joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4365d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x52bd60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x530408]
mov eax, esi
imul eax, esi
push edi
mov dword [ebp - 0xc], edx
mov edi, ecx
and eax, 0x8000000f
jns 0x4365ff
dec eax
or eax, 0xfffffff0
inc eax
mov ebx, 4
cmp eax, 0xe
jne 0x436642
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x7b]
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004b3d60
push eax
call fcn.004b4e1b
mov esi, dword [0x530408]
add esp, 8
mov eax, esi
imul eax, esi
imul eax, esi
cdq
mov ecx, reloc.kernel32.dll_ReleaseActCtx
idiv ecx
xor bl, bl
cmp edx, 5
jne 0x436694
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x64
sub esi, eax
xor ecx, ecx
lea eax, [esi + 0x2f4]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004b3d60
push eax
call fcn.004b4e1b
add esp, 8
push 0
push reloc.kernel32.dll_WaitForMultipleObjectsEx
push 4
push 0
push 2
push 0x40000000
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x436721
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp - 0xc]
push 0
mov eax, dword [eax]
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 8], 0
push dword [eax - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43671a
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov eax, dword [0x530408]
imul eax, eax
cdq
mov ecx, reloc.kernel32.dll_GetDiskFreeSpaceA
idiv ecx
mov bl, 1
cmp edx, 0xa
jne 0x43671a
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.004b4591
mov esp, ebp
pop ebp
ret
Function at 0x445920
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push reloc.kernel32.dll_FileTimeToLocalFileTime
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x52bd60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
push 0
mov dword [ebp - 0x18], esi
call fcn.004b3d98
mov dword [ebp - 4], 0
mov dword [esi + 4], 0
mov byte [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov word [esi + 0x20], ax
mov dword [esi + 0x24], eax
mov byte [esi + 0x28], al
mov dword [esi + 0x2c], eax
mov byte [esi + 0x30], al
mov byte [ebp - 4], 6
test edi, edi
jne 0x4459c6
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x14], str.bad_locale_name
call fcn.004b7cf0
push 0x51b698
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], vtable.std::runtime_error.0
call fcn.004bbc57
push edi
push esi
call fcn.004b402f
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b4591
mov esp, ebp
pop ebp
ret 4
Function at 0x450050
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push reloc.kernel32.dll_FileTimeToLocalFileTime
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x52bd60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00450e10
mov dword [edi], eax
mov dword [ebp - 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.00450e10
mov dword [edi + 8], eax
mov eax, dword [edi]
mov ecx, edi
push dword [eax + 4]
call fcn.00450910
mov eax, dword [edi]
lea ecx, [edi + 8]
mov dword [eax + 4], eax
mov eax, dword [edi]
mov dword [eax], eax
mov eax, dword [edi]
mov dword [eax + 8], eax
mov dword [edi + 4], 0
mov eax, dword [edi + 8]
push dword [eax + 4]
call fcn.00450910
mov eax, dword [edi + 8]
mov dword [eax + 4], eax
mov eax, dword [edi + 8]
mov dword [eax], eax
mov eax, dword [edi + 8]
mov dword [eax + 8], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x450410
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push reloc.kernel32.dll_FileTimeToLocalFileTime
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push esi
push edi
mov eax, dword [0x52bd60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], edx
mov edi, ecx
mov esi, dword [0x530408]
mov ecx, reloc.kernel32.dll_SetSystemTime
lea eax, [esi + 1]
imul eax, esi
cdq
idiv ecx
cmp edx, 4
jne 0x450466
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push reloc.kernel32.dll_SetSystemTime
mov dword [ecx + 0x14], reloc.kernel32.dll_UnmapViewOfFile
mov dword [ecx + 0x10], 0
push str.GetFileVersionInfo
mov byte [ecx], 0
call fcn.004012e0
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 4], 0
push 7
mov dword [ecx + 0x14], reloc.kernel32.dll_UnmapViewOfFile
mov dword [ecx + 0x10], 0
push str.Version
mov byte [ecx], 0
call fcn.004012e0
push 0
lea esi, [edi + 0x40]
push esi
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call fcn.00450e40
push reloc.kernel32.dll_SetSystemTime
push str.GetFileVersionInfo
