joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b200
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x46b25f
push 0x578508
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x46b22c
mov eax, 1
jmp 0x46b27d
push str.RegDeleteKeyTransactedW
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46b25d
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
push eax
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0xc]
jmp 0x46b27d
jmp 0x46b278
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x46b278
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x46b27d
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x46b450
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
xor eax, eax
jne 0x46b459
cmp dword [ebp + 0xc], 0
je 0x46b46c
mov dword [ebp - 0xc], 1
jmp 0x46b473
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
jne 0x46b486
mov eax, 0xd
jmp 0x46b4db
xor edx, edx
jne 0x46b45d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 8]
mov ax, word [edx]
mov word [ebp - 2], ax
add dword [ebp - 8], 2
cmp word [ebp - 2], 0
jne 0x46b499
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x14]
sar ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
lea eax, [edx + edx + 2]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46b4f0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x595be0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20c], ecx
push 0
lea ecx, [ebp - 0x21c]
call fcn.00437c00
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x20c]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.00437ca0
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x46b56f
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x21c]
call fcn.00437c30
mov eax, dword [ebp - 0x224]
jmp 0x46b624
mov dword [ebp - 0x210], 0x100
lea eax, [ebp - 0x230]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x204]
push edx
push 0
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x46b5f3
lea ecx, [ebp - 0x204]
push ecx
lea ecx, [ebp - 0x21c]
call fcn.0046b4f0
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 0
je 0x46b5e7
mov edx, dword [ebp - 0x208]
mov dword [ebp - 0x220], edx
lea ecx, [ebp - 0x21c]
call fcn.00437c30
mov eax, dword [ebp - 0x220]
jmp 0x46b624
mov dword [ebp - 0x210], 0x100
jmp 0x46b579
lea ecx, [ebp - 0x21c]
call fcn.00437c50
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x20c]
call fcn.0046b290
mov dword [ebp - 0x228], eax
lea ecx, [ebp - 0x21c]
call fcn.00437c30
mov eax, dword [ebp - 0x228]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdc6a
mov esp, ebp
pop ebp
ret 4
Function at 0x473530
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x528e78
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x595be0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x18]
call fcn.0042a230
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x14], 0
je 0x47361e
mov ecx, dword [ebp - 0x14]
cmp dword [ecx + 0x18], 0
je 0x47361e
mov byte [ebp - 0xd], 1
push 0x56a9a4
mov ecx, dword [ebp + 8]
call fcn.0044afc0
movzx edx, al
test edx, edx
je 0x4735cb
push 0x56a9fc
mov ecx, dword [ebp + 8]
call fcn.0044ae40
mov ecx, eax
call fcn.0044b1b0
movzx eax, al
test eax, eax
je 0x4735cb
push str.fade
mov ecx, dword [ebp + 8]
call fcn.0044ae40
mov ecx, eax
call fcn.0044a710
mov byte [ebp - 0xd], al
movzx ecx, byte [ebp - 0xd]
test ecx, ecx
je 0x4735ea
push 2
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x10]
mov ecx, dword [ebp - 0x14]
mov edx, dword [eax]
mov ecx, dword [ecx + 0x10]
mov eax, dword [edx + 0x2c]
call eax
jmp 0x47361e
push 0
push 0
push 0x402
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov edx, dword [ebp - 0x14]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
jne 0x473567
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00428a40
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x48a6e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x595be0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], 0
push pe_nt_image_headers32
push 0
lea eax, [ebp - 0x114]
push eax
call fcn.00503b40
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0
je 0x48a760
cmp dword [ebp - 0x114], 5
jae 0x48a754
cmp dword [ebp - 0x114], 4
jne 0x48a760
cmp dword [ebp - 0x110], 0x5a
jb 0x48a760
mov dword [ebp - 0x11c], 0
jmp 0x48a76a
mov dword [ebp - 0x11c], 1
mov al, byte [ebp - 0x11c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdc6a
mov esp, ebp
pop ebp
ret
Function at 0x497cd0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
call fcn.00460d50
call fcn.0043a600
mov dword [ebp - 0x10], eax
push 5
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0048b5b0
add esp, 0xc
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x497e16
push 0xf0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0048b5b0
add esp, 0xc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x14], 0
je 0x497d50
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x18], eax
xor eax, eax
jne 0x497d3f
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x497dfd
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x497df2
mov edx, dword [ebp - 0x24]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.0048a900
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.004207d0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x497dd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0xc]
je 0x497df0
cmp dword [ebp - 8], 0
je 0x497df0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x497dfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x497e06
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x497e16
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x49e690
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
call fcn.0049e650
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x49e6c3
xor al, al
jmp 0x49e80e
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x49e6e1
xor al, al
jmp 0x49e80e
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x49e706
xor al, al
jmp 0x49e80e
mov ecx, dword [ebp - 0x10]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x18], 0
je 0x49e80c
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x49e7f5
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.00503390
add esp, 0xc
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x49e7e8
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.0049e480
add esp, 8
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x49e7e8
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 4]
call fcn.004696d0
test eax, eax
jne 0x49e7af
mov al, 1
jmp 0x49e80e
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
je 0x49e7d7
push 1
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
mov edx, dword [eax]
call edx
mov dword [ebp - 0x24], eax
jmp 0x49e7de
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 4]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], 0
xor al, al
mov esp, ebp
pop ebp
ret 0xc
Function at 0x49f920
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
xor eax, eax
jne 0x49f929
cmp dword [ebp + 0xc], 0
je 0x49f93c
mov dword [ebp - 0x18], 1
jmp 0x49f943
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
jne 0x49f959
mov eax, 0xd
jmp 0x49f9dc
xor edx, edx
jne 0x49f92d
mov dword [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, 2
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 8]
mov cx, word [eax]
mov word [ebp - 2], cx
add dword [ebp - 8], 2
cmp word [ebp - 2], 0
jne 0x49f979
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x20]
sar edx, 1
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
lea eax, [edx + ecx*2]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
lea eax, [edx + ecx*2]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 1
jne 0x49f96a
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 7
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x28]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8
Function at 0x4b2200
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.00503a90
mov eax, dword [0x595be0]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x4b2265
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4b2265
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.0050022e
add eax, 0x40
push eax
call fcn.00503e51
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004fdc6a
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.00503d8c
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4b22f4
call fcn.004b20c0
test eax, eax
jle 0x4b22f4
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004fdc6a
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004fdc6a
add esp, 0x108
ret

Function at 0x4b2350
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x4b2374
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
sub edi, 1
jne 0x4b2366
pop esi
movzx eax, cl
pop edi
ret

Function at 0x4b99a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x4b99e7
mov al, byte [edx]
test al, al
je 0x4b99e7
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x4b99b7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4bcc20
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.00503a90
mov eax, dword [0x595be0]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x34]
push ebp
mov ebp, dword [esp + 0x30]
dec ebp
lea edx, [ebp - 0x29]
cmp ebx, edx
push edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
jle 0x4bcc85
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.004aeb90
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004fdc6a
add esp, 0x20
ret
cmp ebp, 0x29
jge 0x4bccb3
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.004aeb90
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004fdc6a
add esp, 0x20
ret
push esi
mov byte [edi], 0
lea esi, [edi + 1]
push 0
add edi, 0x15
call fcn.004c9d90
mov ecx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x50]
push 0
push edi
push eax
push ecx
call fcn.004d0e60
mov edx, ebp
sub edx, ebx
sub edx, 0x29
push edx
lea eax, [edi + 0x14]
push 0
push eax
call fcn.00503b40
mov edx, dword [esp + 0x34]
mov ecx, edi
sub ecx, ebx
lea eax, [ecx + ebp]
push ebx
mov byte [eax - 0x15], 1
push edx
add eax, 0xffffffec
push eax
call fcn.00503390
push 0x14
push esi
call fcn.004b4280
add esp, 0x38
test eax, eax
jle 0x4bcd45
push 0x48
add ebp, 0xffffffec
push str..crypto_rsa_rsa_oaep.c
push ebp
call fcn.004b0f50
mov ebx, eax
add esp, 0xc
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x4bcd5a
push 0x4b
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.004aeb90
add esp, 0x14
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004fdc6a
add esp, 0x20
ret
call fcn.004c9d90
push eax
push 0x14
push esi
push ebp
push ebx
call fcn.004bcaa0
add esp, 0x14
test eax, eax
jl 0x4bcd45
test ebp, ebp
jle 0x4bcd8b
mov ecx, ebx
mov eax, edi
sub ecx, edi
mov edx, ebp
lea ecx, [ecx]
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
sub edx, 1
jne 0x4bcd80
call fcn.004c9d90
push eax
push ebp
push edi
lea eax, [esp + 0x24]
push 0x14
push eax
call fcn.004bcaa0
add esp, 0x14
test eax, eax
jl 0x4bcd45
lea ecx, [esp + 0x18]
lea edi, [esp + 0x19]
lea ebp, [esp + 0x1a]
lea edx, [esp + 0x1b]
sub ecx, esi
sub edi, esi
sub ebp, esi
sub edx, esi
lea ebx, [esp + 0x1c]
sub ebx, esi
mov eax, esi
mov dword [esp + 0x10], ebx
mov esi, 4
nop
movzx ebx, byte [ecx + eax]
xor byte [eax], bl
movzx ebx, byte [edi + eax]
xor byte [eax + 1], bl
movzx ebx, byte [eax + ebp]
xor byte [eax + 2], bl
movzx ebx, byte [edx + eax]
xor byte [eax + 3], bl
mov ebx, dword [esp + 0x10]
movzx ebx, byte [ebx + eax]
xor byte [eax + 4], bl
add eax, 5
sub esi, 1
jne 0x4bcdd0
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004b10f0
mov ecx, dword [esp + 0x30]
add esp, 4
lea eax, [esi + 1]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004fdc6a
add esp, 0x20
ret
Function at 0x4bd410
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x4bd4dc
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x4bd431
cmp al, 0x6b
jne 0x4bd4dc
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x4bd49d
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x4bd451
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x4bd451
cmp al, 0xbb
jne 0x4bd47a
inc ecx
cmp ecx, esi
jl 0x4bd441
sub esi, ecx
test ecx, ecx
jne 0x4bd4a0
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.004aeb90
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.004aeb90
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x4bd4c9
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.004aeb90
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.00503390
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.004aeb90
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x4c5a30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24
call fcn.00503a90
mov eax, dword [0x595be0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, esi
push edi
mov dword [ebp - 0x18], esi
lea ecx, [eax + 1]
jmp 0x4c5a60
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4c5a60
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
sub eax, ecx
lea edi, [eax + 1]
push edi
push esi
push 8
push 0xfde9
mov dword [ebp - 0x20], 8
call ebx
mov esi, eax
test esi, esi
jg 0x4c5ad8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ec
jne 0x4c5aba
mov ecx, dword [ebp - 0x18]
push 0
push 0
push edi
push ecx
push 0
push 0xfde9
mov dword [ebp - 0x20], 0
call ebx
mov esi, eax
test esi, esi
jg 0x4c5ad8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x4c5b6a
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push edx
push eax
jmp 0x4c5b58
lea eax, [esi + esi]
call fcn.00503d60
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov eax, esp
push esi
push eax
push edi
push ecx
push edx
push 0xfde9
mov dword [ebp - 0x24], eax
call ebx
test eax, eax
je 0x4c5b6a
mov esi, dword [ebp - 0x1c]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c5b03
push 8
sub eax, edx
lea ecx, [ebp - 0x14]
push ecx
inc eax
push eax
push esi
push 0
push 0xfde9
call ebx
test eax, eax
je 0x4c5b6a
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.004ff46c
mov esi, eax
add esp, 8
test esi, esi
jne 0x4c5c0e
call fcn.00502db3
cmp dword [eax], 2
je 0x4c5b50
call fcn.00502db3
cmp dword [eax], 9
jne 0x4c5b62
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push ecx
push edx
call fcn.00503163
mov esi, eax
add esp, 8
test esi, esi
jne 0x4c5c0e
push 0xa9
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.004aeb90
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0x53e948
push eax
push 0x53e944
push ecx
push str.fopen_
push 5
call fcn.004ae770
add esp, 0x2c
call fcn.00502db3
cmp dword [eax], 2
jne 0x4c5be0
push 0xac
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.004aeb90
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdc6a
mov esp, ebp
pop ebp
ret
push 0xae
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.004aeb90
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdc6a
mov esp, ebp
pop ebp
ret
push 0x594b98
call fcn.004ad6f0
mov edi, eax
add esp, 4
test edi, edi
jne 0x4c5c40
push esi
call fcn.004ffc3c
add esp, 4
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdc6a
mov esp, ebp
pop ebp
ret
push 0
push edi
call fcn.004ad180
push esi
push 1
push 0x6a
push edi
call fcn.004ad4e0
add esp, 0x18
mov eax, edi
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004fdc6a
mov esp, ebp
pop ebp
ret
Function at 0x4c66e0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x4c67c3
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
movzx edx, byte [esi]
jl 0x4c675e
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x53ead0]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x53ead0]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x53ead0]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + 0x53ead0]
mov byte [ecx], dl
jmp 0x4c67b0
shl edx, 0x10
cmp edi, 2
jne 0x4c676f
movzx eax, byte [esi + 1]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x53ead0]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x53ead0]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x4c679d
lea edx, [edi + 0x3c]
jmp 0x4c67aa
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x53ead0]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x4c6700
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret