joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419c90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [0x517280]
mov eax, edx
imul eax, edx
and eax, 0x8000000f
jns 0x419cab
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 0xb
jne 0x419cc7
push 0x4b
push 0x4a
push str._d__d_n
call fcn.0049f507
mov edx, dword [0x517280]
add esp, 0xc
lea ecx, [edx + 2]
lea eax, [edx + 1]
imul eax, ecx
imul eax, edx
cdq
mov ecx, 0x11
idiv ecx
push ebx
xor bl, bl
push esi
cmp edx, 0xc
jne 0x419d00
mov esi, 1
mov eax, esi
xor edx, edx
lea ecx, [ecx]
dec edx
lea ecx, [eax + esi]
lea esi, [eax]
mov eax, ecx
jns 0x419cf0
mov dword [0x517280], ecx
mov eax, dword [ebp + 8]
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x419e0d
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
call fcn.00419af0
test al, al
jne 0x419d51
push 4
call fcn.0049dabd
mov ecx, eax
mov eax, dword [0x517280]
add esp, 4
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
push 0
mov eax, dword [eax]
lea ecx, [ebp + 8]
push ecx
mov dword [ebp + 8], 0
push dword [eax - 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x419e0d
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov ecx, dword [0x517280]
mov dword [ebp - 4], 9
lea edx, [ecx + 2]
lea eax, [ecx + 1]
imul eax, edx
imul eax, ecx
cdq
idiv dword [ebp - 4]
mov bl, 1
cmp edx, 7
jne 0x419e0d
test ecx, ecx
je 0x419e0d
lea esp, [esp]
mov eax, ecx
and eax, 0x80000001
jns 0x419dbe
dec eax
or eax, 0xfffffffe
inc eax
jne 0x419dcb
mov eax, ecx
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
jmp 0x419dd2
lea ecx, [ecx*2 + 1]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
lea eax, [eax + eax*2]
sub edx, eax
mov dword [0x517280], ecx
sub edx, 0
je 0x419dfc
sub edx, 2
je 0x419dff
dec edx
je 0x419e00
jmp 0x419e09
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x517280], ecx
test ecx, ecx
jne 0x419db0
call fcn.00419a20
test al, al
jne 0x419e34
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp esi, 0xffffffff
je 0x419e40
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e850
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c00ae
mov eax, dword fs:[0]
push eax
sub esp, 0x178
mov eax, dword [0x515e20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x17c], edi
test edi, edi
je 0x41ea2c
push 0xc
call fcn.0049dabd
mov ebx, eax
add esp, 4
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x170], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x41e8d7
mov eax, dword [0x5159f8]
mov ecx, 0x5159f8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
jmp 0x41e8df
xor ebx, ebx
mov dword [ebp - 0x164], ebx
push esi
mov ecx, ebx
mov dword [ebp - 4], 0xffffffff
call fcn.00402610
mov ecx, dword [0x517280]
mov esi, 0x18
lea eax, [ecx + 2]
inc ecx
imul eax, ecx
mov ecx, dword [0x517280]
imul eax, ecx
cdq
idiv esi
cmp edx, 0xb
jne 0x41e9ba
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x178], eax
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x174], eax
mov eax, ecx
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [ebp - 0x184], eax
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x180], eax
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
xor ebx, ebx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x170], eax
lea esi, [ebp - 0x15f]
nop
mov edi, 1
mov dword [ebp - 0x168], 0xe
nop
add esi, 6
inc edi
dec dword [ebp - 0x168]
jne 0x41e990
mov ebx, dword [ebp - 0x16c]
inc ebx
mov dword [ebp - 0x16c], ebx
cmp ebx, 4
jl 0x41e980
mov ebx, dword [ebp - 0x164]
mov edi, dword [ebp - 0x17c]
mov eax, dword [ebp + 0x14]
mov dword [ebx + 4], eax
call fcn.0041f130
test al, al
jne 0x41e9eb
mov eax, 0x1f
mov esi, 0x8b
test esi, esi
je 0x41e9e4
cdq
idiv esi
mov ecx, esi
mov eax, ecx
mov esi, edx
test ecx, ecx
jne 0x41e9d3
add eax, esi
mov dword [0x517280], eax
mov eax, dword [ebp + 0x18]
push ebx
push dword [ebp + 0xc]
mov dword [ebx + 8], eax
push 0x408
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [0x517280]
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
mov ecx, 0x13
idiv ecx
cmp edx, 2
jne 0x41ea2c
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049e294
mov esp, ebp
pop ebp
ret
Function at 0x420530
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c0278
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x515e20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.00420910
mov dword [edi], eax
lea ecx, [edi + 8]
mov dword [ebp - 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
call fcn.00420910
mov dword [edi + 8], eax
mov eax, dword [edi]
mov ecx, edi
push dword [eax + 4]
call fcn.00420a10
mov eax, dword [edi]
lea ecx, [edi + 8]
mov dword [eax + 4], eax
mov eax, dword [edi]
mov dword [eax], eax
mov eax, dword [edi]
mov dword [eax + 8], eax
mov dword [edi + 4], 0
mov eax, dword [edi + 8]
push dword [eax + 4]
call fcn.00420a10
mov eax, dword [edi + 8]
mov dword [eax + 4], eax
mov eax, dword [edi + 8]
mov dword [eax], eax
mov eax, dword [edi + 8]
mov dword [eax + 8], eax
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x422b90
Capabilities:
Get disk size

Disassembly:
mov ecx, dword [0x517280]
push ebx
push esi
lea esi, [ecx + 1]
mov eax, esi
imul eax, ecx
push edi
cdq
mov edi, 0x14
idiv edi
mov bl, 1
cmp edx, 3
jne 0x422bdc
lea eax, [ecx + 2]
imul eax, esi
imul eax, ecx
cdq
mov ecx, 0xc
idiv ecx
cmp edx, 3
jne 0x422bd6
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
pop edi
pop esi
xor al, al
pop ebx
ret
pop edi
pop esi
mov al, bl
pop ebx
ret
Function at 0x423c50
Capabilities:
Check os version

Disassembly:
push esi
mov esi, dword [0x517280]
mov eax, esi
imul eax, esi
cdq
mov ecx, 0x17
idiv ecx
push edi
cmp edx, 7
jne 0x423ca4
push 0x28
call fcn.0049d210
add esp, 4
mov edi, eax
xor esi, esi
call fcn.0049ed34
add eax, dword [0x517280]
inc esi
mov dword [edi + esi*4 - 4], eax
cmp esi, 0xa
jl 0x423c78
mov eax, dword [edi + 0x24]
push edi
mov dword [0x517280], eax
call fcn.0049ee63
mov esi, dword [0x517280]
add esp, 4
lea ecx, [esi + 2]
lea eax, [esi + 1]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 0x16
idiv ecx
push ebx
lea ebx, [ecx - 0x12]
cmp edx, 0xb
jne 0x423cf4
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x7b]
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049d210
push eax
call fcn.0049ee63
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ebx, eax
call fcn.00445650
test al, al
jne 0x423d15
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
mov dword [0x517280], esi
jmp 0x423d1b
mov esi, dword [0x517280]
lea eax, [esi + 1]
imul eax, esi
cdq
mov ecx, 0x17
idiv ecx
movzx edi, bl
pop ebx
cmp edx, 0xb
jne 0x423d6a
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x64
sub esi, eax
xor ecx, ecx
lea eax, [esi + 0x7b]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049d210
push eax
call fcn.0049ee63
add esp, 8
cmp edi, 6
sbb eax, eax
pop edi
neg eax
pop esi
ret
Function at 0x4251f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call fcn.00424e40
test al, al
jne 0x42523c
mov esi, dword [0x517280]
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x64
sub esi, ecx
xor ecx, ecx
lea eax, [esi + 0x7b]
mov edx, 4
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049d210
push eax
call fcn.0049ee63
add esp, 8
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 4]
push ecx
push 0x2001f
push 0
push dword [eax]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x425260
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov esi, dword [eax]
mov eax, dword [ebp + 8]
mov ecx, dword [esi - 0xc]
mov edx, dword [eax]
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push 0
push edx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x425830
Capabilities:
Get disk size
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [0x517280]
mov dword [ebp - 8], eax
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov dword [ebp - 4], 0x15
idiv dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
cmp edx, 9
cmove esi, ecx
mov dword [0x517280], esi
call fcn.00424cb0
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push dword [edi]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x425894
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push 4
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp - 8]
push 4
push 0
push dword [eax]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
call fcn.00424c30
test al, al
jne 0x4258c7
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
test esi, esi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42eec0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c12cb
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x515e20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x517280]
mov esi, 0xf
lea eax, [ecx + 1]
imul eax, ecx
cdq
idiv esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x148], ebx
mov dword [ebp - 0x150], 0
cmp edx, 8
jne 0x42ef38
xor esi, esi
test ecx, ecx
je 0x42ef32
mov eax, ecx
and eax, 1
add esi, eax
mov eax, ecx
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
jne 0x42ef20
mov dword [0x517280], esi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ecx, eax
shr eax, 8
movzx eax, al
movzx edi, cl
mov dword [ebp - 0x14c], eax
cmp ecx, 0x80000000
jae 0x42ef5e
mov esi, ecx
shr esi, 0x10
cmp edi, 6
jb 0x42ef76
cmp eax, 2
jb 0x42ef76
push ebx
call fcn.0042f080
add esp, 4
jmp 0x42f05b
mov eax, dword [0x5159f8]
mov ecx, 0x5159f8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x144], eax
push esi
push dword [ebp - 0x14c]
lea eax, [ebp - 0x144]
push edi
push 0x4d59f4
push eax
mov dword [ebp - 4], 0
call fcn.00405280
add esp, 0x14
call fcn.0042f850
test al, al
jne 0x42efcf
mov ebx, dword [0x517280]
xor esi, esi
mov edi, ebx
inc esi
dec edi
cmp esi, 0x4c
jb 0x42efc2
mov ebx, dword [ebp - 0x148]
mov esi, dword [ebp - 0x144]
add esi, 0xfffffff0
mov ecx, dword [esi]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
lea edx, [esi + 0xc]
mov ecx, eax
jl 0x42effb
cmp ecx, dword [esi]
jne 0x42effb
mov edi, esi
mov eax, 1
lock xadd dword [edx], eax
jmp 0x42f038
mov eax, dword [ecx]
push 2
push dword [esi + 4]
call dword [eax]
mov edi, eax
test edi, edi
jne 0x42f00f
call fcn.004092c0
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov ecx, dword [esi + 4]
lea eax, [ecx*2 + 2]
push eax
lea eax, [esi + 0x10]
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.0049ee68
add esp, 0x10
lea eax, [edi + 0x10]
mov dword [ebx], eax
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42f05b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049e294
mov esp, ebp
pop ebp
ret
Function at 0x442900
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2f76
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x515e20]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push esi
mov byte [ebp - 4], 1
call ebx
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x4429ac
push 2
push eax
push esi
call ebx
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x4429ac
call fcn.004273b0
mov esi, eax
jmp 0x442a9c
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4429cf
call fcn.004273b0
jmp 0x442a8f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
test ebx, ebx
jne 0x4429ed
call fcn.004273b0
jmp 0x442a8f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x420], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x442a0e
mov esi, 0x8007000e
jmp 0x442a91
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0043c2a0
jmp 0x442a38
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x442a4f
mov esi, 0x8007000e
jmp 0x442a91
push esi
push dword [ebp - 0x418]
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x442a6f
call fcn.004273b0
jmp 0x442a8f
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.004427a0
mov esi, eax
test edi, edi
je 0x442a9c
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x442ac0
lea ecx, [ebp - 0x418]
call fcn.00440de0
jmp 0x442ac0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0049e294
mov esp, ebp
pop ebp
ret 0x10
Function at 0x444440
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x444459
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x444465
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x444460
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44bc80
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.0049f630
mov eax, dword [0x515e20]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x44bce5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x44bce5
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.004a2b4f
add eax, 0x40
push eax
call fcn.004a2987
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0049e294
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.004a28c2
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x44bd74
call fcn.0044bb40
test eax, eax
jle 0x44bd74
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0049e294
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0049e294
add esp, 0x108
ret

Function at 0x450d80
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x450dc7
mov al, byte [edx]
test al, al
je 0x450dc7
push edi
mov edi, pe_nt_image_headers32
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x450d97
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x45dd50
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24
call fcn.0049f630
mov eax, dword [0x515e20]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, esi
push edi
mov dword [ebp - 0x18], esi
lea ecx, [eax + 1]
jmp 0x45dd80
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x45dd80
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
sub eax, ecx
lea edi, [eax + 1]
push edi
push esi
push 8
push 0xfde9
mov dword [ebp - 0x20], 8
call ebx
mov esi, eax
test esi, esi
jg 0x45ddf8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ec
jne 0x45ddda
mov ecx, dword [ebp - 0x18]
push 0
push 0
push edi
push ecx
push 0
push 0xfde9
mov dword [ebp - 0x20], 0
call ebx
mov esi, eax
test esi, esi
jg 0x45ddf8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x45de8a
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push edx
push eax
jmp 0x45de78
lea eax, [esi + esi]
call fcn.004a1180
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov eax, esp
push esi
push eax
push edi
push ecx
push edx
push 0xfde9
mov dword [ebp - 0x24], eax
call ebx
test eax, eax
je 0x45de8a
mov esi, dword [ebp - 0x1c]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x45de23
push 8
sub eax, edx
lea ecx, [ebp - 0x14]
push ecx
inc eax
push eax
push esi
push 0
push 0xfde9
call ebx
test eax, eax
je 0x45de8a
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.004a060d
mov esi, eax
add esp, 8
test esi, esi
jne 0x45df2e
call fcn.004a47fe
cmp dword [eax], 2
je 0x45de70
call fcn.004a47fe
cmp dword [eax], 9
jne 0x45de82
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push ecx
push edx
call fcn.004a18a1
mov esi, eax
add esp, 8
test esi, esi
jne 0x45df2e
push 0xa9
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.0044a800
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0x4e206c
push eax
push 0x4e2068
push ecx
push str.fopen_
push 5
call fcn.0044a3e0
add esp, 0x2c
call fcn.004a47fe
cmp dword [eax], 2
jne 0x45df00
push 0xac
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.0044a800
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049e294
mov esp, ebp
pop ebp
ret
push 0xae
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.0044a800
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049e294
mov esp, ebp
pop ebp
ret
push 0x514eb8
call fcn.00448e40
mov edi, eax
add esp, 4
test edi, edi
jne 0x45df60
push esi
call fcn.004a079d
add esp, 4
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049e294
mov esp, ebp
pop ebp
ret
push 0
push edi
call fcn.004488d0
push esi
push 1
push 0x6a
push edi
call fcn.00448c30
add esp, 0x18
mov eax, edi
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049e294
mov esp, ebp
pop ebp
ret
Function at 0x47cbe0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x47cbf9
mov esi, edi
mov edi, eax
jmp 0x47cbfb
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x47cc0b
mov eax, ebx
jmp 0x47cc15
push eax
push ebx
call fcn.0044def0
add esp, 8
test eax, eax
jne 0x47cc1d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x47cc39
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x47cc24
cmp eax, dword [esi + 4]
jge 0x47cc50
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x47cc40
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x47cc71
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x47cc6e
dec eax
test eax, eax
jg 0x47cc60
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret