joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401280
Capabilities:
Accept command line arguments
Create process on windows
Query or enumerate registry value
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0
call esi
or eax, 1
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
movzx eax, word [esi]
cmp eax, 0x22
jne 0x4012d5
movzx eax, word [esi + 2]
add esi, 2
test ax, ax
je 0x4012cc
mov ecx, eax
cmp cx, 0x22
je 0x4012cc
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
test ax, ax
jne 0x4012b8
movzx edx, word [esi + 2]
add esi, 2
jmp 0x4012f9
mov edx, eax
test ax, ax
je 0x4012f9
mov ecx, eax
mov edi, edi
movzx edx, cx
cmp cx, 0x20
je 0x4012fe
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
mov edx, eax
test ax, ax
jne 0x4012e0
test dx, dx
je 0x401315
movzx ecx, dx
cmp cx, 0x20
ja 0x401315
movzx eax, word [esi + 2]
add esi, 2
mov ecx, eax
test ax, ax
jne 0x401301
push 3
push 1
push 0x400000
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x40138f
push section..text
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x401351
push 1
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401351
push esi
call eax
add esp, 4
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x10c]
push 0x40101c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x10c]
push 0x10
push 0x401058
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x201
push 0
push 0x40106c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401426
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0xc], 0x104
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40141d
cmp dword [ebp - 8], 1
jne 0x40141d
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x401094
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 1
push 0
push esi
lea eax, [ebp - 0x214]
push eax
push 0x4010b4
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x42a440
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x140
mov dword [esp], 0xfffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
sub esp, 4
test eax, eax
je 0x42a473
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
sub esp, 4
test eax, eax
jne 0x42a563
lea eax, [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x108]
mov dword [esp + 4], 0xff
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.msvcrt.dll__vsnprintf]
mov byte [ebp - 9], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x42a538
call fcn.0042a2d0
test eax, eax
jle 0x42a538
mov dword [esp + 4], str.OPENSSL
mov dword [esp], 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov dword [ebp - 0x10c], ebx
sub esp, 8
mov esi, eax
lea eax, [ebp - 0x10c]
mov dword [esp], esi
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
sub esp, 0x24
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 4], ebx
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.OpenSSL:_FATAL
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea eax, [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.004b12f0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x42ab70
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
test ebx, ebx
je 0x42ab9e
xor eax, eax
xor edx, edx
movzx ecx, byte [edi + edx]
xor cl, byte [esi + edx]
add edx, 1
or eax, ecx
cmp edx, ebx
jne 0x42ab87
movzx eax, al
pop ebx
pop esi
pop edi
ret
xor eax, eax
jmp 0x42ab9a
Function at 0x43f390
Capabilities:
Check for software breakpoints

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov edi, dword [esp + 0x40]
cmp edi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
jne 0x43f430
movzx esi, byte [ecx]
lea edx, [esi - 0x6a]
cmp dl, 1
ja 0x43f430
mov eax, esi
cmp al, 0x6b
lea edx, [ecx + 1]
lea ebx, [edi - 2]
je 0x43f3e6
cmp byte [edx + ebx], 0xcc
jne 0x43f4a0
mov eax, dword [esp + 0x30]
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, ebx
add esp, 0x20
pop ebx
pop esi
pop edi
ret
lea eax, [edi - 3]
test eax, eax
jle 0x43f422
lea edx, [ecx + 2]
movzx ecx, byte [ecx + 1]
cmp cl, 0xba
je 0x43f422
cmp cl, 0xbb
jne 0x43f468
xor ecx, ecx
jmp 0x43f413
add edx, 1
movzx ebx, byte [edx - 1]
cmp bl, 0xba
je 0x43f41a
cmp bl, 0xbb
jne 0x43f468
add ecx, 1
cmp ecx, eax
jne 0x43f402
sub eax, ecx
test ecx, ecx
mov ebx, eax
jne 0x43f3bf
mov dword [esp + 0x10], 0x8a
jmp 0x43f470
mov dword [esp + 0x10], 0x72
mov dword [esp + 0xc], str.external_openssl_crypto_rsa_rsa_x931.c
mov dword [esp + 8], 0x89
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 4
call fcn.00429800
add esp, 0x20
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0x10], 0x81
mov dword [esp + 0xc], str.external_openssl_crypto_rsa_rsa_x931.c
mov dword [esp + 8], 0x8a
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 4
call fcn.00429800
mov eax, 0xffffffff
jmp 0x43f3df
mov dword [esp + 0x10], 0x93
mov dword [esp + 0xc], str.external_openssl_crypto_rsa_rsa_x931.c
mov dword [esp + 8], 0x8b
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 4
call fcn.00429800
mov eax, 0xffffffff
jmp 0x43f3df
Function at 0x43fc40
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [esp + 0x64]
mov ebx, dword [esp + 0x60]
lea eax, [esi - 0x29]
cmp eax, dword [esp + 0x6c]
lea edi, [esi - 1]
jle 0x43fce6
cmp edi, 0x28
jle 0x43fcb0
mov byte [ebx], 0
lea ebp, [ebx + 0x15]
call fcn.00450340
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x70]
mov dword [esp], eax
call fcn.004631e0
test eax, eax
jne 0x43fd20
xor eax, eax
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], 0x33
mov dword [esp + 0xc], str.external_openssl_crypto_rsa_rsa_oaep.c
mov dword [esp + 8], 0x78
mov dword [esp + 4], 0x79
mov dword [esp], 4
call fcn.00429800
xor eax, eax
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], 0x2d
mov dword [esp + 0xc], str.external_openssl_crypto_rsa_rsa_oaep.c
mov dword [esp + 8], 0x6e
mov dword [esp + 4], 0x79
mov dword [esp], 4
call fcn.00429800
add esp, 0x4c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, edi
sub edx, dword [esp + 0x6c]
lea eax, [ebx + 1]
mov dword [esp + 0x18], eax
lea eax, [ebx + 0x29]
lea ecx, [edx - 0x29]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x1c]
sub edi, dword [esp + 0x6c]
mov ecx, dword [esp + 0x6c]
mov byte [ebp + edx - 0x15], 1
mov edx, dword [esp + 0x68]
lea eax, [ebp + edi - 0x14]
mov dword [esp], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x18]
mov dword [esp + 4], 0x14
mov dword [esp], eax
call fcn.00433480
test eax, eax
jle 0x43fca3
sub esi, 0x15
mov dword [esp + 8], 0x49
mov dword [esp + 4], str.external_openssl_crypto_rsa_rsa_oaep.c
mov dword [esp], esi
call fcn.004273e0
test eax, eax
mov edi, eax
je 0x43fe48
call fcn.00450340
mov dword [esp + 0xc], 0x14
mov dword [esp + 4], esi
mov dword [esp], edi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 8], eax
call fcn.0043fad0
test eax, eax
js 0x43fca3
xor eax, eax
test esi, esi
jle 0x43fdf7
movzx edx, byte [edi + eax]
xor byte [ebx + eax + 0x15], dl
add eax, 1
cmp eax, esi
jne 0x43fde8
call fcn.00450340
mov dword [esp + 0xc], esi
lea esi, [esp + 0x2c]
mov dword [esp + 8], ebp
mov dword [esp + 4], 0x14
mov dword [esp], esi
mov dword [esp + 0x10], eax
call fcn.0043fad0
xor edx, edx
test eax, eax
js 0x43fca3
movzx eax, byte [esi + edx]
xor byte [ebx + edx + 1], al
add edx, 1
cmp edx, 0x14
jne 0x43fe26
mov dword [esp], edi
call fcn.004276d0
mov eax, 1
jmp 0x43fcde
mov dword [esp + 0x10], 0x4c
mov dword [esp + 0xc], str.external_openssl_crypto_rsa_rsa_oaep.c
mov dword [esp + 8], 0x41
mov dword [esp + 4], 0x79
mov dword [esp], 4
call fcn.00429800
xor eax, eax
jmp 0x43fca5
Function at 0x443610
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x443660
movzx ecx, byte [ebx]
xor eax, eax
test cl, cl
je 0x44365d
xor edx, edx
mov esi, 0x100
lea esi, [esi]
movsx eax, cl
add ebx, 1
or eax, esi
add esi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
rol edx, cl
movzx ecx, byte [ebx]
imul eax, eax
xor edx, eax
test cl, cl
jne 0x443630
mov eax, edx
shr eax, 0x10
xor eax, edx
pop ebx
pop esi
ret
xor eax, eax
pop ebx
pop esi
ret

Function at 0x448f60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov edx, dword [eax]
mov dword [esp], ecx
mov edi, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x3c]
mov edx, dword [edx + 0x78]
test edx, edx
je 0x448fb7
mov dword [esp + 0x30], ebx
mov ebx, dword [esp]
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], eax
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
jmp edx
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00466030
Function at 0x489340
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x21c
mov edi, dword [esp + 0x244]
mov ebp, dword [esp + 0x230]
mov esi, dword [esp + 0x234]
mov ebx, dword [esp + 0x24c]
mov dword [esp], edi
call fcn.0043ea10
mov ecx, eax
mov dword [esp + 0x18], eax
xor eax, eax
test ecx, ecx
js 0x48955d
lea eax, [esp + 0x70]
mov dword [esp], eax
call fcn.004a3f70
test ebp, ebp
je 0x4895b1
cmp esi, 0xffffffff
je 0x4895a2
lea eax, [esp + 0x70]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.004a3c80
test eax, eax
je 0x489589
mov eax, dword [esp + 0x248]
test eax, eax
je 0x48954c
mov dword [esp + 0x1c], 1
lea esi, [esp + 0x140]
lea ebp, [esp + 0x30]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x248], eax
cmovle eax, dword [esp + 0x248]
mov dword [esp], esi
mov byte [esp + 0x2f], cl
mov edi, eax
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x2e], al
lea eax, [esp + 0x70]
mov dword [esp + 4], eax
call fcn.004a3ff0
test eax, eax
je 0x489589
mov eax, dword [esp + 0x23c]
mov dword [esp], esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x238]
mov dword [esp + 4], eax
call fcn.004a3ee0
test eax, eax
je 0x489568
lea eax, [esp + 0x2c]
mov dword [esp + 8], 4
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.004a3ee0
test eax, eax
je 0x489568
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], esi
call fcn.004a3ef0
test eax, eax
je 0x489568
mov dword [esp], esi
call fcn.004a40e0
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
cmp dword [esp + 0x240], 1
mov dword [esp + 0x14], 1
jle 0x489538
lea eax, [esp + 0x70]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.004a3ff0
test eax, eax
je 0x489589
mov eax, dword [esp + 0x18]
mov dword [esp + 4], ebp
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.004a3ee0
test eax, eax
je 0x489568
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], esi
call fcn.004a3ef0
test eax, eax
je 0x489568
mov dword [esp], esi
call fcn.004a40e0
test edi, edi
jle 0x489526
xor eax, eax
movzx edx, byte [ebp + eax]
xor byte [ebx + eax], dl
add eax, 1
cmp eax, edi
jne 0x489517
add dword [esp + 0x14], 1
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x240]
jne 0x4894c1
add dword [esp + 0x1c], 1
add ebx, edi
sub dword [esp + 0x248], edi
jne 0x4893e5
lea eax, [esp + 0x70]
mov dword [esp], eax
call fcn.004a40e0
mov eax, 1
add esp, 0x21c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x70]
mov dword [esp], eax
call fcn.004a40e0
mov dword [esp], esi
call fcn.004a40e0
add esp, 0x21c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x70]
mov dword [esp], eax
call fcn.004a40e0
add esp, 0x21c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebp
call sub.msvcrt.dll_strlen
mov esi, eax
jmp 0x48939b
xor esi, esi
jmp 0x48939b
Function at 0x49ccf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
mov edx, dword [edi + 4]
mov eax, dword [ebx + 4]
cmp edx, eax
jl 0x49cd15
mov eax, edx
mov edx, ebx
mov ebx, edi
mov edi, edx
cmp dword [esi + 8], eax
jl 0x49cd90
mov ebp, dword [edi + 4]
xor eax, eax
test ebp, ebp
jle 0x49cd3b
mov edx, dword [edi]
mov ebp, dword [ebx]
mov ecx, dword [esi]
mov edx, dword [edx + eax*4]
xor edx, dword [ebp + eax*4]
mov dword [ecx + eax*4], edx
add eax, 1
cmp dword [edi + 4], eax
jg 0x49cd23
mov edx, dword [ebx + 4]
cmp eax, edx
jge 0x49cd67
lea ecx, [eax*4]
lea esi, [esi]
mov edx, dword [ebx]
add eax, 1
mov edi, dword [edx + ecx]
mov edx, dword [esi]
mov dword [edx + ecx], edi
mov edx, dword [ebx + 4]
add ecx, 4
cmp edx, eax
jg 0x49cd50
test edx, edx
mov dword [esi + 4], edx
jle 0x49cdb0
mov eax, dword [esi]
sub eax, 4
mov ecx, dword [eax + edx*4]
test ecx, ecx
jne 0x49cd7f
sub edx, 1
jne 0x49cd73
mov dword [esi + 4], edx
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.0041e270
test eax, eax
jne 0x49cd1a
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a3c80
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x9c
mov esi, dword [esp + 0xbc]
mov ebx, dword [esp + 0xb0]
mov ebp, dword [esp + 0xb4]
mov edi, dword [esp + 0xb8]
test esi, esi
je 0x4a3ec2
test ebp, ebp
mov dword [ebx], esi
je 0x4a3d18
mov dword [esp], esi
call fcn.0043e9e0
cmp eax, 0x80
jg 0x4a3e70
cmp eax, edi
jl 0x4a3dfd
cmp edi, 0x80
ja 0x4a3ea1
lea eax, [ebx + 0x50]
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov dword [ebx + 0x4c], edi
cmp edi, 0x80
je 0x4a3d18
mov eax, pe_nt_image_headers32
sub eax, edi
lea edx, [ebx + edi + 0x50]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], edx
call sub.msvcrt.dll_memset
xor eax, eax
lea esi, [esi]
movzx edx, byte [ebx + eax + 0x50]
xor edx, 0x36
mov byte [esp + eax + 0x10], dl
add eax, 1
cmp eax, 0x80
jne 0x4a3d20
mov eax, dword [esp + 0xc0]
lea edi, [ebx + 0x1c]
mov dword [esp + 4], esi
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.00462a80
test eax, eax
jne 0x4a3d61
add esp, 0x9c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call fcn.0043e9e0
mov dword [esp], edi
mov dword [esp + 8], eax
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
call fcn.00462d70
test eax, eax
je 0x4a3d54
xor eax, eax
movzx edx, byte [ebx + eax + 0x50]
xor edx, 0x5c
mov byte [esp + eax + 0x10], dl
add eax, 1
cmp eax, 0x80
jne 0x4a3d83
mov eax, dword [esp + 0xc0]
lea ebp, [ebx + 0x34]
mov dword [esp + 4], esi
mov dword [esp], ebp
mov dword [esp + 8], eax
call fcn.00462a80
test eax, eax
je 0x4a3d54
mov dword [esp], esi
call fcn.0043e9e0
mov dword [esp], ebp
mov dword [esp + 8], eax
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
call fcn.00462d70
test eax, eax
je 0x4a3d54
add ebx, 4
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00462f80
test eax, eax
setne al
add esp, 0x9c
pop ebx
movzx eax, al
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0xc0]
lea edx, [ebx + 4]
mov dword [esp], edx
mov dword [esp + 4], esi
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
call fcn.00462a80
mov edx, dword [esp + 0xc]
test eax, eax
je 0x4a3d54
mov dword [esp], edx
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp + 0xc], edx
call fcn.00462d70
mov edx, dword [esp + 0xc]
test eax, eax
je 0x4a3d54
lea eax, [ebx + 0x4c]
mov dword [esp + 8], eax
lea eax, [ebx + 0x50]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00462d80
test eax, eax
je 0x4a3d54
mov edi, dword [ebx + 0x4c]
jmp 0x4a3cf1
mov dword [esp + 8], str.j____int_sizeof_ctx__key_
mov dword [esp + 4], 0x68
mov dword [esp], str.external_openssl_crypto_hmac_hmac.c
mov dword [esp + 0xc], eax
call fcn.0042a590
mov eax, dword [esp + 0xc]
cmp eax, edi
jge 0x4a3ccf
jmp 0x4a3dfd
mov dword [esp + 8], str.len_0__len__int_sizeof_ctx__key_
mov dword [esp + 4], 0x75
mov dword [esp], str.external_openssl_crypto_hmac_hmac.c
call fcn.0042a590
jmp 0x4a3cdb
test ebp, ebp
mov esi, dword [ebx]
jne 0x4a3cb4
lea edi, [ebx + 0x1c]
nop
jmp 0x4a3ddb
Function at 0x4a7930
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x48]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
test eax, eax
je 0x4a79b1
test ebx, ebx
je 0x4a79c0
test esi, esi
je 0x4a79b5
mov eax, dword [esp + 0x48]
lea ebp, [esp + 0x14]
mov dword [esp + 4], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.00443ac0
test eax, eax
je 0x4a7980
mov eax, dword [eax + 8]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, 0x4e8f68
mov ecx, 4
repe cmpsb byte [esi], byte es:[edi]
je 0x4a79d0
mov eax, dword [esp + 0x48]
mov dword [esp + 4], ebp
mov dword [esp + 0x14], str.default
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.00443ac0
test eax, eax
jne 0x4a7972
xor eax, eax
jmp 0x4a7975
lea ebp, [esp + 0x14]
jmp 0x4a798e
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
jmp 0x4a7975
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x4a7975
jmp 0x4a798e
Function at 0x402ab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, ecx
push edi
push 0x30
push 0
lea eax, [esi + 4]
mov dword [esi], vtable.estrimp_wchar_t__24_.0
push eax
call fcn.005feb40
mov eax, dword [ebp + 8]
lea edx, [esi + 6]
mov ecx, 0xfffffffc
mov dword [ebp + 8], 2
sub ecx, esi
mov dword [esi + 0x34], 0x1e451a06
mov dword [ebp - 8], ecx
mov ebx, eax
mov ecx, 0xfffffffe
mov dword [ebp - 4], 2
sub ecx, esi
lea edi, [eax + 4]
mov dword [ebp - 0xc], ecx
add esp, 0xc
mov ecx, 2
sub ebx, esi
sub ecx, esi
mov dword [ebp - 0x10], ecx
mov ecx, 4
sub ecx, esi
mov dword [ebp - 0x14], ecx
mov ecx, 0xfffffffa
sub ecx, esi
sub dword [ebp + 8], eax
mov dword [ebp - 0x18], ecx
mov eax, dword [esi + 0x34]
add ecx, edx
and ecx, 3
sar eax, cl
xor ax, word [edi - 4]
mov ecx, dword [ebp - 8]
add ecx, edx
mov word [edx - 2], ax
mov eax, dword [esi + 0x34]
and ecx, 3
sar eax, cl
xor ax, word [edi - 2]
mov ecx, dword [ebp - 0xc]
add ecx, edx
mov word [edx], ax
mov eax, dword [esi + 0x34]
and ecx, 3
sar eax, cl
xor ax, word [edi]
mov ecx, dword [ebp + 8]
add ecx, edi
mov word [edx + 2], ax
mov eax, dword [esi + 0x34]
and ecx, 3
sar eax, cl
xor ax, word [ebx + edx]
mov ecx, dword [ebp - 0x10]
add ecx, edx
mov word [edx + 4], ax
mov eax, dword [esi + 0x34]
and ecx, 3
sar eax, cl
xor ax, word [edi + 4]
mov ecx, dword [ebp - 0x14]
add ecx, edx
mov word [edx + 6], ax
mov eax, dword [esi + 0x34]
and ecx, 3
sar eax, cl
xor ax, word [edi + 6]
add edi, 0xc
mov ecx, dword [ebp - 0x18]
mov word [edx + 8], ax
add edx, 0xc
sub dword [ebp - 4], 1
jne 0x402b28
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405090
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x630518
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x6ce488]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x14]
cmp ebx, 0xf060
jne 0x4051e9
cmp byte [edi + 0x5d0], 0
mov dword [eax], 1
je 0x4051d3
call fcn.004021b0
mov ecx, eax
test ecx, ecx
je 0x40528e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push ecx
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], 0
call fcn.00413360
push 0x34
mov esi, eax
mov dword [ebp - 0x50], 0x6a2e44
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.005feb40
mov edx, 0x1e451a06
add esp, 0xc
mov dword [ebp - 0x18], edx
xor eax, eax
mov ecx, eax
and ecx, 3
sar edx, cl
xor dx, word [eax + 0x6a01dc]
mov word [ebp + eax - 0x4c], dx
add eax, 2
cmp eax, 0x1a
jae 0x405155
mov edx, dword [ebp - 0x18]
jmp 0x405135
mov eax, dword [esi]
lea ecx, [ebp - 0x80]
push ecx
mov ecx, esi
call dword [eax]
mov esi, eax
mov byte [ebp - 4], 1
lea eax, [ebp - 0x68]
mov edx, dword [ebp - 0x50]
lea ecx, [ebp - 0x50]
push eax
call dword [edx]
mov byte [ebp - 4], 2
cmp dword [esi + 0x14], 8
jb 0x40517d
mov esi, dword [esi]
cmp dword [eax + 0x14], 8
jb 0x405185
mov eax, dword [eax]
push esi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00402970
add esp, 0xc
lea ecx, [ebp - 0x68]
call fcn.00402f20
lea ecx, [ebp - 0x80]
call fcn.00402f20
mov esi, dword [ebp - 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4051cc
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
jmp 0x405270
push 0
push 0
push 0x10
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
jmp 0x40526e
push dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_IsZoomed]
call esi
push dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push ebx
push dword [ebp + 8]
push dword [edi + 4]
push dword [edi + 8]
call dword [sym.imp.USER32.dll_CallWindowProcW]
push dword [edi + 4]
mov ebx, eax
call esi
cmp eax, dword [ebp - 0x14]
je 0x40526e
push 1
lea esi, [edi + 0x420]
push str.maxbtn
mov ecx, esi
call fcn.004215f0
push 1
push str.restorebtn
mov ecx, esi
mov edi, eax
call fcn.004215f0
mov esi, eax
test edi, edi
je 0x40526e
test esi, esi
je 0x40526e
cmp dword [ebp - 0x14], 1
mov edx, dword [edi]
sete cl
movzx eax, cl
mov ecx, edi
push eax
call dword [edx + 0xe0]
cmp dword [ebp - 0x14], 0
mov edx, dword [esi]
sete al
movzx ecx, al
push ecx
mov ecx, esi
call dword [edx + 0xe0]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c358e
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.00401f90
int3