joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b360
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
xor eax, eax
jne 0x41b383
xor eax, eax
jne 0x41b383
mov esi, esp
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.004744d2
pop edi
pop esi
pop ebx
add esp, 0xcc
cmp ebp, esp
call fcn.004744d2
mov esp, ebp
pop ebp
ret 8

Function at 0x41b3d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xd8]
mov ecx, 0x36
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
xor eax, eax
jne 0x41b3f3
xor eax, eax
jne 0x41b3f3
xor eax, eax
cmp dword [ebp + 0xc], 0
setne al
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x41b414
mov eax, 0xd
jmp 0x41b453
xor eax, eax
jne 0x41b3fb
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.004744d2
lea ecx, [eax + eax + 2]
mov esi, esp
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.004744d2
pop edi
pop esi
pop ebx
add esp, 0xd8
cmp ebp, esp
call fcn.004744d2
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41b470
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xfc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xfc]
mov ecx, 0x3f
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
xor eax, eax
jne 0x41b493
xor eax, eax
jne 0x41b493
xor eax, eax
cmp dword [ebp + 0xc], 0
setne al
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x41b4b4
mov eax, 0xd
jmp 0x41b521
xor eax, eax
jne 0x41b49b
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp esi, esp
call fcn.004744d2
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + eax*2]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
lea edx, [ecx + eax*2]
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x2c], 1
jne 0x41b4c5
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, esp
call fcn.004744d2
pop edi
pop esi
pop ebx
add esp, 0xfc
cmp ebp, esp
call fcn.004744d2
mov esp, ebp
pop ebp
ret 8
Function at 0x425380
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x490cf3
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x1cc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x1dc]
mov ecx, 0x73
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x4abc14]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
call fcn.00406630
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x58]
call fcn.00431180
mov dword [ebp - 4], 0
mov esi, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp esi, esp
call fcn.004744d2
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov esi, esp
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
cmp esi, esp
call fcn.004744d2
mov dword [ebp - 0x64], eax
lea ecx, [ebp - 0xf0]
call fcn.00431180
mov byte [ebp - 4], 1
cmp dword [ebp - 0x64], 0
jle 0x4254f9
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x64]
add eax, 1
push eax
lea ecx, [ebp - 0xf0]
call fcn.00427820
jmp 0x425454
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xf0]
call fcn.00431080
test eax, eax
jne 0x42549d
mov dword [ebp - 0x1d4], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf0]
call fcn.004274b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00426eb0
mov eax, dword [ebp - 0x1d4]
jmp 0x425575
mov eax, dword [ebp - 0x64]
add eax, 1
mov esi, esp
push eax
lea ecx, [ebp - 0xf0]
call fcn.00431080
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp esi, esp
call fcn.004744d2
test eax, eax
jne 0x4254f9
mov dword [ebp - 0x1c8], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf0]
call fcn.004274b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00426eb0
mov eax, dword [ebp - 0x1c8]
jmp 0x425575
lea ecx, [ebp - 0xf0]
call fcn.00431080
push eax
call fcn.0041e7b0
add esp, 4
mov esi, esp
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
cmp esi, esp
call fcn.004744d2
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp dword [ebp - 0x64], 0
jne 0x425534
mov dword [ebp - 0x1dc], 0
jmp 0x425545
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [eax], 0
setne cl
mov dword [ebp - 0x1dc], ecx
mov edx, dword [ebp - 0x1dc]
