joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44abb8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x5f931c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [ebp - 0x2c], ebx
je 0x44accd
cmp byte [esi], 0
jne 0x44ad50
lea ecx, [ebp - 0x14]
push ecx
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [edi + 4]
call fcn.00421f69
lea eax, [ebx + 4]
push dword [eax]
mov dword [ebp - 0x28], eax
call dword [sym.imp.USER32.dll_IsWindow]
xor ebx, ebx
inc ebx
test eax, eax
jne 0x44ac77
mov ecx, dword [ebp - 0x2c]
push eax
push dword [edi + 4]
call fcn.00449766
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x28]
push dword [eax]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
dec ecx
mov eax, edx
mov dword [edi + 0x73c], ecx
sub eax, ecx
mov dword [ebp - 0x30], edx
mov ecx, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.004219fd
mov eax, dword [ebp - 0x2c]
push 0
push ebx
push 0xf1
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0x73c]
lea ecx, [edi + 0x34]
sub dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.004219fd
inc dword [ebp - 0x14]
lea eax, [ebp - 0x14]
inc dword [ebp - 0x10]
lea ecx, [edi + 0x76c]
dec dword [ebp - 0xc]
dec dword [ebp - 8]
push ebx
push eax
call fcn.004219fd
push ebx
lea eax, [ebp - 0x14]
push eax
lea ecx, [edi + 0x8ac]
call fcn.004219fd
mov eax, dword [ebp - 0x28]
push 5
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov byte [esi], bl
jmp 0x44ad50
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x44ad50
cmp byte [esi], 0
je 0x44ad50
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x34]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x14]
push eax
lea ecx, [edi + 4]
call fcn.00421f69
mov eax, dword [edi + 0x73c]
lea ecx, [edi + 0x34]
add dword [ebp - 8], eax
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.004219fd
inc dword [ebp - 0x14]
lea eax, [ebp - 0x14]
inc dword [ebp - 0x10]
lea ecx, [edi + 0x76c]
dec dword [ebp - 0xc]
dec dword [ebp - 8]
push ebx
push eax
call fcn.004219fd
push ebx
lea eax, [ebp - 0x14]
push eax
lea ecx, [edi + 0x8ac]
call fcn.004219fd
mov eax, dword [ebp - 0x2c]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, esi
mov byte [eax], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005364e2
leave
ret 0xc
Function at 0x459500
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x5f931c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x459584
cmp byte [esi + 0x3d], 0
je 0x459584
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x459555
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x459559
sub eax, 1
je 0x45955d
dec eax
sub eax, 1
je 0x459584
xor al, al
jmp 0x459586
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x45957b
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x459555
cmp byte [esi + 0x3d], 0
sete al
jmp 0x459586
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005364e2
leave
ret

Function at 0x45ffde
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x5f931c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x460004
xor eax, eax
jmp 0x4600bf
mov eax, dword [esi + 0x20]
cmp dword [eax], 0
je 0x460026
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, dword [eax]
cmp dword [eax], edx
jae 0x460026
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
mov byte [eax], bl
mov eax, ebx
jmp 0x4600bf
cmp dword [esi + 0x4c], 0
je 0x4600bd
call fcn.0045968a
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x460050
push dword [esi + 0x4c]
push eax
call fcn.004572ab
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x4600bd
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
test eax, eax
js 0x4600bd
cmp eax, 1
jle 0x46008b
cmp eax, 3
jne 0x4600bd
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x460042
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x4600af
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x4600bd
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x4600bf
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005364e2
leave
ret 4
Function at 0x46705f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x467082
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
jmp 0x46713a
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x4670a3
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x4670a5
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x46712e
jg 0x4670b8
test esi, esi
je 0x46712e
test ecx, ecx
jl 0x4670fa
jg 0x4670c2
test eax, eax
je 0x4670fa
cmp ebx, ecx
jg 0x4670d4
jl 0x4670cc
cmp esi, eax
jae 0x4670d4
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x467100
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x46712e
jg 0x46710a
test esi, esi
je 0x46712e
cmp dword [edi + 0x4c], 0
je 0x46712e
mov ecx, edi
call fcn.0045968a
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
leave
ret 0xc
Function at 0x46713f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x467162
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
jmp 0x467210
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
test eax, eax
je 0x467183
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x467185
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test edi, edi
jl 0x467204
jg 0x467198
test esi, esi
je 0x467204
test ecx, ecx
jl 0x4671dc
jg 0x4671a2
test eax, eax
je 0x4671dc
cmp edi, ecx
jg 0x4671b4
jl 0x4671ac
cmp esi, eax
jae 0x4671b4
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], edi
push eax
push dword [ebp + 8]
push dword [ebp - 8]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x4671df
mov edx, dword [ebp + 8]
test edi, edi
jl 0x467204
jg 0x4671e9
test esi, esi
je 0x467204
cmp dword [ebx + 0x4c], 0
je 0x467204
push dword [ebx + 0x4c]
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4694f4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x4c], ebx
jne 0x46950c
xor al, al
jmp 0x46967c
lea eax, [edi + 0x3c]
mov dword [ebp - 0x14], ebx
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x10], ebx
jb 0x46951d
mov eax, dword [eax]
push esi
push ebx
push ebx
push 0x80
push 2
push 2
push 0x40000000
push eax
lea ecx, [ebp - 0x14]
call fcn.00405781
mov esi, dword [ebp - 0x14]
test eax, eax
jne 0x46966e
cmp dword [edi], 4
jne 0x46956b
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x46955f
call fcn.00405442
push ebx
lea eax, [ebp - 0xc]
push eax
push 5
lea eax, [edi + 8]
jmp 0x469596
cmp dword [edi], 5
jne 0x469661
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x46958c
call fcn.00405442
push ebx
lea eax, [ebp - 0xc]
push eax
push 8
lea eax, [edi + 0xd]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4695a7
call fcn.00405442
mov ecx, dword [edi + 4]
mov dword [ebp - 4], ebx
lea eax, [ecx + 1]
test eax, eax
je 0x4695de
mov esi, ebx
mov eax, dword [edi + 0x18]
lea ecx, [ebp - 0x14]
push ebx
push 6
add eax, esi
push eax
call fcn.0040664d
mov ecx, dword [edi + 4]
add esi, 6
mov edx, dword [ebp - 4]
inc edx
mov dword [ebp - 4], edx
lea eax, [ecx + 1]
cmp edx, eax
jb 0x4695b6
mov esi, dword [ebp - 0x14]
cmp dword [edi], 5
jne 0x46960e
xor eax, eax
cmp ax, word [edi + 0x13]
jae 0x46960e
mov esi, ebx
mov eax, dword [edi + 0x24]
lea ecx, [ebp - 0x14]
push ebx
push 4
lea eax, [eax + esi*4]
push eax
call fcn.0040664d
movzx eax, word [edi + 0x13]
inc esi
cmp esi, eax
jl 0x4695ed
mov ecx, dword [edi + 4]
mov esi, dword [ebp - 0x14]
mov edx, ebx
mov dword [ebp - 4], edx
test ecx, ecx
je 0x469650
mov ecx, ebx
mov dword [ebp - 8], ebx
mov eax, dword [edi + 0x30]
mov esi, dword [eax + ecx]
mov eax, dword [eax + ecx + 4]
mov dword [ebp - 0xc], esi
sub eax, esi
je 0x46963e
push ebx
push eax
push esi
lea ecx, [ebp - 0x14]
call fcn.0040664d
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
inc edx
add ecx, 0xc
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
cmp edx, dword [edi + 4]
jb 0x46961c
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x46965d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
mov bl, 1
jmp 0x46966e
test esi, esi
je 0x469679
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, ebx
test esi, esi
je 0x469679
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop esi
pop edi
pop ebx
leave
ret
Function at 0x47dad9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
lea ecx, [eax - 4]
mov dword [ebx], ecx
cmp eax, 4
jne 0x47dafb
mov eax, dword [ebp + 0x10]
and dword [eax], 0
mov al, 1
jmp 0x47dbbb
push esi
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
test esi, esi
je 0x47dbb8
push edi
push dword [ebx]
xor edi, edi
push edi
push esi
call sub.VCRUNTIME140.dll_memset
mov eax, dword [ebp + 8]
add esp, 0xc
mov ecx, dword [ebx]
mov edx, dword [eax]
add eax, 4
mov dword [ebp + 0xc], eax
mov eax, ecx
shr eax, 2
test eax, eax
je 0x47db8d
mov ebx, dword [ebp + 0xc]
mov edi, eax
mov al, byte [ebx]
imul edx, edx, 0x343fd
add edx, 0x269ec3
xor al, dl
mov byte [esi], al
mov eax, edx
sar eax, 8
xor al, byte [ebx + 1]
mov byte [esi + 1], al
mov eax, edx
sar eax, 0x10
xor al, byte [ebx + 2]
mov byte [esi + 2], al
mov eax, edx
mov cl, byte [ebx + 3]
add ebx, 4
sar eax, 0x18
xor al, cl
mov byte [esi + 3], al
add esi, 4
sub edi, 1
jne 0x47db45
mov dword [ebp + 0xc], ebx
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebx]
imul eax, edx, 0x343fd
add eax, 0x269ec3
mov dword [ebp + 0x14], eax
and ecx, 3
je 0x47dbb3
mov edx, dword [ebp + 0xc]
dec edx
mov al, byte [ebp + edi + 0x14]
inc edx
xor al, byte [edx]
inc edi
mov byte [esi - 1], al
cmp edi, ecx
jb 0x47dba4
mov al, 1
pop edi
jmp 0x47dbba
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x480c7e
Capabilities:
Create directory

Disassembly:
push 0xac
mov eax, 0x54a3fc
call fcn.0053655e
lea edi, [ecx + 0x80]
push 0x55a440
lea eax, [ebp - 0xb8]
push edi
push eax
call fcn.00404630
and dword [ebp - 4], 0
push 0x565fa4
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.004030d5
add esp, 0x18
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 2
call fcn.0040257a
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, str.operaprefs.ini
lea eax, [ebp - 0x28]
push ebx
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00404630
add esp, 0xc
push eax
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 3
call fcn.0040a686
mov esi, eax
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push edi
push eax
call fcn.00404630
add esp, 0xc
push eax
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 5
call fcn.0040a686
push 1
push esi
push eax
mov byte [ebp - 4], 6
call fcn.0040cbde
add esp, 0xc
lea ecx, [ebp - 0x64]
call fcn.00403ae4
lea ecx, [ebp - 0x7c]
call fcn.0040257a
lea ecx, [ebp - 0x40]
call fcn.0040257a
lea ecx, [ebp - 0x88]
call fcn.00403ae4
lea ecx, [ebp - 0xa0]
call fcn.0040257a
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.0040257a
mov ebx, str._search.ini
lea eax, [ebp - 0x28]
push ebx
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.00404630
add esp, 0xc
push eax
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 7
call fcn.0040a686
mov esi, eax
push ebx
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 8
push edi
push eax
call fcn.00404630
add esp, 0xc
push eax
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 9
call fcn.0040a686
push 1
push esi
push eax
mov byte [ebp - 4], 0xa
call fcn.0040cbde
add esp, 0xc
lea ecx, [ebp - 0x88]
call fcn.00403ae4
lea ecx, [ebp - 0xa0]
call fcn.0040257a
lea ecx, [ebp - 0x58]
call fcn.0040257a
lea ecx, [ebp - 0x64]
call fcn.00403ae4
lea ecx, [ebp - 0x7c]
call fcn.0040257a
lea ecx, [ebp - 0x40]
call fcn.0040257a
lea ecx, [ebp - 0x28]
call fcn.0040257a
call fcn.00536508
ret
Function at 0x486daf
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 4], ecx
push str.SoftwareMicrosoftWindowsCurrentVersionRun_amigo
mov dword [ecx], SysStringLen
add ecx, 4
call fcn.00401cd4
call fcn.004a03bf
add esp, 0x1c
leave
ret
Function at 0x48f290
Capabilities:
Link many functions at runtime

Disassembly:
push 0xb4
mov eax, 0x54c9ef
call fcn.0053652a
mov edi, ecx
mov dword [ebp - 0x10], edi
xor ebx, ebx
mov dword [edi], ebx
mov dword [edi + 0x2c], ebx
xor eax, eax
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], 7
mov dword [ebp - 4], ebx
mov word [edi + 0x30], ax
mov byte [ebp - 4], 1
mov dword [edi + 0x48], ebx
call fcn.00407c5b
cmp dword [eax + 4], ebx
jle 0x48f3eb
push str.wevtapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi + 0x48], eax
test eax, eax
jne 0x48f32d
push 1
push 3
lea ecx, [ebp - 0xc0]
call fcn.00404da4
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xb0]
push str.LoadLibrary_L_wevtapi.dll___error
push eax
call fcn.0040446a
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
lea eax, [ebp - 0xc0]
push eax
push str.FileEventJournal::FileEventJournal
push 0x1a
jmp 0x48f3c8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.EvtSubscribe
push eax
call esi
push str.EvtQuery
mov dword [0x601160], eax
push dword [edi + 0x48]
call esi
push str.EvtNext
mov dword [0x601164], eax
push dword [edi + 0x48]
call esi
push str.EvtRender
mov dword [0x601168], eax
push dword [edi + 0x48]
call esi
push str.EvtClose
mov dword [0x60116c], eax
push dword [edi + 0x48]
call esi
cmp dword [0x601160], 0
mov dword [0x601170], eax
jne 0x48f3eb
push 1
push 3
lea ecx, [ebp - 0xc0]
call fcn.00404da4
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xb0]
push str.GetProcAddress__wevtapiModule___EvtSubscribe___error
push eax
call fcn.0040446a
pop ecx
pop ecx
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
lea eax, [ebp - 0xc0]
push eax
push str.FileEventJournal::FileEventJournal
push 0x25
push str.C:workprojects_rubilnik_src_systemEventJournal.cpp
push ebx
call fcn.00407c20
mov ecx, eax
call fcn.00412039
lea ecx, [ebp - 0x58]
call fcn.00404fea
lea ecx, [ebp - 0x58]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
mov eax, edi
call fcn.005364f3
ret
Function at 0x4902e9
Capabilities:
Hash data using sha1
Initialize hashing via wincrypt

Disassembly:
push 0x6c
mov eax, 0x538d74
call fcn.0053655e
mov esi, ecx
push 0x559fbc
lea ecx, [ebp - 0x44]
call fcn.00401ca5
xor edi, edi
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
call fcn.004068e7
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [esi + 4]
mov dword [esi], eax
call fcn.00401f0b
lea ecx, [ebp - 0x28]
call fcn.00402554
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00402554
lea ebx, [esi + 0x1c]
cmp dword [ebx], edi
lea edi, [esi + 0x20]
je 0x4903a5
cmp dword [edi], 0
je 0x4903a5
push str.Cryptographic_provider_already_acquired_
lea ecx, [ebp - 0x44]
call fcn.00401ca5
xor eax, eax
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x44]
push eax
call fcn.004068e7
mov eax, dword [ebp - 0x2c]
lea ecx, [esi + 4]
mov dword [esi], eax
lea eax, [ebp - 0x28]
push eax
call fcn.00401f0b
lea ecx, [ebp - 0x28]
call fcn.00402554
lea ecx, [ebp - 0x44]
call fcn.00402554
xor al, al
jmp 0x49045d
mov eax, dword [esi + 0x24]
push 0xf0000020
push 1
push 0
push 0
push ebx
mov dword [esi + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4903e5
push str.Failed_to_acquire_cryptographic_context.
lea ecx, [ebp - 0x44]
call fcn.00401ca5
mov dword [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
and dword [ebp - 0x18], 0
and dword [ebp - 0x14], 0
jmp 0x49036e
push edi
xor edi, edi
push edi
push edi
push 0x8004
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x49045b
push str.Failed_to_acquire_cryptographic_context.
lea ecx, [ebp - 0x78]
call fcn.00401ca5
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x60], eax
lea ecx, [ebp - 0x5c]
lea eax, [ebp - 0x78]
mov dword [ebp - 0x4c], edi
push eax
mov dword [ebp - 0x48], edi
call fcn.004068e7
mov eax, dword [ebp - 0x60]
lea ecx, [esi + 4]
mov dword [esi], eax
lea eax, [ebp - 0x5c]
push eax
call fcn.00401f0b
lea ecx, [ebp - 0x5c]
call fcn.00402554
lea ecx, [ebp - 0x78]
call fcn.00402554
push edi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [ebx], edi
jmp 0x49039e
mov al, 1
call fcn.00536508
ret
Function at 0x490463
Capabilities:
Get system firmware table

Disassembly:
push 0x90
mov eax, 0x54cceb
call fcn.0053655e
mov dword [ebp - 0x98], ecx
mov esi, dword [ebp + 8]
xor eax, eax
push eax
push eax
mov dword [ebp - 0x9c], esi
push eax
mov dword [ebp - 0x90], eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
push 0x52534d42
call ebx
push eax
mov dword [ebp - 0x94], eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov edi, eax
mov dword [esi + 0x14], 7
xor ecx, ecx
xor eax, eax
mov dword [esi + 0x10], ecx
mov word [esi], ax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x90], 1
test edi, edi
je 0x4905a2
push dword [ebp - 0x94]
push edi
push ecx
push 0x52534d42
call ebx
mov ecx, dword [ebp - 0x98]
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.0049066a
cmp dword [ebp - 0x18], 0
mov dword [ebp - 4], 1
je 0x490592
mov ebx, str.E6A23A08432E47E1
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.00403bb9
lea ecx, [ebp - 0x74]
call fcn.004091db
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0041c8ee
pop ecx
pop ecx
mov dword [ebp - 0x90], 3
push 0
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x8c]
push eax
lea ecx, [ebp - 0x74]
call fcn.00490f9d
push eax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
call fcn.0041c94f
pop ecx
pop ecx
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.004035f6
lea ecx, [ebp - 0x40]
call fcn.0040257a
lea ecx, [ebp - 0x8c]
call fcn.00402554
lea ecx, [ebp - 0x58]
call fcn.00402554
lea ecx, [ebp - 0x70]
call fcn.00402554
lea ecx, [ebp - 0x28]
call fcn.0040257a
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov eax, esi
call fcn.00536508
ret 4