joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4376a3
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x34
mov eax, dword [ebp + 8]
add eax, 0xffffff80
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x6a09e667
mov dword [esp + 0xc], 0x9b05688c
mov dword [esp + 0x10], 0x510e527f
movq xmm1, qword [esp + 0x14]
movq xmm0, qword [esp + 0xc]
punpcklqdq xmm0, xmm1
mov eax, dword [esp + 0x30]
movaps xmmword [eax], xmm0
mov dword [esp + 0x24], 0xa54ff53a
mov dword [esp + 0x28], 0x3c6ef372
mov dword [esp + 0x1c], 0x5be0cd19
mov dword [esp + 0x20], 0x1f83d9ab
movq xmm1, qword [esp + 0x24]
movq xmm0, qword [esp + 0x1c]
punpcklqdq xmm0, xmm1
mov eax, dword [esp + 0x30]
movaps xmmword [eax + 0x10], xmm0
mov eax, dword [esp + 0x30]
add eax, 0x20
mov dword [esp], eax
call sym._sha256_block_setup_1
nop
leave
ret

Function at 0x4396c6
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x34
mov eax, dword [ebp + 8]
add eax, 0xffffff80
mov dword [esp + 0x30], eax
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x67452301
mov dword [esp + 0xc], 0x10325476
mov dword [esp + 0x10], 0x98badcfe
movq xmm1, qword [esp + 0x14]
movq xmm0, qword [esp + 0xc]
punpcklqdq xmm0, xmm1
mov eax, dword [esp + 0x30]
movaps xmmword [eax], xmm0
mov dword [esp + 0x2c], 0xc3d2e1f0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x2c]
movd xmm0, dword [esp + 0x28]
movdqa xmm1, xmm0
pinsrd xmm1, eax, 1
mov eax, dword [esp + 0x24]
movd xmm0, dword [esp + 0x20]
pinsrd xmm0, eax, 1
punpcklqdq xmm0, xmm1
mov eax, dword [esp + 0x30]
movaps xmmword [eax + 0x10], xmm0
mov eax, dword [esp + 0x30]
add eax, 0x20
mov dword [esp], eax
call sym._sha1_block_setup_1
nop
leave
ret
Function at 0x4514b4
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
jmp 0x451561
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, edx
movzx eax, byte [eax]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0x40
jle 0x4514ec
cmp byte [ebp - 0x11], 0x5a
jg 0x4514ec
movsx eax, byte [ebp - 0x11]
sub eax, 0x41
mov dword [ebp - 8], eax
jmp 0x451553
cmp byte [ebp - 0x11], 0x60
jle 0x451504
cmp byte [ebp - 0x11], 0x7a
jg 0x451504
movsx eax, byte [ebp - 0x11]
sub eax, 0x47
mov dword [ebp - 8], eax
jmp 0x451553
cmp byte [ebp - 0x11], 0x2f
jle 0x45151c
cmp byte [ebp - 0x11], 0x39
jg 0x45151c
movsx eax, byte [ebp - 0x11]
add eax, 4
mov dword [ebp - 8], eax
jmp 0x451553
cmp byte [ebp - 0x11], 0x2b
jne 0x45152b
mov dword [ebp - 8], 0x3e
jmp 0x451553
cmp byte [ebp - 0x11], 0x2f
jne 0x45153a
mov dword [ebp - 8], 0x3f
jmp 0x451553
cmp byte [ebp - 0x11], 0x3d
jne 0x451549
mov dword [ebp - 8], 0xffffffff
jmp 0x451553
mov eax, 0
jmp 0x451627
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x24], edx
add dword [ebp - 4], 1
cmp dword [ebp - 4], 3
jle 0x4514c6
mov eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
je 0x45157b
mov eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
jne 0x451585
mov eax, 0
jmp 0x451627
mov eax, dword [ebp - 0x1c]
cmp eax, 0xffffffff
jne 0x45159f
mov eax, dword [ebp - 0x18]
cmp eax, 0xffffffff
je 0x45159f
mov eax, 0
jmp 0x451627
mov eax, dword [ebp - 0x18]
cmp eax, 0xffffffff
je 0x4515b0
mov dword [ebp - 0xc], 3
jmp 0x4515c8
mov eax, dword [ebp - 0x1c]
cmp eax, 0xffffffff
je 0x4515c1
mov dword [ebp - 0xc], 2
jmp 0x4515c8
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x24]
shl eax, 0x12
mov edx, eax
mov eax, dword [ebp - 0x20]
shl eax, 0xc
or edx, eax
mov eax, dword [ebp - 0x1c]
shl eax, 6
and eax, 0xfc0
or edx, eax
mov eax, dword [ebp - 0x18]
and eax, 0x3f
or eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
shr eax, 0x10
mov edx, eax
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
cmp dword [ebp - 0xc], 1
jle 0x451613
mov eax, dword [ebp - 0x10]
shr eax, 8
mov edx, eax
mov eax, dword [ebp + 0xc]
add eax, 1
mov byte [eax], dl
cmp dword [ebp - 0xc], 2
jle 0x451624
mov eax, dword [ebp + 0xc]
add eax, 2
mov edx, dword [ebp - 0x10]
mov byte [eax], dl
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x453708
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
sub eax, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sym._fwrite
nop
leave
ret
Function at 0x456e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 9], 0
jmp 0x456ef5
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x20
je 0x456e6a
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x5c
je 0x456e6a
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x2a
je 0x456e6a
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x3f
je 0x456e6a
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x25
je 0x456e6a
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x1f
jle 0x456e6a
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x7f
je 0x456e6a
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
cmp al, 0x2e
jne 0x456ed2
movzx eax, byte [ebp - 9]
xor eax, 1
test al, al
je 0x456ed2
mov eax, dword [ebp + 0xc]
add eax, 0xc
mov dword [esp + 4], 0x25
mov dword [esp], eax
call sym._BinarySink_put_byte
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
shr al, 4
movzx eax, al
movzx eax, byte [eax + str.0123456789ABCDEF__:___]
movzx eax, al
mov edx, dword [ebp + 0xc]
add edx, 0xc
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._BinarySink_put_byte
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
movzx eax, al
and eax, 0xf
movzx eax, byte [eax + str.0123456789ABCDEF__:___]
movzx eax, al
mov edx, dword [ebp + 0xc]
add edx, 0xc
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._BinarySink_put_byte
jmp 0x456eed
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
movzx eax, al
mov edx, dword [ebp + 0xc]
add edx, 0xc
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._BinarySink_put_byte
add dword [ebp + 8], 1
mov byte [ebp - 9], 1
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
jne 0x456e0f
nop
nop
leave
ret
Function at 0x45719c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov byte [ebp - 0xd], 0
movzx eax, byte [0x47dadc]
xor eax, 1
test al, al
je 0x457203
mov dword [esp], str.secur32.dll
call sym._load_system32_dll
mov dword [ebp - 0x14], eax
mov dword [esp], str.sspicli.dll
call sym._load_system32_dll
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x14], 0
je 0x4571f2
mov dword [esp + 4], str.GetUserNameExA
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
jmp 0x4571f7
mov eax, 0
mov dword [0x47dae0], eax
mov byte [0x47dadc], 1
mov eax, dword [0x47dae0]
test eax, eax
je 0x4572b1
mov dword [ebp - 0x20], 0
mov eax, dword [0x47dae0]
lea edx, [ebp - 0x20]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], 8
call eax
sub esp, 0xc
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._safemalloc
mov dword [ebp - 0xc], eax
mov eax, dword [0x47dae0]
lea edx, [ebp - 0x20]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 4], edx
mov dword [esp], 8
