joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41e4e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov dword [esp], str.BACNET_IP_DEBUG
call sym._getenv
test eax, eax
je 0x41e508
call sym._bip_debug_enable
call sym._bvlc_debug_enable
mov byte [0x42ac88], 1
mov dword [esp], str.BACNET_IP_PORT
call sym._getenv
test eax, eax
je 0x41e532
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
call sym._strtol
movzx eax, ax
mov dword [esp], eax
jmp 0x41e544
call sym._bip_get_port
cmp ax, 0x3ff
ja 0x41e549
mov dword [esp], 0xbac0
call sym._bip_set_port
mov dword [esp], str.BACNET_IP_BROADCAST_BIND_ADDR
call sym._getenv
test eax, eax
je 0x41e561
mov dword [esp], eax
call sym._bip_set_broadcast_binding
mov dword [esp], str.BACNET_IP_NAT_ADDR
call sym._getenv
test eax, eax
je 0x41e5b8
lea ebx, [ebp - 0xe]
mov dword [esp], eax
mov dword [esp + 4], ebx
call sym._bip_get_addr_by_name
test al, al
je 0x41e5b8
mov dword [esp], str.BACNET_IP_NAT_PORT
mov word [ebp - 0xa], 0xbac0
call sym._getenv
test eax, eax
je 0x41e5b0
xor edx, edx
mov dword [esp], eax
mov dword [esp + 8], edx
mov dword [esp + 4], edx
call sym._strtol
mov word [ebp - 0xa], ax
mov dword [esp], ebx
call sym._bvlc_set_global_address_for_nat
mov dword [esp], str.BACNET_APDU_TIMEOUT
call sym._getenv
test eax, eax
je 0x41e5e5
xor ebx, ebx
mov dword [esp], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
call sym._strtol
movzx eax, ax
mov dword [esp], eax
call sym._apdu_timeout_set
mov dword [esp], str.BACNET_APDU_RETRIES
call sym._getenv
test eax, eax
je 0x41e612
xor ecx, ecx
mov dword [esp], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
call sym._strtol
movzx eax, al
mov dword [esp], eax
call sym._apdu_retries_set
mov dword [esp], str.BACNET_IFACE
call sym._getenv
mov dword [esp], eax
call sym._bip_init
test al, al
jne 0x41e636
mov dword [esp], 1
call sym._exit
mov dword [esp], str.BACNET_INVOKE_ID
call sym._getenv
test eax, eax
je 0x41e663
xor edx, edx
mov dword [esp], eax
mov dword [esp + 8], edx
mov dword [esp + 4], edx
call sym._strtol
movzx eax, al
mov dword [esp], eax
call sym._tsm_invokeID_set
call sym._dlenv_network_port_init
call sym._dlenv_register_as_foreign_device
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x41fe74
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x117]
push ebx
sub esp, 0x13c
mov dword [esp + 4], 0xff
mov dword [esp], esi
call dword [sym.imp.WS2_32.dll_gethostname]
push ecx
push ecx
test eax, eax
je 0x41fea4
mov eax, str.gethostname
jmp 0x41feb9
mov dword [esp], esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov ebx, eax
push edx
test eax, eax
jne 0x41feca
mov eax, str.gethostbyname
call sym._print_last_error
mov dword [esp], 1
call sym._exit
cmp byte [0x42ac8c], 0
je 0x41ff5f
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
movzx edx, byte [eax + 1]
movzx ecx, byte [eax + 3]
movzx edi, byte [eax + 2]
mov dword [ebp - 0x120], edx
movzx edx, byte [eax]
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x11c], edi
mov edi, dword [dbg.__acrt_iob_func]
mov dword [ebp - 0x124], edx
mov dword [esp], 2
call edi
mov ecx, dword [ebp - 0x128]
mov dword [esp + 0x18], ecx
mov ecx, dword [ebp - 0x11c]
mov dword [esp + 0x14], ecx
mov edx, dword [ebp - 0x120]
mov dword [esp + 0x10], edx
mov edx, dword [ebp - 0x124]
mov dword [esp + 8], esi
mov dword [esp + 0xc], edx
mov dword [esp + 4], str.BIP:_host__s_at__u._u._u._u_n
mov dword [esp], eax
call sym._fprintf
mov dword [esp], 2
call edi
mov dword [esp], eax
call sym._fflush
mov eax, dword [ebx + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401010
Capabilities:
Get common file path

Disassembly:
push edi
sub esp, 0x200
mov edi, esp
push 0x7c
push edi
call sub.KERNEL32.dll_GetSystemDirectoryA
lea ecx, [edi + 0x7c]
push ecx
push edi
add edi, eax
mov eax, 0x69636d5c
stosd dword es:[edi], eax
mov eax, 0x337a7471
stosd dword es:[edi], eax
mov eax, 0x6c642e32
stosd dword es:[edi], eax
mov eax, 0x6c
stosd dword es:[edi], eax
call sub.KERNEL32.dll_FindFirstFileA
add esp, 0x200
pop edi
inc eax
jne 0x401050
ret
pushal
jmp fcn.00401360

Function at 0x401288
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov esi, 0x4031d4
push ebx
mov ebx, esp
push ebx
push 0x2b
add dword [esp], 0x15
mov eax, 0xfffffe70
push eax
add dword [esp], 0xaec
push section..data
xor ecx, ecx
add ecx, sym.imp.KERNEL32.dll_VirtualProtect
call dword [ecx]
pop edx
mov eax, 0x403400
mov dword [esi - 0x1c0], eax
lea ebx, [eax + 0x4c]
mov ecx, 0x40251f
xor eax, eax
cmp eax, 0x55c
je 0x4012f3
sub eax, 0xfffffffc
inc ecx
inc ecx
inc ecx
inc ecx
mov edi, dword [ecx - 4]
mov dword [ebx - 0x4c], edi
add ebx, 4
xor dword [ebx - 0x50], 0xe7a32584
sub dword [ebx - 0x50], 0x4eac6723
jmp 0x4012cc
call sub.KERNEL32.dll_GetLogicalDrives
pop ebp
ret 0xc
Function at 0x433003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x61c5229b
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x36331bc7
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4330c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x429004]
jne 0x40100a
repz ret
jmp fcn.004019f7

Function at 0x404bcb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x429004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402b5c
and dword [ebp - 0x14], 0
cmp dword [0x42b278], 0
mov dword [ebp - 0x18], eax
jne 0x404c7e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404d26
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404d26
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42b278], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42b27c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42b280], eax
call edi
push eax
call esi
mov dword [0x42b288], eax
test eax, eax
je 0x404c7e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42b284], eax
mov eax, dword [0x42b284]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x404cd7
cmp dword [0x42b288], ecx
je 0x404cd7
push eax
call esi
push dword [0x42b288]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404cd7
test ebx, ebx
je 0x404cd7
call edi
test eax, eax
je 0x404cce
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x404cce
test byte [ebp - 8], 1
jne 0x404cd7
or dword [ebp + 0x10], 0x200000
jmp 0x404d0a
mov eax, dword [0x42b27c]
cmp eax, dword [ebp - 0x18]
je 0x404d0a
push eax
call esi
test eax, eax
je 0x404d0a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x404d0a
mov eax, dword [0x42b280]
cmp eax, dword [ebp - 0x18]
je 0x404d0a
push eax
call esi
test eax, eax
je 0x404d0a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42b278]
call esi
test eax, eax
je 0x404d26
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404d28
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x4252f2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [0x42cb2c]
push dword [0x42c978]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
leave
ret
Function at 0x425381
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x429004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x80c], eax
cmp ebx, 0x19f
jne 0x4253ad
push 0
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
push edi
xor edi, edi
test ebx, ebx
jle 0x4253f5
push esi
and dword [ebp - 0x808], 0
lea esi, [ebp - 0x808]
call fcn.00425376
mov eax, dword [ebp - 0x80c]
mov cl, byte [ebp - 0x808]
xor byte [eax + edi], cl
cmp ebx, 0xf
jne 0x4253ef
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
inc edi
cmp edi, ebx
jl 0x4253b5
pop esi
pop edi
cmp ebx, 0x2d
jne 0x42540c
or dword [0x42cc64], 0xffffffff
mov dword [0x42cc60], 0xa62e7790
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
leave
ret
Function at 0x4014b0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x4014c2
mov eax, dword [0x4df08b]
shl eax, 2
mov dword [0x4df08f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.004d21cc
pop edx
call fcn.004d2130
call fcn.004d220c
push 0
call fcn.004d366c
pop ecx
push 0x4df034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x4df093], eax
push 0
jmp fcn.004d9388
Function at 0x465fdc
Capabilities:
Accept command line arguments

Disassembly:
sub dword [0x4eb2ac], 1
jae 0x466062
mov byte [0x4e58d0], 2
mov dword [0x4eacfc], 0x4ddff0
mov dword [0x4ead00], 0x4de00e
mov byte [0x4ead3a], 2
mov dword [0x4eace8], 0x464c68
call fcn.00462c1c
test al, al
je 0x46601f
call fcn.00462c4c
call fcn.00462d10
mov word [0x4ead40], 0xd7b0
mov word [0x4eaf0c], 0xd7b0
mov word [0x4eb0d8], 0xd7b0
call fcn.00464b38
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [0x4ead2c], eax
call fcn.00460b78
mov dword [0x4ead28], eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov dword [0x4ead20], eax
ret

Function at 0x466a78
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x4669c4
call sub.USER32.DLL_EnumWindows
ret

Function at 0x466b9c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x466c19
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004665e8
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
push 0
call sub.KERNEL32.DLL_Sleep
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x466bc1
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00466240
cmp dword [ebp - 4], 0
je 0x466c03
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00463e24
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.USER32.DLL_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x466c20
lea eax, [ebp - 4]
call fcn.00463964
ret
Function at 0x4d8448
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x4e82fc], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x4d8522
cmp dword [0x4e82f8], 0
jne 0x4d8522
cmp dword [0x4e84dc], 0
je 0x4d84dc
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.004d8218
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4d84c2
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.004d8218
add esp, 8
mov ebx, eax
test eax, eax
jne 0x4d84c2
lea ebx, [ebp - 0x84]
jmp 0x4d84c3
inc ebx
call fcn.004d8404
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x4d855d
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x4e8300
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004d273c
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x4e8303
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x4d855d
cmp dword [0x4e82f8], 0
je 0x4d853c
cmp dword [0x4e82f8], 0xffffffff
je 0x4d855d
push esi
call dword [0x4e82f8]
pop ecx
mov eax, dword [0x4e82fc]
test eax, eax
je 0x4d855d
cmp dword [0x4e82fc], 0xffffffff
je 0x4d855d
cmp byte [eax], 0
je 0x4d855d
push esi
push eax
call fcn.004d8368
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x1d395724
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x5c365ceb
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x439840
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [0x53d720]
cmp eax, edx
jle 0x439867
mov eax, dword [ebp - 0xc]
mov dword [0x53d720], eax
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov eax, dword [0x537574]
mov edx, eax
mov eax, dword [ebp - 0xc]
push edx
mov edx, 0xc
mov ecx, edx
imul ecx
pop edx
add eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
push eax
call dword [sym.imp.MSVCRT.DLL_strlen]
add esp, 4
dec eax
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov eax, dword [0x540a48]
cmp eax, 0
je 0x4398e8
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
push eax
call fcn.0044c2fc
mov edx, eax
mov eax, dword [ebp - 0x1c]
mov dword [eax + 8], edx
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
sub eax, 3
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
cmp eax, 0x3e
je 0x43996e
push 0
push dword [str._n_r_t__e]
push 3
push 0
push 0x3e
push 2
push 0
push 0x549df8
push 6
push 0
push dword [str._n_r_t__e]
push 3
push 0
push dword [ebp + 8]
push 2
push 0
push str._Found:
push 6
push 0
push dword [str._n_r_t__e]
push 3
push 0
push dword [ebp - 0xc]
push 2
push 0
push str._Datatype_Error:_invalid_actions_count_for_type:
push 6
push 0x6c
lea esi, [esp + 4]
push esi
push 9
call fcn.004219a8
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
mov eax, dword [ebp - 0xc]
shl eax, 8
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0
je 0x439990
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
cmp eax, 0xffffffff
jne 0x439990
jmp 0x439994
xor eax, eax
jmp 0x439997
xor eax, eax
inc eax
cmp eax, 0
je 0x4399c5
mov eax, dword [ebp - 0x14]
shl eax, 8
inc eax
push eax
mov eax, 0x3e
mov edx, dword [ebp + 8]
sub eax, edx
pop edx
xchg edx, eax
add eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [0x537578]
mov edi, dword [ebp - 0x18]
dec edi
mov eax, dword [eax + edi*4]
jmp 0x4399ca
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, eax
mov eax, dword [0x537578]
mov edi, dword [ebp - 0x10]
dec edi
mov dword [eax + edi*4], edx
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
add eax, 4
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
dec eax
mov dword [ebp + 8], eax
mov eax, 0
mov edx, dword [ebp + 8]
cmp eax, edx
jne 0x439978
leave
pop esi
pop ecx
pop ecx
pop ecx
add esp, ecx
push esi
ret
Function at 0x4415e9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
push 0
push dword [0x537884]
push dword [ebp + 8]
call fcn.004360b3
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
xchg edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
xchg edx, eax
xchg edx, eax
shl eax, 4
add eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x44168e
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 3
je 0x441683
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
cmp eax, edx
sete al
xor ah, ah
cwde
xor al, 1
cmp eax, 0
je 0x441678
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.0042bf0d
mov eax, dword [ebp - 0x14]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov edx, eax
mov eax, dword [ebp - 0x10]
cmp eax, edx
jb 0x441645
mov eax, dword [ebp - 0x14]
xchg edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x18]
cmp eax, 0
je 0x4416d3
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
push eax
push 0
push dword [0x537888]
push dword [ebp + 8]
call fcn.004360b3
mov eax, dword [ebp + 8]
leave
ret 0x1c

Function at 0x4441d1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 4
mov eax, dword [ebp + 0x10]
cmp eax, 0
jne 0x4441ec
call fcn.00487685
jmp 0x4441ef
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, 2
xchg edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, 0
xchg edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov eax, 0
xchg edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 0xc], edx
mov eax, dword [ebp + 0x14]
cmp eax, 0
je 0x444250
cmp eax, 0xffffffff
je 0x444268
push 0
push str._Loading_Error:_input_encoding_unsupported
push 6
push 0xc
lea esi, [esp + 4]
push esi
push 1
call fcn.004219a8
push 0
call dword [sym.imp.MSVCRT.DLL_exit]
add esp, 4
jmp 0x444283
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042eeb5
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], edx
jmp 0x444283
xor eax, eax
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0042f035
mov edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], edx
mov eax, 7
xchg edx, eax
mov eax, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
leave
ret 0x10
Function at 0x461ae9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, dword [ebp + 8]
add eax, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
sar eax, 0x13
and eax, 0xf
mov dword [ebp - 0x18], eax
mov eax, 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
and eax, 0xff
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
dec edi
mov al, byte [eax + edi]
and eax, 0xff
push eax
call fcn.004499b4
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push dword [ebp + 0xc]
call fcn.00444136
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
cmp eax, edx
sete al
xor ah, ah
cwde
xor al, 1
cmp eax, 0
je 0x461b80
mov eax, dword [ebp + 0x14]
dec eax
mov dword [ebp + 0x14], eax
mov al, 0x2e
and eax, 0xff
push eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov eax, dword [eax]
push eax
call fcn.00442c16
push dword [ebp - 0xc]
call dword [sym.imp.MSVCRT.DLL_strlen]
add esp, 4
mov edx, eax
mov eax, dword [ebp + 0x14]
sub eax, edx
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
cmp eax, edx
jne 0x461b1a
mov eax, dword [ebp + 0x14]
leave
ret 0x10

Function at 0x48537e
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
mov eax, 1
mov dword [ebp - 0x10], 1
mov eax, 0x100
shl eax, 2
push eax
call dword [sym.imp.MSVCRT.DLL_malloc]
add esp, 4
mov dword [0x53dce8], eax
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0xc], eax
mov eax, 0
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0xc]
and eax, 1
mov edx, eax
mov eax, 0
cmp eax, edx
jne 0x4853d9
mov eax, dword [ebp - 0xc]
shr eax, 1
jmp 0x4853e4
mov eax, dword [ebp - 0xc]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 8
jne 0x4853be
mov eax, dword [ebp - 0xc]
xchg edx, eax
mov eax, dword [0x53dce8]
mov edi, dword [ebp - 0x10]
dec edi
mov dword [eax + edi*4], edx
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0x101
jne 0x4853ab
leave
ret
Function at 0x485d8b
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0xf0000000
push 0x18
push 0
push 0
push 0x53dcec
call dword [sym.imp.ADVAPI32.DLL_CryptAcquireContextW]
leave
ret

Function at 0x485dc7
Capabilities:
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0xc
push 0x40
call dword [sym.imp.MSVCRT.DLL_malloc]
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, 0
mov dword [ebp - 0xc], 0
push dword [ebp + 0x10]
call fcn.0048541b
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
cmp eax, 2
je 0x485e56
cmp eax, 3
je 0x485e5d
cmp eax, 4
je 0x485e64
cmp eax, 5
je 0x485e6b
cmp eax, 6
je 0x485e72
push dword [ebp + 0x10]
call fcn.0044a1d8
push eax
push 0xb
push dword [0x5474a4]
call fcn.00452889
push eax
push 3
push dword [0x547494]
call fcn.00452889
push eax
push 0xc
lea esi, [esp + 4]
push esi
push 3
call fcn.0042c0ce
mov eax, 0
jmp 0x485e77
mov eax, 0x8003
jmp 0x485e77
mov eax, 0x8004
jmp 0x485e77
mov eax, 0x800c
jmp 0x485e77
mov eax, 0x800d
jmp 0x485e77
mov eax, 0x800e
mov dword [ebp + 0x10], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push dword [ebp + 0x10]
push dword [0x53dcec]
call dword [sym.imp.ADVAPI32.DLL_CryptCreateHash]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.DLL_CryptHashData]
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push 2
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.DLL_CryptGetHashParam]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.DLL_CryptDestroyHash]
mov eax, dword [ebp - 0x10]
leave
ret 0xc

Function at 0x485ec6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
sub esp, 0x10
mov eax, dword [ebp + 8]
xchg edx, eax
mov eax, dword [0x53dcf4]
mov dword [eax], edx
mov eax, 0
mov dword [0x53dcf0], 0
mov eax, 1
mov dword [ebp - 0x10], 1
mov eax, 1
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [0x53dcf4]
mov edi, dword [ebp - 0x10]
dec edi
mov eax, dword [eax + edi*4]
sar eax, 0x1e
push eax
pop edx
xchg edx, eax
mov eax, dword [0x53dcf4]
mov edi, dword [ebp - 0x10]
dec edi
mov eax, dword [eax + edi*4]
xchg edx, eax
xor eax, edx
push edx
mov edx, 0x6c078965
mov ecx, edx
imul ecx
pop edx
mov edx, dword [ebp - 0x10]
add eax, edx
mov edx, eax
mov eax, dword [0x53dcf4]
mov edi, dword [ebp - 0x18]
dec edi
mov dword [eax + edi*4], edx
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0x270
jne 0x485f02
leave
ret 4