joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a5b0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x140
mov dword [esp], 0xfffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
sub esp, 4
test eax, eax
je 0x42a5e3
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
sub esp, 4
test eax, eax
jne 0x42a6d3
lea eax, [ebp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
lea ebx, [ebp - 0x108]
mov dword [esp + 4], 0xff
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [sym.imp.msvcrt.dll__vsnprintf]
mov byte [ebp - 9], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x42a6a8
call fcn.0042a440
test eax, eax
jle 0x42a6a8
mov dword [esp + 4], str.OPENSSL
mov dword [esp], 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov dword [ebp - 0x10c], ebx
sub esp, 8
mov esi, eax
lea eax, [ebp - 0x10c]
mov dword [esp], esi
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
sub esp, 0x24
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 4], ebx
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.OpenSSL:_FATAL
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea eax, [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call fcn.004b1840
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x42ace0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
test ebx, ebx
je 0x42ad0e
xor eax, eax
xor edx, edx
movzx ecx, byte [edi + edx]
xor cl, byte [esi + edx]
add edx, 1
or eax, ecx
cmp edx, ebx
jne 0x42acf7
movzx eax, al
pop ebx
pop esi
pop edi
ret
xor eax, eax
jmp 0x42ad0a
Function at 0x4380c0
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 4
mov esi, dword [esp + 0x20]
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
test esi, esi
jle 0x43815c
lea eax, [edi + 4]
mov dword [esp], eax
xor eax, eax
cmp esi, 2
jle 0x438160
movzx edx, byte [ebx]
movzx edi, byte [ebx + 1]
shl edx, 0x10
shl edi, 8
or edx, edi
movzx edi, byte [ebx + 2]
or edx, edi
mov edi, dword [esp]
mov ebp, edx
shr ebp, 0x12
movzx ecx, byte [ebp + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ebp, edx
shr ebp, 0xc
and ebp, 0x3f
mov byte [edi - 4], cl
movzx ecx, byte [ebp + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ebp, edx
shr ebp, 6
and edx, 0x3f
and ebp, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi - 3], cl
movzx ecx, byte [ebp + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi - 1], dl
mov byte [edi - 2], cl
sub esi, 3
add eax, 4
add ebx, 3
add dword [esp], 4
test esi, esi
jg 0x4380e3
mov byte [edi], 0
add esp, 4
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x438151
movzx ebp, byte [ebx]
shl ebp, 0x10
cmp esi, 2
je 0x4381a0
mov edx, ebp
mov edi, dword [esp]
shr edx, 0x12
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shr ebp, 0xc
and ebp, 0x3f
mov byte [edi - 4], dl
movzx edx, byte [ebp + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi - 3], dl
mov edx, 0x3d
mov ecx, dword [esp]
mov edi, ecx
mov byte [ecx - 2], dl
mov byte [ecx - 1], 0x3d
jmp 0x438140
movzx edi, byte [ebx + 1]
mov ecx, dword [esp]
shl edi, 8
or edi, ebp
mov edx, edi
shr edx, 0x12
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 4], dl
mov edx, edi
shr edx, 0xc
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shr edi, 6
and edi, 0x3f
mov byte [ecx - 3], dl
movzx edx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x438192
Function at 0x43f5d0
Capabilities:
Check for software breakpoints

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov edi, dword [esp + 0x40]
cmp edi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x38]
jne 0x43f670
movzx esi, byte [ecx]
lea edx, [esi - 0x6a]
cmp dl, 1
ja 0x43f670
mov eax, esi
cmp al, 0x6b
lea edx, [ecx + 1]
lea ebx, [edi - 2]
je 0x43f626
cmp byte [edx + ebx], 0xcc
jne 0x43f6e0
mov eax, dword [esp + 0x30]
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov eax, ebx
add esp, 0x20
pop ebx
pop esi
pop edi
ret
lea eax, [edi - 3]
test eax, eax
jle 0x43f662
lea edx, [ecx + 2]
movzx ecx, byte [ecx + 1]
cmp cl, 0xba
je 0x43f662
cmp cl, 0xbb
jne 0x43f6a8
xor ecx, ecx
jmp 0x43f653
add edx, 1
movzx ebx, byte [edx - 1]
cmp bl, 0xba
je 0x43f65a
cmp bl, 0xbb
jne 0x43f6a8
add ecx, 1
cmp ecx, eax
jne 0x43f642
sub eax, ecx
test ecx, ecx
mov ebx, eax
jne 0x43f5ff
mov dword [esp + 0x10], 0x8a
jmp 0x43f6b0
mov dword [esp + 0x10], 0x72
mov dword [esp + 0xc], str.external_openssl_crypto_rsa_rsa_x931.c
mov dword [esp + 8], 0x89
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 4
call fcn.00429970
add esp, 0x20
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0x10], 0x81
mov dword [esp + 0xc], str.external_openssl_crypto_rsa_rsa_x931.c
mov dword [esp + 8], 0x8a
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 4
call fcn.00429970
mov eax, 0xffffffff
jmp 0x43f61f
mov dword [esp + 0x10], 0x93
mov dword [esp + 0xc], str.external_openssl_crypto_rsa_rsa_x931.c
mov dword [esp + 8], 0x8b
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 4
call fcn.00429970
mov eax, 0xffffffff
jmp 0x43f61f
Function at 0x43ff00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [esp + 0x64]
mov ebx, dword [esp + 0x60]
lea eax, [esi - 0x29]
cmp eax, dword [esp + 0x6c]
lea edi, [esi - 1]
jle 0x43ffa6
cmp edi, 0x28
jle 0x43ff70
mov byte [ebx], 0
lea ebp, [ebx + 0x15]
call fcn.004506c0
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x70]
mov dword [esp], eax
call fcn.004636a0
test eax, eax
jne 0x43ffe0
xor eax, eax
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], 0x34
mov dword [esp + 0xc], str.external_openssl_crypto_rsa_rsa_oaep.c
mov dword [esp + 8], 0x78
mov dword [esp + 4], 0x79
mov dword [esp], 4
call fcn.00429970
xor eax, eax
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], 0x2e
mov dword [esp + 0xc], str.external_openssl_crypto_rsa_rsa_oaep.c
mov dword [esp + 8], 0x6e
mov dword [esp + 4], 0x79
mov dword [esp], 4
call fcn.00429970
add esp, 0x4c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, edi
sub edx, dword [esp + 0x6c]
lea eax, [ebx + 1]
mov dword [esp + 0x18], eax
lea eax, [ebx + 0x29]
lea ecx, [edx - 0x29]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memset
mov edx, dword [esp + 0x1c]
sub edi, dword [esp + 0x6c]
mov ecx, dword [esp + 0x6c]
mov byte [ebp + edx - 0x15], 1
mov edx, dword [esp + 0x68]
lea eax, [ebp + edi - 0x14]
mov dword [esp], eax
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call sub.msvcrt.dll_memcpy
mov eax, dword [esp + 0x18]
mov dword [esp + 4], 0x14
mov dword [esp], eax
call fcn.00433670
test eax, eax
jle 0x43ff63
sub esi, 0x15
mov dword [esp + 8], 0x4a
mov dword [esp + 4], str.external_openssl_crypto_rsa_rsa_oaep.c
mov dword [esp], esi
call fcn.00427550
test eax, eax
mov edi, eax
je 0x440108
call fcn.004506c0
mov dword [esp + 0xc], 0x14
mov dword [esp + 4], esi
mov dword [esp], edi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 8], eax
call fcn.0043fd90
test eax, eax
js 0x43ff63
xor eax, eax
test esi, esi
jle 0x4400b7
movzx edx, byte [edi + eax]
xor byte [ebx + eax + 0x15], dl
add eax, 1
cmp eax, esi
jne 0x4400a8
call fcn.004506c0
mov dword [esp + 0xc], esi
lea esi, [esp + 0x2c]
mov dword [esp + 8], ebp
mov dword [esp + 4], 0x14
mov dword [esp], esi
mov dword [esp + 0x10], eax
call fcn.0043fd90
xor edx, edx
test eax, eax
js 0x43ff63
movzx eax, byte [esi + edx]
xor byte [ebx + edx + 1], al
add edx, 1
cmp edx, 0x14
jne 0x4400e6
mov dword [esp], edi
call fcn.00427840
mov eax, 1
jmp 0x43ff9e
mov dword [esp + 0x10], 0x4d
mov dword [esp + 0xc], str.external_openssl_crypto_rsa_rsa_oaep.c
mov dword [esp + 8], 0x41
