joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51f404
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x51f423
mov eax, dword [0x53e0b4]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x51f430
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x51f45d
je 0x51f46f
sub ecx, 0x100
je 0x51f47d
sub ecx, 0x100
je 0x51f484
sub ecx, 0x100
je 0x51f476
jmp 0x51f48b
sub ecx, 0x600
je 0x51f484
sub ecx, 0x100
je 0x51f46f
jmp 0x51f48b
mov edi, 1
jmp 0x51f490
mov edi, 2
jmp 0x51f490
mov edi, 4
jmp 0x51f490
mov edi, 5
jmp 0x51f490
mov edi, 3
test byte [ebp + 0xd], 1
je 0x51f4b7
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x53e63c]
test al, 0x80
je 0x51f4b0
mov ebx, 0x80
jmp 0x51f4c9
mov ebx, 1
jmp 0x51f4c9
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x51f4c9
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x51f4db
je 0x51f4e4
dec eax
je 0x51f4ed
jmp 0x51f4f6
mov dword [ebp - 4], 0x80000000
jmp 0x51f505
mov dword [ebp - 4], 0x40000000
jmp 0x51f505
mov dword [ebp - 4], 0xc0000000
jmp 0x51f505
push 1
call fcn.0051ee3c
pop ecx
mov ebx, eax
jmp 0x51f5f1
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x51f521
sub eax, 0x10
je 0x51f528
sub eax, 0x10
je 0x51f531
sub eax, 0x10
je 0x51f53a
jmp 0x51f53a
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x51f541
mov dword [ebp - 8], 1
jmp 0x51f541
mov dword [ebp - 8], 2
jmp 0x51f541
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x51f5aa
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x51f59f
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x51f59f
add ebx, 0xffffffb2
push ebx
call fcn.0051ee3c
pop ecx
mov ebx, eax
jmp 0x51f5f1
mov edi, esi
push edi
call fcn.0051f374
pop ecx
test eax, eax
je 0x51f5be
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x51f5ca
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0051eb98
add esp, 8
mov ebx, eax
inc eax
jne 0x51f5f1
push 4
call fcn.0051ee3c
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x524654
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x524abc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x53f140], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x524b74
cmp byte [0x5280fa], 0
je 0x524b2e
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.00523a58
add esp, 8
mov ebx, eax
test eax, eax
jne 0x524b17
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.00523a58
add esp, 8
mov ebx, eax
test eax, eax
jne 0x524b17
lea ebx, [ebp - 0x54]
jmp 0x524b18
inc ebx
call fcn.00524a74
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x524b95
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x53f144
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.005183dc
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x53f147
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x524b95
cmp dword [0x53f140], 0xffffffff
je 0x524b95
mov eax, dword [0x53f140]
test eax, eax
je 0x524b95
cmp byte [eax], 0
je 0x524b95
push esi
push eax
call fcn.00524c24
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5252d0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
push esi
call fcn.005183dc
pop ecx
inc eax
push eax
call fcn.00524378
pop ecx
mov ebx, eax
test eax, eax
jne 0x5252fd
mov dword [0x53f11c], 8
or eax, 0xffffffff
jmp 0x525375
xor eax, eax
push esi
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, ebx
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push 0x3d
push ebx
call fcn.0052388c
add esp, 8
mov esi, eax
test eax, eax
jne 0x525347
mov dword [0x53f11c], 0x13
push ebx
call fcn.00524270
pop ecx
or eax, 0xffffffff
jmp 0x525375
mov byte [esi], 0
cmp byte [esi + 1], 0
jne 0x525354
xor edx, edx
jmp 0x525357
lea edx, [esi + 1]
push edx
push ebx
call sub.KERNEL32.dll_SetEnvironmentVariableA
dec eax
je 0x52536a
call fcn.0051eea0
mov esi, eax
jmp 0x52536c
xor esi, esi
push ebx
call fcn.00524270
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x5253b0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x566898], 0
jne 0x525431
cmp dword [0x5668b4], 0
jne 0x5253e0
call sub.KERNEL32.dll_GetEnvironmentStrings
mov dword [0x5668b4], eax
test eax, eax
jne 0x5253e0
push str.GetEnvironmentStrings_failed
call fcn.00524bac
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x5668b4]
jmp 0x5253f4
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.005183dc
pop ecx
mov edi, eax
test eax, eax
jne 0x5253ec
lea edi, [ebp + 1]
push edi
call fcn.00524378
pop ecx
mov ebx, eax
mov dword [0x56689c], ebx
test ebx, ebx
jne 0x52541e
xor eax, eax
jmp 0x5254f4
push edi
mov edx, dword [0x5668b4]
push edx
push ebx
call fcn.005181ec
add esp, 0xc
jmp 0x525451
xor esi, esi
mov ebx, dword [0x566898]
jmp 0x52544b
push eax
call fcn.005183dc
pop ecx
test eax, eax
jne 0x525447
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x52543b
lea ebx, [esi + 4]
push 4
mov dword [0x5668a0], ebx
inc ebx
push ebx
call fcn.00523acc
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x525474
xor eax, eax
jmp 0x5254f4
cmp dword [0x566898], 0
jne 0x5254a5
xor esi, esi
mov ebx, dword [0x56689c]
mov eax, dword [esp]
mov ebp, eax
jmp 0x525496
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.005183dc
pop ecx
mov edi, eax
test eax, eax
jne 0x52548c
jmp 0x5254d6
xor esi, esi
mov ebx, dword [0x566898]
mov eax, dword [esp]
mov edi, eax
jmp 0x5254d0
push eax
call fcn.005183dc
pop ecx
test eax, eax
je 0x5254c5
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x5254c9
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x5254b4
mov eax, dword [0x566898]
test eax, eax
je 0x5254e6
push eax
call fcn.00524270
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x566898], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x402240
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov ecx, ebp
mov dword [0x404144], eax
add ecx, 8
mov dword [0x4040e2], ecx
mov dword [0x404148], 0x30
mov dword [0x40414c], 2
mov dword [0x404154], 0
mov dword [0x404158], 0
mov dword [0x404150], 0x4025d0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x40415c], eax
mov dword [0x404168], 0xf
mov dword [0x404170], 0x40386b
mov dword [0x4040da], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404160], eax
mov dword [0x404174], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x404164], eax
push 0x404148
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4040da]
push 0
push 0
push 0x24e
push 0x320
push 0xd8
push 0xa0
push 0x40000
push str.myform
push 0x40386b
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x40413c], eax
xor eax, eax
jmp 0x40232b
push eax
push dword [0x40413c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x40413c]
call dword [sym.imp.user32.dll_UpdateWindow]
push 0
push 0
push 0
push 0x404178
call dword [sym.imp.user32.dll_GetMessageA]
test eax, eax
je 0x402371
push 0x404178
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x404178
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x402344
mov eax, dword [0x404180]
call fcn.00401208
ret

Function at 0x41208a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4b1064
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x41210a
arpl word [edx + esi], si
mov cl, 0xa5
cdq
invalid
invalid
Function at 0x40107e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax]
mov eax, dword [eax + 4]
push esi
push edi
xor edi, edi
cmp dword [0x2afa6d4], 0x594
mov dword [ebp - 8], eax
jne 0x4010b2
push edi
lea eax, [ebp - 0x430]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [0x421c58]
mov dword [ebp - 0x20], eax
mov eax, dword [0x421c5c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
call fcn.00401077
mov eax, dword [0x421c60]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x421c64]
add esi, 0x23f
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, ebx
shl eax, 4
cmp dword [0x2afa6d4], 0xc
mov dword [ebp - 4], eax
jne 0x40112d
push edi
lea eax, [ebp - 0x830]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointW]
push edi
lea eax, [ebp - 0x30]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push edi
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x2afa6d4]
cmp eax, 0xfa9
jne 0x401149
mov dword [0x2afa6d0], 0xedeb2e40
cmp eax, 0x3eb
jne 0x401164
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [0x2afa084], edi
mov ecx, dword [ebp - 0xc]
mov edx, ebx
lea eax, [esi + ebx]
shr edx, cl
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [0x2afa6cc], 0xf4ea3dee
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor edx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
lea ecx, [esi + eax]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
shr eax, cl
add eax, dword [ebp - 0x24]
mov ecx, eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 4], eax
xor dword [ebp - 4], ecx
sub ebx, dword [ebp - 4]
add esi, 0x61c88647
dec dword [ebp - 0x1c]
jne 0x4010ed
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov dword [eax], ebx
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x4012be
Capabilities:
Delete directory
Get disk information
Move file

Disassembly:
mov eax, 0x41d5b1
call fcn.0041c60c
sub esp, 0xc20
push ebx
push esi
xor esi, esi
cmp dword [0x2afa6d4], 0x93
push edi
jne 0x401345
push str.huwojumavekuyixejobi_ruvovaporipe
push str.zavezofahasizavobevo_biloxepegixifutebuj
call dword [sym.imp.KERNEL32.dll_MoveFileW]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], esi
mov word [ebp - 0x28], ax
push esi
mov dword [ebp - 4], esi
call fcn.00401597
push esi
push esi
call fcn.00401835
push esi
push esi
call fcn.004018d2
push esi
push esi
call fcn.00401835
push esi
call fcn.004017ef
add esp, 0x20
call fcn.004012b0
push esi
call fcn.00401978
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 8
pop ecx
jb 0x401345
push dword [ebp - 0x28]
call fcn.00401840
pop ecx
add dword [0x2afa6d4], 0x1134b
push dword [0x2afa6d4]
mov eax, dword [0x424580]
push esi
mov dword [0x2afb138], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x2afa088], eax
call fcn.004011fb
xor edi, edi
cmp dword [0x2afa6d4], esi
jbe 0x4013b4
mov eax, dword [0x2afb138]
mov al, byte [eax + edi + 0x1134b]
mov ecx, dword [0x2afa088]
mov byte [ecx + edi], al
cmp dword [0x2afa6d4], 0x490
jne 0x4013ab
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetComputerNameExW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectA]
inc edi
cmp edi, dword [0x2afa6d4]
jb 0x40137a
xor edi, edi
mov eax, dword [0x2afa6d4]
add eax, edi
cmp eax, 0x8d
jne 0x4013f3
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
push esi
call dword [sym.imp.KERNEL32.dll_FindNextChangeNotification]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
call dword [sym.imp.KERNEL32.dll_SetFileApisToANSI]
inc edi
cmp edi, 0x38681
jl 0x4013b6
mov eax, dword [0x2afa6d4]
mov ecx, dword [0x2afa088]
shr eax, 3
cmp eax, esi
jbe 0x401441
mov edi, ecx
mov ebx, eax
cmp dword [0x2afa6d4], 0x959
jne 0x401435
push esi
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push edi
call fcn.0040107e
add edi, 8
dec ebx
jne 0x401412
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x62
jne 0x401461
mov dword [ebp - 0x10], esi
add dword [ebp - 0x10], 0x5f9a
mov eax, dword [ebp - 0x10]
add dword [0x2afa088], eax
inc edi
cmp edi, 0x674db
jl 0x401443
push 0x7b
pop edi
cmp dword [0x2afa6d4], 0x86
jne 0x4014ab
push esi
lea eax, [ebp - 0xc2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push esi
push str.wotakaluyafalahe
call dword [sym.imp.KERNEL32.dll_SetVolumeLabelA]
lea eax, [ebp - 0x42c]
push eax
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteAce]
dec edi
jne 0x40146d
call fcn.00401000
call dword [0x2afa088]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x404578
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4218ac]
jne 0x404582
repz ret
jmp fcn.00406e8c

Function at 0x406c4f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00401d5c
and dword [ebp - 4], 0
cmp dword [0x425f90], 0
mov ebx, eax
jne 0x406d00
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406db1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406db1
push eax
call fcn.00401cea
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x425f90], eax
call esi
push eax
call fcn.00401cea
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x425f94], eax
call esi
push eax
call fcn.00401cea
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x425f98], eax
call esi
push eax
call fcn.00401cea
pop ecx
mov dword [0x425fa0], eax
test eax, eax
je 0x406d00
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00401cea
pop ecx
mov dword [0x425f9c], eax
mov eax, dword [0x425f9c]
cmp eax, ebx
je 0x406d58
cmp dword [0x425fa0], ebx
je 0x406d58
push eax
call fcn.00401d65
push dword [0x425fa0]
mov esi, eax
call fcn.00401d65
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x406d58
test edi, edi
je 0x406d58
call esi
test eax, eax
je 0x406d4f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406d4f
test byte [ebp - 0xc], 1
jne 0x406d58
or dword [ebp + 0x10], 0x200000
jmp 0x406d91
mov eax, dword [0x425f94]
cmp eax, ebx
je 0x406d91
push eax
call fcn.00401d65
pop ecx
test eax, eax
je 0x406d91
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406d91
mov eax, dword [0x425f98]
cmp eax, ebx
je 0x406d91
push eax
call fcn.00401d65
pop ecx
test eax, eax
je 0x406d91
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x425f90]
call fcn.00401d65
pop ecx
test eax, eax
je 0x406db1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406db3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4cd59f
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x3c]
mov edx, dword [ebx + eax + 0x78]
add edx, ebx
mov esi, dword [edx + 0x18]
mov eax, edx
mov edi, dword [edx + 0x1c]
mov edx, dword [edx + 0x20]
mov dword [ebp - 0x1c], esi
xor esi, esi
add edx, ebx
mov dword [ebp - 0x20], edx
mov edx, dword [eax + 0x24]
add edx, ebx
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x1c], esi
je 0x4cd607
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ecx + esi*4]
add eax, ebx
mov dword [esp], eax
call fcn.004cd56c
mov ecx, dword [ebp - 0x24]
movzx ecx, word [ecx + esi*2]
lea ecx, [ebx + ecx*4]
mov ecx, dword [ecx + edi]
cmp eax, dword [ebp + 0xc]
jne 0x4cd604
lea eax, [ebx + ecx]
jmp 0x4cd609
inc esi
jmp 0x4cd5d1
xor eax, eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x43c500
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x43ca20
test edx, edx
je 0x43ca20
call fcn.0043c517
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x43ca60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0043c500
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x43cad1
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x43ca96
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x43d3e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x43d464
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x43d43c
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x43d444
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.0043d469

Function at 0x4485f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ca150
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x659bc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esi], vtable.CryptoPP::FilterWithBufferedInput.0
mov dword [esi + 4], vtable.CryptoPP::FilterWithBufferedInput.1.0
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x30]
cmp eax, ecx
mov edx, dword [esi + 0x34]
mov edi, edx
cmovb ecx, eax
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x448654
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x448665
push 0x48
push esi
call fcn.005c6ee7
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x448be0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ca271
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x659bc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x24], edi
push 0
mov dword [ebp - 0x1c], 0
call fcn.0047c560
mov dword [ebp - 4], 0
mov dword [edi], vtable.CryptoPP::BaseN_Decoder.0
mov dword [edi + 4], vtable.CryptoPP::BaseN_Decoder.1.0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x30], 0xffffffff
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
push esi
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0047d0b0
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.0047ec10
mov esi, eax
push 0x14
mov byte [ebp - 4], 3
call fcn.005c6c66
mov ecx, eax
xorps xmm0, xmm0
mov eax, dword [ebp + 8]
add esp, 4
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 4], str.DecodingLookupArray
mov word [ecx + 8], 1
mov dword [ecx + 0xc], 0
mov dword [ecx], vtable.CryptoPP::AlgorithmParametersTemplate_int_const__.0
mov dword [ecx + 0x10], eax
mov byte [ebp - 4], 4
mov eax, dword [esi + 4]
mov dword [esi + 4], 0
mov edx, dword [ecx + 0xc]
mov dword [ebp - 0x20], eax
test edx, edx
je 0x448cf2
mov eax, dword [edx]
mov ecx, edx
push 1
call dword [eax]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov dword [ecx + 0xc], eax
mov edx, dword [esi + 4]
mov dword [ebp - 0x14], 0
test edx, edx
je 0x448d0e
mov eax, dword [edx]
mov ecx, edx
push 1
call dword [eax]
mov ecx, dword [ebp - 0x18]
mov dword [esi + 4], ecx
mov byte [esi + 8], 1
push esi
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 3
call fcn.0047eb90
mov dword [ebp - 0x1c], 1
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x448d3a
mov eax, dword [ecx]
push 1
call dword [eax]
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 2
push eax
push str.Log2Base
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x30], vtable.CryptoPP::NameValuePairs.0
call fcn.00461750
push eax
mov ecx, edi
call fcn.00482a80
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x38]
test ecx, ecx
je 0x448d6f
mov edx, dword [ecx]
push 1
call dword [edx]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c6b67
mov esp, ebp
pop ebp
ret 0xc
Function at 0x448d90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ca150
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x659bc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
mov eax, dword [esi + 0x30]
mov ecx, dword [esi + 0x34]
cmp eax, ecx
mov edx, dword [esi + 0x38]
mov edi, edx
cmovb ecx, eax
xor al, al
rep stosb byte es:[edi], al
push edx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ecx, dword [esi + 0xc]
add esp, 4
test ecx, ecx
je 0x448de7
mov eax, dword [ecx]
push 1
call dword [eax]
test byte [ebp + 8], 1
je 0x448df8
push 0x3c
push esi
call fcn.005c6ee7
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4