joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46c7b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x513d34
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
push ebx
push esi
push edi
mov eax, dword [0x573be0]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
mov dword [esp + 0x28], ecx
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
mov byte [esp + 0x12], 0
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [esp + 0x30], edi
mov dword [esp + 0xf8], 0
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x1c], esi
mov ebx, dword [ebp + 8]
push str.filePath
mov ecx, ebx
mov byte [esp + 0xfc], 1
call fcn.00439d60
cmp eax, 0x57b240
je 0x46cb01
push str.filePath
mov ecx, ebx
call fcn.00439d60
cmp byte [eax + 8], 4
jne 0x46cb01
push str.filePath
mov ecx, ebx
call fcn.00439d60
mov esi, eax
jmp loc.005dd170
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov eax, str.filePath_error
mov byte [esp + 0xf8], 2
test eax, 0xffff0000
jne 0x46cb44
movzx ebx, ax
mov ecx, ebx
call fcn.0041fcd0
test eax, eax
je 0x46cb52
push ebx
push eax
lea ecx, [esp + 0x1c]
call fcn.00420bb0
jmp 0x46cb52
push str.filePath_error
lea ecx, [esp + 0x18]
call fcn.00420650
push str.isFileExist
lea ecx, [esp + 0x24]
mov byte [esp + 0xfc], 3
call fcn.004204a0
mov byte [esp + 0xf8], 4
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0x1c]
lea ecx, [esp + 0x28]
mov byte [esp + 0xfc], 5
call fcn.00421890
add esp, 4
mov ecx, eax
mov eax, dword [esp + 0x28]
mov byte [esp + 0xf8], 6
cmp dword [eax + 0xc], 0
je 0x46cbc6
push 2
push ecx
lea ecx, [esp + 0x28]
push ecx
add eax, 8
push eax
call fcn.004219a0
mov byte [esp + 0xf8], 5
mov edx, dword [esp + 0x24]
add edx, 0xfffffff0
or ebx, 0xffffffff
lea ecx, [edx + 0xc]
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x46cbee
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0xf8], 4
mov edx, dword [esp + 0x18]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46cc13
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0xf8], 3
mov edx, dword [esp + 0x20]
add edx, 0xfffffff0
mov ecx, ebx
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x46cc38
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [esp + 0xf8], 1
mov edx, dword [esp + 0x14]
Function at 0x4711a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x513530
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x573be0]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [0x573be0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0x30
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x38], 0
cmp dword [esp + 0x18], 0
jbe 0x47124a
cmp dword [esp + 0x1c], 0
jne 0x47124a
push 1
push 0x5534c8
lea ecx, [esp + 0x18]
call fcn.00420c80
jmp 0x4712cb
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
push 1
mov esi, eax
call edi
mov ecx, dword [esp + 0x20]
sub ecx, dword [esp + 0x18]
cmp ecx, esi
jne 0x47127e
cmp dword [esp + 0x24], eax
jae 0x47127e
push 1
push 0x54ad24
lea ecx, [esp + 0x18]
call fcn.00420c80
jmp 0x4712cb
push 0
call edi
push 1
mov esi, eax
call edi
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
sub ecx, edx
sub edi, eax
cmp ecx, esi
je 0x4712b5
cmp edi, dword [esp + 0x14]
jne 0x4712b5
test edx, edx
jne 0x4712cb
push 0x54ce40
jmp 0x4712c2
test edx, edx
jne 0x4712cb
test eax, eax
je 0x4712cb
push 0x5534cc
lea ecx, [esp + 0x14]
call fcn.00420600
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
call dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x14], eax
mov byte [esp + 0x38], 1
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
push edx
push esi
push ecx
push eax
push dword [esp + 0x20]
sub edx, eax
push edx
sub esi, ecx
push esi
lea eax, [esp + 0x30]
push str.__width__:__d____height__:__d____taskbarLocation__:___s_____top__:__d____left__:__d____right__:__d____bottom__:__d
push eax
call fcn.00421610
mov esi, dword [esp + 0x38]
add esp, 0x24
test ebx, ebx
je 0x47133a
mov eax, 8
mov word [ebx], ax
push dword [esi - 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x471337
call fcn.004208f0
mov dword [ebx + 8], eax
lea edx, [esi - 0x10]
or esi, 0xffffffff
mov byte [esp + 0x38], 0
lea ecx, [edx + 0xc]
mov eax, esi
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x47135b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x38], 0xffffffff
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x47137e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.004e8f3a
mov esp, ebp
pop ebp
ret 4
Function at 0x4768a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x573be0]
xor eax, ebp
mov dword [ebp - 4], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.004eee10
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x118], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x47690d
mov eax, dword [ebp - 0x114]
cmp eax, 5
jae 0x4768fd
cmp eax, 4
jne 0x47690d
cmp dword [ebp - 0x110], 0x5a
jb 0x47690d
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e8f3a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
call fcn.004e8f3a
mov esp, ebp
pop ebp
ret
Function at 0x477250
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0x573be0]
xor eax, ebp
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ecx + 0x10]
push edi
mov dword [ebp - 0x128], edx
test esi, esi
jne 0x47728c
lea eax, [esi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004e8f3a