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], reloc.kernel32.dll_UnmapViewOfFile
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x34], 0
call fcn.004012e0
lea eax, [ebp - 0x34]
push eax
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.00450800
mov bl, byte [eax]
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x20], 0x10
jb 0x450515
push dword [ebp - 0x34]
call fcn.004b458c
add esp, 4
mov dword [ebp - 0x20], reloc.kernel32.dll_UnmapViewOfFile
mov dword [ebp - 0x24], 0
mov byte [ebp - 0x34], 0
test bl, bl
jne 0x450541
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push dword [ebp + 0x10]
mov eax, dword [esi]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0x14]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x457ac0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, ecx
test edx, edx
jne 0x457ad5
lea eax, [edx + 0xd]
pop esi
pop ebp
ret 0xc
mov eax, edx
push edi
lea edi, [eax + 2]
jmp 0x457ae0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x457ae0
sub eax, edi
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x459b50
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push reloc.kernel32.dll_FileTimeToLocalFileTime
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x52bd60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x18], 0
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov edx, eax
shr edx, 8
movzx ecx, dl
movzx edi, al
mov dword [ebp - 0x14], ecx
cmp eax, 0x80000000
jae 0x459ba3
mov esi, eax
shr esi, 0x10
cmp edi, 6
jb 0x459c11
cmp ecx, 2
jb 0x459c11
mov eax, dword [0x530408]
imul eax, eax
cdq
mov ecx, reloc.kernel32.dll_IsProcessInJob
idiv ecx
cmp edx, 0x14
jne 0x459bf6
push reloc.kernel32.dll_CreateFileA
call fcn.004b3d60
add esp, 4
mov edi, eax
xor esi, esi
call fcn.004b597b
add eax, dword [0x530408]
inc esi
mov dword [edi + esi*4 - 4], eax
cmp esi, 0xa
jl 0x459bd0
mov eax, dword [edi + 0x24]
push edi
mov dword [0x530408], eax
call fcn.004b4e1b
add esp, 4
mov ecx, ebx
call fcn.00459f30
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x52b6d0]
mov ecx, 0x52b6d0
call dword [eax + reloc.kernel32.dll_AssignProcessToJobObject]
add eax, 0x10
mov dword [ebp - 0x10], eax
push esi
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push edi
push reloc.kernel32.dll_GetComputerNameExA
push eax
mov dword [ebp - 4], 0
call fcn.00404c00
mov esi, dword [ebp - 0x10]
add esi, 0xfffffff0
add esp, 0x14
mov ecx, esi
call fcn.00404770
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x459c71
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45c6c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push reloc.kernel32.dll_FileTimeToLocalFileTime
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x52bd60]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 0x1c]
call fcn.00431f80
push eax
mov eax, dword [ebp + 8]
push str.errornarand
push ecx
mov dword [esp + 0x3c], 0
mov ecx, dword [eax]
sub ecx, 0x10
mov esi, esp
call fcn.00404770
add eax, 0x10
lea ecx, [esp + 0x24]
mov dword [esi], eax
call fcn.0045c110
add esp, 4
push eax
mov edx, 0x530bfc
lea ecx, [esp + 0x20]
mov byte [esp + 0x3c], 1
call fcn.00403b40
add esp, 4
mov edx, eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x38], 2
call fcn.00426ca0
add esp, 4
mov edx, eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 3
call fcn.00403b40
add esp, 4
mov ecx, eax
mov byte [esp + 0x30], 4
call fcn.0043fc40
mov byte [esp + 0x30], 3
mov edx, dword [esp + 0xc]
add edx, 0xfffffff0
or esi, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x45c790
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [esp + 0x30], 2
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45c7b2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [esp + 0x30], 1
mov edx, dword [esp + 0x14]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45c7d4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov byte [esp + 0x30], 0
mov edx, dword [esp + 0x18]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x45c7f6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov dword [esp + 0x30], 0xffffffff
mov edx, dword [esp + 0x1c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x45c819
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + reloc.kernel32.dll_IsBadStringPtrA]
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x45ddc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x45ddd9
