joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a18d0
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a199b
add byte [eax], al
invalid
jmp 0x4a198f

Function at 0x401411
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x150
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
call esi
push edx
mov dword [ebp - 0x124], eax
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x118], 6
push ecx
push ecx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push edx
push edx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x11c], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push ecx
push ecx
mov dword [esp], 0
mov dword [ebp - 0x120], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
lea eax, [ebp - 0x134]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push eax
mov dword [esp], 0
call esi
lea esi, [ebp - 0x10c]
push edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push ecx
push ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1a
mov dword [esp], 0
call dword [sym.imp.SHELL32.DLL_SHGetFolderPathA]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
sub esp, 0x1c
call ebx
mov dword [esp], esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 5]
push esi
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x40162e
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 1
call fcn.00401411
test eax, eax
jne 0x4016c8
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x402132
sub eax, 0x4016d0
mov dword [esp], 0x4016d0
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x4016c8
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.00401382
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.004015b7
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1b400
mov dword [esp], 0x40300c
call fcn.00401e35
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0xdf102c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdf1036
pushal
call 0xdf103c
pop ebp
sub ebp, 0x10
sub ebp, 0x9f102c
jmp 0xdf1052
mov eax, 0x9f102c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ad
mov edx, 0x8443f823
xor byte [eax], dl
inc eax
dec ecx
jne 0xdf1069
jmp 0xdf107c
test al, 0xee
test al, 0xaa
pop ds
and esp, dword [ebx]
and esp, dword [edx + 0x2323dbe2]
and esp, dword [eax]
out dx, al
wait
sub esp, dword [ebx]
and esp, dword [ebx]
cdq
or esp, dword [ebx]
and esp, dword [ebx]
aam 0xc1
and bl, ch
test al, 0xa2
das
and esp, dword [ebx]
and esp, dword [eax]
out 0x73, al
scasb al, byte es:[edi]
inc edi
pop es
fild qword [edx + 0x5b4b0727]
dec esi
add ah, byte [ebx]
dec ebx
xchg edi, eax
sbb dword [esi + 0x23], 0x4b070f22
xchg dword [edi], eax
in eax, 0xae
retf
Function at 0x402f6c
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x402fc1
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x402fbc
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x402fa6
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x402fae
cmp edx, ebx
jne 0x4030fc
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x402f7d
add eax, dword [eax + 4]
jmp 0x402f6a
mov dword [ebp + 0xc], ebx
jmp 0x402fcc
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x402fe4
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x403002
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x403060
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x403047
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x403050
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40305a
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40303c
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x402fc6
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4030ad
dec eax
je 0x4030a4
sub eax, 3
je 0x40309b
mov dword [ebp - 4], 0x40
jmp 0x4030ca
mov dword [ebp - 4], 4
jmp 0x4030b0
mov dword [ebp - 4], 0x20
jmp 0x4030b0
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4030fc
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40307c
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
dec dword [ebx - 0x1fcd788]
call fcn.0040290d
jns 0x4030e1
mov edx, 0x1475ff3e
push 1
push esi
call edi
mov eax, esi
jmp 0x403108
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403d6c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.0040290d
mov bh, 0x15
cmpsd dword [esi], dword es:[edi]
sub ecx, dword [ebp - 0x72b7b]
call dword [eax - 0x18]
pop ss
jmp 0x403e04
invalid
Function at 0x401040
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov edx, str..ssh_id_rsa
mov ebp, esp
push ebx
sub esp, 0x424
mov eax, dword [0x423070]
test eax, eax
jne 0x401114
mov dword [esp + 0x10], edx
mov ecx, 0x41b9ac
mov ebx, dword [ebp + 8]
mov edx, 0x400
mov eax, dword [ebx + 0x18]
mov ebx, 0x423d7c
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
mov dword [esp], 0x423d7c
call sub.msys_1.0.dll_snprintf
mov dword [esp + 0xc], ebx
mov edx, dword [0x423d34]
mov ecx, str._s___s_:
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov ebx, dword [edx + 0xc]
mov dword [esp], ebx
lea ebx, [ebp - 0x408]
call sub.msys_1.0.dll_fprintf
mov eax, dword [0x423d34]
mov edx, 0x400
mov ecx, dword [eax + 4]
mov dword [esp + 4], edx
mov dword [esp], ebx
mov dword [esp + 8], ecx
call sub.msys_1.0.dll_fgets
test eax, eax
je 0x401165
mov dword [esp], ebx
mov ecx, 0x41b9bc
mov dword [esp + 4], ecx
call sub.msys_1.0.dll_strcspn
xor edx, edx
mov byte [ebp + eax - 0x408], dl
cmp byte [ebp - 0x408], 0
jne 0x401171
mov ebx, 1
mov dword [0x423030], ebx
add esp, 0x424
pop ebx
pop ebp
ret
mov dword [esp], eax
call fcn.00407fc0
cmp eax, 1
mov edx, str..ssh_id_rsa
je 0x40105c
jle 0x40119e
cmp eax, 2
mov edx, str..ssh_id_dsa
je 0x40105c
mov ebx, dword [0x423d34]
mov ecx, 0xd
mov edx, 1
mov eax, dword [ebx + 0xc]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp + 0xc], eax
mov dword [esp], str.bad_key_type_n
call sub.msys_1.0.dll_fwrite
mov dword [esp], 1
call sub.msys_1.0.dll_exit
mov dword [esp + 4], ebx
mov eax, 0x400
mov ebx, 1
mov dword [esp + 8], eax
mov dword [esp], 0x423d7c
call fcn.00416650
mov dword [0x423030], ebx
add esp, 0x424
pop ebx
pop ebp
ret
test eax, eax
mov edx, str..ssh_identity
je 0x40105c
jmp 0x40113a
Function at 0x401940
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov byte [esi], 0
jmp 0x401970
mov eax, dword [ebp + 0x10]
dec eax
cmp eax, ebx
jbe 0x4019c1
cmp edx, 0xa
je 0x4019b7
cmp edx, 0xd
je 0x40198c
mov byte [ebx + esi], dl
inc ebx
mov byte [esi + ebx], 0
mov dword [esp], edi
call sub.msys_1.0.dll_fgetc
cmp eax, 0xffffffff
mov edx, eax
jne 0x401956
add esp, 0x1c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
call sub.msys_1.0.dll_fgetc
cmp eax, 0xffffffff
mov ecx, eax
setne al
xor edx, edx
cmp ecx, 0xa
setne dl
test edx, eax
je 0x4019b7
mov dword [esp + 4], edi
mov dword [esp], ecx
call sub.msys_1.0.dll_ungetc
inc eax
je 0x4019f8
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [0x423d34]
mov edi, 0x15
mov esi, 1
mov edx, dword [ecx + 0xc]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp + 0xc], edx
mov dword [esp], str.input_line_too_long._n
call sub.msys_1.0.dll_fwrite
mov dword [esp], 1
call sub.msys_1.0.dll_exit
call sub.msys_1.0.dll___errno
mov ecx, dword [eax]
mov edi, str.unget:__s_n
mov dword [esp], ecx
call sub.msys_1.0.dll_strerror
mov dword [esp + 8], eax
mov esi, dword [0x423d34]
mov dword [esp + 4], edi
mov ebx, dword [esi + 0xc]
mov dword [esp], ebx
call sub.msys_1.0.dll_fprintf
jmp 0x4019ec
Function at 0x401e10
Capabilities:
Get file attributes
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x50
mov eax, dword [0x423030]
test eax, eax
je 0x401f50
mov dword [esp], 0x423d7c
lea ebx, [ebp - 0x48]
mov dword [esp + 4], ebx
call sub.msys_1.0.dll_stat
test eax, eax
js 0x401fd5
mov dword [esp], 0x423d7c
xor eax, eax
mov esi, 0x41ba1b
mov dword [esp + 8], eax
mov dword [esp + 4], esi
call fcn.0040e9e0
test eax, eax
mov ebx, eax
je 0x401eb0
mov edx, dword [0x423d34]
mov eax, dword [edx + 8]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00407830
test eax, eax
je 0x401f70
mov dword [esp], ebx
call fcn.004067f0
mov esi, dword [0x423d34]
mov ebx, dword [esi + 8]
mov dword [esp], 0xa
mov dword [esp + 4], ebx
call sub.msys_1.0.dll_fputc
mov dword [esp], 0
call sub.msys_1.0.dll_exit
nop
lea esi, [esi]
mov eax, dword [0x423034]
test eax, eax
jne 0x401fc8
mov dword [esp], str.Enter_passphrase:
mov edx, 2
mov dword [esp + 4], edx
call fcn.00411e00
mov dword [esp + 4], eax
mov esi, eax
xor ebx, ebx
mov dword [esp + 8], ebx
mov dword [esp], 0x423d7c
call fcn.0040e9e0
mov dword [esp], esi
mov ebx, eax
call sub.msys_1.0.dll_strlen
mov dword [esp + 8], eax
xor ecx, ecx
mov dword [esp + 4], ecx
mov dword [esp], esi
call sub.msys_1.0.dll_memset
mov dword [esp], esi
call fcn.0040ced0
test ebx, ebx
jne 0x401e61
mov ecx, dword [0x423d34]
mov edx, 0xc
mov eax, 1
mov esi, dword [ecx + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp + 0xc], esi
mov dword [esp], str.load_failed_n
call sub.msys_1.0.dll_fwrite
mov dword [esp], 1
call sub.msys_1.0.dll_exit
lea esi, [esi]
mov edx, dword [ebp + 8]
mov ecx, str.Enter_file_in_which_the_key_is
mov dword [esp + 4], ecx
mov dword [esp], edx
call fcn.00401040
jmp 0x401e25
mov edx, dword [0x423d34]
mov ecx, 0x10
mov esi, 1
mov eax, dword [edx + 0xc]
mov dword [esp + 8], ecx
mov dword [esp + 4], esi
mov dword [esp + 0xc], eax
mov dword [esp], str.key_write_failed
call sub.msys_1.0.dll_fwrite
mov dword [esp], ebx
call fcn.004067f0
mov esi, dword [0x423d34]
mov ebx, dword [esi + 8]
mov dword [esp], 0xa
mov dword [esp + 4], ebx
call sub.msys_1.0.dll_fputc
mov dword [esp], 0
jmp 0x401ea6
mov dword [esp], eax
call fcn.0040cf00
jmp 0x401ed2
mov dword [esp], 0x423d7c
call sub.msys_1.0.dll_perror
jmp 0x401f41
Function at 0x401ff0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp], 0
mov dword [ebp - 8], ebx
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], 0
call fcn.004103f0
mov eax, dword [ebp + 0xc]
xor edx, edx
lea ecx, [ebp - 0xc]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004110b0
test eax, eax
mov ebx, eax
jg 0x402039
mov dword [esp], str.cannot_read_public_key_from_pkcs11
call fcn.00411b20
xor esi, esi
cmp esi, ebx
jge 0x402086
mov edx, dword [0x423d34]
mov ecx, dword [ebp - 0xc]
mov eax, dword [edx + 8]
mov dword [esp + 4], eax
mov edx, dword [ecx + esi*4]
mov dword [esp], edx
call fcn.00407830
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + esi*4]
inc esi
mov dword [esp], ecx
call fcn.004067f0
mov edx, dword [0x423d34]
mov eax, dword [edx + 8]
mov dword [esp], 0xa
mov dword [esp + 4], eax
call sub.msys_1.0.dll_fputc
cmp esi, ebx
jl 0x40203f
mov ebx, dword [ebp - 0xc]
mov dword [esp], ebx
call fcn.0040ced0
call fcn.00410420
mov dword [esp], 0
call sub.msys_1.0.dll_exit
lea esi, [esi]
lea edi, [edi]
Function at 0x402600
Capabilities:
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], edi
mov edx, dword [0x423028]
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
test edx, edx
jne 0x4026d0
test eax, eax
jne 0x4026a0
mov dword [esp + 0x10], esi
test edi, edi
mov eax, 0x41bd0a
jne 0x402645
mov eax, 0x41ba1b
mov dword [esp + 0xc], eax
test edi, edi
mov eax, 0x41bd0c
jne 0x402657
mov eax, 0x41ba1b
mov dword [esp + 8], eax
mov edi, str._s_s_s
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.msys_1.0.dll_fprintf
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00407830
test eax, eax
je 0x402782
mov dword [ebp + 0xc], ebx
mov esi, dword [ebp - 8]
mov ebx, dword [ebp - 0xc]
mov dword [ebp + 8], 0xa
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
jmp sub.msys_1.0.dll_fputc
mov dword [esp], esi
xor ecx, ecx
xor edx, edx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call fcn.0040f8c0
test eax, eax
mov esi, eax
jne 0x402633
mov dword [esp], str.hash_host_failed
call fcn.00411b20
lea esi, [esi]
mov edi, dword [0x42302c]
xor ecx, ecx
mov ebx, 2
test edi, edi
sete cl
xor eax, eax
mov dword [esp + 4], ecx
test edi, edi
setne al
mov dword [esp + 8], eax
mov edx, dword [ebp - 0x10]
mov dword [esp], edx
call fcn.00407190
mov dword [ebp - 0x14], eax
mov ecx, 1
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov edi, dword [ebp - 0x10]
mov dword [esp], edi
call fcn.00407190
mov edi, eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.00407a40
mov edx, dword [ebp - 0x10]
mov ebx, eax
mov dword [esp], edx
call fcn.00407ae0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], esi
mov ecx, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], str._u__s__s___s__n
mov dword [esp + 8], ecx
call sub.msys_1.0.dll_printf
cmp dword [section..data], 3
jg 0x402778
mov dword [esp], edi
call fcn.0040ced0
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
mov dword [ebp + 8], esi
mov esi, dword [ebp - 8]
mov esp, ebp
pop ebp
jmp fcn.0040ced0
mov dword [esp], edi
call sub.msys_1.0.dll_puts
jmp 0x402759
mov dword [esp], str.key_write_failed
call fcn.00411b20
nop
Function at 0x403570
Capabilities:
Get file attributes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x60
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x4c], 0
test esi, esi
je 0x403620
mov dword [esp], esi
lea edx, [ebp - 0x48]
mov dword [esp + 4], edx
call sub.msys_1.0.dll_stat
test eax, eax
js 0x403600
mov dword [esp], esi
lea ebx, [ebp - 0x4c]
mov dword [esp + 4], ebx
call fcn.0040eb10
test eax, eax
mov ebx, eax
je 0x403639
mov esi, dword [0x42306c]
mov edx, dword [0x423d34]
mov dword [esp + 0xc], esi
mov ecx, dword [edx + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], ecx
mov dword [esp], eax
call fcn.0040d8a0
mov dword [esp], ebx
call fcn.004067f0
mov esi, dword [ebp - 0x4c]
mov dword [esp], esi
call fcn.0040ced0
mov edx, 1
add esp, 0x60
mov eax, edx
pop ebx
pop esi
pop ebp
ret
call sub.msys_1.0.dll___errno
xor edx, edx
cmp dword [eax], 2
je 0x4035f4
mov dword [esp], esi
call sub.msys_1.0.dll_perror
mov dword [esp], 1
call sub.msys_1.0.dll_exit
mov eax, dword [ebp + 8]
mov ecx, str.Enter_file_in_which_the_key_is
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00401040
jmp 0x40358a
mov eax, dword [ebp - 0x4c]
test eax, eax
jne 0x403652
mov dword [esp + 4], esi
mov dword [esp], str.failed_to_read_v2_public_key_from__s._n
call sub.msys_1.0.dll_printf
jmp 0x403614
mov dword [esp], eax
call fcn.0040ced0
jmp 0x403640
Function at 0x406b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], 0
mov edx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x40], 0
test eax, eax
mov dword [edx], 0
je 0x406ce4
cmp eax, 1
jne 0x406d14
call sub.msys_crypto_1.0.0.dll_EVP_md5
mov dword [ebp - 0x44], eax
mov ebx, dword [esi]
cmp ebx, 5
ja case.default.0x406bac
jmp dword [ebx*4 + 0x41d5cc]
mov dword [esp], ebx
call fcn.00408cd0
mov dword [esi], eax
lea edx, [ebp - 0x40]
lea eax, [ebp - 0x3c]
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], esi
call fcn.00408860
mov dword [esi], ebx
mov esi, dword [ebp - 0x40]
test esi, esi
je 0x406d08
mov dword [esp], 0x40
call fcn.0040cd90
mov edi, eax
mov eax, dword [ebp - 0x44]
lea esi, [ebp - 0x38]
mov dword [esp], esi
mov dword [esp + 4], eax
call sub.msys_crypto_1.0.0.dll_EVP_DigestInit
mov dword [esp], esi
mov edx, dword [ebp - 0x3c]
mov ebx, dword [ebp - 0x40]
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
call sub.msys_crypto_1.0.0.dll_EVP_DigestUpdate
mov dword [esp + 4], edi
mov ecx, dword [ebp + 0x10]
mov dword [esp], esi
mov dword [esp + 8], ecx
call sub.msys_crypto_1.0.0.dll_EVP_DigestFinal
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov ebx, dword [ebp - 0x40]
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp], ebx
call sub.msys_1.0.dll_memset
mov ecx, dword [ebp - 0x40]
mov dword [esp], ecx
call fcn.0040ced0
add esp, 0x4c
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
lea edi, [ebp - 0x3c]
lea ebx, [ebp - 0x40]
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
call fcn.00408860
jmp 0x406bd5
mov ecx, dword [esi + 8]
mov eax, dword [ecx + 0x10]
mov dword [esp], eax
call fcn.00418a40
mov edx, eax
add edx, 7
js 0x406cee
mov ebx, edx
mov edx, dword [esi + 8]
sar ebx, 3
mov edi, dword [edx + 0x14]
mov dword [esp], edi
call fcn.00418a40
mov edx, eax
add edx, 7
js 0x406cf3
sar edx, 3
lea ecx, [ebx + edx]
mov dword [ebp - 0x3c], ecx
mov dword [esp], ecx
call fcn.0040cd90
mov dword [esp + 4], eax
mov dword [ebp - 0x40], eax
mov eax, dword [esi + 8]
mov edx, dword [eax + 0x10]
mov dword [esp], edx
call sub.msys_crypto_1.0.0.dll_BN_bn2bin
mov edi, dword [ebp - 0x40]
mov ecx, ebx
add ecx, edi
mov dword [esp + 4], ecx
mov eax, dword [esi + 8]
mov ebx, dword [eax + 0x14]
mov dword [esp], ebx
call sub.msys_crypto_1.0.0.dll_BN_bn2bin
jmp 0x406bd5
call sub.msys_crypto_1.0.0.dll_EVP_sha1
jmp 0x406b9e
lea edx, [eax + 0xe]
jmp 0x406c86
lea edx, [eax + 0xe]
jmp 0x406ca0
mov dword [esp + 4], ebx
mov dword [esp], str.key_fingerprint_raw:_bad_key_type__d
call fcn.00411b20
mov dword [esp], str.key_fingerprint_raw:_blob_is_null
call fcn.00411b20
mov dword [esp + 4], eax
mov dword [esp], str.key_fingerprint_raw:_bad_digest_type__d
call fcn.00411b20
lea esi, [esi]
lea edi, [edi]
Function at 0x40a7c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
cmp eax, 7
mov dword [0x423178], ebx
mov edx, dword [ebp + 0x14]
ja 0x40a8a5
mov dword [0x41b020], eax
test edx, edx
mov dword [0x41b024], edx
jne 0x40a801
cmp ecx, 0xb
ja case.default.0x40a7fa
jmp dword [ecx*4 + 0x41e614]
add esp, 0x14
pop ebx
pop ebp
ret
mov eax, 0xb8
lea esi, [esi]
mov dword [0x41b028], eax
mov edx, dword [0x41b028]
mov eax, 1
test ebx, ebx
mov dword [esp + 4], eax
mov eax, ebx
mov dword [esp + 8], edx
je 0x40a89e
mov dword [esp], eax
call sub.msys_1.0.dll_openlog
add esp, 0x14
pop ebx
pop ebp
jmp fcn.00419a38
mov eax, 0x18
jmp 0x40a810
mov eax, 8
jmp 0x40a810
mov eax, 0x20
jmp 0x40a810
mov eax, 0x50
jmp 0x40a810
mov eax, pe_nt_image_headers32
jmp 0x40a810
mov eax, 0x88
jmp 0x40a810
mov ecx, 0x90
mov dword [0x41b028], ecx
jmp 0x40a815
mov eax, 0x98
mov dword [0x41b028], eax
jmp 0x40a815
mov eax, 0xa0
jmp 0x40a810
mov eax, 0xa8
jmp 0x40a810
mov eax, 0xb0
jmp 0x40a810
mov eax, dword [0x42418c]
jmp 0x40a82e
mov dword [esp + 8], eax
mov edx, str.Unrecognized_internal_syslog_level_code__d_n
mov dword [esp + 4], edx
mov ecx, dword [0x423d34]
mov edx, dword [ecx + 0xc]
mov dword [esp], edx
call sub.msys_1.0.dll_fprintf
mov dword [esp], 1
call sub.msys_1.0.dll_exit
mov dword [esp + 8], ecx
mov ebx, str.Unrecognized_internal_syslog_facility_code__d_n
mov dword [esp + 4], ebx
jmp 0x40a8b2

Function at 0x40ba20
Capabilities:
Terminate process

Disassembly:
push ebp
mov edx, 2
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov dword [esp + 4], edx
mov dword [esp], str._dev_null
call fcn.00415a10
cmp eax, 0xffffffff
mov esi, eax
lea ebx, [eax + 1]
je 0x40bad3
cmp ebx, 2
jg 0x40ba71
mov dword [esp], ebx
xor edx, edx
mov ecx, 3
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
call sub.msys_1.0.dll_fcntl
test eax, eax
js 0x40ba7d
inc ebx
cmp ebx, 2
jle 0x40ba50
cmp esi, 2
jg 0x40bac4
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msys_1.0.dll_dup2
inc eax
jne 0x40ba6b
call sub.msys_1.0.dll___errno
mov ebx, dword [eax]
mov dword [esp], ebx
call sub.msys_1.0.dll_strerror
mov dword [esp + 8], eax
mov eax, str.dup2:__s_n
mov dword [esp + 4], eax
mov eax, dword [0x423d34]
mov esi, dword [eax + 0xc]
mov dword [esp], esi
call sub.msys_1.0.dll_fprintf
mov dword [esp], 1
call sub.msys_1.0.dll_exit
mov dword [esp], esi
call sub.msys_1.0.dll_close
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
call sub.msys_1.0.dll___errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msys_1.0.dll_strerror
mov dword [esp + 8], eax
mov eax, str.Couldnt_open__dev_null:__s_n
jmp 0x40baa4