mov dword [esp + 4], 0x79
mov dword [esp], 4
call fcn.00429970
xor eax, eax
jmp 0x43ff65
Function at 0x443930
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x443980
movzx ecx, byte [ebx]
xor eax, eax
test cl, cl
je 0x44397d
xor edx, edx
mov esi, 0x100
lea esi, [esi]
movsx eax, cl
add ebx, 1
or eax, esi
add esi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
rol edx, cl
movzx ecx, byte [ebx]
imul eax, eax
xor edx, eax
test cl, cl
jne 0x443950
mov eax, edx
shr eax, 0x10
xor eax, edx
pop ebx
pop esi
ret
xor eax, eax
pop ebx
pop esi
ret

Function at 0x449290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov edx, dword [eax]
mov dword [esp], ecx
mov edi, dword [esp + 0x38]
mov ecx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x3c]
mov edx, dword [edx + 0x78]
test edx, edx
je 0x4492e7
mov dword [esp + 0x30], ebx
mov ebx, dword [esp]
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], eax
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
jmp edx
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004664f0
Function at 0x44edd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
cmp dword [eax + 8], 0
jne 0x44edf3
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
jmp fcn.0044eb80
jmp fcn.0044e850
Function at 0x4898d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x21c
mov edi, dword [esp + 0x244]
mov ebp, dword [esp + 0x230]
mov esi, dword [esp + 0x234]
mov ebx, dword [esp + 0x24c]
mov dword [esp], edi
call fcn.0043ec50
mov ecx, eax
mov dword [esp + 0x18], eax
xor eax, eax
test ecx, ecx
js 0x489aed
lea eax, [esp + 0x70]
mov dword [esp], eax
call fcn.004a44b0
test ebp, ebp
je 0x489b41
cmp esi, 0xffffffff
je 0x489b32
lea eax, [esp + 0x70]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.004a41c0
test eax, eax
je 0x489b19
mov eax, dword [esp + 0x248]
test eax, eax
je 0x489adc
mov dword [esp + 0x1c], 1
lea esi, [esp + 0x140]
lea ebp, [esp + 0x30]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x248], eax
cmovle eax, dword [esp + 0x248]
mov dword [esp], esi
mov byte [esp + 0x2f], cl
mov edi, eax
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x2e], al
lea eax, [esp + 0x70]
mov dword [esp + 4], eax
call fcn.004a4530
test eax, eax
je 0x489b19
mov eax, dword [esp + 0x23c]
mov dword [esp], esi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x238]
mov dword [esp + 4], eax
call fcn.004a4420
test eax, eax
je 0x489af8
lea eax, [esp + 0x2c]
mov dword [esp + 8], 4
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.004a4420
test eax, eax
je 0x489af8
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], esi
call fcn.004a4430
test eax, eax
je 0x489af8
mov dword [esp], esi
call fcn.004a4620
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
cmp dword [esp + 0x240], 1
mov dword [esp + 0x14], 1
jle 0x489ac8
lea eax, [esp + 0x70]
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.004a4530
test eax, eax
je 0x489b19
mov eax, dword [esp + 0x18]
mov dword [esp + 4], ebp
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.004a4420
test eax, eax
je 0x489af8
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], esi
call fcn.004a4430
test eax, eax
je 0x489af8
mov dword [esp], esi
call fcn.004a4620
test edi, edi
jle 0x489ab6
xor eax, eax
movzx edx, byte [ebp + eax]
xor byte [ebx + eax], dl
add eax, 1
cmp eax, edi
jne 0x489aa7
add dword [esp + 0x14], 1
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x240]
jne 0x489a51
add dword [esp + 0x1c], 1
add ebx, edi
sub dword [esp + 0x248], edi
jne 0x489975
lea eax, [esp + 0x70]
mov dword [esp], eax
call fcn.004a4620
mov eax, 1
add esp, 0x21c
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x70]
mov dword [esp], eax
call fcn.004a4620
mov dword [esp], esi
call fcn.004a4620
add esp, 0x21c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x70]
mov dword [esp], eax
call fcn.004a4620
add esp, 0x21c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebp
call sub.msvcrt.dll_strlen
mov esi, eax
jmp 0x48992b
xor esi, esi
jmp 0x48992b
Function at 0x49d240
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
mov edx, dword [edi + 4]
mov eax, dword [ebx + 4]
cmp edx, eax
jl 0x49d265
mov eax, edx
mov edx, ebx
mov ebx, edi
mov edi, edx
cmp dword [esi + 8], eax
jl 0x49d2e0
mov ebp, dword [edi + 4]
xor eax, eax
test ebp, ebp
jle 0x49d28b
mov edx, dword [edi]
mov ebp, dword [ebx]
mov ecx, dword [esi]
mov edx, dword [edx + eax*4]
xor edx, dword [ebp + eax*4]
mov dword [ecx + eax*4], edx
add eax, 1
cmp dword [edi + 4], eax
jg 0x49d273
mov edx, dword [ebx + 4]
cmp eax, edx
jge 0x49d2b7
lea ecx, [eax*4]
lea esi, [esi]
mov edx, dword [ebx]
add eax, 1
mov edi, dword [edx + ecx]
mov edx, dword [esi]
mov dword [edx + ecx], edi
mov edx, dword [ebx + 4]
add ecx, 4
cmp edx, eax
jg 0x49d2a0
test edx, edx
mov dword [esi + 4], edx
jle 0x49d300
mov eax, dword [esi]
sub eax, 4
mov ecx, dword [eax + edx*4]
test ecx, ecx
jne 0x49d2cf
sub edx, 1
jne 0x49d2c3
mov dword [esi + 4], edx
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.0041e320
test eax, eax
jne 0x49d26a
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4a41c0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x9c
mov esi, dword [esp + 0xbc]
mov ebx, dword [esp + 0xb0]
mov ebp, dword [esp + 0xb4]
mov edi, dword [esp + 0xb8]
test esi, esi
je 0x4a4402
test ebp, ebp
mov dword [ebx], esi
je 0x4a4258
mov dword [esp], esi
call fcn.0043ec20
cmp eax, 0x80
jg 0x4a43b0
cmp eax, edi
jl 0x4a433d
cmp edi, 0x80
ja 0x4a43e1
lea eax, [ebx + 0x50]
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp], eax
call sub.msvcrt.dll_memcpy
mov dword [ebx + 0x4c], edi
cmp edi, 0x80
je 0x4a4258
mov eax, pe_nt_image_headers32
sub eax, edi
lea edx, [ebx + edi + 0x50]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], edx
call sub.msvcrt.dll_memset
xor eax, eax
lea esi, [esi]
movzx edx, byte [ebx + eax + 0x50]
xor edx, 0x36
mov byte [esp + eax + 0x10], dl
add eax, 1
cmp eax, 0x80
jne 0x4a4260
mov eax, dword [esp + 0xc0]
lea edi, [ebx + 0x1c]
mov dword [esp + 4], esi
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.00462f40
test eax, eax
jne 0x4a42a1
add esp, 0x9c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], esi
call fcn.0043ec20
mov dword [esp], edi
mov dword [esp + 8], eax
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
call fcn.00463230
test eax, eax
je 0x4a4294
xor eax, eax
movzx edx, byte [ebx + eax + 0x50]
xor edx, 0x5c
mov byte [esp + eax + 0x10], dl
add eax, 1
cmp eax, 0x80
jne 0x4a42c3
mov eax, dword [esp + 0xc0]
lea ebp, [ebx + 0x34]
mov dword [esp + 4], esi
mov dword [esp], ebp
mov dword [esp + 8], eax
call fcn.00462f40
test eax, eax
je 0x4a4294
mov dword [esp], esi
call fcn.0043ec20
mov dword [esp], ebp
mov dword [esp + 8], eax
lea eax, [esp + 0x10]
mov dword [esp + 4], eax
call fcn.00463230
test eax, eax
je 0x4a4294
add ebx, 4
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.00463440
test eax, eax
setne al
add esp, 0x9c
pop ebx
movzx eax, al
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0xc0]
lea edx, [ebx + 4]
mov dword [esp], edx
mov dword [esp + 4], esi
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
call fcn.00462f40
mov edx, dword [esp + 0xc]
test eax, eax
je 0x4a4294
mov dword [esp], edx
mov dword [esp + 8], edi
mov dword [esp + 4], ebp
mov dword [esp + 0xc], edx
call fcn.00463230
mov edx, dword [esp + 0xc]
test eax, eax
je 0x4a4294
lea eax, [ebx + 0x4c]
mov dword [esp + 8], eax
lea eax, [ebx + 0x50]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00463240
test eax, eax
je 0x4a4294
mov edi, dword [ebx + 0x4c]
jmp 0x4a4231
mov dword [esp + 8], str.j____int_sizeof_ctx__key_
mov dword [esp + 4], 0x68
mov dword [esp], str.external_openssl_crypto_hmac_hmac.c
mov dword [esp + 0xc], eax
call fcn.0042a700
mov eax, dword [esp + 0xc]
cmp eax, edi
jge 0x4a420f
jmp 0x4a433d
mov dword [esp + 8], str.len_0__len__int_sizeof_ctx__key_
mov dword [esp + 4], 0x75
mov dword [esp], str.external_openssl_crypto_hmac_hmac.c
call fcn.0042a700
jmp 0x4a421b
test ebp, ebp
mov esi, dword [ebx]
jne 0x4a41f4
lea edi, [ebx + 0x1c]
nop
jmp 0x4a431b
Function at 0x4a7e60
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x48]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
test eax, eax
je 0x4a7ee1
test ebx, ebx
je 0x4a7ef0
test esi, esi
je 0x4a7ee5
mov eax, dword [esp + 0x48]
lea ebp, [esp + 0x14]
mov dword [esp + 4], ebp
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.00443de0
test eax, eax
je 0x4a7eb0
mov eax, dword [eax + 8]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, 0x4e90e8
mov ecx, 4
repe cmpsb byte [esi], byte es:[edi]
je 0x4a7f00
mov eax, dword [esp + 0x48]
mov dword [esp + 4], ebp
mov dword [esp + 0x14], str.default
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.00443de0
test eax, eax
jne 0x4a7ea2
xor eax, eax
jmp 0x4a7ea5
lea ebp, [esp + 0x14]
jmp 0x4a7ebe
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
jmp 0x4a7ea5
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x4a7ea5
jmp 0x4a7ebe
Function at 0x4b0ab0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4b0ae8
xor edx, edx
nop
mov ecx, dword [eax + 0xc]
cmp ecx, ebx
ja 0x4b0ade
add ecx, dword [eax + 8]
cmp ebx, ecx
jb 0x4b0aea
add edx, 1
add eax, 0x28
cmp edx, esi
jb 0x4b0ad0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x4b49a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [ebp + 8]
call sub.msvcrt.dll__errno
test ebx, ebx
mov dword [eax], 0
je 0x4b4b4e
cmp byte [ebx], 0
je 0x4b4b18
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
sub esp, 4
cmp eax, 0xffffffff
je 0x4b4b30
test al, 0x10
je 0x4b4b18
lea edi, [ebp - 0x11c]
mov dword [esp + 4], ebx
mov ebx, edi
mov dword [esp + 8], 0x104
mov dword [esp], edi
call sub.msvcrt.dll__fullpath
mov edx, dword [ebx]
add ebx, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x4b4a04
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [ebx + 2]
cmove ebx, edx
add al, al
sbb ebx, 3
sub ebx, edi
lea eax, [ebx + 0x233]
mov dword [esp], eax
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
je 0x4b4b3f
lea edx, [eax + 0x22c]
lea eax, [ebx + 1]
mov dword [esp], edx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [ebp - 0x12c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [ebp - 0x12c]
cmp byte [esi + 0x22c], 0
je 0x4b4a93
movzx eax, byte [esi + ebx + 0x22b]
cmp al, 0x2f
je 0x4b4a93
cmp al, 0x5c
je 0x4b4a93
mov edi, 0x5c
mov word [edx + ebx], di
mov eax, edx
mov ecx, dword [eax]
add eax, 4
lea edx, [ecx - 0x1010101]
not ecx
and edx, ecx
and edx, 0x80808080
je 0x4b4a95
mov ecx, edx
shr ecx, 0x10
test edx, 0x8080
cmove edx, ecx
lea ecx, [eax + 2]
cmove eax, ecx
add dl, dl
sbb eax, 3
mov edx, 0x2a
mov word [eax], dx
xor ecx, ecx
xor eax, eax
lea edx, [esi + 0x120]
xor ebx, ebx
mov word [esi + 0x11c], cx
mov edi, edx
mov ecx, 0x41
mov dword [esi + 0x224], 0xffffffff
mov dword [esi + 0x228], 0
mov dword [esi + 0x118], 0
mov word [esi + 0x11e], bx
rep stosd dword es:[edi], eax
mov eax, esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x14
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 2
xor eax, eax
jmp 0x4b4b10
call sub.msvcrt.dll__errno
mov dword [eax], 0xc
xor eax, eax
jmp 0x4b4b10
call sub.msvcrt.dll__errno
mov dword [eax], 0xe
xor eax, eax
jmp 0x4b4b10