joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414988
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
push 0
push 2
push 0
call fcn.004a559d
add esp, 0x10
push dword [ebp + 8]
push 0
push 2
push 0
call fcn.004a559d
add esp, 0x10
push dword [ebp + 0x10]
push 0
push 2
push 0
call fcn.004a559d
add esp, 0x10
cmp dword [ebp + 0x14], 0
jne 0x414a29
sub esp, 0xc
push dword [ebp + 8]
call sub.msvcrt.dll_remove
add esp, 0x10
sub esp, 8
push dword [ebp + 8]
push dword [ebp + 0x10]
call sub.msvcrt.dll_rename
add esp, 0x10
test eax, eax
je 0x414a29
sub esp, 0xc
sub esp, 4
call sub.msvcrt.dll__errno
add esp, 4
push dword [eax]
call sub.msvcrt.dll_strerror
add esp, 0x10
push eax
push dword [ebp + 8]
push dword [ebp + 0x10]
push str.renaming___s_to___s_failed:__s_n
call fcn.0049d87b
add esp, 0x10
mov dword [ebp - 8], 0x25
jmp 0x414b2d
sub esp, 0xc
push dword [ebp + 0x10]
call sub.msvcrt.dll_remove
add esp, 0x10
cmp dword [ebp + 0x14], 0
je 0x414a4b
sub esp, 0xc
push dword [ebp + 0x10]
call fcn.0041e3a4
add esp, 0x10
sub esp, 8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.msvcrt.dll_rename
add esp, 0x10
test eax, eax
je 0x414b26
sub esp, 0xc
sub esp, 4
call sub.msvcrt.dll__errno
add esp, 4
push dword [eax]
call sub.msvcrt.dll_strerror
add esp, 0x10
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str.renaming___s_to___s_failed:__s_n
call fcn.004a7e84
add esp, 4
push eax
call fcn.0049d87b
add esp, 0x10
sub esp, 0xc
push dword [ebp + 0x10]
call fcn.0041e39f
add esp, 0x10
mov dword [ebp - 4], 0x25
cmp dword [ebp + 0x14], 0
je 0x414b1e
sub esp, 0xc
push str.WARNING:_2_files_with_confidential_information_exists._n
call fcn.004a7e84
add esp, 4
push eax
call fcn.0049d7de
add esp, 0x10
sub esp, 8
push dword [ebp + 0x10]
push str._s_is_the_unchanged_one_n
call fcn.004a7e84
add esp, 4
push eax
call fcn.0049d7de
add esp, 0x10
sub esp, 8
push dword [ebp + 0xc]
push str._s_is_the_new_one_n
call fcn.004a7e84
add esp, 4
push eax
call fcn.0049d7de
add esp, 0x10
sub esp, 0xc
push str.Please_fix_this_possible_security_flaw_n
call fcn.004a7e84
add esp, 4
push eax
call fcn.0049d7de
add esp, 0x10
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x414b2d
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
leave
ret
Function at 0x41fb59
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
sub esp, 0xc
push str.GNUPGHOME
call sub.msvcrt.dll_getenv
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41fb83
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0
jne 0x41fb9d
sub esp, 4
push str.HomeDir
push str.SoftwareGNUGnuPG
push 0
call fcn.004a8392
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41fbaf
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0
jne 0x41fc4a
sub esp, 0xc
lea eax, [ebp - 0x128]
push eax
push 0
push 0
push 0x801a
push 0
call fcn.0041f9f4
add esp, 0x20
test eax, eax
js 0x41fc4a
sub esp, 0xc
lea eax, [ebp - 0x128]
push eax
call sub.msvcrt.dll_strlen
add esp, 4
add eax, 7
push eax
call fcn.004a2e27
add esp, 0x10
mov dword [ebp - 0x12c], eax
sub esp, 8
push str.gnupg
sub esp, 0xc
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x12c]
call fcn.004a06ff
add esp, 0x14
push eax
call sub.msvcrt.dll_strcpy
add esp, 0x10
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0xc], eax
sub esp, 8
push 0
push dword [ebp - 0xc]
call sub.msvcrt.dll__access
add esp, 0x10
test eax, eax
je 0x41fc4a
sub esp, 8
push 0
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CreateDirectoryA
add esp, 8
cmp dword [ebp - 0xc], 0
je 0x41fc58
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0
jne 0x41fc5f
mov dword [ebp - 0xc], 0x4db228
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x41fd1e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov dword [ebp - 0xc], 0xffffffff
sub esp, 0xc
push 0x4db28c
call sub.msvcrt.dll_getenv
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41fd72
mov eax, dword [ebp + 8]
cmp byte [eax], 0x40
jle 0x41fd55
mov eax, dword [ebp + 8]
cmp byte [eax], 0x5a
jle 0x41fd67
mov eax, dword [ebp + 8]
cmp byte [eax], 0x60
jle 0x41fd8b
mov eax, dword [ebp + 8]
cmp byte [eax], 0x7a
jle 0x41fd67
jmp 0x41fd8b
mov eax, dword [ebp + 8]
inc eax
cmp byte [eax], 0x3a
je 0x41fd72
jmp 0x41fd8b
sub esp, 8
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.msvcrt.dll__access
add esp, 0x10
mov dword [ebp - 0x20], eax
jmp 0x41fe5d
sub esp, 0xc
push dword [ebp - 8]
call sub.msvcrt.dll_strlen
add esp, 4
mov ebx, eax
push dword [ebp + 8]
call sub.msvcrt.dll_strlen
add esp, 4
lea eax, [ebx + eax]
add eax, 2
push eax
call fcn.004a2e27
add esp, 0x10
mov dword [ebp - 0x10], eax
sub esp, 0xc
push dword [ebp - 8]
call fcn.004a2fe0
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
sub esp, 8
push 0x4db291
lea eax, [ebp - 0x14]
push eax
call fcn.004a8c00
add esp, 0x10
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x41fe3b
sub esp, 8
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call sub.msvcrt.dll_strcpy
add esp, 0x10
sub esp, 8
push 0x4db293
push dword [ebp - 0x10]
call sub.msvcrt.dll_strcat
add esp, 0x10
sub esp, 8
push dword [ebp + 8]
push dword [ebp - 0x10]
call sub.msvcrt.dll_strcat
add esp, 0x10
sub esp, 8
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call sub.msvcrt.dll__access
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x41fdcf
sub esp, 0xc
push dword [ebp - 0x1c]
call fcn.004a2f78
add esp, 0x10
sub esp, 0xc
push dword [ebp - 0x10]
call fcn.004a2f78
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x420a63
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov dword [ebp - 0xc], str.c:gnupg
cmp dword [0x4fdfd8], 0
jne 0x420b8e
cmp dword [0x4fe1a8], 0
jne 0x420b8e
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x7e
jne 0x420af6
sub esp, 0xc
push dword [ebp + 8]
call sub.msvcrt.dll_strlen
add esp, 0x10
mov ebx, eax
mov eax, dword [ebp - 0xc]
inc eax
sub esp, 0xc
push eax
call sub.msvcrt.dll_strlen
add esp, 0x10
cmp ebx, eax
jb 0x420af6
mov esi, dword [ebp - 0xc]
inc esi
sub esp, 0xc
push dword [ebp + 8]
call sub.msvcrt.dll_strlen
add esp, 0x10
mov ebx, eax
add ebx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
inc eax
sub esp, 0xc
push eax
call sub.msvcrt.dll_strlen
add esp, 0x10
sub ebx, eax
mov eax, ebx
sub esp, 8
push esi
push eax
call sub.msvcrt.dll_strcmp
add esp, 0x10
test eax, eax
jne 0x420af6
jmp 0x420b17
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0x7e
je 0x420b8e
sub esp, 8
push dword [ebp - 0xc]
push dword [ebp + 8]
call fcn.0049dcee
add esp, 0x10
test eax, eax
jne 0x420b8e
sub esp, 0xc
push dword [ebp + 8]
call sub.msvcrt.dll__mkdir
add esp, 0x10
test eax, eax
je 0x420b5b
sub esp, 4
sub esp, 8
sub esp, 4
call sub.msvcrt.dll__errno
add esp, 4
push dword [eax]
call sub.msvcrt.dll_strerror
add esp, 0xc
push eax
push dword [ebp + 8]
push 0x4db460
call fcn.004a7e84
add esp, 4
push eax
call fcn.0049d8b6
cmp dword [0x4fdfc4], 0
jne 0x420b80
sub esp, 8
push dword [ebp + 8]
push str.directory___s_created_n
call fcn.004a7e84
add esp, 4
push eax
call fcn.0049d7de
add esp, 0x10
sub esp, 0xc
push dword [ebp + 8]
call fcn.00420783
add esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x428d15
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x14], 0x20
cmp dword [0x4fccf0], 0
je 0x428f28
push dword [ebp + 8]
call fcn.00428a5f
add esp, 4
test eax, eax
jne 0x428d43
jmp 0x428f28
cmp dword [ebp + 0x18], 0xffffffff
jne 0x428d55
lea eax, [ebp - 0x14]
dec dword [eax]
mov dword [ebp + 0x18], 0
push dword [ebp + 8]
call fcn.0042866f
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 1
cmp dword [ebp - 0x20], 0
je 0x428de1
sub esp, 4
push dword [ebp - 8]
push str._GNUPG:___s
push dword [0x4fccf0]
call sub.msvcrt.dll_fprintf
add esp, 0x10
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x10], 0
je 0x428dda
cmp dword [ebp + 0xc], 0
je 0x428dda
sub esp, 8
push dword [0x4fccf0]
push dword [ebp + 0xc]
call sub.msvcrt.dll_fputs
add esp, 0x10
sub esp, 0xc
push dword [ebp + 0xc]
call sub.msvcrt.dll_strlen
add esp, 0x10
mov edx, eax
lea eax, [ebp - 0x1c]
add dword [eax], edx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x428e50
cmp dword [ebp - 0xc], 0
jne 0x428e50
mov eax, dword [ebp - 4]
cmp byte [eax], 0x25
je 0x428e21
mov eax, dword [ebp - 4]
mov al, byte [eax]
and eax, 0xff
cmp eax, dword [ebp - 0x14]
jle 0x428e21
mov eax, dword [ebp - 4]
cmp byte [eax], 0x7f
je 0x428e21
jmp 0x428e28
mov dword [ebp - 0xc], 1
cmp dword [ebp + 0x18], 0
je 0x428e44
lea eax, [ebp - 0x1c]
inc dword [eax]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp + 0x18]
jbe 0x428e44
mov dword [ebp - 0x20], 1
jmp 0x428e50
lea eax, [ebp - 4]
inc dword [eax]
lea eax, [ebp - 0x18]
dec dword [eax]
jmp 0x428df4
cmp dword [ebp - 0xc], 0
je 0x428e60
lea eax, [ebp - 4]
dec dword [eax]
lea eax, [ebp - 0x18]
inc dword [eax]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
je 0x428e86
push dword [0x4fccf0]
push 1
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
sub edx, eax
mov eax, edx
push eax
push dword [ebp + 0x10]
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp dword [ebp - 0xc], 0