call eax
sub esp, 0xc
test al, al
setne al
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4572a6
mov dword [esp + 4], 0x40
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strchr
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4572b1
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0
jmp 0x4572b1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._safefree
movzx eax, byte [ebp - 0xd]
xor eax, 1
test al, al
je 0x457339
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov dword [esp], 0
mov eax, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call eax
sub esp, 8
test eax, eax
jne 0x4572e6
mov dword [ebp - 0x20], 0x100
mov eax, dword [ebp - 0x20]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._safemalloc
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_GetUserNameA]
call eax
sub esp, 8
test eax, eax
setne al
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 0xd]
xor eax, 1
test al, al
je 0x457339
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._safefree
cmp byte [ebp - 0xd], 0
je 0x457344
mov eax, dword [ebp - 0xc]
jmp 0x457349
mov eax, 0
leave
ret
Function at 0x45734c
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
call sym._should_have_security
test al, al
je 0x45739c
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x14]
mov dword [esp + 8], eax
lea eax, [ebp - 0x10]
mov dword [esp + 4], eax
mov dword [esp], 0x1f0001
call sym._make_private_security_descriptor
xor eax, 1
test al, al
jne 0x45743a
mov dword [esp + 8], 0xc
mov dword [esp + 4], 0
lea eax, [ebp - 0x20]
mov dword [esp], eax
call sym._memset
mov dword [ebp - 0x20], 0xc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
lea eax, [ebp - 0x20]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CreateMutexA]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x457420
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [esp], eax
call sym._win_strerror
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.CreateMutex___s___failed:__s
call sym._dupprintf
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
jmp 0x45743b
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
jmp 0x45743b
nop
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x457452
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
call eax
sub esp, 4
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x457469
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_LocalFree]
call eax
sub esp, 4
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x457872
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x14], 0x105
mov eax, dword [ebp - 0x14]
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], eax
call sym._safemalloc
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
call eax
sub esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4578d0
mov eax, dword [ebp - 0xc]
jmp 0x457924
cmp dword [ebp - 0x10], 0xea
je 0x4578eb
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._safefree
mov eax, 0
jmp 0x457924
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
lea eax, [ebp - 0x14]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._safegrowarray
mov dword [ebp - 0xc], eax
jmp 0x45789d
leave
ret
Function at 0x457926
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
jne 0x45797b
mov eax, dword [ebp - 0x10]
cmp eax, 4
jne 0x45797b
mov eax, dword [ebp - 0xc]
cmp eax, 4
je 0x457982
mov eax, 0
jmp 0x457987
mov eax, 1
leave
ret