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x45dde5
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x45dde0
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45ed80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push reloc.kernel32.dll_FileTimeToLocalFileTime
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x52bd60]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x420], 0
push reloc.kernel32.dll_SetHandleCount
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x42c], edi
test edi, edi
jne 0x45ee26
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x42c], eax
test edi, edi
jne 0x45ee26
call fcn.0040c4b0
mov esi, eax
jmp 0x45ef13
push dword [ebp - 0x428]
push dword [ebp - 0x424]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x45ee49
call fcn.0040c4b0
jmp 0x45ef06
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x424], ebx
test ebx, ebx
jne 0x45ee67
call fcn.0040c4b0
jmp 0x45ef06
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x428], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x45ee88
mov esi, 0x8007000e
jmp 0x45ef08
push eax
lea ecx, [ebp - 0x420]
mov byte [ebp - 4], 2
call fcn.0045d760
jmp 0x45eeb2
mov dword [ebp - 4], 1
cmp dword [ebp - 0x420], 0
jne 0x45eec9
mov esi, 0x8007000e
jmp 0x45ef08
push esi
push dword [ebp - 0x420]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x45eee9
call fcn.0040c4b0
jmp 0x45ef06
mov eax, dword [ebp - 0x420]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x420]
lea ecx, [ebp - 0x1c]
call fcn.0045ec20
mov esi, eax
test edi, edi
je 0x45ef13
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x41c]
cmp dword [ebp - 0x420], eax
je 0x45ef30
lea ecx, [ebp - 0x420]
call fcn.0045d710
lea esp, [esp]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b4591
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4675b0
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.004b8fc0
mov eax, dword [0x52bd60]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x467615
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x467615
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.004b9679
add eax, 0x40
push eax
call fcn.004b94b1
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004b4591
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.004b93ec
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4676a4
call fcn.00467470
test eax, eax
jle 0x4676a4
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004b4591
add esp, 0x108
ret
push reloc.kernel32.dll_GetUserDefaultLangID
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004b4591
add esp, 0x108
ret

Function at 0x467700
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x467724
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
sub edi, 1
jne 0x467716
pop esi
movzx eax, cl
pop edi
ret

Function at 0x46eb10
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x46eb57
mov al, byte [edx]
test al, al
je 0x46eb57
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x46eb27
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x472590
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x47265c
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x4725b1
cmp al, 0x6b
jne 0x47265c
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x47261d
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x4725d1
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x4725d1
cmp al, 0xbb
jne 0x4725fa
inc ecx
cmp ecx, esi
jl 0x4725c1
sub esi, ecx
test ecx, ecx
jne 0x472620
push reloc.kernel32.dll_EnumDateFormatsA
push str..crypto_rsa_rsa_x931.c
push reloc.kernel32.dll_EnumDateFormatsA
push reloc.kernel32.dll_WaitForMultipleObjectsEx
push 4
call fcn.00463a30
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push reloc.kernel32.dll_FreeConsole
push str..crypto_rsa_rsa_x931.c
push reloc.kernel32.dll_EnumDateFormatsA
push reloc.kernel32.dll_WaitForMultipleObjectsEx
push 4
call fcn.00463a30
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x472649
push reloc.kernel32.dll_SetThreadPriority
push str..crypto_rsa_rsa_x931.c
push reloc.kernel32.dll_FileTimeToLocalFileTime
push reloc.kernel32.dll_WaitForMultipleObjectsEx
push 4
call fcn.00463a30
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.004b88c0
add esp, 0xc
mov eax, esi
pop esi
ret
push reloc.kernel32.dll_SetCurrentDirectoryW
push str..crypto_rsa_rsa_x931.c
push reloc.kernel32.dll_CreateMutexExW
push reloc.kernel32.dll_WaitForMultipleObjectsEx
push 4
call fcn.00463a30
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x47b850
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x47b933
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
movzx edx, byte [esi]
jl 0x47b8ce
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x4f0028]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x4f0028]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x4f0028]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + 0x4f0028]
mov byte [ecx], dl
jmp 0x47b920
shl edx, 0x10
cmp edi, 2
jne 0x47b8df
movzx eax, byte [esi + 1]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x4f0028]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x4f0028]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x47b90d
lea edx, [edi + 0x3c]
jmp 0x47b91a
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x4f0028]
mov byte [ecx], dl
inc ecx
mov byte [ecx], reloc.kernel32.dll_VerifyVersionInfoW
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x47b870
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x495d30
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x495d49
mov esi, edi
mov edi, eax
jmp 0x495d4b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x495d5b
mov eax, ebx
jmp 0x495d65
push eax
push ebx
call fcn.00466ba0
add esp, 8
test eax, eax
jne 0x495d6d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x495d89
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x495d74
cmp eax, dword [esi + 4]
jge 0x495da0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x495d90
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x495dc1
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x495dbe
dec eax
test eax, eax
jg 0x495db0
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x49a3a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x130
call fcn.004b8fc0
mov eax, dword [0x52bd60]
xor eax, esp
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0x13c]
push ebx
push ebp
mov ebp, dword [esp + 0x158]
push esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x154]
push edi
mov edi, dword [esp + 0x144]
push eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], eax
mov ebx, 1
call fcn.0047caf0
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
test esi, esi
jge 0x49a403
xor eax, eax
jmp 0x49a58d
lea ecx, [esp + 0x2c]
push ecx
call fcn.004abe20
mov edx, dword [esp + 0x160]
add esp, 4
mov dword [esp + 0x18], edx
test edi, edi
jne 0x49a428
mov dword [esp + 0x148], edi
jmp 0x49a452
cmp dword [esp + 0x148], 0xffffffff
jne 0x49a452
mov eax, edi
lea ecx, [eax + 1]
mov dword [esp + 0x10], ecx
jmp 0x49a440
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x49a440
sub eax, dword [esp + 0x10]
mov dword [esp + 0x148], eax
test edx, edx
je 0x49a57b
jmp 0x49a468
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
cmp edx, esi
jg 0x49a46e
mov esi, edx
mov edx, ebx
shr edx, 0x18
mov eax, ebx
shr eax, 0x10
push 0
mov byte [esp + 0x18], dl
mov edx, dword [esp + 0x20]
push edx
mov byte [esp + 0x1d], al
mov eax, dword [esp + 0x150]
mov ecx, ebx
shr ecx, 8
push eax
mov byte [esp + 0x22], cl
lea ecx, [esp + 0x38]
push edi
push ecx
mov byte [esp + 0x2b], bl
call fcn.004abb60
mov edx, dword [esp + 0x164]
mov eax, dword [esp + 0x38]
push edx
push eax
lea ecx, [esp + 0x48]
push ecx
call fcn.004abd60
push 4
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x54]
push eax
call fcn.004abd60
push 0
lea ecx, [esp + 0x12c]
push ecx
lea edx, [esp + 0x60]
push edx
call fcn.004abd70
push esi
lea eax, [esp + 0x138]
push eax
push ebp
call fcn.004b88c0
mov eax, dword [esp + 0x198]
add esp, 0x44
cmp eax, 1
jle 0x49a566
dec eax
mov dword [esp + 0x10], eax
jmp 0x49a510
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x100]
push ecx
push edx
mov edx, dword [esp + 0x28]
mov eax, ecx
mov ecx, dword [esp + 0x154]
push eax
push ecx
push edi
push edx
call fcn.004abf30
add esp, 0x1c
test esi, esi
jle 0x49a55f
lea ecx, [esp + 0xfc]
mov eax, ebp
sub ecx, ebp
mov edi, esi
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x49a550
mov edi, dword [esp + 0x28]
sub dword [esp + 0x10], 1
jne 0x49a510
mov eax, dword [esp + 0x18]
sub eax, esi
inc ebx
add ebp, esi
mov dword [esp + 0x18], eax
test eax, eax
jne 0x49a460
lea eax, [esp + 0x2c]
push eax
call fcn.004abec0
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b4591
add esp, 0x130
ret