, 0x17111
sub edx, 0xbc4b
pop edx
push ecx
push eax
add esp, 4
sub ecx, 0x707b
pop ecx
push esi
push eax
add esp, 4
or esi, 0xb6ae
pop esi
mov dword [ebp - 0xab8], 0
push esi
and esi, 0xdbac
pop esi
push ecx
and ecx, 0x9e0
call 0x4060d1
add byte [esi], bh
dec edx
dec ebx
inc esi
cmp byte [eax], bh
inc ecx
dec ebp
dec esi
add esp, 4
jmp 0x4060db
pop ecx
push ebx
and ebx, 0x10ca1
pop ebx
mov byte [ebp - 0x878], 0x45
mov byte [ebp - 0x877], 0x78
mov byte [ebp - 0x876], 0x69
mov byte [ebp - 0x875], 0x74
mov byte [ebp - 0x874], 0x50
mov byte [ebp - 0x873], 0x72
mov byte [ebp - 0x872], 0x6f
mov byte [ebp - 0x871], 0x63
mov byte [ebp - 0x870], 0x65
mov byte [ebp - 0x86f], 0x73
mov byte [ebp - 0x86e], 0x73
mov byte [ebp - 0x86d], 0
push ecx
sub ecx, 0x19fd
pop ecx
push ebx
push esi
add esp, 4
sub ebx, 0x89e9
sub ebx, 0x184cd
and ebx, 0x17460
pop ebx
push edx
push esi
add esp, 4
xor edx, 0x712b
sub edx, 0x702c
pop edx
mov ecx, 0x6b
mov word [ebp - 0x1738], cx
mov edx, 0x65
mov word [ebp - 0x1736], dx
mov eax, 0x72
mov word [ebp - 0x1734], ax
mov ecx, 0x6e
mov word [ebp - 0x1732], cx
mov edx, 0x65
mov word [ebp - 0x1730], dx
mov eax, 0x6c
mov word [ebp - 0x172e], ax
mov ecx, 0x33
mov word [ebp - 0x172c], cx
mov edx, 0x32
mov word [ebp - 0x172a], dx
mov eax, 0x2e
mov word [ebp - 0x1728], ax
mov ecx, 0x64
mov word [ebp - 0x1726], cx
mov edx, 0x6c
mov word [ebp - 0x1724], dx
mov eax, 0x6c
mov word [ebp - 0x1722], ax
xor ecx, ecx
mov word [ebp - 0x1720], cx
push eax
xor eax, 0x9349
or eax, 0xc547
sub eax, 0x10fab
pop eax
push eax
xor eax, 0xf41f
call 0x40622b
add byte [esi], dh
push eax
inc edx
aas
xor cl, byte [edx + 0x3b]
add esp, 4
sub eax, 0x9119
pop eax
push edi
push esi
add esp, 4
jmp 0x406240
xor edi, 0xd302
jmp 0x40624c
pop edi
push ecx
and ecx, 0x5f2a
and ecx, 0xe757
and ecx, 0xf52d
Function at 0x406a47
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
push ebx
add esp, 4
xor eax, 0xdc5e
pop eax
push edx
xor edx, edx
mov word [ebp - 0x214], dx
xor eax, eax
mov word [ebp - 0x110], ax
push ebx
or ebx, 0x3af1
call 0x406845
add byte [ebx + 0x48], cl
dec eax
inc esi
cmp ecx, dword [edi + 0x50]
add esp, 4
or ebx, 0x43cb
pop ebx
push ecx
jmp 0x406857
xor ecx, 0x2804
xor ecx, 0x4943
pop ecx
mov ecx, dword [ebp - 0xc9c]
mov dx, word [ecx]
mov word [ebp - 0x1036], dx
mov eax, dword [ebp - 0xc9c]
add eax, 2
mov dword [ebp - 0xc9c], eax
mov cx, word [ebp - 0x1036]
mov word [ebp - 0x214], cx
mov edx, dword [ebp - 0xca0]
mov ax, word [edx]
mov word [ebp - 0x1038], ax
mov ecx, dword [ebp - 0xca0]
add ecx, 2
mov dword [ebp - 0xca0], ecx
mov dx, word [ebp - 0x1038]
mov word [ebp - 0x110], dx
push eax
push ecx
add esp, 4
jmp 0x4068cb
and eax, 0xb172
pop eax
push ebx
push edx
add esp, 4
and ebx, 0x3284
or ebx, 0x15df2
xor ebx, 0x2cd6
and ebx, 0xbe64
pop ebx
movzx eax, word [ebp - 0x110]
test eax, eax
jne 0x406913
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
sub ecx, edx
mov dword [ebp - 0x15ec], ecx
jmp 0x406976
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x110]
cmp eax, ecx
je 0x406832
movzx edx, word [ebp - 0x214]
xor edx, 0x20
movzx eax, word [ebp - 0x110]
cmp edx, eax
je 0x406832
movzx ecx, word [ebp - 0x214]
movzx edx, word [ebp - 0x110]
cmp dword [ebp - 0x15ec], 0
jne 0x4069bf
push edx
push edi
add esp, 4
add edx, 0x1142
add edx, 0xed01
jmp 0x406996
xor edx, 0x12f0a
pop edx
push edi
or edi, 0x1834f
add edi, 0x11e9c
xor edi, 0x151ba
pop edi
mov ecx, dword [ebp - 0x508]
mov dword [ebp - 0x750], ecx
jmp 0x406a27
push edx
push edi
add esp, 4
and edx, 0x555b
sub edx, 0xc0e8
pop edx
push ebx
and ebx, 0x589c
sub ebx, 0x1746c
or ebx, 0xc220
pop ebx
push esi
push edx
add esp, 4
add esi, 0xdcbb
pop esi
mov edx, dword [ebp - 0x508]
mov eax, dword [edx]
mov dword [ebp - 0x508], eax
mov ecx, dword [ebp - 0x508]
cmp ecx, dword [ebp - 0xca4]
je 0x406a1d
mov edx, dword [ebp - 0x508]
cmp dword [edx + 0x30], 0
jne 0x4067d3
mov dword [ebp - 0x750], 0
push eax
push edx
add esp, 4
xor eax, 0xcc1f
add byte [eax], al
pop eax
push esi
or esi, 0x1491a
call 0x406a47
add byte [ecx + 0x50], cl
inc edi
cmp edi, dword [esi]
xor al, 0x41
add esp, 4
jmp 0x406a52
add esi, 0xe256
pop esi
cmp dword [ebp - 0x750], 0
jne 0x406aa3
push edx
and edx, 0x117ad
or edx, 0xfa5d
invalid
Function at 0x408003
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
add esp, 4
and eax, 0x905f
jmp 0x407f90
pop eax
cmp dword [ebp - 0x774], 0
jne 0x407fdb
push eax
push edi
add esp, 4
sub eax, 0x11296
call 0x41923b
xor eax, 0x10717
and eax, 0x31b0
pop eax
push ebx
xor ebx, 0x12321
or ebx, 0xefc7
or ebx, 0x99fd
sub ebx, 0x129e2
pop ebx
mov dword [ebp - 0xab4], 0
jmp 0x408b03
push ecx
or ecx, 0xa5e7
add ecx, 0x14945
add ecx, 0xe3d1
and ecx, 0x143d9
pop ecx
push ecx
call 0x408003
add byte [ebx + 0x40], al
inc ecx
inc ebp
cmp al, 0x38
cmp al, 0x83
les eax, [ecx + eax*4]
loope 0x40806e
mov esi, 0x8b590000
lea ecx, [eax + edi*8 + 0x518bffff]
sbb byte [ecx - 0x3a36b], cl
inc edi
test dword [eax + edi*8 - 1], edi
inc dword [eax]
add byte [eax], al
add byte [ebx - 0x3a37b], cl
dec dword [ecx - 0x166b7b]
inc dword [ebx - 0x166b43]
inc dword [eax]
jne 0x40804c
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], ecx
jmp 0x40833d
mov edx, dword [ebp - 0x166c]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1670], eax
jne 0x408074
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], ecx
jmp 0x40833d
invalid
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1670]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x1678], edx
cmp dword [ebp - 0x1678], 0
jne 0x4080a6
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], eax
jmp 0x40833d
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [ebp - 0x1678]
mov dword [ebp - 0x778], ecx
jne 0x4080cb
mov edx, dword [ebp - 0x784]
mov dword [ebp - 0x3f8], edx
jmp 0x40833d
mov eax, dword [ebp - 0x778]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x19a4], ecx
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19a8], eax
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19ac], edx
mov dword [ebp - 0x77c], 0
add byte [eax], al
add byte [eax], al
jmp 0x408125
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x77c]
cmp edx, dword [ecx + 0x18]
jae 0x408331
mov eax, dword [ebp - 0x77c]
mov ecx, dword [ebp - 0x19a4]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + eax*4]
mov dword [ebp - 0x780], edx
mov eax, dword [ebp - 0x77c]
mov ecx, dword [ebp - 0x19a8]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x19ac]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x19b0], ecx
mov dword [ebp - 0x1a0], 0
jmp 0x408195
mov eax, dword [ebp - 0x780]
add eax, dword [ebp - 0x1a0]
movsx ecx, byte [eax]
test ecx, ecx
je 0x408247
invalid
xchg ebp, eax
pushal
invalid
Function at 0x41c160
Capabilities:
Encode data using xor

Disassembly:
add al, byte [edx]
add bl, byte [edx - 0x7c]
cli
adc ebp, eax
add eax, dword [ebx]
test dl, dl
jecxz 0x41c1eb
add eax, dword [ebx]
bound edx, qword [ebp + edx*2 - 0x7a]
mov dword [edi], 0x991ecc84
add eax, dword [ebx]
jmp 0x41c18b
xchg bh, al
pop es
test ah, dh
push ebp
rol byte [ebx], cl
add ebx, dword [esi + ecx*4 - 0x68]
wait
add al, byte [edx]
imul ecx, dword [esi - 0x777396fb], 0x202f6b7
