joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407cd5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x407ce4
pop dword [ebp - 0x28]
mov eax, 0xca8b9d2c
sub eax, 0xca4b2048
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0xedbe0493
sub dword [ebp - 0x38], 0x9f6bbf48
mov dword [ebp - 0x34], 0x651c6d13
add dword [ebp - 0x34], 0xcd16df32
mov dword [ebp - 0x30], 0x10b89e29
add dword [ebp - 0x30], 0x3b93a605
mov dword [ebp - 0x2c], 0x6f93a802
add dword [ebp - 0x2c], 0x906c57fe
lea eax, [ebp - 0x38]
push eax
mov eax, 0xf57f9984
add eax, 0xac387a4
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x2f0dec10
sub dword [ebp - 0x38], 0xba9b82ba
mov dword [ebp - 0x34], 0x94345b4d
sub dword [ebp - 0x34], 0x52c7f9d8
mov dword [ebp - 0x30], 0xb564ed90
add dword [ebp - 0x30], 0xae0a7edc
mov dword [ebp - 0x2c], 0xdce7599e
sub dword [ebp - 0x2c], 0xdce7599e
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x8ce60e17
sub eax, 0x8ca2ecfb
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3b5dc
push 0
call eax
mov ecx, 0x1e74cea4
sub ecx, 0x1e7486b6
xor ebx, ebx
add ebx, eax
mov esi, 0x442600
add esi, dword [ebp - 0x28]
mov edi, 0xc4f23da8
sub edi, 0x30b8f898
add dword [ebp - 0x24], eax
mov edx, dword [esi]
sub dword [ebp - 0x18], edx
add edx, edi
sub dword [ebp - 0x20], 0x5efc1dc6
mov dword [ebx], edx
xor dword [ebp - 0x24], esi
add ebx, 4
add esi, 0x3b38174e
sub esi, 0x3b38174a
loop 0x407e02
add eax, 0xe7c351c9
add eax, 0x183dc0c2
mov ebx, eax
add eax, 0x8ef4c6fa
sub eax, 0x8ef4c6f5
mov ecx, 0xa856d3fa
add ecx, 0x57e92c06
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x4090b9
Capabilities:
Link many functions at runtime

Disassembly:
push 0
mov eax, 0x430847
call fcn.0042e77a
mov esi, ecx
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 8], 0
mov dword [esi + 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x3c], eax
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x40], eax
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x44], eax
mov eax, dword [ebp + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [esi + 0x2c], eax
setne al
push str.MAPI32.DLL
mov byte [esi + 0x20], al
call fcn.00409031
mov dword [esi + 0x18], eax
test eax, eax
je 0x4091cb
push 0xc
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
pop ecx
mov dword [ebp + 0x10], ebx
and dword [ebp - 4], 0
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
test ebx, ebx
je 0x409163
push str.MAPIFreeBuffer
push dword [esi + 0x18]
call edi
push str.MAPIAllocateBuffer
push dword [esi + 0x18]
mov dword [ebp + 0xc], eax
call edi
mov dword [ebx + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebx + 8], eax
mov dword [ebx], vtable.MapiAllocator.0
mov eax, ebx
xor ebx, ebx
jmp 0x409167
xor ebx, ebx
xor eax, eax
or dword [ebp - 4], 0xffffffff
push str.MAPIInitialize
push dword [esi + 0x18]
mov dword [esi + 0x14], eax
call edi
push str.MAPIUninitialize
push dword [esi + 0x18]
mov dword [esi + 4], eax
call edi
push str.MAPILogonEx
push dword [esi + 0x18]
mov dword [esi + 8], eax
call edi
push str.HrQueryAllRows
push dword [esi + 0x18]
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x4091cb
cmp dword [esi + 8], ebx
je 0x4091cb
cmp dword [esi + 0xc], ebx
je 0x4091cb
push ebx
call eax
mov dword [esi + 0x1c], eax
cmp eax, ebx
jl 0x4091d2
push esi
push 0x63
push ebx
push ebx
push ebx
call dword [esi + 0xc]
mov dword [esi + 0x1c], eax