Function at 0x457989
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [esp + 0x14], 4
lea eax, [ebp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
test eax, eax
sete al
leave
ret

Function at 0x4579cc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea eax, [ebp - 0x18]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
jne 0x457a13
mov eax, dword [ebp - 0x14]
cmp eax, 1
je 0x457a1d
mov eax, 0
jmp 0x457aca
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._safemalloc
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
jne 0x457a84
mov eax, dword [ebp - 0x14]
cmp eax, 1
je 0x457a96
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sym._safefree
mov eax, 0
jmp 0x457aca
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0xc]
jb 0x457abc
mov dword [esp + 8], 0x6c
mov dword [esp + 4], str.E:GitcnPuTTY_TEMP1windowsutils_registry.c
mov dword [esp], str.size___allocsize
mov eax, dword [sym.imp.ucrtbase.dll__assert]
call eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
add eax, edx
mov byte [eax], 0
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x457acc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov dword [esp], eax
call sym._strlen
add eax, 1
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
test eax, eax
sete al
leave
ret

Function at 0x457b19
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea eax, [ebp - 0x18]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
jne 0x457b60
mov eax, dword [ebp - 0x14]
cmp eax, 7
je 0x457b6a
mov eax, 0
jmp 0x457c1f
call sym._strbuf_new
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
add eax, 2
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strbuf_append
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
jne 0x457bca
mov eax, dword [ebp - 0x14]
cmp eax, 7
je 0x457bdc
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strbuf_free
mov eax, 0
jmp 0x457c1f
mov eax, dword [ebp - 0x18]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strbuf_shrink_to
nop
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strbuf_chomp
test al, al
jne 0x457bef
mov eax, dword [ebp - 0xc]
add eax, 0xc
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._BinarySink_put_byte
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x457c21
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
lea edx, [eax + 1]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 7
mov dword [esp + 8], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call eax
sub esp, 0x18
test eax, eax
sete al
leave
ret
Function at 0x457cd8
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov byte [ebp - 0x11c], dl
mov byte [ebp - 0x120], al
cmp byte [ebp - 0x11c], 0
je 0x457d30
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
mov dword [esp], 0x104
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x457d29
cmp dword [ebp - 0xc], 0x103
jbe 0x457d30
mov byte [ebp - 0x11c], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x4c
cmp dword [ebp + 8], 0
je 0x457d4e
mov eax, dword [ebp + 8]
movzx eax, byte [eax]
test al, al
je 0x457d4e
mov eax, dword [ebp + 8]
jmp 0x457d53
mov eax, 0
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x2c], eax
cmp byte [ebp - 0x120], 0
je 0x457d79
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.COMDLG32.DLL_GetSaveFileNameA]
call eax
sub esp, 4
test eax, eax
setne al
jmp 0x457d8e
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.COMDLG32.DLL_GetOpenFileNameA]
call eax
sub esp, 4
test eax, eax
setne al
mov byte [ebp - 0xd], al
cmp dword [ebp + 8], 0
je 0x457dc7
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], 0x104
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call eax
sub esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x457dc1
cmp dword [ebp - 0x14], 0x103
jbe 0x457dc7
mov eax, dword [ebp + 8]
mov byte [eax], 0
cmp byte [ebp - 0x11c], 0
je 0x457de3
lea eax, [ebp - 0x118]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
call eax
sub esp, 4
movzx eax, byte [ebp - 0xd]
leave
ret

Function at 0x458de8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x47db20]
test eax, eax
jne 0x458e5b
jmp 0x458e32
mov eax, dword [0x47db20]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 1
mov edx, dword [ebp - 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], 1
mov dword [esp + 4], 0x47db24
mov dword [esp], eax
call sym._safegrowarray
mov dword [0x47db20], eax
mov edx, dword [0x47db24]
mov eax, dword [0x47db20]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [0x47db24]
cmp dword [ebp - 0xc], eax
jae 0x458df9
mov eax, dword [0x47db20]
leave
ret

Function at 0x45925c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov ebx, dword [ebp - 0xc]
mov dword [esp], 2
call sym.___acrt_iob_func
mov dword [esp + 8], ebx
mov edx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym._vfprintf
call sym._abort
Function at 0x459e30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp ax, 0x5a4d
je 0x459e4f
mov eax, 0
jmp 0x459e93
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp - 4]
add eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, 0x4550
je 0x459e72
mov eax, 0
jmp 0x459e93
mov eax, dword [ebp - 8]
add eax, 0x18
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp ax, 0x10b
je 0x459e8e
mov eax, 0
jmp 0x459e93
mov eax, 1
leave
ret

Function at 0x459e95
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x3c]
mov edx, eax
mov eax, dword [ebp + 8]
add eax, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 0x14]
movzx edx, ax
mov eax, dword [ebp - 0xc]
add eax, edx
add eax, 0x18
mov dword [ebp - 4], eax
jmp 0x459ef4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
cmp dword [ebp + 0xc], eax
jb 0x459eec
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x459eec
mov eax, dword [ebp - 4]
jmp 0x459f08
add dword [ebp - 8], 1
add dword [ebp - 4], 0x28
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + 6]
movzx eax, ax
cmp dword [ebp - 8], eax
jb 0x459ec9
mov eax, 0
leave
ret
Function at 0x474f00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x474f42
call fcn.0047a885
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x474f42
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x474f39
xor eax, eax
jmp 0x474f4a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00474f50
pop edi
pop esi
pop ebx
ret 4

Function at 0x47adb5
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47ade3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47ae01
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047ad1b
jmp 0x47ae01
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47ae01
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047ad1b
test edi, edi
mov eax, edi
jne 0x47adeb
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403161
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x403161
lcall 0x5de5, 0x8b10c483
jmp loc.00791034