joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45da4e
Capabilities:
Enumerate files on windows

Disassembly:
push 0x278
mov eax, 0x4dfcf9
call fcn.004bb813
push str.googlechrome_applicationchrome.exe
lea ecx, [ebp - 0x268]
call fcn.00401814
xor eax, eax
mov dword [ebp - 0x264], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x26c]
push eax
call fcn.00408311
lea ecx, [ebp - 0x268]
push ecx
push eax
lea eax, [ebp - 0x278]
push eax
mov byte [ebp - 4], 1
call fcn.0044ced3
push eax
mov byte [ebp - 4], 2
call fcn.00407ecd
mov ecx, dword [ebp - 0x278]
add esp, 0x14
lea ecx, [ecx - 0x10]
mov bl, al
call fcn.00404c8b
mov ecx, dword [ebp - 0x26c]
lea ecx, [ecx - 0x10]
call fcn.00404c8b
mov ecx, dword [ebp - 0x268]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00404c8b
test bl, bl
je 0x45dae4
mov al, 1
jmp 0x45dc7d
push str.GoogleChrome_SxSApplicationchrome.exe
lea ecx, [ebp - 0x268]
call fcn.00401814
lea eax, [ebp - 0x26c]
push eax
mov dword [ebp - 4], 3
call fcn.0040822c
lea ecx, [ebp - 0x268]
push ecx
push eax
lea eax, [ebp - 0x270]
push eax
mov byte [ebp - 4], 4
call fcn.0044ced3
add esp, 0x10
mov ecx, dword [ebp - 0x26c]
lea ecx, [ecx - 0x10]
call fcn.00404c8b
mov ecx, dword [ebp - 0x268]
mov byte [ebp - 4], 7
lea ecx, [ecx - 0x10]
call fcn.00404c8b
lea eax, [ebp - 0x270]
push eax
call fcn.00407ecd
pop ecx
test al, al
jne 0x45dc60
lea eax, [ebp - 0x260]
push eax
push str.c:chrome
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x45dc69
test byte [ebp - 0x260], 0x10
je 0x45dc48
push str.chrome.exe
lea ecx, [ebp - 0x264]
call fcn.00401814
lea eax, [ebp - 0x234]
push eax
lea ecx, [ebp - 0x274]
mov byte [ebp - 4], 8
call fcn.00401855
push str.c:chrome_
lea ecx, [ebp - 0x27c]
mov byte [ebp - 4], 9
call fcn.00401814
lea ecx, [ebp - 0x274]
push ecx
push eax
lea eax, [ebp - 0x280]
push eax
mov byte [ebp - 4], 0xa
call fcn.0044ced3
lea ecx, [ebp - 0x264]
push ecx
push eax
lea eax, [ebp - 0x284]
push eax
mov byte [ebp - 4], 0xb
call fcn.0044ced3
push eax
mov byte [ebp - 4], 0xc
call fcn.00407ecd
mov ecx, dword [ebp - 0x284]
add esp, 0x1c
lea ecx, [ecx - 0x10]
mov bl, al
call fcn.00404c8b
mov ecx, dword [ebp - 0x280]
lea ecx, [ecx - 0x10]
call fcn.00404c8b
mov ecx, dword [ebp - 0x27c]
lea ecx, [ecx - 0x10]
call fcn.00404c8b
mov ecx, dword [ebp - 0x274]
lea ecx, [ecx - 0x10]
call fcn.00404c8b
mov ecx, dword [ebp - 0x264]
mov byte [ebp - 4], 7
lea ecx, [ecx - 0x10]
call fcn.00404c8b
test bl, bl
jne 0x45dc60
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45db74
jmp 0x45dc63
xor eax, eax
inc eax
mov dword [ebp - 0x264], eax
mov ecx, dword [ebp - 0x270]
add ecx, 0xfffffff0
call fcn.00404c8b
mov al, byte [ebp - 0x264]
call fcn.004bb7c2
ret
Function at 0x46210a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x4e0592
call fcn.004bb87f
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x418], ebx
push 0x60
push ebx
push esi
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x462187
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x462187
call fcn.00446a0b
mov esi, eax
jmp 0x46225e
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x4621aa
call fcn.00446a0b
jmp 0x462251
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x420], eax
test eax, eax
je 0x4621a0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov dword [ebp - 0x41c], esi
lea eax, [esi + 1]
cmp eax, esi
jae 0x4621da
mov esi, 0x8007000e
jmp 0x462253
push eax
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.0046161d
jmp 0x462200
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x4621d3
push esi
push dword [ebp - 0x418]
push esi
push dword [ebp - 0x420]
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x4621a0
mov eax, dword [ebp - 0x418]
push dword [ebp + 0x14]
xor edx, edx
mov word [eax + ecx*2], dx
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.00461fd1
mov esi, eax
test edi, edi
je 0x46225e
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x462277
lea ecx, [ebp - 0x418]
call fcn.004619bc
mov eax, esi
call fcn.004bb7d1
ret 0x10
Function at 0x463262
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x10]
test edx, edx
jne 0x463270
xor al, al
pop ebp
ret
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov byte [edx], al
test edi, edi
jne 0x463280
xor al, al
jmp 0x4632a4
push esi
mov esi, eax
cmp dword [ebp + 0xc], eax
jle 0x46329d
movzx ecx, byte [esi + edi]
movzx eax, al
xor ecx, eax
inc esi
mov al, byte [ecx + 0x4f2a50]
cmp esi, dword [ebp + 0xc]
jl 0x463288
xor al, 0x55
mov byte [edx], al
mov al, 1
pop esi
pop edi
pop ebp
ret

Function at 0x463423
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
mov eax, dword [0x531698]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1d0], eax
cmp esi, 0x40
jbe 0x463490
lea eax, [ebp - 0x1cc]
push eax
call fcn.00464937
push esi
lea eax, [ebp - 0x1cc]
push edi
push eax
call fcn.004636af
push 0x20
push 0
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x1cc]
push eax
call fcn.00464ea4
push 0x20
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.004bc640
add esp, 0x2c
jmp 0x4634b9
push esi
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.004baa20
add esp, 0xc
cmp esi, 0x40
jae 0x4634b9
push 0x40
pop eax
sub eax, esi
push eax
lea eax, [ebp - 0x44]
add eax, esi
push 0
push eax
call fcn.004bc640
add esp, 0xc
xor ecx, ecx
mov al, byte [ebp + ecx - 0x44]
xor al, 0x36
mov byte [ebp + ecx - 0xa4], al
inc ecx
cmp ecx, 0x40
jl 0x4634bb
lea eax, [ebp - 0x1cc]
push eax
call fcn.00464937
push 0x40
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x1cc]
push eax
call fcn.00464fcc
push dword [ebp + 0x14]
lea eax, [ebp - 0x1cc]
push ebx
push eax
call fcn.004636af
push 0x20
push 0
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x1cc]
push eax
call fcn.00464ea4
add esp, 0x2c
xor ecx, ecx
pop edi
pop esi
pop ebx
mov al, byte [ebp + ecx - 0x44]
xor al, 0x5c
mov byte [ebp + ecx - 0xa4], al
inc ecx
cmp ecx, 0x40
jl 0x46351b
lea eax, [ebp - 0x1cc]
push eax
call fcn.00464937
push 0x40
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x1cc]
push eax
call fcn.00464fcc
push 0x20
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x1cc]
push eax
call fcn.00464fcc
push dword [ebp + 0x1c]
lea eax, [ebp - 0x1cc]
push 0
push dword [ebp - 0x1d0]
push eax
call fcn.00464ea4
mov ecx, dword [ebp - 4]
xor ecx, ebp
add esp, 0x2c
call fcn.004bb744
leave
ret
Function at 0x46412d
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 0x100
call fcn.004b9bb1
mov ebx, dword [ebp + 0x10]
pop ecx
mov esi, eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], 0x80
push dword [ebp + 8]
mov dword [ebp - 8], ebx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edi, eax
test edi, edi
jne 0x4641da
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4641da
cmp dword [ebp - 8], ebx
jbe 0x464190
test esi, esi
je 0x46418c
push esi
call fcn.004baa14
pop ecx
xor al, al
jmp 0x4641ec
mov eax, dword [ebp - 4]
cmp eax, 0x80
jbe 0x4641bd
test esi, esi
je 0x4641a8
push esi
call fcn.004baa14
mov eax, dword [ebp - 4]
pop ecx
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004b9bb1
pop ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov edi, eax
test esi, esi
je 0x4641e5
push esi
call fcn.004baa14
pop ecx
xor eax, eax
test edi, edi
setne al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4641f1
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x531698]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor eax, eax
push 7
mov word [ebp - 0x24], ax
pop ecx
lea edi, [ebp - 0x22]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x84], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x464286
push 0x43
lea eax, [ebp - 0x67]
push 0
push eax
mov byte [ebp - 0x68], 0
call fcn.004bc640
push 0x44
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0046412d
add esp, 0x18
test al, al
je 0x464286
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004640d2
pop ecx
pop ecx
push eax
mov ecx, ebx
call fcn.0040e4c2
push 0
push 1
lea ecx, [ebp - 0x80]
call fcn.0040f484
and dword [esi], 0
push esi
call fcn.004642a8
pop ecx
test al, al
jne 0x464297
and dword [esi], 0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.004bb744
leave
ret
Function at 0x4647b4
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push 0x30
mov eax, 0x4e089c
call fcn.004bb813
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x30], ebx
push 0xf0000000
push 1
push ebx
push ebx
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x464807
push ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
push 0x14
mov ecx, edi
mov byte [edi], bl
call fcn.0040f778
cmp dword [ebp - 0x30], 0
jmp 0x464923
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 0x8004
push dword [ebp - 0x30]
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x464850
push ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
push 0x14
mov ecx, edi
mov byte [edi], bl
call fcn.0040f778
cmp dword [ebp - 0x2c], 0
je 0x4647fe
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [ebp - 0x2c], ebx
jmp 0x4647fe
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
jb 0x46485b
mov esi, dword [esi]
push ebx
push eax
push esi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x464826
push 4
pop ecx
push ebx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
push ecx
push dword [ebp - 0x2c]
mov dword [ebp - 0x34], ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov dword [ebp - 0x38], ecx
call ebx
test eax, eax
jne 0x4648a7
xor ebx, ebx
push ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
push 0x14
mov ecx, edi
mov byte [edi], bl
call fcn.0040f778
jmp 0x46490f
xor eax, eax
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x28], al
mov esi, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x34]
inc eax
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 2
call fcn.0046475a
pop ecx
pop ecx
push eax
push 2
push esi
call ebx
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov ecx, edi
mov dword [edi + 0x10], ebx
test eax, eax
jne 0x4648f6
mov byte [edi], bl
push ebx
push 0x14
call fcn.0040f778
jmp 0x464907
cmp dword [ebp - 0x34], 0x14
mov byte [edi], bl
jne 0x4648ec
lea eax, [ebp - 0x28]
push eax
call fcn.0040cdc2
lea ecx, [ebp - 0x28]
call fcn.00401056
cmp dword [ebp - 0x2c], ebx
je 0x464920
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x30], ebx
je 0x46492f
push ebx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
call fcn.004bb7c2
ret

Function at 0x464937
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x128
push 0
push esi
call fcn.004bc640
push 0x20
lea eax, [esi + 0x100]
push 0x4f2d90
push eax
call fcn.004baa20
add esp, 0x18
pop esi
pop ebp
ret
Function at 0x468600
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.004bc610
mov eax, dword [0x531698]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x468665
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x468665
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.004c006d
add eax, 0x40
push eax
call fcn.004c39e1
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004bb744
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.004c391c
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4686f4
call fcn.004684c0
test eax, eax
jle 0x4686f4
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004bb744
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004bb744
add esp, 0x108
ret
Function at 0x47a710
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24
call fcn.004bc610
mov eax, dword [0x531698]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, esi
push edi
mov dword [ebp - 0x18], esi
lea ecx, [eax + 1]
jmp 0x47a740
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x47a740
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
sub eax, ecx
lea edi, [eax + 1]
push edi
push esi
push 8
push 0xfde9
mov dword [ebp - 0x20], 8
call ebx
mov esi, eax
test esi, esi
jg 0x47a7b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ec
jne 0x47a79a
mov ecx, dword [ebp - 0x18]
push 0
push 0
push edi
push ecx
push 0
push 0xfde9
mov dword [ebp - 0x20], 0
call ebx
mov esi, eax
test esi, esi
jg 0x47a7b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x47a84a
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push edx
push eax
jmp 0x47a838
lea eax, [esi + esi]
call fcn.004c3030
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov eax, esp
push esi
push eax
push edi
push ecx
push edx
push 0xfde9
mov dword [ebp - 0x24], eax
call ebx
test eax, eax
je 0x47a84a
mov esi, dword [ebp - 0x1c]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47a7e3
push 8
sub eax, edx
lea ecx, [ebp - 0x14]
push ecx
inc eax
push eax
push esi
push 0
push 0xfde9
call ebx
test eax, eax
je 0x47a84a
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.004bdede
mov esi, eax
add esp, 8
test esi, esi
jne 0x47a8ee
call fcn.004c4e4f
cmp dword [eax], 2
je 0x47a830
call fcn.004c4e4f
cmp dword [eax], 9
jne 0x47a842
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push ecx
push edx
call fcn.004c2aeb
mov esi, eax
add esp, 8
test esi, esi
jne 0x47a8ee
push 0xa9
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.00467180
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0x4fdab4
push eax
push 0x4fdab0
push ecx
push str.fopen_
push 5
call fcn.00466d60
add esp, 0x2c
call fcn.004c4e4f
cmp dword [eax], 2
jne 0x47a8c0
push 0xac
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.00467180
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb744
mov esp, ebp
pop ebp
ret
push 0xae
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.00467180
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb744
mov esp, ebp
pop ebp
ret
push 0x5306b0
call fcn.004657d0
mov edi, eax
add esp, 4
test edi, edi
jne 0x47a920
push esi
call fcn.004be06e
add esp, 4
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb744
