joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402538
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf0
mov ecx, 0x82
lea eax, [ebp - 0x208]
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov esi, str.SetupApi.dll
push esi
lea edi, [ebp - 0x208]
mov esi, 0x44b578
rep movsd dword es:[edi], dword [esi]
pop esi
lea edi, [ebp - 0x410]
push esi
mov esi, 0x44b781
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
pop esi
push 0x104
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
push esi
lea edx, [ebp - 0x208]
push edx
call sub.KERNEL32.DLL_lstrcatA
push 8
push 0
lea ecx, [ebp - 0x208]
push ecx
call sub.KERNEL32.DLL_LoadLibraryExA
mov edi, eax
mov dword [ebx + 8], edi
test edi, edi
je 0x4025f2
lea eax, [esi + 0xe]
push eax
push edi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x53af54], eax
lea edx, [esi + 0x23]
push edx
mov ecx, dword [ebx + 8]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x53af58], eax
lea eax, [esi + 0x3f]
push eax
mov edx, dword [ebx + 8]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x53af5c], eax
lea ecx, [esi + 0x60]
push ecx
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x53af60], eax
jmp 0x40260d
push 0x10
lea edx, [esi + 0x82]
push edx
lea ecx, [esi + 0x7d]
push ecx
push 0
call sub.USER32.DLL_MessageBoxA
xor eax, eax
jmp 0x402700
push 0x104
lea edx, [ebp - 0x410]
push edx
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea ecx, [esi + 0x9d]
push ecx
lea eax, [ebp - 0x410]
push eax
call sub.KERNEL32.DLL_lstrcatA
push 8
push 0
lea edx, [ebp - 0x410]
push edx
call sub.KERNEL32.DLL_LoadLibraryExA
mov edi, eax
mov dword [ebx + 0xc], edi
test edi, edi
je 0x4026e0
lea eax, [esi + 0xa6]
push eax
push edi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x53af64], eax
lea edx, [esi + 0xb6]
push edx
mov ecx, dword [ebx + 0xc]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x53af68], eax
lea eax, [esi + 0xc6]
push eax
mov edx, dword [ebx + 0xc]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x53af6c], eax
lea ecx, [esi + 0xd6]
push ecx
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x53af70], eax
lea edx, [esi + 0xec]
push edx
mov ecx, dword [ebx + 0xc]
push ecx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x53af74], eax
lea eax, [esi + 0xff]
push eax
mov edx, dword [ebx + 0xc]
push edx
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x53af78], eax
lea ecx, [esi + 0x116]
push ecx
mov eax, dword [ebx + 0xc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x53af7c], eax
jmp 0x4026fb
push 0x10
lea edx, [esi + 0x129]
push edx
lea ecx, [esi + 0x123]
push ecx
push 0
call sub.USER32.DLL_MessageBoxA
xor eax, eax
jmp 0x402700
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40303c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
xor eax, eax
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 0x10], eax
xor ebx, ebx
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x114]
push ecx
push esi
mov eax, dword [ebp + 0xc]
push eax
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov ebx, eax
test ebx, ebx
jne 0x4030da
mov dword [ebp - 0xc], 0xc8
push str.HIDVid_3689Pid_8762
call fcn.00409bcc
pop ecx
mov edi, eax
push edi
lea eax, [ebp - 0x110]
push eax
push 0x44bd08
call fcn.00409e94
add esp, 0xc
test eax, eax
jne 0x4030da
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp + 0x10]
jne 0x4030d7
push 0x44bd34
mov ecx, dword [ebp + 0x14]
push ecx
call sub.KERNEL32.DLL_lstrcpyA
lea eax, [ebp - 0x110]
push eax
mov edx, dword [ebp + 0x14]
push edx
call sub.KERNEL32.DLL_lstrcatA
mov eax, 1
jmp 0x4030e5
inc dword [ebp - 0x10]
inc esi
test ebx, ebx
je 0x403058
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404010
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor ecx, ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebx]
mov eax, dword [eax]
mov edx, dword [edx + 4]
mov dword [ebp - 4], esi
mov esi, dword [ebx + 4]
mov dword [ebp - 8], esi
mov esi, dword [ebx + 8]
mov dword [ebp - 0xc], esi
mov ebx, dword [ebx + 0xc]
mov dword [ebp - 0x10], ebx
mov ebx, 0x20