jmp 0x4091d2
mov dword [esi + 0x1c], 0x80040102
mov eax, esi
call fcn.0042e852
ret 0x28
Function at 0x40c202
Capabilities:
Get common file path

Disassembly:
push 0x214
mov eax, 0x43091b
call fcn.0042e7e3
push ecx
mov esi, ecx
mov dword [ebp - 0x21c], esp
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], esp
call main
lea ecx, [esi + 0xc]
push ecx
xor edi, edi
mov dword [ebp - 0x21c], esp
mov dword [ebp - 4], edi
mov dword [ebp - 0x21c], esp
call main
push str.HKEY_CURRENT_USERSoftwareAdobeAdobe_Acrobat11.0
mov ecx, esi
mov byte [ebp - 4], 1
call main
push str.HKEY_CURRENT_USERSoftwareAdobeAcrobat_Reader11.0
mov ecx, esi
call main
push str.HKEY_CURRENT_USERSoftwareAdobeAdobe_Synchronizer11.0
mov ecx, esi
call main
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push edi
push 0x1a
lea eax, [ebp - 0x218]
push eax
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call edi
mov ebx, dword [sym.imp.MSVCR100.dll_wcscat_s]
test eax, eax
je 0x40c2cc
push str.AdobeAcrobat11.0
lea eax, [ebp - 0x218]
push 0x104
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call main
push 0
push 0x1c
lea eax, [ebp - 0x218]
push eax
push 0
call edi
test eax, eax
je 0x40c303
push str.AdobeAcrobat11.0
lea eax, [ebp - 0x218]
push 0x104
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call main
push 0
push 0x1a
lea eax, [ebp - 0x218]
push eax
push 0
call edi
test eax, eax
je 0x40c33a
push str.AdobeLinguisticsDictionaries
lea eax, [ebp - 0x218]
push 0x104
push eax
call ebx
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call main
push str.SOFTWAREPoliciesAdobeAdobe_Acrobat11.0FeatureLockDown
mov ecx, esi
call main
push str.SOFTWAREPoliciesAdobeAcrobat_Reader11.0FeatureLockDown
mov ecx, esi
call main
mov eax, esi
call fcn.0042e866
ret
Function at 0x4115d0
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
push esi
mov esi, dword [esp + 8]
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 4], eax
call fcn.004193b0
cmp eax, 0x17
je 0x41160e
mov dword [esi], 0x418a08
pop esi
ret
mov dword [esi], 0x4115a0
pop esi
ret

Function at 0x411620
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x4c
mov eax, dword [0x43c4b0]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
mov ebx, dword [esp + 0x58]
push ebp
push esi
mov esi, dword [esp + 0x5c]
mov eax, dword [esi + 0x18]
shr eax, 3
and eax, 0x3f
cmp eax, 0x38
push edi
mov edi, 0x38
jb 0x411652
mov edi, 0x78
sub edi, eax
push edi
lea eax, [esp + 0x14]
push 0
push eax
call main
add esp, 0xc
mov byte [esp + 0x10], 0x80
lea ecx, [esp + edi + 0x11]
lea eax, [esi + 0x1a]
mov ebp, 2
movzx edx, byte [eax - 2]
mov byte [ecx - 1], dl
movzx edx, byte [eax - 1]
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub ebp, 1
jne 0x411675
add edi, 8
push edi
lea eax, [esp + 0x14]
push eax
push esi
call fcn.004114a0
add esp, 0xc
lea ecx, [ebx + 1]
lea eax, [esi + 0xa]
lea edi, [ebp + 4]
movzx edx, byte [eax - 2]
mov byte [ecx - 1], dl
movzx edx, byte [eax - 1]
mov byte [ecx], dl
movzx edx, byte [eax]
mov byte [ecx + 1], dl
movzx edx, byte [eax + 1]
mov byte [ecx + 2], dl
add eax, 4
add ecx, 4
sub edi, 1
jne 0x4116b5
xor eax, eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], eax
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 4], eax
call fcn.004193b0
cmp eax, 0x17
je 0x411724
pop edi
mov dword [esi], 0x418a08
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0042e764
add esp, 0x4c
ret
mov ecx, dword [esp + 0x58]
pop edi
mov dword [esi], 0x4115a0
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042e764
add esp, 0x4c
ret
Function at 0x422370
Capabilities:
Hash data using sha1

Disassembly:
call fcn.004193b0
add eax, 0xfffffffd
cmp eax, 0x25
ja case.0x422384.8
movzx eax, byte [eax + 0x42240c]
jmp dword [eax*4 + 0x4223f8]
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x4275a8
jmp 0x4223ca
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x426470
jmp 0x4223ca
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x4253c0
jmp 0x4223ca
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x422340
jmp 0x4223ca
mov eax, dword [esp + 4]
mov dword [eax + 0x5c], 0x415ef0
xor ecx, ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret
Function at 0x422440
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x60
mov eax, dword [0x43c4b0]
xor eax, esp
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x6c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x70]
push edi
mov edi, dword [esp + 0x78]
lea ecx, [esp + 0x1c]
and ecx, 7
push 0x48
lea ebx, [esp + 0x28]
sub ebx, ecx
push 0
push ebx
mov dword [esp + 0x1c], eax
call main
mov edx, dword [esi + 0x18]
and edx, 0x3f
mov eax, 0x40
sub eax, edx
add esp, 0xc
cmp eax, 8
ja 0x422491
add eax, 0x40
mov ecx, dword [esi + 0x14]
mov ebp, dword [esi + 0x18]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ebp
shr edx, 0x1d
or ecx, edx
mov byte [ebx], 0x80
lea edx, [ebp*8]
mov dword [esp + 0x18], edx
mov edx, ecx
shr edx, 0x18
mov byte [eax + ebx - 8], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + ebx - 7], dl
mov edx, ecx
shr edx, 8
mov byte [eax + ebx - 6], dl
mov byte [eax + ebx - 5], cl
mov ecx, dword [esp + 0x18]
mov edx, ecx
shr edx, 0x18
mov byte [eax + ebx - 4], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + ebx - 3], dl
mov edx, ecx
mov byte [eax + ebx - 1], cl
mov ecx, dword [esp + 0x10]
push ecx
push eax
shr edx, 8
push ebx
push esi
mov byte [eax + ebx - 2], dl
call fcn.00422240
movzx edx, byte [esi + 3]
mov byte [edi], dl
movzx eax, byte [esi + 2]
mov byte [edi + 1], al
mov ecx, dword [esi]
shr ecx, 8
mov byte [edi + 2], cl
movzx edx, byte [esi]
mov byte [edi + 3], dl
movzx eax, byte [esi + 7]
mov byte [edi + 4], al
movzx ecx, byte [esi + 6]
mov byte [edi + 5], cl
mov edx, dword [esi + 4]
shr edx, 8
mov byte [edi + 6], dl
movzx eax, byte [esi + 4]
mov byte [edi + 7], al
movzx ecx, byte [esi + 0xb]
mov byte [edi + 8], cl
movzx edx, byte [esi + 0xa]
mov byte [edi + 9], dl
mov eax, dword [esi + 8]
shr eax, 8
mov byte [edi + 0xa], al
movzx ecx, byte [esi + 8]
mov byte [edi + 0xb], cl
movzx edx, byte [esi + 0xf]
mov byte [edi + 0xc], dl
movzx eax, byte [esi + 0xe]
mov byte [edi + 0xd], al
mov ecx, dword [esi + 0xc]
shr ecx, 8
mov byte [edi + 0xe], cl
movzx edx, byte [esi + 0xc]
mov byte [edi + 0xf], dl
movzx eax, byte [esi + 0x13]
mov byte [edi + 0x10], al
movzx ecx, byte [esi + 0x12]
mov byte [edi + 0x11], cl
mov edx, dword [esi + 0x10]
shr edx, 8
mov byte [edi + 0x12], dl
movzx eax, byte [esi + 0x10]
push esi
mov byte [edi + 0x13], al
call fcn.00422370
push 0x140
push 0
add esi, 0x60
push esi
call main
mov ecx, dword [esp + 0x8c]
add esp, 0x20
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042e764
add esp, 0x60
ret
Function at 0x42e764
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x43c4b0]
jne 0x42e76e
repz ret
jmp fcn.0042f000

Function at 0x42ee33
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x436140
call fcn.0042e950
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
cmp dword [0x43cb24], ebx
jne 0x42ebd6
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.kernel32.dll_HeapSetInformation]
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x43cb20
push ebx
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x42ec10
cmp eax, esi
jne 0x42ec03
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x42ec13
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x42ebea
xor esi, esi
inc esi
mov eax, dword [0x43cb1c]
cmp eax, esi
jne 0x42ec26
push 0x1f
call sub.MSVCR100.dll__amsg_exit
pop ecx
jmp 0x42ec61
mov eax, dword [0x43cb1c]
test eax, eax
jne 0x42ec5b
mov dword [0x43cb1c], esi
push 0x432410
push 0x432404
call sub.MSVCR100.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x42ec61
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x42ed73
mov dword [0x43c754], esi
mov eax, dword [0x43cb1c]
cmp eax, esi
jne 0x42ec85
push 0x432400
push 0x4323e4
call sub.MSVCR100.dll__initterm
pop ecx
pop ecx
mov dword [0x43cb1c], 2
cmp dword [ebp - 0x20], ebx
jne 0x42ec92
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x43cb28], ebx
je 0x42ecb3
push 0x43cb28
call main
pop ecx
test eax, eax
je 0x42ecb3
push ebx
push 2
push ebx
call dword [0x43cb28]
mov eax, dword [sym.imp.MSVCR100.dll__wcmdln]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp ecx, 0x20
ja 0x42ed14
cmp cx, bx
je 0x42eccf
cmp dword [ebp - 0x1c], ebx
jne 0x42ed14
movzx ecx, word [eax]
cmp cx, bx
je 0x42ece4
cmp ecx, 0x20
ja 0x42ece4
add eax, 2
mov dword [ebp - 0x24], eax
jmp 0x42eccf
test byte [ebp - 0x40], 1
je 0x42ecf0
movzx ecx, word [ebp - 0x3c]
jmp 0x42ecf3
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x400000
call main
mov dword [0x43c750], eax
cmp dword [0x43c744], ebx
jne 0x42ed59
push eax
call dword [sym.imp.MSVCR100.dll_exit]
cmp ecx, 0x22
jne 0x42ed24
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
add eax, 2
jmp 0x42ecba
cmp dword [0x43c754], ebx
jne 0x42ed67
call dword [sym.imp.MSVCR100.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x43c750]
call fcn.0042e995
ret
call main
jmp 0x42eba8
Function at 0x42fe44
Capabilities:
Get disk information

Disassembly:
push edi
mov ecx, esi
xor edi, edi
call fcn.0042a440
cmp dword [esi + 4], edi
jne 0x42fe57
xor eax, eax
pop edi
ret
mov ecx, esi
call fcn.0042a440
cmp dword [esi + 4], 1
jne 0x42fe81
push edi
mov ecx, esi
call main
movzx eax, ax
push eax
call main
add esp, 4
test al, al
je 0x42fe81
xor eax, eax
inc eax
pop edi
ret
mov ecx, esi
call fcn.0042a440
cmp dword [esi + 4], 3
jne 0x42fee6
push edi
mov ecx, esi
call main
movzx eax, ax
push eax
call dword [sym.imp.MSVCR100.dll_iswalpha]
pop ecx
test eax, eax
je 0x42fee6
push 1
mov ecx, esi
call main
cmp ax, 0x3a
jne 0x42fee6
push 2
mov ecx, esi
call main
movzx eax, ax
push eax
call main
add esp, 4
test al, al
je 0x42fee6
mov ecx, esi
call fcn.0042a440
push eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
xor ecx, ecx
inc ecx
cmp ecx, eax
sbb eax, eax
neg eax
pop edi
ret
mov ecx, esi
call fcn.0042a440
cmp dword [esi + 4], 2
jbe 0x43001c
push 0
mov ecx, esi
call main
movzx eax, ax
push eax
call main
add esp, 4
test al, al
je 0x43001c
push 1
mov ecx, esi
call main
movzx eax, ax
push eax
call main
add esp, 4
test al, al
je 0x43001c
push 2
pop edi
push edi
mov ecx, esi
call main
movzx eax, ax
push eax
call main
add esp, 4
test al, al
jne 0x42fe53
mov ecx, esi
inc edi
call fcn.0042a440
cmp edi, dword [esi + 4]
jae 0x42ff75
push edi
mov ecx, esi
call main
movzx eax, ax
push eax
call main
add esp, 4
test al, al
je 0x42ff50
mov ecx, esi
call fcn.0042a440
cmp dword [esi + 4], edi
je 0x42fe53
mov ecx, esi
inc edi
call fcn.0042a440
cmp dword [esi + 4], edi
je 0x42fe53
push edi
mov ecx, esi
call main
movzx eax, ax
push eax
call main
add esp, 4
test al, al
jne 0x42fe53
mov ecx, esi
inc edi
call fcn.0042a440
cmp edi, dword [esi + 4]
jae 0x42ffd7
push edi
mov ecx, esi
call main
movzx eax, ax
push eax
call main
add esp, 4
test al, al
je 0x42ffb2
mov ecx, esi
call fcn.0042a440
lea eax, [edi + 1]
cmp dword [esi + 4], eax
ja 0x42fe53
mov ecx, esi
call fcn.0042a440
cmp dword [esi + 4], edi
jne 0x430005
movzx eax, word [0x43c4d0]
push eax
mov ecx, esi
call main
mov ecx, esi
call fcn.0042a440
push eax
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
xor ecx, ecx
inc ecx
cmp ecx, eax
sbb edi, edi
neg edi
mov eax, edi
pop edi
ret
Function at 0x43006f
Capabilities:
Check if file exists

Disassembly:
push 0x49c
mov eax, 0x4311d4
call fcn.0042e7e3
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ecx, esi
call fcn.0042a440
xor ebx, ebx
cmp dword [esi + 4], ebx
jne 0x43009c
mov eax, 0xffffe89d
jmp 0x4302c7
push ebx
push 0xffffffffffffffff
push 0x434240
lea ecx, [ebp - 0x488]
call fcn.0042abfe
push ebx
lea eax, [ebp - 0x488]
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0042b3a7
cmp eax, 0xffffffff
setne bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
call fcn.004076dd
lea ecx, [ebp - 0x480]
call fcn.004076dd
test bl, bl
je 0x4300ef
mov eax, 0xffffe8c2
jmp 0x4302c7
mov ecx, esi
call fcn.0042a440
mov ebx, dword [sym.imp.kernel32.dll_FindFirstFileW]
lea ecx, [ebp - 0x46c]
push ecx
push eax
call ebx
mov dword [ebp - 0x470], eax
cmp eax, 0xffffffff
jne 0x430227
mov ecx, esi
call fcn.0042a440
lea ecx, [ebp - 0x48c]
push ecx
lea ecx, [ebp - 0x21c]
push ecx
mov esi, 0x105
push esi
push eax
call dword [sym.imp.kernel32.dll_GetFullPathNameW]
mov dword [ebp - 0x470], eax
test eax, eax
jne 0x430147
inc eax
jmp 0x4302c7
cmp eax, esi
jbe 0x430155
mov eax, 0xffffe8c1
jmp 0x4302c7
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x488]
call fcn.0042a71a
lea esi, [ebp - 0x488]
mov dword [ebp - 4], 1
call fcn.0042fe44
test eax, eax
je 0x4301b4
xor eax, eax
mov dword [edi], 2
mov dword [edi + 4], eax
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
xor esi, esi
lea ecx, [ebp - 0x478]
call fcn.004076dd
lea ecx, [ebp - 0x480]
call fcn.004076dd
mov eax, esi
jmp 0x4302c7
mov ecx, dword [ebp - 0x470]
lea ecx, [ebp + ecx*2 - 0x21e]
movzx eax, word [ecx]
push eax
call main
add esp, 4
test al, al
jne 0x4301ed
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
je 0x4301e6
cmp eax, 3
je 0x4301e6
xor esi, esi
inc esi
jmp 0x430197
mov esi, 0xffffe8c2
jmp 0x430197
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x46c]
push eax
lea eax, [ebp - 0x21c]
push eax
call ebx
mov dword [ebp - 0x470], eax
cmp eax, 0xffffffff
je 0x4301d1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x478]
call fcn.004076dd
lea ecx, [ebp - 0x480]
call fcn.004076dd
push dword [ebp - 0x470]
call dword [sym.imp.kernel32.dll_FindClose]
test byte [ebp - 0x46c], 0x10
push 0
pop eax
setne al
xor ebx, ebx
inc eax
mov dword [edi], eax
cmp dword [ebp - 0x450], ebx
je 0x43027b
push ebx
push 0xffffffffffffffff
push str.file_size_larger_than_4GB_encountered
lea ecx, [ebp - 0x4a4]
mov dword [ebp - method.RSException.virtual_0], vtable.RSException.0
call fcn.0042abfe
push 0x435834
lea eax, [ebp - 0x4a8]
push eax
call sub.MSVCR100.dll__CxxThrowException
mov eax, dword [ebp - 0x44c]
mov dword [edi + 4], eax
lea esi, [edi + 0x10]
lea eax, [ebp - 0x458]
push esi
push eax
call main
pop ecx
pop ecx
cmp dword [ebp - 0x468], ebx
jne 0x4302b3
cmp dword [ebp - 0x464], ebx
jne 0x4302b3
mov eax, dword [esi]
mov dword [edi + 8], eax
mov eax, dword [esi + 4]
mov dword [edi + 0xc], eax
jmp 0x4302c5
add edi, 8
lea eax, [ebp - 0x468]
push edi
push eax
call main
pop ecx
pop ecx
xor eax, eax
call fcn.0042e866
ret
Function at 0x40112e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp esi, 6
jl 0x4012b9
lea eax, [esi - 6]
and eax, 0x80000003
jns 0x401152
dec eax
or eax, 0xfffffffc
inc eax
jne 0x4012b9
mov edi, dword [ebp + 0xc]
push dword [edi + 4]
call fcn.0040d78e
pop ecx
test eax, eax
je 0x401187
push str.Failed_to_initialize_NSS_n
push 2
call dword [sym.imp.nss3.dll_PR_GetSpecialFD]
pop ecx
push eax
call dword [sym.imp.nss3.dll_PR_fprintf]
pop ecx
pop ecx
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, esi
shl eax, 8
push eax
call sub.nss3.dll_PORT_NewArena
mov dword [ebp - 8], eax
pop ecx
test eax, eax
jne 0x4011a6
push str.PORT_NewArena_failed
call fcn.0040d961
jmp 0x40117e
push 5
pop ebx
cmp esi, ebx
jle 0x401240
add edi, 0x10
mov eax, dword [edi - 4]
mov ecx, dword [edi - 8]
mov dword [ebp - 4], eax
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
push ecx
mov dword [ebp - 0x10], ecx
call fcn.00401040
pop ecx
pop ecx
test al, al
je 0x4012af
push 0
push dword [ebp - 4]
call sub.nss3.dll_PK11_FindCertFromNickname
mov dword [ebp + 8], eax
pop ecx
pop ecx
test eax, eax
je 0x40129a
push dword [ebp - 0x14]
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x18]
call fcn.0040d068
add esp, 0x10
test eax, eax
je 0x401277
push dword [eax]
push dword [ebp - 0xc]
call fcn.0040109e
pop ecx
pop ecx
test al, al
je 0x401257
cmp dword [ebp + 8], 0
je 0x40122f
push dword [ebp + 8]
call sub.nss3.dll_CERT_DestroyCertificate
pop ecx
add ebx, 4
add edi, 0x10
cmp ebx, esi
jl 0x4011b4
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
test eax, eax
je 0x401251
push 0
push eax
call sub.nss3.dll_PORT_FreeArena
pop ecx
pop ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
push dword [ebp - 0xc]
push str.Failed_to_write_file__s_n
push 2
call dword [sym.imp.nss3.dll_PR_GetSpecialFD]
pop ecx
push eax
call dword [sym.imp.nss3.dll_PR_fprintf]
add esp, 0xc
jmp 0x40117f
push dword [ebp - 4]
push dword [ebp - 0x10]
push str.Failed_to_generate_OCSP_response_of_type__s_for__s_n
push 2
call dword [sym.imp.nss3.dll_PR_GetSpecialFD]
pop ecx
push eax
call dword [sym.imp.nss3.dll_PR_fprintf]
add esp, 0x10
jmp 0x40117f
push str.PK11_FindCertFromNickname_failed
call fcn.0040d961
pop ecx
push dword [ebp - 4]
push str.Failed_to_find_certificate_with_nick__s_n
jmp 0x40125f
push dword [ebp - 0x10]
push str.Cannot_generate_OCSP_response_of_type__s_n
jmp 0x40125f
mov eax, dword [ebp + 0xc]
push dword [eax]
push str.usage:__s__NSS_DB_directory___responsetype___cert_nick___extranick___outfilename____resptype___cert_nick___extranick___outfilename____n
jmp 0x40125f