joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422400
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x48
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0x44], eax
cmp word [esp + 0x4c], 4
push esi
mov esi, dword [esp + 0x54]
mov word [esi], 0
jbe 0x422434
xor al, al
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.0052bfb9
add esp, 0x48
ret 8
push str.SYSTEM.INI
call fcn.00405ef0
movzx eax, ax
add eax, 1
cmp eax, 0x10
jg 0x422480
mov al, 0x49
mov byte [esp + 4], 0x53
mov byte [esp + 5], 0x59
mov byte [esp + 6], 0x53
mov byte [esp + 7], 0x54
mov byte [esp + 8], 0x45
mov byte [esp + 9], 0x4d
mov byte [esp + 0xa], 0x2e
mov byte [esp + 0xb], al
mov byte [esp + 0xc], 0x4e
mov byte [esp + 0xd], al
mov byte [esp + 0xe], 0
push str.Sentinel
call fcn.00405ef0
movzx ecx, ax
add ecx, 1
cmp ecx, 0x10
jg 0x4224c2
mov cl, 0x65
mov al, 0x6e
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], cl
mov byte [esp + 0x16], al
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], 0
push str.port
call fcn.00405ef0
movzx edx, ax
add edx, 2
cmp edx, 0x10
jg 0x4224f0
mov byte [esp + 0x24], 0x70
mov byte [esp + 0x25], 0x6f
mov byte [esp + 0x26], 0x72
mov byte [esp + 0x27], 0x74
mov byte [esp + 0x28], 0
lea eax, [esp + 0x24]
push eax
call fcn.00405ef0
movzx eax, ax
cmp ax, 0x10
jae 0x422511
mov cl, byte [esp + 0x50]
movzx edx, ax
add cl, 0x31
mov byte [esp + edx + 0x24], cl
lea eax, [esp + 4]
push eax
push 0x14
lea ecx, [esp + 0x3c]
push ecx
push 0x57a034
lea edx, [esp + 0x34]
push edx
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x422584
push 0x2c
lea ecx, [esp + 0x38]
push ecx
call fcn.00422210
movzx eax, ax
cmp ax, 0x10
jae 0x422584
movzx eax, ax
mov dl, byte [esp + eax + 0x35]
and dl, 0xdf
cmp dl, 0x54
jne 0x422584
cmp byte [esp + eax + 0x36], 0x3a
jne 0x422584
push esi
lea eax, [esp + eax + 0x3b]
push eax
call fcn.00405f40
test al, al
je 0x42257f
movzx eax, word [esi]
cmp ax, 1
jl 0x42257f
cmp ax, 7
jle 0x422584
mov word [esi], 0
mov ecx, dword [esp + 0x48]
xor eax, eax
cmp word [esi], ax
pop esi
setne al
xor ecx, esp
call fcn.0052bfb9
add esp, 0x48
ret 8
Function at 0x4225a0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x54
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0x50], eax
push esi
push edi
mov edi, dword [esp + 0x64]
push str.SYSTEM.INI
call fcn.00405ef0
movzx eax, ax
add eax, 1
cmp eax, 0x10
jg 0x422600
mov al, 0x49
mov byte [esp + 8], 0x53
mov byte [esp + 9], 0x59
mov byte [esp + 0xa], 0x53
mov byte [esp + 0xb], 0x54
mov byte [esp + 0xc], 0x45
mov byte [esp + 0xd], 0x4d
mov byte [esp + 0xe], 0x2e
mov byte [esp + 0xf], al
mov byte [esp + 0x10], 0x4e
mov byte [esp + 0x11], al
mov byte [esp + 0x12], 0
push str.Sentinel
call fcn.00405ef0
movzx ecx, ax
add ecx, 1
cmp ecx, 0x10
jg 0x422642
mov al, 0x6e
mov byte [esp + 0x28], 0x53
mov byte [esp + 0x29], 0x65
mov byte [esp + 0x2a], al
mov byte [esp + 0x2b], 0x74
mov byte [esp + 0x2c], 0x69
mov byte [esp + 0x2d], al
mov byte [esp + 0x2e], 0x65
mov byte [esp + 0x2f], 0x6c
mov byte [esp + 0x30], 0
push str.PortVerify
call fcn.00405ef0
movzx edx, ax
add edx, 1
cmp edx, 0x10
jg 0x42268e
mov al, 0x72
mov byte [esp + 0x18], 0x50
mov byte [esp + 0x19], 0x6f
mov byte [esp + 0x1a], al
mov byte [esp + 0x1b], 0x74
mov byte [esp + 0x1c], 0x56
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x1e], al
mov byte [esp + 0x1f], 0x69
mov byte [esp + 0x20], 0x66
mov byte [esp + 0x21], 0x79
mov byte [esp + 0x22], 0
push str.TRUE
call fcn.00405ef0
movzx eax, ax
add eax, 1
cmp eax, 0x10
jg 0x4226bc
mov byte [esp + 0x38], 0x54
mov byte [esp + 0x39], 0x52
mov byte [esp + 0x3a], 0x55
mov byte [esp + 0x3b], 0x45
mov byte [esp + 0x3c], 0
lea ecx, [esp + 8]
push ecx
push 0x10
lea edx, [esp + 0x50]
push edx
push 0x57a034
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, eax
test esi, esi
je 0x4226f4
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x3c]
push eax
call fcn.00406000
mov byte [edi], al
mov ecx, dword [esp + 0x58]
xor eax, eax
test esi, esi
pop edi
setne al
pop esi
xor ecx, esp
call fcn.0052bfb9
add esp, 0x54
ret 8
Function at 0x422710
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x34
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov esi, dword [esp + 0x3c]
push str.SYSTEM.INI
call fcn.00405ef0
movzx eax, ax
add eax, 1
cmp eax, 0x10
jg 0x42276f
mov al, 0x49
mov byte [esp + 4], 0x53
mov byte [esp + 5], 0x59
mov byte [esp + 6], 0x53
mov byte [esp + 7], 0x54
mov byte [esp + 8], 0x45
mov byte [esp + 9], 0x4d
mov byte [esp + 0xa], 0x2e
mov byte [esp + 0xb], al
mov byte [esp + 0xc], 0x4e
mov byte [esp + 0xd], al
mov byte [esp + 0xe], 0
push str.Sentinel
call fcn.00405ef0
movzx ecx, ax
add ecx, 1
cmp ecx, 0x10
jg 0x4227b1
mov al, 0x6e
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], al
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], al
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], 0
push str.delay
call fcn.00405ef0
movzx edx, ax
add edx, 1
cmp edx, 0x10
jg 0x4227e4
mov byte [esp + 0x24], 0x64
mov byte [esp + 0x25], 0x65
mov byte [esp + 0x26], 0x6c
mov byte [esp + 0x27], 0x61
mov byte [esp + 0x28], 0x79
mov byte [esp + 0x29], 0
lea eax, [esp + 4]
push eax
push 0
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
xor ecx, ecx
test eax, eax
setne cl
mov word [esi], ax
mov al, cl
mov ecx, dword [esp + 0x34]
pop esi
xor ecx, esp
call fcn.0052bfb9
add esp, 0x34
ret 4
Function at 0x422820
Capabilities:
Contain obfuscated stackstrings
Read .ini file

Disassembly:
sub esp, 0x74
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0x70], eax
push esi
mov esi, dword [esp + 0x7c]
push 0x10
push 0
lea eax, [esp + 0x6c]
push eax
mov word [esi], 0
call fcn.00405f10
push str.SYSTEM.INI
call fcn.00405ef0
movzx ecx, ax
add ecx, 1
cmp ecx, 0x10
jg 0x422892
mov byte [esp + 4], 0x53
mov byte [esp + 5], 0x59
mov byte [esp + 6], 0x53
mov byte [esp + 7], 0x54
mov byte [esp + 8], 0x45
mov byte [esp + 9], 0x4d
mov byte [esp + 0xa], 0x2e
mov byte [esp + 0xb], 0x49
mov byte [esp + 0xc], 0x4e
mov byte [esp + 0xd], 0x49
mov byte [esp + 0xe], 0
push str.Sentinel
call fcn.00405ef0
movzx edx, ax
add edx, 1
cmp edx, 0x10
jg 0x4228d4
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x15], 0x65
mov byte [esp + 0x16], 0x6e
mov byte [esp + 0x17], 0x74
mov byte [esp + 0x18], 0x69
mov byte [esp + 0x19], 0x6e
mov byte [esp + 0x1a], 0x65
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1c], 0
push str.machine
call fcn.00405ef0
movzx eax, ax
add eax, 1
cmp eax, 0x10
jg 0x422911
mov byte [esp + 0x44], 0x6d
mov byte [esp + 0x45], 0x61
mov byte [esp + 0x46], 0x63
mov byte [esp + 0x47], 0x68
mov byte [esp + 0x48], 0x69
mov byte [esp + 0x49], 0x6e
mov byte [esp + 0x4a], 0x65
mov byte [esp + 0x4b], 0
push str.NEC9800
call fcn.00405ef0
movzx ecx, ax
add ecx, 1
cmp ecx, 0x10
jg 0x42294e
mov al, 0x30
mov byte [esp + 0x24], 0x4e
mov byte [esp + 0x25], 0x45
mov byte [esp + 0x26], 0x43
mov byte [esp + 0x27], 0x39
mov byte [esp + 0x28], 0x38
mov byte [esp + 0x29], al
mov byte [esp + 0x2a], al
mov byte [esp + 0x2b], 0
push str.FUJITSU
call fcn.00405ef0
movzx edx, ax
add edx, 1
cmp edx, 0x10
jg 0x42298b
mov al, 0x55
mov byte [esp + 0x34], 0x46
mov byte [esp + 0x35], al
mov byte [esp + 0x36], 0x4a
mov byte [esp + 0x37], 0x49
mov byte [esp + 0x38], 0x54
mov byte [esp + 0x39], 0x53
mov byte [esp + 0x3a], al
mov byte [esp + 0x3b], 0
push 0x5b2af4
call fcn.00405ef0
movzx eax, ax
add eax, 1
cmp eax, 0x10
jg 0x4229b4
mov byte [esp + 0x54], 0x49
mov byte [esp + 0x55], 0x42
mov byte [esp + 0x56], 0x4d
mov byte [esp + 0x57], 0
lea ecx, [esp + 4]
push ecx
push 0x10
lea edx, [esp + 0x6c]
push edx
push 0x57a034
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x422a25
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x68]
push eax
call fcn.00406000
test al, al
je 0x4229f3
mov word [esi], 2
jmp 0x422a25
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x68]
push edx
call fcn.00406000
test al, al
je 0x422a0d
mov word [esi], 3
jmp 0x422a25
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x68]
push ecx
call fcn.00406000
test al, al
je 0x422a25
mov word [esi], 1
mov ecx, dword [esp + 0x74]
xor eax, eax
cmp word [esi], ax
pop esi
setne al
xor ecx, esp
call fcn.0052bfb9
add esp, 0x74
ret 4
Function at 0x4241e0
Capabilities:
Check os version

Disassembly:
sub esp, 0xac
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0xa8], eax
push esi
mov esi, dword [esp + 0xb4]
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x14], 2
jne 0x4242c7
cmp dword [esp + 8], 5
jne 0x4242c7
cmp dword [esp + 0xc], 0
jne 0x4242c7
mov al, 0x5c
mov cl, 0x6c
mov byte [esp + 0x98], al
mov byte [esp + 0x99], al
mov byte [esp + 0x9b], al
mov dl, 0x62
mov byte [esp + 0xa2], al
mov al, 0x6e
mov byte [esp + 0x9c], 0x47
mov byte [esp + 0x9d], cl
mov byte [esp + 0x9e], 0x6f
mov byte [esp + 0x9f], dl
mov byte [esp + 0xa0], 0x61
mov byte [esp + 0xa1], cl
mov byte [esp + 0xa3], 0x53
mov byte [esp + 0xa4], al
mov byte [esp + 0xa5], 0x74
mov byte [esp + 0xa6], al
mov byte [esp + 0xa7], cl
mov byte [esp + 0xa8], 0x55
mov byte [esp + 0xa9], 0x73
mov byte [esp + 0xaa], dl
mov byte [esp + 0xab], 0
jmp 0x424326
mov al, 0x5c
mov byte [esp + 0x98], al
mov byte [esp + 0x99], al
mov byte [esp + 0x9b], al
mov al, 0x6e
mov byte [esp + 0x9c], 0x53
mov byte [esp + 0x9d], al
mov byte [esp + 0x9e], 0x74
mov byte [esp + 0x9f], al
mov byte [esp + 0xa0], 0x6c
mov byte [esp + 0xa1], 0x55
mov byte [esp + 0xa2], 0x73
mov byte [esp + 0xa3], 0x62
mov byte [esp + 0xa4], 0
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
lea ecx, [esp + 0xb0]
push ecx
mov byte [esp + 0xb6], 0x2e
call fcn.00423620
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x4243a6
call fcn.00423ee0
add eax, 0xfffffffe
cmp eax, 1
ja 0x42437d
mov ax, 0x20c
pop esi
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.0052bfb9
add esp, 0xac
ret 8
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x42438a
push eax
call fcn.00423aa0
mov ax, 0x20b
pop esi
mov ecx, dword [esp + 0xa8]
xor ecx, esp
call fcn.0052bfb9
add esp, 0xac
ret 8
mov ecx, dword [esp + 0xac]
pop esi
xor ecx, esp
mov ax, 0x200
call fcn.0052bfb9
add esp, 0xac
ret 8
Function at 0x43ea60
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x5ed284]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 4
push dword [ebp - 8]
mov edi, eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov ecx, dword [ebp - 8]
add esp, 8
xor ebx, ebx
mov dword [ebp - 0x10], eax
test ecx, ecx
jle 0x43eaf2
sub eax, edi
mov dword [ebp - 0xc], eax
push esi
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [edi]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, eax
push esi
push 1
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov ecx, dword [ebp - 0xc]
add esp, 8
push 0
push 0
push esi
push eax
push 0xffffffffffffffff
push dword [edi]
mov dword [ecx + edi], eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 8]
lea edi, [edi + 4]
inc ebx
cmp ebx, ecx
jl 0x43eaa5
mov eax, dword [ebp - 0x10]
pop esi
mov edx, eax
call fcn.0043e0f0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4841d0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57572f
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x5ed284]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x220], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_void_]
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 1
push str.msiexec__i__
push eax
call dword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const___int_]
add esp, 0xc
mov dword [ebp - 0x220], 1
lea eax, [esi + 0x5c]
lea ecx, [ebp - 0x21c]
push eax
call dword [0x5786f4]
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x214]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::constructor_class_QString_const__]
push 0xffffffffffffffff
lea eax, [ebp - 0x224]
mov dword [ebp - 0x220], 3
push str.__REINSTALLALL_REINSTALLMODEvomus
push eax
call dword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QString::fromUtf8_char_const___int_]
add esp, 0xc
push eax
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 3
call dword [0x5786f4]
lea ecx, [ebp - 0x224]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x218]
call dword [sym.imp.Qt5Core.dll_public:_class_QString____thiscall_QString::operator_class_QString_const__]
lea ecx, [ebp - 0x214]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x218]
call dword [sym.imp.Qt5Core.dll__toLocal8Bit_QString__QGBE_AVQByteArray__XZ]
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 4
call dword [sym.imp.Qt5Core.dll_public:_bool___thiscall_QByteArray::isNull_void_const]
test al, al
jne 0x484328
mov eax, dword [ebp - 0x214]
lea ecx, [ebp - 0x214]
cmp dword [eax + 4], 0x200
jg 0x48432e
call dword [sym.imp.Qt5Core.dll_public:_char_const____thiscall_QByteArray::constData_void_const]
push eax
lea eax, [ebp - 0x210]
push 0x200
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
add esp, 0xc
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 0
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QByteArray::destructor_void_]
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0
call dword [sym.imp.Qt5Core.dll_public:_static_void___cdecl_QCoreApplication::exit_int_]
add esp, 4
lea ecx, [ebp - 0x218]
call dword [sym.imp.Qt5Core.dll_public:_void___thiscall_QString::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052bfb9
mov esp, ebp
pop ebp
ret
Function at 0x48aff0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x30]
test ecx, ecx
je 0x48b01b
call dword [sym.imp.Qt5Widgets.dll_public:_class_QWidget____thiscall_QStackedWidget::currentWidget_void_const]
cmp eax, dword [esi + 0x34]
jne 0x48b01b
push ecx
push esp
mov ecx, esi
call dword [sym.imp.Qt5Widgets.dll_public:_class_QByteArray___thiscall_QWidget::saveGeometry_void_]
call fcn.0043f420
add esp, 4
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x494920
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.0052c8c0
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x4949bf
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4949bf
lea eax, [esp + 0x114]
push eax
push 0
push dword [esp + 0x118]
lea eax, [esp + 0x14]
push 0x100
push eax
call fcn.004531c0
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call sub.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf
add esp, 0x1c
or ecx, 0xffffffff
test eax, eax
cmovs eax, ecx
lea ecx, [esp + 4]
push 0
push ecx
test eax, eax
mov ecx, 0x100
cmovs eax, ecx
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0052bfb9
add esp, 0x108
ret
lea eax, [esp + 0x114]
push eax
push 0
push dword [esp + 0x118]
lea eax, [esp + 0x14]
push 0xff
push eax
call fcn.004531c0
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call sub.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf
add esp, 0x1c
mov byte [esp + 0x107], 0
call fcn.004947e0
test eax, eax
jle 0x494a53
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x494a67
push 0
lea eax, [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0052bfb9
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0052bfb9
add esp, 0x108
ret
Function at 0x4bb6c0
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
push dword [esp + 0x10]
call fcn.004bb7a0
mov edi, eax
add esp, 8
test edi, edi
jne 0x4bb749
push 0xaf
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.00494060
push 0x592ef0
push esi
push 0x592ef4
push dword [esp + 0x2c]
push str.fopen_
push 5
call fcn.00493840
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov edx, 2
mov ecx, dword [eax]
xor eax, eax
cmp ecx, 2
setne al
lea eax, [eax*2 + 0xb2]
push eax
push str..crypto_bio_bss_file.c
mov eax, 0x80
cmovne eax, edx
push eax
push 0x6d
push 0x20
call fcn.00494060
add esp, 0x40
xor eax, eax
pop edi
pop esi
ret
push 0x5ec4d0
call fcn.00492de0
mov esi, eax
add esp, 4
test esi, esi
jne 0x4bb76a
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 4
xor eax, eax
pop edi
pop esi
ret
push 0
push esi
call fcn.00492a10
push edi
push 1
push 0x6a
push esi
call fcn.00492a40
add esp, 0x18
mov eax, esi
pop edi
pop esi
ret

Function at 0x4bcde0
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [esp + 0xc]
push ebp
xor ebp, ebp
test edx, edx
jle 0x4bcec2
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
inc edi
nop dword [eax + eax]
movzx eax, byte [edi - 1]
cmp edx, 3
jl 0x4bce53
movzx ecx, byte [edi]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 1]
shl eax, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], cl
mov ecx, eax
shr ecx, 0xc
inc esi
and ecx, 0x3f
mov ebx, esi
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], cl
mov ecx, eax
and ecx, 0x3f
shr eax, 6
and eax, 0x3f
mov ch, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x4bce9c
shl eax, 0x10
cmp edx, 2
jne 0x4bce63
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
lea ebx, [esi + 1]
shr ecx, 0x12
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], cl
mov ecx, eax
shr ecx, 0xc
mov esi, ebx
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx], cl
cmp edx, 1
jne 0x4bce8e
mov cl, 0x3d
jmp 0x4bce9a
shr eax, 6
and eax, 0x3f
mov cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ch, 0x3d
lea eax, [esi + 2]
mov byte [ebx + 1], cl
sub edx, 3
mov byte [eax], ch
add ebp, 4
lea esi, [eax + 1]
add edi, 3
test edx, edx
jg 0x4bce00
pop edi
mov byte [esi], 0
mov eax, ebp
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esp + 8]
mov byte [eax], 0
mov eax, ebp
pop ebp
ret
Function at 0x4c2a10
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x4c2ad9
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x4c2a31
cmp al, 0x6b
jne 0x4c2ad9
inc ecx
cmp al, 0x6b
jne 0x4c2a9b
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x4c2a52
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x4c2a52
cmp dl, 0xbb
jne 0x4c2a7b
inc eax
cmp eax, esi
jl 0x4c2a40
sub esi, eax
test eax, eax
jne 0x4c2a9e
push 0x83
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00494060
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x7b
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00494060
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x4c2ac7
push 0x8b
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.00494060
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x70
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.00494060
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x4c71a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x70
call fcn.0052c8c0
mov eax, dword [0x5ed284]
xor eax, esp
mov dword [esp + 0x6c], eax
cmp dword [esp + 0x88], 0x40000000
mov eax, dword [esp + 0x7c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x84]
push ebp
mov ebp, dword [esp + 0x78]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x90]
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], 0
ja 0x4c7377
mov esi, dword [esp + 0x80]
cmp esi, 0x40000000
ja 0x4c7377
cmp dword [esp + 0x88], 0x40000000
ja 0x4c7377
push ebx
push edi
push eax
call fcn.00495000
mov edi, eax
lea eax, [esp + 0x28]
push eax
call fcn.00491a60
push 0
push dword [esp + 0x20]
lea eax, [esp + 0x34]
mov ebx, 1
push eax
call fcn.00491510
push dword [esp + 0xa4]
lea eax, [esp + 0x3c]
mov dword [esp + 0x28], 0x1000000
push dword [esp + 0x30]
push eax
call fcn.004916b0
add esp, 0x20
test eax, eax
je 0x4c7353
push 4
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004916b0
add esp, 0xc
test eax, eax
je 0x4c7353
push dword [esp + 0x98]
lea eax, [esp + 0x28]
push dword [esp + 0x24]
push eax
call fcn.004916b0
add esp, 0xc
test eax, eax
je 0x4c7353
push 0
cmp esi, edi
jb 0x4c731b
lea eax, [esp + 0x28]
push ebp
push eax
call fcn.00491440
add esp, 0xc
test eax, eax
je 0x4c7353
sub esi, edi
je 0x4c734b
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x2c]
add ebp, edi
push eax
inc ebx
call fcn.00491510
push dword [esp + 0x9c]
mov eax, ebx
mov byte [esp + 0x23], bl
push dword [esp + 0x28]
shr eax, 8
mov byte [esp + 0x26], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x25], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x24], al
lea eax, [esp + 0x38]
push eax
call fcn.004916b0
add esp, 0x18
test eax, eax
jne 0x4c7267
jmp 0x4c7353
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00491440
add esp, 0xc
test eax, eax
je 0x4c7353
push esi
lea eax, [esp + 0x40]
push eax
push ebp
call sub.VCRUNTIME140.dll_memcpy
lea eax, [esp + 0x48]
push edi
push eax
call fcn.004944b0
add esp, 0x14
mov dword [esp + 0x1c], 1
lea eax, [esp + 0x24]
push eax
call fcn.004916c0
mov eax, dword [esp + 0x20]
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.0052bfb9
add esp, 0x70
ret
mov ecx, dword [esp + 0x74]
xor eax, eax
pop esi
pop ebp
xor ecx, esp
call fcn.0052bfb9
add esp, 0x70
ret