jmp 0x40407f
add ecx, 0x9e3779b9
mov esi, edx
shl esi, 4
add esi, dword [ebp - 4]
lea edi, [ecx + edx]
xor esi, edi
mov edi, edx
shr edi, 5
add edi, dword [ebp - 8]
xor esi, edi
add eax, esi
mov esi, eax
shl esi, 4
add esi, dword [ebp - 0xc]
lea edi, [ecx + eax]
xor esi, edi
mov edi, eax
shr edi, 5
add edi, dword [ebp - 0x10]
xor esi, edi
add edx, esi
mov esi, ebx
add ebx, 0xffffffff
test esi, esi
jg 0x404047
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [eax + 4], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40469c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe5c
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, str.SetupApi.dll
push esi
mov esi, 0x44ba14
lea edi, [ebp - 0x64]
mov ecx, 0x19
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
mov esi, 0x44ba79
lea edi, [ebp - 0x78]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
pop esi
push esi
mov esi, 0x44ba8e
lea edi, [ebp - 0x1a4]
mov ecx, 0x4b
rep movsd dword es:[edi], dword [esi]
pop esi
push ebx
push 0x104
lea eax, [ebp - 0x64]
push eax
lea edx, [esi + 0x3b9]
push edx
lea ecx, [esi + 0x3ae]
push ecx
lea eax, [esi + 0x3a0]
push eax
call sub.KERNEL32.DLL_GetPrivateProfileStringA
push ebx
push 0x14
lea edx, [ebp - 0x78]
push edx
lea ecx, [esi + 0x3d6]
push ecx
lea eax, [esi + 0x3d1]
push eax
lea edx, [esi + 0x3c3]
push edx
call sub.KERNEL32.DLL_GetPrivateProfileStringA
push ebx
push 0x12c
lea ecx, [ebp - 0x1a4]
push ecx
lea eax, [esi + 0x3ee]
push eax
lea edx, [esi + 0x3e9]
push edx
lea ecx, [esi + 0x3db]
push ecx
call sub.KERNEL32.DLL_GetPrivateProfileStringA
lea eax, [ebp - 0x78]
push eax
call fcn.0040e12c
pop ecx
push eax
lea edx, [ebp - 0x1a4]
lea ecx, [ebp - 0x64]
push edx
push ecx
call dword [0x53af44]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405934
Capabilities:
Create process on windows
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffba4
push ebx
push esi
push edi
cmp dword [ebp + 0xc], 0
mov edi, dword [ebp + 0x10]
je 0x40595e
lea eax, [ebp - 0x45c]
push eax
call fcn.00405be8
pop ecx
test eax, eax
jne 0x405a1d
push 0x400
push 0
lea edx, [ebp - 0x45c]
push edx
call fcn.00409a4c
add esp, 0xc
lea ecx, [ebp - 0x45c]
push ecx
push 0x1ff
call sub.KERNEL32.DLL_GetTempPathA
push str.YShow3D.exe
lea eax, [ebp - 0x45c]
push eax
call sub.KERNEL32.DLL_lstrcatA
xor edx, edx
mov dword [ebp - 8], edx
push 4
push 0x44d148
lea ecx, [ebp - 8]
push ecx
call fcn.004099dc
add esp, 0xc
push 4
push 0x1000
mov eax, dword [ebp - 8]
push eax
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov ebx, eax
test ebx, ebx
jne 0x4059cd
xor eax, eax
jmp 0x405aac
push 0x293af
lea edx, [ebp - 8]
push 0x44d14c
push edx
push ebx
call fcn.00416b10
add esp, 0x10
lea ecx, [ebp - 0x45c]
push 0
push 0
push 2
push 0
push 3
push 0xc0000000
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp esi, 0xffffffff
je 0x405a1d
push 0
lea eax, [ebp - 4]
push eax
mov edx, dword [ebp - 8]
push edx
push ebx
push esi
call sub.KERNEL32.DLL_WriteFile
push esi
call sub.KERNEL32.DLL_CloseHandle
mov ecx, dword [ebp + 8]
push ecx
lea eax, [ebp - 0x45c]
push eax
call sub.KERNEL32.DLL_lstrcatA
push 0x44
push 0
lea edx, [ebp - 0x4c]
push edx
call fcn.00409a4c
add esp, 0xc
mov dword [ebp - 0x4c], 0x44
mov dword [ebp - 0x20], 1
mov word [ebp - 0x1c], 1
push 0x10
push 0
lea ecx, [ebp - 0x5c]
push ecx
call fcn.00409a4c
add esp, 0xc
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0x45c]
push eax
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push ecx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x405a8b
xor eax, eax
jmp 0x405aac
cmp dword [edi], 1
jne 0x405a9c
mov edx, dword [ebp - 0x54]
mov eax, 1
mov dword [edi], edx
jmp 0x405aac
push 0xffffffffffffffff
mov edx, dword [ebp - 0x5c]
push edx
call sub.KERNEL32.DLL_WaitForSingleObject
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407324
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
mov eax, dword [0x518359]
mov edx, dword [0x518361]
lea ecx, [ebp - 0x224]
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [0x51835d]
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], edx
mov edx, dword [0x518365]
mov dword [0x53af14], 1
mov dword [ebp - 0x18], edx
push 0x208
push ecx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x224]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x407468
push 0
push ebx
call sub.KERNEL32.DLL_GetFileSize
mov edi, eax
push 2
push 0
push 0xfffffffffffffff8
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea eax, [ebp - 4]
push 0
push eax
lea edx, [ebp - 0x14]
push 8
push edx
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4073d3
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x40746a
push 8
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0xc]
push ecx
call fcn.00409ca4
add esp, 0xc
test eax, eax
je 0x4073ed
xor eax, eax
jmp 0x40746a
push 2
push 0
push 0xfffffffffffffff4
push ebx
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea edx, [ebp - 4]
push edx
push 4
push esi
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x407416
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x40746a
push 4
push 0x1000
mov edx, dword [esi]
push edx
push 0
call sub.KERNEL32.DLL_VirtualAlloc
mov dword [0x44b16c], eax
mov eax, edi
sub eax, dword [esi]
sub eax, 0xc
push 0
push 0
push eax
push ebx
call sub.KERNEL32.DLL_SetFilePointer
lea edx, [ebp - 4]
push 0
push edx
mov eax, dword [0x44b16c]
mov ecx, dword [esi]
push ecx
push eax
push ebx
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x407461
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
jmp 0x40746a
mov eax, 1
jmp 0x40746a
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407ecc
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movzx eax, word [eax + 0x14]
add eax, dword [ebp + 0xc]
add eax, 0x18
xor ecx, ecx
jmp 0x407f00
mov edx, dword [eax + 8]
test edx, edx
jne 0x407eef
mov edx, dword [eax + 0x10]
mov esi, dword [eax + 0xc]
cmp ebx, esi
jb 0x407efc
add edx, esi
cmp ebx, edx
jb 0x407f0d
inc ecx
add eax, 0x28
mov edx, dword [ebp + 0xc]
movzx edx, word [edx + 6]
cmp ecx, edx
jb 0x407ee5
xor eax, eax
pop esi
pop ebx
pop ebp
ret
Function at 0x408274
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0x5a4d
je 0x40828e
xor eax, eax
jmp 0x40840e
mov ebx, dword [edi + 0x3c]
add ebx, edi
cmp dword [ebx], 0x4550
je 0x4082a2
xor eax, eax
jmp 0x40840e
cmp word [ebx + 0x14], 0xe0
jne 0x4082b2
cmp word [ebx + 0x18], 0x10b
je 0x4082b9
xor eax, eax
jmp 0x40840e
mov dword [0x53b19c], edi
mov ebx, dword [edi + 0x3c]
mov esi, edi
add ebx, esi
mov eax, dword [ebx + 0x78]
mov dword [ebp - 0x18], eax
push ebx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00407ecc
add esp, 8
test eax, eax
jne 0x4082e4
xor eax, eax
jmp 0x40840e
mov edx, dword [0x53b19c]
push edx
push ebx
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00407f14
add esp, 0xc
mov ebx, dword [ebx + 0x78]
test ebx, ebx
jne 0x408316
push 0x10
push 0
push str.Error_in_GetProcAddressDirectly__
push 0
call sub.USER32.DLL_MessageBoxA
xor eax, eax
jmp 0x40840e
add ebx, esi
mov edx, dword [ebx + 0x24]
add edx, esi
mov dword [ebp - 4], edx
mov ecx, dword [ebx + 0x20]
add ecx, esi
mov dword [ebp - 0xc], ecx
mov eax, dword [ebx + 0x1c]
add eax, esi
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0xc]
mov ecx, edx
shr ecx, 0x10
test cx, cx
je 0x4083e0
xor esi, esi
mov eax, dword [ebp - 8]
mov edx, eax
mov dword [ebp - 0x28], edx
jmp 0x4083d2
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
test eax, eax
je 0x4083cd
xor edx, edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x28]
mov eax, ecx
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0xc]
mov ecx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 4]
mov edx, eax
mov dword [ebp - 0x1c], edx
jmp 0x4083c4
mov ecx, dword [ebp - 0x1c]
movzx eax, word [ecx]
cmp esi, eax
jne 0x4083b9
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx]
add ecx, edi
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + 0xc]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4083b9
test cl, cl
je 0x4083ae
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4083b9
add eax, 2
add edx, 2
test cl, cl
jne 0x408392
jne 0x4083b9
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
add eax, edi
jmp 0x40840e
inc dword [ebp - 0x14]
add dword [ebp - 0x20], 4
add dword [ebp - 0x1c], 2
mov edx, dword [ebx + 0x18]
dec edx
cmp edx, dword [ebp - 0x14]
jae 0x408378
inc esi
add dword [ebp - 0x28], 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x408350
jmp 0x40840c
xor esi, esi
mov eax, dword [ebp - 8]
jmp 0x408404
mov ecx, dword [ebx + 0x10]
add ecx, esi
cmp edx, ecx
jne 0x408400
cmp dword [eax], 0
je 0x408400
mov edx, dword [eax]
shl edx, 6
add edi, edx
mov eax, edi
jmp 0x40840e
inc esi
add eax, 4
mov ecx, dword [ebx + 0x14]
dec ecx
cmp esi, ecx
jbe 0x4083e7
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x408418
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
push 0
push 1
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.KERNEL32.DLL_TerminateProcess
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop ebx
pop ebp
ret
Function at 0x409420
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x40af30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x40af4c
call fcn.0040c2fc
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x40af67
test bl, 1
je 0x40af67
mov dword [0x51a5fc], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x40b114
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x40b133
mov eax, dword [0x519724]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x40b140
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x40b16d
je 0x40b17f
sub ecx, 0x100
je 0x40b18d
sub ecx, 0x100
je 0x40b194
sub ecx, 0x100
je 0x40b186
jmp 0x40b19b
sub ecx, 0x600
je 0x40b194
sub ecx, 0x100
je 0x40b17f
jmp 0x40b19b
mov edi, 1
jmp 0x40b1a0
mov edi, 2
jmp 0x40b1a0
mov edi, 4
jmp 0x40b1a0
mov edi, 5
jmp 0x40b1a0
mov edi, 3
test byte [ebp + 0xd], 1
je 0x40b1c7
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x51919c]
test al, 0x80
je 0x40b1c0
mov ebx, 0x80
jmp 0x40b1d9
mov ebx, 1
jmp 0x40b1d9
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x40b1d9
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x40b1eb
je 0x40b1f4
dec eax
je 0x40b1fd
jmp 0x40b206
mov dword [ebp - 4], 0x80000000
jmp 0x40b215
mov dword [ebp - 4], 0x40000000
jmp 0x40b215
mov dword [ebp - 4], 0xc0000000
jmp 0x40b215
push 1
call fcn.0040c298
pop ecx
mov ebx, eax
jmp 0x40b305
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x40b231
sub eax, 0x10
je 0x40b238
sub eax, 0x10
je 0x40b241
sub eax, 0x10
je 0x40b24a
jmp 0x40b24a
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x40b251
mov dword [ebp - 8], 1
jmp 0x40b251
mov dword [ebp - 8], 2
jmp 0x40b251
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x40b2be
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x40b2b3
test byte [ebp + 0xd], 1
je 0x40b2ae
mov ebx, 0x50
jmp 0x40b2b3
mov ebx, 2
push ebx
call fcn.0040c298
pop ecx
mov ebx, eax
jmp 0x40b305
mov edi, esi
push edi
call fcn.0040b084
pop ecx
test eax, eax
je 0x40b2d2
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x40b2de
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0040bfdc
add esp, 8
mov ebx, eax
inc eax
jne 0x40b305
push 4
call fcn.0040c298
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4101cc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x41022e
call fcn.0041017c
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.00409bcc
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.00409bcc
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x410294
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x51a604], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x41036e
cmp dword [0x51a600], 0
jne 0x41036e
cmp dword [0x51a7f4], 0
je 0x410328
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0041007c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x41030e
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0041007c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x41030e
lea ebx, [ebp - 0x84]
jmp 0x41030f
inc ebx
call fcn.00410250
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4103a9
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x51a608