je 0x428eb7
sub esp, 4
mov eax, dword [ebp - 4]
mov al, byte [eax]
and eax, 0xff
push eax
push 0x4dcf48
push dword [0x4fccf0]
call sub.msvcrt.dll_fprintf
add esp, 0x10
lea eax, [ebp - 4]
inc dword [eax]
lea eax, [ebp - 0x18]
dec dword [eax]
mov eax, dword [ebp - 4]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp + 0x14], eax
cmp dword [ebp - 0x20], 0
je 0x428ee2
cmp dword [ebp + 0x14], 0
je 0x428ee2
sub esp, 8
push dword [0x4fccf0]
push 0xa
call sub.msvcrt.dll_putc
add esp, 0x10
cmp dword [ebp + 0x14], 0
je 0x428eed
jmp 0x428d78
sub esp, 8
push dword [0x4fccf0]
push 0xa
call sub.msvcrt.dll_putc
add esp, 0x10
sub esp, 0xc
push dword [0x4fccf0]
call sub.msvcrt.dll_fflush
add esp, 0x10
test eax, eax
je 0x428f28
cmp dword [0x4fe1cc], 0
je 0x428f28
sub esp, 0xc
push 0
call fcn.00407bbb
leave
ret
Function at 0x428f4b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
sub esp, 4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.msvcrt.dll__read
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x428f7a
call sub.msvcrt.dll__errno
cmp dword [eax], 4
jne 0x428f7a
jmp 0x428f51
cmp dword [ebp - 4], 0
jne 0x428fb1
cmp dword [ebp + 0x10], 0
je 0x428fb1
cmp dword [0x4fcce0], 2
jg 0x428fa4
mov eax, dword [ebp + 0xc]
mov byte [eax], 4
mov dword [ebp - 4], 1
inc dword [0x4fcce0]
jmp 0x428fb1
sub esp, 0xc
push 2
call sub.msvcrt.dll_raise
add esp, 0x10
mov eax, dword [ebp - 4]
leave
ret
Function at 0x42d641
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xe4
cmp dword [0x4fcd20], 0
jne 0x42d659
jmp 0x42d859
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0xc]
cmp eax, dword [ebp - 0xc]
jle 0x42d859
call fcn.00428bce
test eax, eax
je 0x42d80b
cmp dword [ebp + 0xc], 0
je 0x42d69d
sub esp, 4
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0xc]
call fcn.00421f96
add esp, 0x10
jmp 0x42d6d5
cmp dword [ebp + 0x10], 0
je 0x42d6be
sub esp, 4
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0x10]
call fcn.00422246
add esp, 0x10
jmp 0x42d6d5
sub esp, 4
push str.dump_attribs
push 0x2b3
push str._home_wk_src_gpg4win_build_gpg4win_1.1.3_src_playground_build_gnupg_1.4.7_g10_keylist.c
call fcn.0049d962
lea eax, [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0xe0]
jae 0x42d72f
sub esp, 4
mov eax, dword [ebp - 0x3c]
mov al, byte [eax]
and eax, 0xff
push eax
push 0x4dd6b7
lea edx, [ebp - 0xd8]
mov eax, dword [ebp - 0xdc]
add eax, eax
lea eax, [edx + eax]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x10
lea eax, [ebp - 0xdc]
inc dword [eax]
lea eax, [ebp - 0x3c]
inc dword [eax]
jmp 0x42d6e5
sub esp, 0xc
mov eax, dword [ebp + 8]
cmp dword [eax + 0x2c], 0
setne al
and eax, 0xff
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x30], 0
je 0x42d757
or dword [ebp - 0xe4], 2
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xe8], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x34], 0
je 0x42d77b
mov eax, dword [ebp - 0xe8]
or eax, 4
mov dword [ebp - 0xe8], eax
push dword [ebp - 0xe8]
mov eax, dword [ebp + 8]
push dword [eax + 0x38]
mov eax, dword [ebp + 8]
push dword [eax + 0x40]
mov eax, dword [ebp + 8]
push dword [eax + 0xc]
mov eax, dword [ebp - 0xc]
inc eax
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov eax, edx
add eax, eax
add eax, edx
lea edx, [eax*4]
mov eax, dword [ecx + 8]
mov al, byte [edx + eax]
and eax, 0xff
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov eax, edx
add eax, eax
add eax, edx
lea edx, [eax*4]
mov eax, dword [ecx + 8]
push dword [edx + eax + 8]
push str.__lu__u__u__u__lu__lu__u
lea ebx, [ebp - 0xd8]
lea eax, [ebp - 0xd8]
push eax
call sub.msvcrt.dll_strlen
add esp, 4
lea eax, [ebx + eax]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x30
sub esp, 8
lea eax, [ebp - 0xd8]
push eax
push 0x43
call fcn.00428bfa
add esp, 0x10
push dword [0x4fcd20]
push 1
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov eax, edx
add eax, eax
add eax, edx
lea edx, [eax*4]
mov eax, dword [ecx + 8]
push dword [edx + eax + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
mov eax, edx
add eax, eax
add eax, edx
lea edx, [eax*4]
mov eax, dword [ecx + 8]
push dword [edx + eax + 4]
call sub.msvcrt.dll_fwrite
add esp, 0x10
lea eax, [ebp - 0xc]
inc dword [eax]
jmp 0x42d660
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4351d3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [ebp + 8], 0
je 0x435333
mov eax, dword [ebp + 8]
cmp byte [eax], 0x3c
jne 0x435333
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp byte [eax], 0x20
je 0x435204
mov eax, dword [ebp + 8]
cmp byte [eax], 9
je 0x435204
jmp 0x435209
inc dword [ebp + 8]
jmp 0x4351f2
sub esp, 8
push 0x4dea30
push dword [ebp + 8]
call sub.msvcrt.dll_fopen
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43525a
sub esp, 0xc
mov eax, dword [ebp - 0x10]
push dword [eax + 0x10]
call fcn.0041e3a9
add esp, 0x10
test eax, eax
je 0x43525a
sub esp, 0xc
push dword [ebp - 0x10]
call sub.msvcrt.dll_fclose
add esp, 0x10
mov dword [ebp - 0x10], 0
call sub.msvcrt.dll__errno
mov dword [eax], 1
cmp dword [ebp - 0x10], 0
jne 0x4352a1
sub esp, 4
sub esp, 8
sub esp, 4
call sub.msvcrt.dll__errno
add esp, 4
push dword [eax]
call sub.msvcrt.dll_strerror
add esp, 0xc
push eax
push dword [ebp + 8]
push 0x4dea33
call fcn.004a7e84
add esp, 4
push eax
call fcn.004a0b14
add esp, 0x10
mov dword [ebp - 0x14], 0xffffffff
jmp 0x43541c
sub esp, 0xc
push 0xfe
call fcn.004a2e27
add esp, 0x10
mov dword [ebp - 4], eax
push dword [ebp - 0x10]
push 0xfe
push 1
push dword [ebp - 4]
call sub.msvcrt.dll_fread
add esp, 0x10
mov dword [ebp - 8], eax
sub esp, 0xc
push dword [ebp - 0x10]
call sub.msvcrt.dll_fclose
add esp, 0x10
cmp dword [ebp - 8], 0
jns 0x43538d
sub esp, 4
sub esp, 8
sub esp, 4
call sub.msvcrt.dll__errno
add esp, 4
push dword [eax]
call sub.msvcrt.dll_strerror
add esp, 0xc
push eax
push dword [ebp + 8]
push 0x4dea48
call fcn.004a7e84
add esp, 4
push eax
call fcn.004a0b14
add esp, 0x10
sub esp, 0xc
push dword [ebp - 4]
call fcn.004a2f78
add esp, 0x10
mov dword [ebp - 0x14], 0xffffffff
jmp 0x43541c
sub esp, 8
sub esp, 4
push str.Login_data__account_name_:
call fcn.004a7e84
add esp, 8
push eax
push str.cardedit.change_login
call fcn.0042919e
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x435369
mov dword [ebp - 0x14], 0xffffffff
jmp 0x43541c
sub esp, 0xc
push dword [ebp - 4]
call fcn.0049f3bc
add esp, 0x10
call fcn.004292da
sub esp, 0xc
push dword [ebp - 4]
call sub.msvcrt.dll_strlen
add esp, 0x10
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xfe
jle 0x4353cb
sub esp, 8
push 0xfe
push str.Error:_Login_data_too_long__limit_is__d_characters_._n
call fcn.004a7e84
add esp, 4
push eax
call fcn.004a0b14
add esp, 0x10
sub esp, 0xc
push dword [ebp - 4]
call fcn.004a2f78
add esp, 0x10
mov dword [ebp - 0x14], 0xffffffff
jmp 0x43541c
push 0
push dword [ebp - 8]
push dword [ebp - 4]
push 0x4deaca
call fcn.00431bb1
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x435408
sub esp, 8
sub esp, 4
push dword [ebp - 0xc]
call fcn.004a8910
add esp, 8
push eax
push str.error_setting_login_data:__s_n
call fcn.0049d87b
add esp, 0x10
sub esp, 0xc
push dword [ebp - 4]
call fcn.004a2f78
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
leave
ret
Function at 0x443a82
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp dword [0x4fe188], 0
je 0x443abb
sub esp, 4
push 1
lea eax, [ebp - 0xd]
push eax
push dword [ebp + 8]
call sub.msvcrt.dll__read
add esp, 0x10
cmp eax, 1
jne 0x443ab2
cmp byte [ebp - 0xd], 0xa
je 0x443ab2
jmp 0x443a91
mov byte [ebp - 0xd], 0
jmp 0x443baf
cmp dword [0x4fdff8], 0
jne 0x443ad7
sub esp, 8
push dword [ebp + 8]
push str.Reading_passphrase_from_file_descriptor__d_...
call fcn.004a0b14
add esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0x64
mov dword [ebp - 4], 0x64
mov eax, dword [ebp - 8]
dec eax
cmp eax, dword [ebp - 4]
jg 0x443b43
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 8]
add dword [eax], 0x64
sub esp, 0xc
push dword [ebp - 8]
call fcn.004a2e67
add esp, 0x10
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 0
je 0x443b3c
sub esp, 4
push dword [ebp - 4]
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call sub.msvcrt.dll_memcpy
add esp, 0x10
sub esp, 0xc
push dword [ebp - 0x14]
call fcn.004a2f78
add esp, 0x10
jmp 0x443b43
mov dword [ebp - 4], 0
sub esp, 4
push 1
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
push eax
push dword [ebp + 8]
call sub.msvcrt.dll__read
add esp, 0x10
cmp eax, 1
jne 0x443b74
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
cmp byte [eax], 0xa
je 0x443b74
lea eax, [ebp - 4]
inc dword [eax]
jmp 0x443aec
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov byte [eax], 0
cmp dword [0x4fdff8], 0
jne 0x443b96
sub esp, 0xc
push str._b_b_b____n
call fcn.004a0b14
add esp, 0x10
sub esp, 0xc
push dword [0x4fcf60]
call fcn.004a2f78
add esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [0x4fcf60], eax
leave
ret
Function at 0x462a5f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
cmp dword [0x4cf1f0], 0xffffffff
je 0x462a85
sub esp, 4
push 0x248
push str._home_wk_src_gpg4win_build_gpg4win_1.1.3_src_playground_build_gnupg_1.4.7_g10_tdbio.c
push str.db_fd___1
call sub.msvcrt.dll__assert
cmp dword [0x4fd070], 0
jne 0x462aa4
sub esp, 0xc
push dword [0x4fd060]
call fcn.004a729f
add esp, 0x10
mov dword [0x4fd070], eax
cmp dword [0x4fd070], 0
jne 0x462ac9
sub esp, 8
push dword [0x4fd060]
push str.cant_create_lock_for___s_n
call fcn.004a7e84
add esp, 4
push eax
call fcn.0049d8b6
sub esp, 8
push 0x8002
push dword [0x4fd060]
call sub.msvcrt.dll__open
add esp, 0x10
mov dword [0x4cf1f0], eax
cmp dword [0x4cf1f0], 0xffffffff
jne 0x462b40
call sub.msvcrt.dll__errno
cmp dword [eax], 0xd
je 0x462b03
call sub.msvcrt.dll__errno
cmp dword [eax], 0x1e
je 0x462b03
jmp 0x462b40
sub esp, 8
push 0x8000
push dword [0x4fd060]
call sub.msvcrt.dll__open
add esp, 0x10
mov dword [0x4cf1f0], eax
cmp dword [0x4cf1f0], 0xffffffff
je 0x462b40
sub esp, 0xc
push str.NOTE:_trustdb_not_writable_n
call fcn.004a7e84
add esp, 4
push eax
call fcn.0049d7de
add esp, 0x10
cmp dword [0x4cf1f0], 0xffffffff
jne 0x462b7e
sub esp, 4
sub esp, 8
sub esp, 4
call sub.msvcrt.dll__errno
add esp, 4
push dword [eax]
call sub.msvcrt.dll_strerror
add esp, 0xc
push eax
push dword [0x4fd060]
push 0x4e8d65
call fcn.004a7e84
add esp, 4
push eax
call fcn.0049d8b6
sub esp, 0xc
push dword [0x4fd060]
call fcn.0041e39f
add esp, 0x10
sub esp, 4
push 5
lea eax, [ebp - 0x18]
push eax
push dword [0x4cf1f0]
call sub.msvcrt.dll__read
add esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffff
jne 0x462bbb
call sub.msvcrt.dll__errno
cmp dword [eax], 4
jne 0x462bbb
jmp 0x462b8f
cmp dword [ebp - 0x1c], 5
jne 0x462be0
lea eax, [ebp - 0x18]
sub esp, 4
push 5
push 0x4e8e1a
push eax
call sub.msvcrt.dll_memcmp
add esp, 0x10
test eax, eax
jne 0x462be0
call fcn.00465081
sub esp, 4
push 1
lea eax, [ebp - 0x68]
push eax
push 0
call fcn.00463e6e
add esp, 0x10
test eax, eax
je 0x462c13
sub esp, 8
push dword [0x4fd060]
push str._s:_invalid_trustdb_n
call fcn.004a7e84
add esp, 4
push eax
call fcn.0049d8b6
leave
ret
Function at 0x4723e0
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
sub esp, 0xc
push dword [ebp + 8]
call fcn.004a2fe0
add esp, 0x10
mov dword [ebp - 0x6c], eax
sub esp, 4
push 0x10
push 0
lea eax, [ebp - 0x18]
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
sub esp, 4
push 0x44
push 0
lea eax, [ebp - 0x68]
push eax
call sub.msvcrt.dll_memset
add esp, 0x10
mov dword [ebp - 0x68], 0x44
sub esp, 8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x6c]
push 0
call sub.KERNEL32.dll_CreateProcessA
add esp, 8
test eax, eax
jne 0x472455
mov dword [ebp - 0x70], 0xffffffff
jmp 0x472496
sub esp, 8
push 0xffffffffffffffff
push dword [ebp - 0x18]
call sub.KERNEL32.dll_WaitForSingleObject
add esp, 8
sub esp, 0xc
push dword [ebp - 0x18]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
sub esp, 0xc
push dword [ebp - 0x14]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
sub esp, 0xc
push dword [ebp - 0x6c]
call fcn.004a2f78
add esp, 0x10
mov dword [ebp - 0x70], 0
mov eax, dword [ebp - 0x70]
leave
ret