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ecx + 0xc]
mov ecx, 0xffff
movzx eax, word [edi]
cmp ax, cx
je 0x47746a
test byte [edi + 2], 1
je 0x477457
movzx ebx, ax
mov eax, 0x4000
test word [esi], ax
je 0x4772ca
push 0
push 0xffffffffffffffff
push edx
call dword [sym.imp.USER32.dll_SetMenuDefaultItem]
mov eax, 0xbfff
and word [esi], ax
push 0x30
lea eax, [ebp - 0x158]
push 0
push eax
call fcn.004eee10
add esp, 0xc
lea eax, [ebp - 0x120]
push pe_nt_image_headers32
push 0
push eax
mov dword [ebp - 0x158], 0x30
call fcn.004eee10
add esp, 0xc
lea eax, [ebp - 0x124]
push eax
mov dword [ebp - 0x124], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x477331
mov eax, dword [ebp - 0x120]
cmp eax, 5
jae 0x47733b
cmp eax, 4
jne 0x477331
cmp dword [ebp - 0x11c], 0x5a
jae 0x47733b
mov dword [ebp - 0x158], 0x2c
movzx ecx, word [esi]
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x154], 1
mov dword [ebp - 0x148], ebx
test ecx, 0x100
je 0x477365
or eax, 3
mov dword [ebp - 0x14c], eax
test ecx, 0x200
je 0x477376
or eax, 8
mov dword [ebp - 0x14c], eax
test ecx, 0x1000
je 0x477389
or eax, 0x1000
mov dword [ebp - 0x14c], eax
test ecx, 0x2000
je 0x477418
push 0x30
lea eax, [ebp - 0x188]
push 0
push eax
call fcn.004eee10
add esp, 0xc
mov dword [ebp - 0x188], 0x30
call fcn.004768a0
mov ecx, dword [ebp - 0x188]
test al, al
mov eax, 0x2c
cmovne ecx, eax
lea eax, [ebp - 0x188]
push eax
push 0
push ebx
push dword [ebp - 0x128]
mov dword [ebp - 0x188], ecx
mov dword [ebp - 0x184], 0x10
mov dword [ebp - 0x178], ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
test eax, eax
je 0x477418
mov eax, dword [ebp - 0x180]
or dword [ebp - 0x154], 0x10
and eax, 0xfffff7fb
or dword [ebp - 0x150], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x158]
push eax
push 0
push ebx
mov ebx, dword [ebp - 0x128]
push ebx
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
mov eax, 0x800
test word [esi], ax
je 0x477450
movzx eax, word [edi]
push 0
push eax
movzx eax, word [esi + 6]
push eax
movzx eax, word [esi + 4]
push eax
push ebx
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov ecx, 0xffff
mov edx, ebx
movzx eax, word [edi + 4]
add edi, 4
add esi, 8
cmp ax, cx
jne 0x4772a0
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004e8f3a
mov esp, ebp
pop ebp
ret 4
Function at 0x489ed0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x489eec
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], 0
mov eax, dword [esi + 0x18]
test eax, eax
je 0x489f0a
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 0x18], 0
push dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x489ff6
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x489ff6
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x489ff6
mov edi, dword [ebp + 0xc]
push edi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esi + 0x18], eax
test eax, eax
je 0x489ff6
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x489fe6
push edi
push ebx
push eax
call fcn.004ee660
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push 0
push dword [esi + 0x18]
mov dword [ebp + 0xc], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x489fdd
mov ecx, dword [ebp + 0xc]
call fcn.00489d70
mov dword [esi + 4], eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x489fdd
mov eax, dword [ecx + 8]
mov dword [ecx + 8], 0
test eax, eax
jne 0x489fc9
pop edi
pop esi
mov al, 1
pop ebx
pop ebp
ret 0xc
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x489fd6
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 4], 0
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 0x18], 0
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 0xc
Function at 0x48afe0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x48aff9
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
jmp loc.005e2508

Function at 0x48b510
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x517ae6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x573be0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
push 0x60
push 0
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x48b5bc
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x48b5bc
call fcn.00444910
mov esi, eax
jmp 0x48b6ac
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x48b5df
call fcn.00444910
jmp 0x48b69f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
test ebx, ebx
jne 0x48b5fd
call fcn.00444910
jmp 0x48b69f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x48b61e
mov esi, 0x8007000e
jmp 0x48b6a1
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.00497910
jmp 0x48b648
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
jne 0x48b65f
mov esi, 0x8007000e
jmp 0x48b6a1
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x48b67f
call fcn.00444910
jmp 0x48b69f
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.0048c310
mov esi, eax
test edi, edi
je 0x48b6ac
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x48b6d0
lea ecx, [ebp - 0x418]
call fcn.00497c50
jmp 0x48b6d0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004e8f3a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x497460
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x517c6c
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
push ebx
push esi
push edi
mov eax, dword [0x573be0]
xor eax, esp
push eax
lea eax, [esp + 0xf0]
mov dword fs:[0], eax
xor bl, bl
mov byte [esp + 0x16], bl
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
lea eax, [esp + 0x1c]
push eax
push 0x20019
push 0
push str.CLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
mov dword [esp + 0x108], 0
push SysReAllocString
mov dword [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4977d3
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
mov dword [esp + 0x24], esi
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [esp + 0x30], edi
xor ecx, ecx
mov eax, 0x1fffff
mov edx, 2
mul edx
seto cl
mov byte [esp + 0xf8], 1
neg ecx
or ecx, eax
push ecx
call fcn.004e9b36
push 0x3ffffe
mov ebx, eax
push 0
push ebx
call fcn.004eee10
add esp, 0x10
lea eax, [esp + 0x18]
push eax
push ebx
lea eax, [esp + 0x28]
push eax
push 0
push 0x54b754
push esi
mov dword [esp + 0x30], 0x3ffffe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x497589
mov eax, dword [esp + 0x20]
cmp eax, 1
je 0x49756f
cmp eax, 2
jne 0x497589
test ebx, ebx
je 0x4975d5
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4975d0
test al, 1
jne 0x497589
shr eax, 1
cmp word [ebx + eax*2 - 2], 0
je 0x4975d5
add edi, 0xfffffff0
mov byte [esp + 0xf8], 0
lea eax, [edi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4975ab
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x4975b6
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [esp + 0x16]
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov word [ebx], ax
mov eax, dword [0x574ba4]
mov ecx, 0x574ba4
call dword [eax + 0xc]
jmp 0x5d0d58
mov al, bl
mov ecx, dword [esp + 0xf0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49d460
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.004eed60
mov eax, dword [0x573be0]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x49d4c5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x49d4c5
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.004eb4fe
add eax, 0x40
push eax
call fcn.004ef121
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004e8f3a
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.004ef05c
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x49d554
call fcn.0049d320
test eax, eax
jle 0x49d554
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004e8f3a
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004e8f3a
add esp, 0x108
ret

Function at 0x49d5b0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x49d5d4
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
sub edi, 1
jne 0x49d5c6
pop esi
movzx eax, cl
pop edi
ret

Function at 0x4a4c00
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x4a4c47
mov al, byte [edx]
test al, al
je 0x4a4c47
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x4a4c17
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4a7ea0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.004eed60
mov eax, dword [0x573be0]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x34]
push ebp
mov ebp, dword [esp + 0x30]
dec ebp
lea edx, [ebp - 0x29]
cmp ebx, edx
push edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
jle 0x4a7f05
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.00499df0
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004e8f3a
add esp, 0x20
ret
cmp ebp, 0x29
jge 0x4a7f33
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.00499df0
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004e8f3a
add esp, 0x20
ret
push esi
mov byte [edi], 0
lea esi, [edi + 1]
push 0
add edi, 0x15
call fcn.004b5010
mov ecx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x50]
push 0
push edi
push eax
push ecx
call fcn.004bc160
mov edx, ebp
sub edx, ebx
sub edx, 0x29
push edx
lea eax, [edi + 0x14]
push 0
push eax
call fcn.004eee10
mov edx, dword [esp + 0x34]
mov ecx, edi
sub ecx, ebx
lea eax, [ecx + ebp]
push ebx
mov byte [eax - 0x15], 1
push edx
add eax, 0xffffffec
push eax
call fcn.004ee660
push 0x14
push esi
call fcn.0049f4e0
add esp, 0x38
test eax, eax
jle 0x4a7fc5
push 0x48
add ebp, 0xffffffec
push str..crypto_rsa_rsa_oaep.c
push ebp
call fcn.0049c1a0
mov ebx, eax
add esp, 0xc
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x4a7fda
push 0x4b
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.00499df0
add esp, 0x14
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004e8f3a
add esp, 0x20
ret
call fcn.004b5010
push eax
jmp loc.005cc4b0
Function at 0x4a8690
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x4a875c
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x4a86b1
jmp loc.005e1180
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x4a871d
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x4a86d1
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x4a86d1
cmp al, 0xbb
jne 0x4a86fa
inc ecx
cmp ecx, esi
jl 0x4a86c1
sub esi, ecx
test ecx, ecx
jne 0x4a8720
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00499df0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00499df0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x4a8749
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.00499df0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.004ee660
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.00499df0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret