joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0200
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x14
push ebp
push esi
mov esi, dword [esp + 0x24]
xor ebp, ebp
cmp esi, ebp
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ebp
je 0x4b0330
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
push eax
push 0x40000
push ebp
push esi
push edi
call ebx
test eax, eax
jne 0x4b031f
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x10]
push ecx
push 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
jne 0x4b031f
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4b031a
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], ebp
push ecx
push 0x20019
push ebp
push esi
push edi
call ebx
test eax, eax
jne 0x4b031f
push eax
push eax
lea edx, [esp + 0x30]
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x28]
push eax
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x34]
push ebp
lea eax, [esp + 0x44]
push edx
push eax
push ebp
push ebp
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x4b031f
push 0x105
call fcn.004d7039
mov esi, eax
mov eax, dword [esp + 0x30]
add esp, 4
xor edi, edi
test eax, eax
jbe 0x4b0311
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edx, dword [esp + 0x10]
push 0x105
push esi
push edi
push edx
call ebx
test eax, eax
jne 0x4b0301
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
push 1
push eax
push esi
push ecx
mov ecx, dword [esp + 0x24]
call fcn.004b0200
jmp 0x4b0308
cmp eax, 0x103
je 0x4b0311
mov eax, dword [esp + 0x2c]
inc edi
cmp edi, eax
jb 0x4b02d7
push esi
call fcn.004d7062
add esp, 4
mov ebp, 1
mov eax, dword [esp + 0x10]
pop edi
test eax, eax
pop ebx
je 0x4b0330
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
pop esi
pop ebp
add esp, 0x14
ret 0x10
Function at 0x4b7dc0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x4b7e0c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x4b7e0c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x4b7df6
push eax
call ebp
test ax, ax
jl 0x4b7e04
inc esi
add edi, 4
cmp esi, 6
jb 0x4b7de8
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.004b7ac0
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4bb9d0
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x4bba30
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x4bba30
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x4bba30
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x4bba30
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x4bba40
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x4d96e8
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4d9720
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004d779f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004d7777
jmp 0x4d972c
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4dadda
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4dae1c
call fcn.004e0c92
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4dae1c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4dae13
xor eax, eax
jmp 0x4dae24
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004dae2a
pop edi
pop esi
pop ebx
ret 4

Function at 0x4e11c2
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4e11f0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4e120e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004e1128
jmp 0x4e120e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4e120e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004e1128
test edi, edi
mov eax, edi
jne 0x4e11f8
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10034404
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 0x4e7e
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
push 0x686f
call fcn.10033fe8
add esp, 0x14
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1003443e
xor eax, eax
jmp 0x10034595
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1003445c
xor eax, eax
jmp 0x10034595
push 0x5d33
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
push 1
call fcn.10033d36
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x1003447f
xor eax, eax
jmp 0x10034595
push 0x643b
push 1
lea eax, [ebp - 0xc]
push eax
push 0x4486
lea eax, [ebp - 0x24]
push eax
push 0x79a7
push 0x59ee
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x3d19
push 0x353a
push 0x9ba
push 0x153b
lea eax, [ebp - 4]
push eax
push 0x218a
push 0x55f1
push 0x1244
push 0x19f0
call fcn.10034040
add esp, 0x48
lea eax, [ebp + 8]
push eax
push 1
push 0x389e
lea eax, [ebp - 4]
push eax
push 0x4f67
lea eax, [ebp - 8]
push eax
call fcn.1003434a
add esp, 0x18
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x1003451e
push 0x7d
push 0x121
push 1
push dword [ebp - 0x14]
push dword [ebp - 4]
call fcn.1002efba
add esp, 0x14
push dword [ebp - 4]
call fcn.10033c22
pop ecx
test eax, eax
jne 0x1003452f
xor eax, eax
jmp 0x10034595
push 1
push dword [ebp - 4]
call fcn.1002bff1
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1003457d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1003455a
xor eax, eax
jmp 0x10034595
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10034573
xor eax, eax
jmp 0x10034595
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1003458e
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x10034592
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x40d9f1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
inc ecx
push ebp
inc ecx
push esp
push ebp
push edi
push esi
push ebx
dec eax
sub esp, 0x88
dec eax
mov esi, dword [0x821a]
fld xword [ecx]
mov ecx, 8
mov edi, edx
dec eax
mov eax, dword [esi]
dec eax
mov dword [esp + 0x78], eax
xor eax, eax
fstp xword [esp + 0x20]
call fcn.00412bd1
dec eax
test eax, eax
dec eax
mov ebx, eax
je 0x40db2d
dec eax
lea ecx, [esp + 0x60]
dec eax
lea edx, [esp + 0x50]
dec esp
lea eax, [esp + 0x74]
fld xword [esp + 0x20]
fstp xword [esp + 0x50]
call fcn.00411a61
fldz
fld xword [esp + 0x60]
fucomi st(1)
fstp st(1)
jb 0x40db78
fld1
fucomi st(1)
jbe 0x40db7c
fnstcw word [esp + 0x3e]
movzx eax, word [esp + 0x3e]
inc ecx
mov ecx, 2
inc ecx
mov eax, 2
or ah, 0xc
mov word [esp + 0x3c], ax
fld dword [0x7e7d]
fmul st(2), st(0)
fxch st(2)
fld st(0)
fldcw word [esp + 0x3c]
fistp dword [esp + 0x38]
fldcw word [esp + 0x3e]
mov eax, dword [esp + 0x38]
dec eax
mov dword [esp + 0x20], eax
dec eax
mov edx, eax
fild qword [esp + 0x20]
fsubp st(1)
fldz
fxch st(1)
fucomi st(1)
jb 0x40db82
fxch st(2)
fucomi st(2)
jbe 0x40db8c
fxch st(2)
fmulp st(3)
fxch st(2)
fld st(0)
fldcw word [esp + 0x3c]
fistp dword [esp + 0x38]
fldcw word [esp + 0x3e]
mov eax, dword [esp + 0x38]
dec eax
mov dword [esp + 0x20], eax
fild qword [esp + 0x20]
fsubp st(1)
fucomi st(2)
fstp st(2)
jb 0x40db96
fucomi st(1)
jbe 0x40db9c
shl edx, 0x10
or edx, eax
inc ecx
cmp ecx, 1
inc edx
mov dword [ebx + eax*4 - 4], edx
inc ecx
mov eax, 1
jne 0x40db64
fstp st(0)
fstp st(0)
mov edx, dword [ebx + 4]
test edx, edx
jne 0x40db71
mov eax, dword [ebx]
xor ebp, ebp
test eax, eax
inc eax
setne ch
mov eax, dword [esp + 0x74]
dec ecx
mov ebp, ebx
inc esp
lea esp, [eax - 0x40]
dec eax
lea edx, [esp + 0x40]
inc ecx
mov ecx, edi
dec ecx
mov eax, ebx
inc esp
mov ecx, esp
dec eax
mov dword [esp + 0x40], ebp
dec esp
mov dword [esp + 0x48], ebp
call fcn.0040d381
dec eax
mov edi, dword [esp + 0x78]
dec eax
xor edi, dword [esi]
jne 0x40dba5
dec eax
add esp, 0x88
pop ebx
pop esi
pop edi
pop ebp
inc ecx
pop esp
inc ecx
pop ebp
ret
inc ecx
mov ecx, 1
jmp 0x40da82
mov ebp, 2
jmp 0x40db22
fstp st(0)
jmp 0x40dba0
fstp st(0)
fstp st(0)
jmp 0x40dba0
fstp st(0)
fstp st(0)
fstp st(0)
fstp st(0)
jmp 0x40dba0
fstp st(0)
fstp st(0)
fstp st(0)
fstp st(0)
jmp 0x40dba0
fstp st(0)
fstp st(0)
jmp 0x40dba0
fstp st(0)
fstp st(0)
call fcn.00412a81
call fcn.00412a51
nop
nop word [eax + eax]
Function at 0x413f80
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40d015
lea edi, [esi - 0xc015]
push edi
or ebp, 0xffffffff
jmp 0x413fa2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x413fa9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x413f98
mov eax, 1
add ebx, ebx
jne 0x413fbb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x413fb0
jne 0x413fcc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413fb0
xor ecx, ecx
sub eax, 3
jb 0x413fe0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414052
mov ebp, eax
add ebx, ebx
jne 0x413feb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x413ff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41401c
inc ecx
add ebx, ebx
jne 0x414008
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x413ffd
jne 0x414019
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x413ffd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41403c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41402d
jmp 0x413f9e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41403c
add edi, ecx
jmp 0x413f9e
pop esi
mov edi, esi
mov ecx, 0x210
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41405a
cmp byte [edi], 5
jne 0x41405a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41405f
lea edi, [esi + 0x11000]
mov eax, dword [edi]
or eax, eax
je 0x4140ce
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x15454]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x15508]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41408c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1550c]
or eax, eax
je 0x4140c8
mov dword [ebx], eax
add ebx, 4
jmp 0x4140a9
call dword [esi + 0x1551c]
mov ebp, dword [esi + 0x15510]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414102
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x4035c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push ecx
mov dword [esp + 0x14], edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
xor edi, edi
mov ecx, dword [ebx + 0x3c]
mov ebp, dword [ecx + ebx + 0x78]
mov ecx, dword [ebp + ebx + 0x20]
add ebp, ebx
add ecx, ebx
mov dword [esp + 0x14], ecx
mov eax, dword [ebp + 0x1c]
add eax, ebx
mov dword [esp + 0x1c], eax
mov eax, dword [ebp + 0x24]
add eax, ebx
mov dword [esp + 0x18], eax
cmp dword [ebp + 0x18], edi
jbe 0x4036c9
mov esi, dword [ecx + edi*4]
xor eax, eax
mov cl, byte [esi + ebx]
add esi, ebx
test cl, cl
je 0x403668
cmp cl, 0x30
jl 0x403629
mov cl, byte [esi]
cmp cl, 0x5a
jg 0x403629
movsx ecx, cl
mov dl, byte [ecx + 0x427fa0]
jmp 0x40363c
mov dl, byte [esi]
lea ecx, [edx - 0x61]
cmp cl, 0x19
ja 0x40363c
movsx ecx, dl
mov dl, byte [ecx + 0x427f80]
mov byte [eax + 0x42e238], dl
test al, 1
je 0x403658
mov cl, byte [eax + 0x42e237]
mov byte [eax + 0x42e237], dl
mov byte [eax + 0x42e238], cl
mov cl, byte [esi + 1]
inc esi
inc eax
mov edx, eax
test cl, cl
jne 0x403612
cmp edx, 0x64
jae 0x4036d3
mov byte [eax + 0x42e238], 0
mov ecx, 0x42e238
mov eax, dword [esp + 0x10]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x403698
test dl, dl
je 0x403694
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x403698
add eax, 2
add ecx, 2
test dl, dl
jne 0x403678
xor eax, eax
jmp 0x40369d
sbb eax, eax
or eax, 1
test eax, eax
je 0x4036b0
inc edi
cmp edi, dword [ebp + 0x18]
jae 0x4036c9
mov ecx, dword [esp + 0x14]
jmp 0x403604
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
movzx eax, word [eax + edi*2]
pop edi
pop esi
pop ebp
mov eax, dword [ecx + eax*4]
add eax, ebx
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
call fcn.00407f09
int3

Function at 0x408a35
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x408a74
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408a74
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408a74
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x408a74
cmp dword [ecx + 0x74], 0xe
jbe 0x408a74
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4190d5
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4251b8
push 0x4251b0
push str.FlsAlloc
push 0x1f
call fcn.00418f94
mov esi, eax
add esp, 0x10
test esi, esi
je 0x419109
push dword [ebp + 8]
mov ecx, esi
call dword [0x42213c]
call esi
jmp 0x41910f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x419153
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4251c8
push 0x4251c0
push str.FlsGetValue
push 0x21
call fcn.00418f94
mov esi, eax
add esp, 0x10
test esi, esi
je 0x41918a
push dword [ebp + 8]
mov ecx, esi
call dword [0x42213c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x419192
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4251d0
push 0x4251c8
push str.FlsSetValue
push 0x22
call fcn.00418f94
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4191cc
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42213c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x41a7d6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x41a873
push ebx
push esi
call fcn.0041a79f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00417d34
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x41a820
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41a872
push edi
push eax
call fcn.00415ece
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x41a840
call fcn.00415e94
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x41a871
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00417d34
add esp, 0x20
test eax, eax
jne 0x41a85f
push edi
call fcn.00415e94
jmp 0x41a867
push ebx
call fcn.00415e94
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x41a876
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x41a887
pop esi
ret
push ebx
push edi
push esi
call fcn.0041a79f
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00415ece
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x41a8af
push ebx
push esi
push edi
call fcn.00408e10
add esp, 0xc
push 0
call fcn.00415e94
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x41ac7f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041a8c4
Function at 0x4218b0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4218dd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4218dd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4038d0
Capabilities:
Hash data with md5

Disassembly:
push 0xffffffffffffffff
push 0x4567b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x474ea0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
call fcn.00403b40
push 1
lea esi, [edi + 0x10]
mov dword [esp + 0x1c], 0
mov eax, dword [esi + 4]
mov ecx, dword [esi + 8]
push 4
push eax
push ecx
push esi
call fcn.00403cb0
mov dword [esi + 8], eax
mov dword [esi + 4], 4
mov eax, dword [edi + 0x18]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
add esp, 0x14
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x403d90
Capabilities:
Encrypt data using rc6

Disassembly:
push 0xffffffffffffffff
push 0x456a68
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x474ea0]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov ebp, ecx
mov eax, dword [ebp + 4]
mov ebx, dword [esp + 0x3c]
mov edx, dword [eax + 0xc]
lea ecx, [ebp + 4]
push ebx
call edx
cmp eax, ebx
je 0x403de4
push 0x98
push str.e:workspace.secure_ebooklibrariescyrptlib_seckey.h
push str.GetValidKeyLength_length___length
call fcn.0043d216
add esp, 0xc
mov esi, dword [esp + 0x40]
cmp esi, 1
jb 0x403df5
cmp esi, 0x7fffffff
jbe 0x403e09
push 0x3b
push str.e:workspace.secure_ebooklibrariescyrptlib_seckey.h
push str.rounds____unsigned_int_MIN_ROUNDS__rounds____unsigned_int_MAX_ROUNDS
call fcn.0043d216
add esp, 0xc
mov dword [ebp + 0xc], esi
lea esi, [esi + esi + 4]
lea edi, [ebp + 0x10]
call fcn.00404410
lea eax, [ebx + 3]
shr eax, 2
mov dword [esp + 0x40], eax
cmp eax, 1
mov dword [esp + 0x3c], 1
lea eax, [esp + 0x3c]
jb 0x403e37
lea eax, [esp + 0x40]
mov edi, dword [eax]
push edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], edi
call fcn.00403bc0
xor esi, esi
add esp, 4
cmp edi, esi
jne 0x403e58
xor eax, eax
mov dword [esp + 0x3c], eax
jmp 0x403e77
xor ecx, ecx
mov eax, edi
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0041ab3d
add esp, 4
mov dword [esp + 0x3c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], esi
mov ecx, dword [esp + 0x38]
push ebx
push ecx
push eax
mov eax, edi
call fcn.00404470
mov edx, dword [ebp + 0x18]
mov eax, 1
add esp, 0xc
mov dword [edx], 0xb7e15163
cmp dword [ebp + 0x14], eax
jbe 0x403ebd
mov ecx, dword [ebp + 0x18]
mov edx, dword [ecx + eax*4 - 4]
lea ecx, [ecx + eax*4]
sub edx, 0x61c88647
add eax, 1
mov dword [ecx], edx
cmp eax, dword [ebp + 0x14]
jb 0x403ea3
mov eax, dword [ebp + 0x14]
xor ebx, ebx
mov dword [esp + 0x38], eax
cmp eax, edi
mov dword [esp + 0x40], esi
lea eax, [esp + 0x14]
jb 0x403ed6
lea eax, [esp + 0x38]
mov eax, dword [eax]
lea eax, [eax + eax*2]
cmp eax, esi
mov dword [esp + 0x38], eax
jbe 0x403f30
xor edx, edx
mov eax, esi
div dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
lea ecx, [eax + edx*4]
mov eax, dword [ecx]
add eax, dword [esp + 0x40]
xor edx, edx
add eax, ebx
rol eax, 3
mov dword [ecx], eax
mov ebx, eax
mov eax, esi
div edi
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx + edx*4]
add esi, 1
lea edi, [ecx + edx*4]
mov edx, dword [esp + 0x40]
add eax, edx
mov cl, bl
add cl, dl
add eax, ebx
rol eax, cl
cmp esi, dword [esp + 0x38]
mov dword [edi], eax
mov edi, dword [esp + 0x14]
mov dword [esp + 0x40], eax
jb 0x403ee3
mov esi, dword [esp + 0x3c]
lea edx, [edi*4]
push edx
push 0
push esi
call fcn.004376f0
push esi
call fcn.0041ab38
add esp, 0x10
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x10
Function at 0x404980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x456418
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x474ea0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
push 0x10
push str.BER_decode_error
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.00402670
lea eax, [esp + 4]
push eax
push 1
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.00401040
cmp dword [esp + 0x1c], 0x10
mov dword [esi], vtable.CryptoPP::InvalidArgument.0
jb 0x4049f8
mov ecx, dword [esp + 8]
push ecx
call fcn.0041ab38
add esp, 4
mov eax, esi
mov dword [esi], vtable.CryptoPP::BERDecodeErr.0
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
add esp, 0x28
ret

Function at 0x4058a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x456c50
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x474ea0]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [0x474ea0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
push 1
mov dword [esp + 0x20], eax
mov dword [esp + 8], eax
push 0x476728
lea eax, [esp + 0xc]
mov dword [esp + 0x2c], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x10], edx
mov edx, dword [ecx]
mov edx, dword [edx + 0x7c]
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], vtable.CryptoPP::ArraySink.0
mov dword [esp + 0x20], vtable.CryptoPP::ArraySink.1.0
call edx
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004377fb
mov esp, ebp
pop ebp
ret 8

Function at 0x405980
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x456c20
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x474ea0]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x474ea0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ecx]
xor edx, edx
push 1
push 0x476728
push edx
mov dword [esp + 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
push eax
lea edx, [esp + 0x1c]
mov dword [esp + 0x34], eax
push edx
mov edx, dword [esi + 0x80]
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], vtable.CryptoPP::ArraySink.0
mov dword [esp + 0x30], vtable.CryptoPP::ArraySink.1.0
call edx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.004377fb
mov esp, ebp
pop ebp
ret 8