mov ss, word [eax + 0x202f39b]
xchg ah, al
add eax, 0xf39b908c
add al, byte [edx]
imul ecx, dword [esi + 0x2f6b798], 0x988c6902
sub eax, dword [ecx]
add al, byte [edx]
mov cs, word [eax + 0x202f397]
imul ecx, dword [esi - 0x6f7396f5], 0x202f6b5
mov ds, word [eax + 0x202f397]
add al, byte [edx]
xchg ch, al
add eax, 0xf397988c
add al, byte [edx]
imul ecx, dword [esi + 0x2f6b588], 0x888c6902
daa
add al, byte [edx]
add dl, byte [ebp + 0x59]
xchg bh, al
pop es
test ch, al
nop
call 0xc5c5c4ff
mov word [ebx - 0xa7bfcfd], es
insd dword es:[edi], dx
push es
add al, 3
test ch, ah
mov edx, 0x5d03032a
pop ecx
test cl, bh
xchg edi, eax
xor eax, dword [ebx]
add eax, dword [ecx + edi*8 + 0x3047384]
test cl, dh
ja 0x41c1d5
add eax, dword [ebx]
popal
adc bh, byte [edx + 0x2022790]
add cl, byte [eax + 0x121b78cc]
mov edx, 0x2012b98
add dl, byte [edx]
mov edx, 0x2022788
add ch, byte [esi]
ror dword [eax + ebx*4 + 0x202ee6b], cl
out dx, al
adc bh, byte [edx + 0x2012b90]
add dl, byte [edx]
mov edx, 0x2022798
add bh, byte [esi]
int 0x12
xchg dword [edx + eax], ecx
add al, byte [edx]
adc bh, byte [edx + 0x2012b88]
add al, byte [esi - 0x45eddc0d]
nop
daa
add al, byte [edx]
add bh, byte [esi]
les edx, [edx]
xchg ebx, esi
add dword [edx], eax
add dl, byte [edx]
mov edx, 0x2012b98
add dl, byte [edx]
mov edx, 0x2022788
add bh, byte [esi]
rol dword [eax + 0x6f88ca0f], cl
out dx, al
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
out dx, al
or eax, 0xee6f88ca
add al, byte [edx]
add al, 3
add eax, dword [ebx]
mov ss, word [eax + 0x202ee6f]
mov word [eax + 0x202ee6b], ss
xchg al, al
imul ebp, esi, 2
add al, byte [ebx]
js 0x41c2f3
pop ecx
test cl, bh
xor al, byte [ebx]
add al, 3
out dx, al
or dword [edx + 0x4f], edx
aas
xor eax, 0x5a614f40
test dl, dl
mul byte [ebx + eax + 0x68d28403]
or al, byte [ebx]
add eax, dword [edx + ecx*8 + 0x3035014]
bound edx, qword [esi - 0x7c]
invalid
mov dword [edi], 0x3030aeb
add eax, dword [ebx]
dec ecx
dec edx
cmp edi, dword [eax]
dec edx
inc eax
xchg bh, al
pop es
out dx, al
or dword [edi + 0x47], ecx
cmp eax, 0x84415148
int3
Function at 0x426820
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x4b000c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x49df28]
mov dword [ebp - 0xc], eax
mov cx, word [0x49df2c]
mov word [ebp - 8], cx
mov edx, dword [ebp + 8]
add edx, 0x41
mov eax, 2
imul ecx, eax, 0
mov word [ebp + ecx - 0xc], dx
push 0x400
lea edx, [ebp - 0x80c]
push edx
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jne 0x426877
xor eax, eax
jmp 0x4268ad
push 0xe
push str.DeviceFloppy
lea ecx, [ebp - 0x80c]
push ecx
call fcn.004700ce
add esp, 0xc
test eax, eax
jne 0x42689d
mov dword [ebp - 0x810], 1
jmp 0x4268a7
mov dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x810]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045c1c1
mov esp, ebp
pop ebp
ret

Function at 0x427420
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c4
mov eax, dword [0x4b000c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4b6734], 0
jle 0x427443
mov eax, dword [0x4b6734]
jmp 0x4274a7
push 0
push 0x24
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4274a2
push 0x2b4
push 0
lea ecx, [ebp - 0x4c0]
push ecx
call fcn.00460ff0
add esp, 0xc
push 0x4000
push 0x2b4
lea edx, [ebp - 0x4c0]
push edx
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [ebp - 0x4c4], eax
mov ecx, dword [ebp - 0x4bc]
mov dword [0x4b6734], ecx
mov eax, dword [0x4b6734]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045c1c1
mov esp, ebp
pop ebp
ret
Function at 0x42b630
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x42b64c
mov eax, dword [ebp - 4]
sub eax, 0x384
mov dword [ebp - 0x18], eax
jmp 0x42b653
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], ecx
push 4
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0
push 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x42b7b7
cmp dword [ebp - 0x14], 0
je 0x42b6fa
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
add eax, 0x1c
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
jne 0x42b6fa
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x24], 0
jne 0x42b6f8
mov dword [ebp - 0x14], 0
jmp 0x42b6a9
push 0
push 0
push 0
mov edx, dword [ebp - 4]
add edx, 0x1c
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x42b71d
jmp 0x42b694
cmp dword [ebp - 0x1c], 0
jne 0x42b728
jmp 0x42b7b7
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 0x10
jne 0x42b755
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0xc]
mov eax, dword [ecx + 0x1c]
cmp eax, dword [edx + 4]
jne 0x42b755
push 1
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [ebp - 4]
add eax, 0x1c
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx]
call eax
test eax, eax
jne 0x42b786
mov ecx, dword [ebp - 4]
add ecx, 0x1c
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
mov edx, dword [ebp - 4]
add edx, 0x1c
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x20], 0x12
jne 0x42b791
jmp 0x42b7b7
mov ecx, dword [ebp - 4]
add ecx, 0x1c
push ecx
call fcn.00416280
add esp, 4
test eax, eax
je 0x42b7b2
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0
jmp 0x42b694
push 1
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x20], 0x12
jne 0x42b7e3
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x4449a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4b000c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], 0x114
push 0x110
push 0
lea eax, [ebp - 0x114]
push eax
call fcn.00460ff0
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x444a04
cmp dword [ebp - 0x114], 6
jb 0x444a04
mov dword [ebp - 0x11c], 1
jmp 0x444a0e
mov dword [ebp - 0x11c], 0
mov al, byte [ebp - 0x11c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045c1c1
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66ae88
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0x19
push 0x6a4fa0
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.00416f50
lea eax, [esp + 4]
push eax
push 6
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.004175b0
cmp dword [esp + 0x1c], 0x10
jb 0x401072
mov ecx, dword [esp + 8]
push ecx
call fcn.00610458
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::Integer::DivideByZero.0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret

Function at 0x401090
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66ae88
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0x32
push str.Integer:_no_integer_satisfies_the_given_parameters
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.00416f50
lea eax, [esp + 4]
push eax
push 6
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.004175b0
cmp dword [esp + 0x1c], 0x10
jb 0x401102
mov ecx, dword [esp + 8]
push ecx
call fcn.00610458
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::Integer::RandomNumberNotFound.0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret

Function at 0x401a30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66d488
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esi + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x3c]
call fcn.00412390
push eax
lea ecx, [esi + 0x34]
mov dword [esp + 0x30], 0
call fcn.0040ee50
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov edx, ecx
add edx, edx
mov esi, eax
mov ebx, edi
xor eax, eax
add edx, edx
rep stosd dword es:[edi], eax
push ebx
cmp edx, 0x10
jb 0x401a9e
call fcn.0063c1c4
jmp 0x401aa3
call fcn.0061588e
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x20
ret 4
Function at 0x401ef0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66b23b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
lea edi, [esi + 0xc]
xor eax, eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov bl, byte [esp + 0x30]
mov dword [esp + 0x20], 1
cmp bl, al
je 0x401f5a
mov ebp, dword [esp + 0x2c]
push ebp
mov ecx, edi
call fcn.004135e0
mov eax, dword [esp + 0x28]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
push ebp
push eax
push ecx
push edx
call fcn.006111dc
add esp, 0x10
jmp 0x401f68
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov eax, esi
mov byte [esi], bl
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0xc

Function at 0x40f540
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x66cb40
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x704e7c]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
mov edx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
push edx
push eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], vtable.CryptoPP::ArraySink.1.0
mov dword [esp + 0x14], vtable.CryptoPP::ArraySink.0
call fcn.0040f5d0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.006108ae
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4118e0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x66d221
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
xor eax, eax
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], eax
call fcn.0040e940
mov ebx, 1
mov dword [esp + 0x30], ebx
mov esi, dword [esp + 0x38]
mov ecx, esi
call fcn.0040e940
mov eax, dword [esp + 0x3c]
push eax
push esi
mov ecx, edi
lea edx, [esp + 0x1c]
mov dword [esp + 0x18], ebx
call fcn.004115d0
mov ebx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
xor eax, eax
mov edi, ebx
mov ecx, edx
rep stosd dword es:[edi], eax
add esp, 8
lea ecx, [edx*4]
push ebx
cmp ecx, 0x10
jb 0x41196b
call fcn.0063c1c4
jmp 0x411970
call fcn.0061588e
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8

Function at 0x411990
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x66d1e1
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x10], ebx
mov esi, dword [esp + 0x38]
mov ecx, esi
call fcn.0040e940
mov dword [esp + 0x30], ebx
mov ebx, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], ebx
call fcn.0040e940
mov eax, dword [esp + 0x3c]
push eax
lea ecx, [esp + 0x18]
push ecx
mov ecx, edi
mov edx, esi
mov dword [esp + 0x38], ebx
call fcn.004115d0
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
mov ecx, edx
add edx, edx
add esp, 8
xor eax, eax
add edx, edx
mov edi, ebx
rep stosd dword es:[edi], eax
push ebx
cmp edx, 0x10
jb 0x411a1e
call fcn.0063c1c4
jmp 0x411a23
call fcn.0061588e
mov eax, esi
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x24
ret 8

Function at 0x414130
Capabilities:
Hash data using sha1

Disassembly:
push 0xffffffffffffffff
push 0x66bc80
mov eax, dword fs:[0]
push eax
mov eax, dword [0x704e7c]
xor eax, esp
push eax
lea eax, [esp + 4]
mov dword fs:[0], eax
mov eax, ecx
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0x58], 0x10
lea ecx, [eax + 0x10]
mov dword [ecx + 0x4c], ecx
mov dl, 1
mov byte [ecx + 0x41], dl
lea ecx, [eax + 0x60]
mov dword [ecx + 0x48], 0x10
mov byte [ecx + 0x41], dl
mov dword [ecx + 0x4c], ecx
mov ecx, dword [eax + 0xac]
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
pop ecx
add esp, 0xc
ret