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00409bcc
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x51a60b
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4103a9
cmp dword [0x51a600], 0
je 0x410388
cmp dword [0x51a600], 0xffffffff
je 0x4103a9
push esi
call dword [0x51a600]
pop ecx
mov eax, dword [0x51a604]
test eax, eax
je 0x4103a9
cmp dword [0x51a604], 0xffffffff
je 0x4103a9
cmp byte [eax], 0
je 0x4103a9
push esi
push eax
call fcn.004101cc
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x410e24
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x53ba7c], 0
jne 0x410ea5
cmp dword [0x53ba9c], 0
jne 0x410e54
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x53ba9c], eax
test eax, eax
jne 0x410e54
push str.GetEnvironmentStrings_failed
call fcn.004103c0
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x53ba9c]
jmp 0x410e68
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00409bcc
pop ecx
mov edi, eax
test eax, eax
jne 0x410e60
lea edi, [ebp + 1]
push edi
call fcn.004089d8
pop ecx
mov ebx, eax
mov dword [0x53ba80], ebx
test ebx, ebx
jne 0x410e92
xor eax, eax
jmp 0x410f68
push edi
mov edx, dword [0x53ba9c]
push edx
push ebx
call fcn.004099dc
add esp, 0xc
jmp 0x410ec5
xor esi, esi
mov ebx, dword [0x53ba7c]
jmp 0x410ebf
push eax
call fcn.00409bcc
pop ecx
test eax, eax
jne 0x410ebb
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x410eaf
lea ebx, [esi + 4]
push 4
mov dword [0x53ba84], ebx
inc ebx
push ebx
call fcn.00408494
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x410ee8
xor eax, eax
jmp 0x410f68
cmp dword [0x53ba7c], 0
jne 0x410f19
xor esi, esi
mov ebx, dword [0x53ba80]
mov eax, dword [esp]
mov ebp, eax
jmp 0x410f0a
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00409bcc
pop ecx
mov edi, eax
test eax, eax
jne 0x410f00
jmp 0x410f4a
xor esi, esi
mov ebx, dword [0x53ba7c]
mov eax, dword [esp]
mov edi, eax
jmp 0x410f44
push eax
call fcn.00409bcc
pop ecx
test eax, eax
je 0x410f39
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x410f3d
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x410f28
mov eax, dword [0x53ba7c]
test eax, eax
je 0x410f5a
push eax
call fcn.004089e8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x53ba7c], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x413c08
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov ecx, 0x51b264
test edx, edx
jne 0x413c27
xor eax, eax
jmp 0x413d45
mov dword [ebp - 4], 1
cmp byte [ebp - 4], 0
je 0x413c44
push esi
push edx
push eax
call fcn.00413d4c
add esp, 0xc
jmp 0x413d45
push esi
push edx
push eax
call fcn.0041400c
add esp, 0xc
jmp 0x413d45
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x41731c
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
push edi
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
test eax, eax
je 0x417359
push ebx
call sub.KERNEL32.DLL_GetFileType
test eax, eax
je 0x417359
lea edx, [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
push 0x5191d4
call fcn.0040cb04
add esp, 0xc
jmp 0x4174b1
mov eax, dword [ebp + 8]
jmp 0x417433
lea edx, [ebp + 0xc]
push edx
push eax
push 0xff
lea eax, [ebp - 0x104]
push eax
call fcn.0040c944
mov byte [ebp - 5], 0
add esp, 0x10
call sub.KERNEL32.DLL_GetVersion
cmp eax, 0x80000000
jae 0x41749c
call fcn.00417264
test eax, eax
je 0x41749c
push str.OPENSSL
push 0
call sub.ADVAPI32.DLL_RegisterEventSourceA
mov ebx, eax
lea eax, [ebp - 0x104]
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
push 0
push edx
push 0
push 1
push 0
push 0
push 0
push 1
push ebx
call sub.ADVAPI32.DLL_ReportEventA
push ebx
call sub.ADVAPI32.DLL_DeregisterEventSource
jmp 0x4174b1
push 0x10
lea ecx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push ecx
push 0
call sub.USER32.DLL_MessageBoxA
mov esp, ebp
mov edi, dword [ebp - 0x110]
mov esi, dword [ebp - 0x10c]
mov ebx, dword [ebp - 0x108]
pop ebp
ret

Function at 0x419470
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], edx
mov dword [eax + 0x18], ecx
xor edx, edx
mov dword [eax + 0x5c], edx
mov eax, 1
pop ebp
ret