mov esp, ebp
pop ebp
ret
push 0
push edi
call fcn.00465260
push esi
push 1
push 0x6a
push edi
call fcn.004655c0
add esp, 0x18
mov eax, edi
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bb744
mov esp, ebp
pop ebp
ret
Function at 0x4995a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x4995b9
mov esi, edi
mov edi, eax
jmp 0x4995bb
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x4995cb
mov eax, ebx
jmp 0x4995d5
push eax
push ebx
call fcn.0046a870
add esp, 8
test eax, eax
jne 0x4995dd
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x4995f9
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x4995e4
cmp eax, dword [esi + 4]
jge 0x499610
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x499600
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x499631
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x49962e
dec eax
test eax, eax
jg 0x499620
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x4d4c28
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x531698]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004c6ab8
mov dword [ebp - 0x14], eax
cmp dword [0x5365fc], edi
jne 0x4d4d19
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x4d4ca6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x4d4df9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x4d4df9
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4d4df9
push eax
call ebx
push 0x5217c8
push esi
mov dword [0x5365fc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x536600], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x5217ec
push esi
mov dword [0x536604], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x53660c], eax
test eax, eax
je 0x4d4d16
push 0x521808
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x536608], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x4d4d3e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x4d4d31
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x4d4d53
push 4
pop eax
jmp 0x4d4dfb
cmp dword [ebp - 0x14], edi
je 0x4d4d53
push dword [0x5365fc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x4d4d38
mov eax, dword [0x536608]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x4d4db1
cmp dword [0x53660c], esi
je 0x4d4db1
push eax
call ebx
push dword [0x53660c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4d4db1
test eax, eax
je 0x4d4db1
call ecx
test eax, eax
je 0x4d4da6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4d4da6
test byte [ebp - 8], 1
jne 0x4d4db1
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x4d4de1
mov eax, dword [0x536600]
cmp eax, esi
je 0x4d4dde
push eax
call ebx
test eax, eax
je 0x4d4dde
call eax
mov edi, eax
test edi, edi
je 0x4d4dde
mov eax, dword [0x536604]
cmp eax, esi
je 0x4d4dde
push eax
call ebx
test eax, eax
je 0x4d4dde
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x5365fc]
call ebx
test eax, eax
je 0x4d4df9
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x4d4dfb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004bb744
leave
ret
Function at 0x4d7202
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.004c7c65
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4d723a
xor eax, eax
jmp 0x4d7266
cmp esi, dword [ebp - 4]
je 0x4d7263
cmp dword [ebp + 0xc], 0
je 0x4d7263
push dword [edi + 0x9c]
call fcn.004d6e10
push dword [edi + 0x9c]
mov esi, eax
call fcn.004bbed3
pop ecx
pop ecx
cmp esi, eax
je 0x4d7236
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x406074], 1
mov dword [0x406070], 1
mov dword [0x40606c], 1
mov dword [0x406064], 1
jne 0x401060
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010c0
mov dword [0x40600c], eax
mov eax, dword [0x406080]
test eax, eax
jne 0x4010b0
mov dword [esp], 1
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x406094]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x40607c]
mov dword [eax], edx
call sym.__setargv
cmp dword [0x403020], 1
je 0x4010f0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 2
call sym.___set_app_type
jmp 0x40107a
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x401102
cmp dx, 0x20b
jne 0x401060
cmp dword [ecx + 0x84], 0xe
jbe 0x401060
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401060
mov dword [esp], sym.__matherr
call sym.___mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401060
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401060

Function at 0x401920
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call sym.___acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call sym.___acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]