mov dword [ebp - 0x1bc], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xf0]
call fcn.004274b0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.00426eb0
mov eax, dword [ebp - 0x1bc]
push edx
mov ecx, ebp
push eax
lea edx, [0x4255b4]
call fcn.004744f5
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004744c3
add esp, 0x1dc
cmp ebp, esp
call fcn.004744d2
mov esp, ebp
pop ebp
ret 4
Function at 0x432700
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
push edi
lea edi, [ebp - 0x12c]
mov ecx, 0x4b
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
call fcn.00425ab0
call fcn.00432c10
mov dword [ebp - 8], eax
push 5
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00432bc0
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4328c3
push 0xf0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.00432bc0
add esp, 0xc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x38], 0
cmp dword [ebp - 0x20], 0
je 0x4327ae
mov esi, esp
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp esi, esp
call fcn.004744d2
mov dword [ebp - 0x2c], eax
xor eax, eax
jne 0x432790
xor eax, eax
jne 0x432790
mov esi, esp
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp esi, esp
call fcn.004744d2
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x44], 0
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp esi, esp
call fcn.004744d2
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
je 0x432898
mov esi, esp
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp esi, esp
call fcn.004744d2
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x432884
mov eax, dword [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
call fcn.004328e0
add esp, 8
mov dword [ebp - 0x68], eax
mov esi, esp
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x68]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
cmp esi, esp
call fcn.004744d2
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.00432c40
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x432857
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004744d2
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x5c]
je 0x432882
mov esi, esp
mov eax, dword [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
cmp esi, esp
call fcn.004744d2
mov esi, esp
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp esi, esp
call fcn.004744d2
jmp 0x432896
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004744d2
mov dword [ebp - 0x44], eax
jmp 0x4328aa
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp esi, esp
call fcn.004744d2
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x4328c3
mov esi, esp
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, esp
call fcn.004744d2
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
add esp, 0x12c
cmp ebp, esp
call fcn.004744d2
mov esp, ebp
pop ebp
ret
Function at 0x434d80
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x37c
push ebx
push esi
push edi
lea edi, [ebp - 0x37c]
mov ecx, 0xdf
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x4abc14]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [0x4ad2f0], eax
mov eax, dword [ebp + 0x10]
push eax
call fcn.0041e7b0
add esp, 4
push eax
lea ecx, [ebp - 0x234]
call fcn.00440cd0
push 0x47bb
push str.sUhhddpqMgjrth2gNYRtcNrnecpuIc
push 0x302c
push 0x33f4
call fcn.004566b0
add esp, 0x10
push eax
push 0
mov ecx, 0x4ad2f8
call fcn.00471220
push 1
mov ecx, 0x4ad2f8
call fcn.004710e0
mov dword [ebp - 0x240], eax
push 0x1e7
push str.teQHicVxq9Yckthsmu4
push 0x696c
push 0x4ab8
call fcn.004566b0
add esp, 0x10
mov esi, esp
push eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
cmp esi, esp
call fcn.004744d2
mov dword [0x4ad2f4], eax
cmp dword [ebp - 0x240], 0
je 0x434eed
push 0x103f
push 0x61b2
push str.huw6lc9rlf8
push 0x74f2
push 0x5496
call fcn.004566b0
add esp, 0x14
push eax
call fcn.00441090
add esp, 4
movzx eax, al
test eax, eax
je 0x434eed
lea ecx, [ebp - 0x264]
call fcn.00403540
lea eax, [ebp - 0x264]
push eax
push str.retrynav
call fcn.00440ea0
add esp, 8
mov dword [ebp - 0x270], 0
mov esi, esp
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp esi, esp
call fcn.004744d2
mov eax, dword [ebp - 0x270]
add eax, 1
mov dword [ebp - 0x270], eax
push 1
mov ecx, 0x4ad2f8
call fcn.004710e0
mov dword [ebp - 0x240], eax
cmp dword [ebp - 0x240], 0
je 0x434ee2
cmp dword [ebp - 0x270], 0xa
jl 0x434e9b
lea ecx, [ebp - 0x264]
call fcn.00403970
cmp dword [ebp - 0x240], 0
je 0x434f34
mov esi, esp
push 0
push 0
mov eax, dword [0x4ad2f4]
push eax
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
cmp esi, esp
call fcn.004744d2
mov dword [ebp - 0x354], 3
lea ecx, [ebp - 0x234]
call fcn.00440e30
mov eax, dword [ebp - 0x354]
jmp 0x435034
push 0x3b1e
push 0x6eea
push str.0d0LquYgqOgjjtpqk6c6n8I
push 0x12b9
push 0x5e4e
call fcn.004566b0
add esp, 0x14
push eax
call fcn.00454bb0
add esp, 4
push 1
lea eax, [ebp - 0x378]
push eax
call fcn.00441160
add esp, 8
mov ecx, eax
call fcn.00403a00
push eax
call fcn.00454de0
add esp, 4
lea ecx, [ebp - 0x378]
call fcn.00403970
mov eax, dword [ebp + 0x14]
push eax
mov ecx, 0x4ad308
call fcn.004350f0
mov dword [ebp - 0x27c], eax
push 0
mov ecx, 0x4ad300
call fcn.004350a0
mov eax, dword [eax]
mov dword [0x4ad2fc], eax
mov ecx, dword [0x4ad2fc]
mov dword [0x4ad2f8], ecx
mov eax, dword [ebp - 0x27c]
push eax
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp esi, esp
call fcn.004744d2
push eax
push 0x4c30
push 0x39a4
push str.uegniZZxnPsrhtIl0e1ugthhke1uwtIP
push 0x23f7
push 0x706d
call fcn.004565f0
add esp, 0x14
push eax
call fcn.00454e30
add esp, 0xc
call fcn.00454ff0
mov esi, esp
mov eax, dword [ebp - 0x27c]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push edx
mov ecx, ebp
push eax
lea edx, [0x435068]
call fcn.004744f5
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004744c3
add esp, 0x37c
cmp ebp, esp
call fcn.004744d2
mov esp, ebp
pop ebp
ret 0x10
Function at 0x437040
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xe4]
mov ecx, 0x39
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov esi, esp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp esi, esp
call fcn.004744d2
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x30], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x30], 0
jne 0x43708d
xor eax, eax
jmp 0x4370d1
mov esi, esp
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
push 0x437a40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.004744d2
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4370ce
mov esi, esp
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.004744d2
mov eax, dword [ebp - 0x20]
push edx
mov ecx, ebp
push eax
lea edx, [0x4370f8]
call fcn.004744f5
pop eax
pop edx
pop edi
pop esi
pop ebx
add esp, 0xe4
cmp ebp, esp
call fcn.004744d2
mov esp, ebp
pop ebp
ret

Function at 0x440cd0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4917db
mov eax, dword fs:[0]
push eax
sub esp, 0xf0
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xfc]
mov ecx, 0x3c
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x4abc14]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.00403540
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
mov dword [0x4ad36c], eax
mov esi, esp
push 0x104
mov eax, dword [ebp - 0x14]
add eax, 0x24
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp esi, esp
call fcn.004744d2
cmp dword [ebp + 8], 0
jne 0x440d61
mov esi, esp
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp esi, esp
call fcn.004744d2
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.004035e0
mov byte [ebp - 0xf5], 0x20
lea eax, [ebp - 0xf5]
push eax
push 0x440c70
lea ecx, [ebp - 0xec]
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.00441370
mov edx, dword [eax]
push edx
lea eax, [ebp - 0xe0]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.00441310
mov ecx, dword [eax]
push ecx
call fcn.004413d0
add esp, 0x10
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
mov eax, dword [ebp - 0x14]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.00403660
movzx eax, al
test eax, eax
jne 0x440dff
mov esi, esp
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 8
call fcn.00403a00
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp esi, esp
call fcn.004744d2
mov ecx, dword [ebp - 0x14]
mov dword [ecx + 4], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xfc
cmp ebp, esp
call fcn.004744d2
mov esp, ebp
pop ebp
ret 4
Function at 0x454e30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4158
call fcn.00474750
push ebx
push esi
push edi
lea edi, [ebp - 0x4158]
mov ecx, 0x1056
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x4abc14]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [0x4ad550]
test eax, eax
je 0x454e72
movzx eax, byte [0x4ad551]
test eax, eax
jne 0x454e77
jmp 0x454f6b
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x3fff
lea edx, [ebp - 0x4014]
push edx
call fcn.00455050
add esp, 0x10
mov dword [ebp - 0x4020], eax
cmp dword [ebp - 0x4020], 0
jle 0x454f6b
cmp dword [0x4ad554], 0
je 0x454f4f
lea eax, [ebp - 0x4030]
push eax
call fcn.00454860
add esp, 4
lea eax, [ebp - 0x4030]
push eax
call fcn.004550a0
add esp, 4
mov dword [ebp - 0x403c], eax
mov eax, dword [ebp - 0x403c]
push eax
push str._Y__m__d__H:_M:_S
push 0x50
lea ecx, [ebp - 0x4094]
push ecx
call fcn.00479082
add esp, 0x10
mov eax, dword [0x4ad554]
push eax
lea ecx, [ebp - 0x4094]
push ecx
call fcn.00474c80
add esp, 4
push eax
push 1
lea edx, [ebp - 0x4094]
push edx
call fcn.00474ad6
add esp, 0x10
mov eax, dword [0x4ad554]
push eax
mov ecx, dword [ebp - 0x4020]
push ecx
push 1
lea edx, [ebp - 0x4014]
push edx
call fcn.00474ad6
add esp, 0x10
mov eax, dword [0x4ad554]
push eax
call fcn.004785ed
add esp, 4
jmp 0x454f6b
mov esi, esp
lea eax, [ebp - 0x4014]
push eax
push 0x1f
call fcn.00470330
add esp, 4
call eax
cmp esi, esp
call fcn.004744d2
push edx
mov ecx, ebp
push eax
lea edx, [0x454f9c]
call fcn.004744f5
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004744c3
add esp, 0x4158
cmp ebp, esp
call fcn.004744d2
mov esp, ebp
pop ebp
ret
Function at 0x454e3f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4158
call fcn.00474750
push ebx
push esi
push edi
lea edi, [ebp - 0x4158]
mov ecx, 0x1056
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x4abc14]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, byte [0x4ad550]
test eax, eax
je 0x454e72
movzx eax, byte [0x4ad551]
test eax, eax
jne 0x454e77
jmp 0x454f6b
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x3fff
lea edx, [ebp - 0x4014]
push edx
call fcn.00455050
add esp, 0x10
mov dword [ebp - 0x4020], eax
cmp dword [ebp - 0x4020], 0
jle 0x454f6b
cmp dword [0x4ad554], 0
je 0x454f4f
lea eax, [ebp - 0x4030]
push eax
call fcn.00454860
add esp, 4
lea eax, [ebp - 0x4030]
push eax
call fcn.004550a0
add esp, 4
mov dword [ebp - 0x403c], eax
mov eax, dword [ebp - 0x403c]
push eax
push str._Y__m__d__H:_M:_S
push 0x50
lea ecx, [ebp - 0x4094]
push ecx
call fcn.00479082
add esp, 0x10
mov eax, dword [0x4ad554]
push eax
lea ecx, [ebp - 0x4094]
push ecx
call fcn.00474c80
add esp, 4
push eax
push 1
lea edx, [ebp - 0x4094]
push edx
call fcn.00474ad6
add esp, 0x10
mov eax, dword [0x4ad554]
push eax
mov ecx, dword [ebp - 0x4020]
push ecx
push 1
lea edx, [ebp - 0x4014]
push edx
call fcn.00474ad6
add esp, 0x10
mov eax, dword [0x4ad554]
push eax
call fcn.004785ed
add esp, 4
jmp 0x454f6b
mov esi, esp
lea eax, [ebp - 0x4014]
push eax
push 0x1f
call fcn.00470330
add esp, 4
call eax
cmp esi, esp
call fcn.004744d2
push edx
mov ecx, ebp
push eax
lea edx, [0x454f9c]
call fcn.004744f5
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004744c3
add esp, 0x4158
cmp ebp, esp
call fcn.004744d2
mov esp, ebp
pop ebp
ret
Function at 0x455130
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xf4]
mov ecx, 0x3d
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + 0x68]
test ecx, ecx
je 0x455163
jmp 0x45525c
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x10]
shr ecx, 3
and ecx, 0x3f
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 0xc]
shl eax, 3
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x10]
add edx, eax
mov dword [ebp - 0xf4], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xf4]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp + 0xc]
shl edx, 3
cmp dword [ebp - 0xf4], edx
jae 0x4551af
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x14]
add ecx, 1
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], ecx
mov eax, dword [ebp + 0xc]
shr eax, 0x1d
mov ecx, dword [ebp - 8]
add eax, dword [ecx + 0x14]
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
mov eax, 0x40
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x2c]
jb 0x455234
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
lea ecx, [eax + edx + 0x18]
push ecx
call fcn.00474d10
add esp, 0xc
mov eax, dword [ebp - 8]
add eax, 0x18
push eax
mov ecx, dword [ebp - 8]
call fcn.00455420
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
jmp 0x45520f
mov eax, dword [ebp - 0x14]
add eax, 0x40
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add eax, 0x3f
cmp eax, dword [ebp + 0xc]
jae 0x45522b
mov eax, dword [ebp + 8]
add eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
call fcn.00455420
jmp 0x455206
mov dword [ebp - 0x20], 0
jmp 0x45523b
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
lea ecx, [eax + edx + 0x18]
push ecx
call fcn.00474d10
add esp, 0xc
pop edi
pop esi
pop ebx
add esp, 0xf4
cmp ebp, esp
call fcn.004744d2
mov esp, ebp
pop ebp
ret 8

Function at 0x4553b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0xcc]
mov ecx, 0x33
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov byte [eax + 0x68], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], 0
mov eax, dword [ebp - 8]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 8]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 8]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 8]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 8]
mov dword [eax + 0xc], 0x10325476
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45b580
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492629
mov eax, dword fs:[0]
push eax
sub esp, 0x508
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x514]
mov ecx, 0x142
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x4abc14]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
call fcn.0040f6c0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
mov dword [eax], vtable.CFsWrite.0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 4
call fcn.004038c0
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x18]
add ecx, 0x20
call fcn.00403540
mov byte [ebp - 4], 2
mov esi, esp
lea eax, [ebp - 0x228]
push eax
push 0x104
push 0xb
call fcn.00470330
add esp, 4
call eax
cmp esi, esp
call fcn.004744d2
mov esi, esp
lea eax, [ebp - 0x438]
push eax
push 0
push 0x49a86c
lea ecx, [ebp - 0x228]
push ecx
push 0xb
call fcn.00470330
add esp, 4
call eax
cmp esi, esp
call fcn.004744d2
mov esi, esp
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
lea eax, [ebp - 0x438]
push eax
push 0x21
call fcn.00470330
add esp, 4
call eax
cmp esi, esp
call fcn.004744d2
push eax
lea ecx, [ebp - 0x444]
call fcn.004303c0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x444]
call fcn.00444770
movzx eax, al
test eax, eax
jne 0x45b6d8
mov esi, esp
push 0
lea eax, [ebp - 0x450]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x444]
call fcn.00443bc0
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp esi, esp
call fcn.004744d2
lea eax, [ebp - 0x438]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x20
call fcn.004035e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x444]
call fcn.00406030
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x18]
push edx
mov ecx, ebp
push eax
lea edx, [0x45b730]
call fcn.004744f5
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004744c3
add esp, 0x514
cmp ebp, esp
call fcn.004744d2
mov esp, ebp
pop ebp
ret 0xc