joyce8/EMBER2024-capa huggingface dataset:
Function at 0x449c00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d8d00
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x539c80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x5c
push dword [edi + 0xdc]
call fcn.004aede4
add esp, 8
test eax, eax
jne 0x449c43
or eax, 0xffffffff
jmp 0x449c4b
sub eax, dword [edi + 0xdc]
sar eax, 1
inc eax
push eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [edi + 0xdc]
call fcn.004227c0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
push 0x2001f
push 0
push dword [edi + 0xdc]
push dword [edi + 0x194]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
or esi, 0xffffffff
test eax, eax
jne 0x449ce1
call fcn.00442560
push eax
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x18]
call fcn.00417c70
add esp, 4
mov byte [ebp - 4], 1
push 0x20
push dword [ebp + 8]
push 3
push 0
push dword [eax]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp + 8], eax
mov byte [ebp - 4], 0
mov ebx, dword [ebp - 0x18]
add ebx, 0xfffffff0
mov edx, esi
lea ecx, [ebx + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x449cd9
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp + 8]
test eax, eax
jne 0x449ce1
mov bl, 1
jmp 0x449d20
call fcn.00442dd0
push eax
lea ecx, [ebp + 8]
call fcn.00402400
mov byte [ebp - 4], 3
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.0044a730
mov byte [ebp - 4], 0
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x449d1e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov edi, dword [ebp - 0x10]
add edi, 0xfffffff0
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x449d41
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44daf0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9adc
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push edi
mov eax, dword [0x539c80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CreateEventW]
push 0
push 0
mov dword [ebx], 0x522460
mov dword [ebx + 4], eax
mov byte [ebx + 8], 0
xorps xmm0, xmm0
movq qword [ebx + 0xc], xmm0
push 1
movq qword [ebx + 0x14], xmm0
push 0
mov dword [ebx + 0x1c], 0
call edi
mov dword [ebx + 0x20], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0x24], eax
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov byte [ebp - 4], 1
lea ecx, [ebx + 0x34]
push 0x1000
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.00424280
mov byte [ebp - 4], 2
push 0
push 0
mov byte [ebx + 0x40], 0
xorps xmm0, xmm0
movq qword [ebx + 0x44], xmm0
push 1
movq qword [ebx + 0x4c], xmm0
push 0
mov dword [ebx + 0x54], 0
call edi
mov dword [ebx + 0x58], eax
mov byte [ebp - 4], 3
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x60], 0
mov dword [ebx + 0x64], 0
mov dword [ebx + 0x68], 0
mov byte [ebp - 4], 4
lea eax, [ebx + 0x74]
mov dword [ebx + 0x6c], 0
push eax
mov dword [ebx + 0x70], 0x5223c8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 5
lea ecx, [ebx + 0x8c]
push ecx
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], ecx
call fcn.0042c9f0
mov byte [ebp - 4], 8
push 0
push 0
push 1
push 0
call edi
mov dword [ebx + 0xa0], eax
mov byte [ebp - 4], 9
lea eax, [ebx + 0xa8]
push eax
mov dword [ebx + 0xa4], 0x5223c8
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov byte [ebp - 4], 0xa
cmp dword [ebx + 0xa0], 0
mov byte [ebx + 0xc0], 1
jne 0x44dc87
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp + 8], str.Failure_to_initialize_channel
call fcn.004af852
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x1c], 0x522414
mov byte [ebp - 4], 0xa
push 0x524814
lea eax, [ebp - 0x1c]
push eax
call fcn.004b447b
mov eax, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x58]
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x54], ecx
test eax, eax
je 0x44dcb7
test ecx, ecx
je 0x44dcb7
mov dword [ebp - 4], 0xffffffff
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
mov dword [ebp + 8], str.Failed_creating_channel_events
call fcn.004af852
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x1c], 0x522414
mov byte [ebp - 4], 0xa
push 0x524814
lea eax, [ebp - 0x1c]
push eax
call fcn.004b447b
int3
Function at 0x44e240
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9f18
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x539c80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
cmp byte [ebx + 8], 0
je 0x44e27d
call fcn.0044e390
test al, al
je 0x44e375
lea eax, [ebx + 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x1000
push dword [ebx + 0x34]
mov dword [ebp - 0x10], 0
push dword [ebx + 0x24]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x44e2f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x44e33c
cmp eax, 0x3e5
je 0x44e2ed
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], str.Channel_read_failure
call fcn.004af852
mov dword [ebp - 4], 2
mov dword [ebp - 0x2c], 0x522414
mov dword [ebp - 4], 0xffffffff
push 0x524814
lea eax, [ebp - 0x2c]
push eax
call fcn.004b447b
mov byte [ebx + 8], 1
cmp byte [ebx + 8], 0
jne 0x44e375
mov edi, dword [ebx + 0x2c]
sub edi, dword [ebx + 0x28]
mov eax, dword [ebp - 0x10]
add eax, edi
push eax
lea ecx, [ebx + 0x28]
call fcn.00424280
push dword [ebp - 0x10]
mov eax, dword [ebx + 0x28]
push dword [ebx + 0x34]
add eax, edi
push eax
call fcn.004b10e0
add esp, 0xc
push dword [ebx + 0x20]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
call fcn.004af8b5
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0x522414
mov dword [ebp - 4], 1
mov dword [ebp - 0x20], 0x522474
mov dword [ebp - 4], 0xffffffff
push 0x5247e8
lea eax, [ebp - 0x20]
push eax
call fcn.004b447b
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e4e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d9f68
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x539c80]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [edi + 0x40], 0
je 0x44e519
call fcn.0044e6f0
test al, al
je 0x44e553
mov eax, dword [edi + 0x60]
cmp eax, dword [edi + 0x64]
jne 0x44e5ae
lea eax, [edi + 0x70]
mov dword [ebp - 0x18], eax
lea esi, [eax + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp dword [edi + 0x9c], 0
jne 0x44e567
mov dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x30]
push eax
lea ecx, [edi + 0x8c]
call fcn.0042c470
mov edx, eax
mov eax, dword [edx]
test eax, eax
je 0x44e580
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, dword [edx + 8]
mov eax, dword [eax + ecx*4]
add eax, 4
push eax
lea ecx, [edi + 0x60]
call fcn.004284c0
mov dword [edi + 0x6c], 0
mov dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [edi + 0x64]
sub ecx, dword [edi + 0x60]
lea eax, [edi + 0x44]
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [edi + 0x6c]
add eax, dword [edi + 0x60]
push ecx
push eax
push dword [edi + 0x5c]
mov dword [ebp - 0x14], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x44e628
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
je 0x44e6ad
cmp eax, 0x3e5
je 0x44e624
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], str.Channel_write_failure
call fcn.004af852
mov dword [ebp - 4], 3
mov dword [ebp - 0x30], 0x522414
mov dword [ebp - 4], 0xffffffff
push 0x524814
lea eax, [ebp - 0x30]
push eax
call fcn.004b447b
mov byte [edi + 0x40], 1
cmp byte [edi + 0x40], 0
jne 0x44e553
mov eax, dword [ebp - 0x14]
add dword [edi + 0x6c], eax
mov eax, dword [edi + 0x64]
sub eax, dword [edi + 0x60]
mov byte [ebp - 0xd], 1
cmp dword [edi + 0x6c], eax
jne 0x44e68f
lea eax, [edi + 0x70]
mov dword [ebp - 0x18], eax
lea esi, [eax + 4]
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 4
lea ecx, [edi + 0x8c]
call fcn.0044ebb0
mov eax, dword [edi + 0x60]
mov dword [edi + 0x64], eax
cmp dword [edi + 0x9c], 0
mov dword [edi + 0x6c], 0
setne byte [ebp - 0xd]
mov dword [ebp - 4], 0xffffffff
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [edi + 0x58]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x24]
call fcn.004af8b5
mov dword [ebp - 4], 1
mov dword [ebp - 0x24], 0x522414
mov dword [ebp - 4], 2
mov dword [ebp - 0x24], 0x522474
mov dword [ebp - 4], 0xffffffff
push 0x5247e8
lea eax, [ebp - 0x24]
push eax
call fcn.004b447b
int3
Function at 0x44f9d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x94d4
call fcn.004b17e0
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x53ed90]
push ebx
push esi
mov esi, edx
mov edx, ecx
lea ecx, [eax + 1]
imul ecx, eax
push edi
mov dword [ebp - 0x94d4], esi
mov dword [ebp - 0x94d0], edx
and ecx, 0x8000000f
jns 0x44fa12
dec ecx
or ecx, 0xfffffff0
inc ecx
cmp ecx, 9
jne 0x44fa96
xor eax, eax
push 0x94c6
push eax
mov word [ebp - 0x94cc], ax
lea eax, [ebp - 0x94ca]
push eax
call fcn.004b1a50
add esp, 0xc
xor edi, edi
xor esi, esi
lea esp, [esp]
xor eax, eax
test edi, edi
je 0x44fa6a
test eax, eax
je 0x44fa6a
lea ecx, [esi + eax]
lea edx, [ebp - 0x94cc]
lea edx, [edx + ecx*2]
lea ecx, [esi + eax]
mov cx, word [ebp + ecx*2 - 0x95e0]
inc cx
add cx, word [edx - 2]
mov word [edx], cx
inc eax
cmp eax, 0x8a
jl 0x44fa42
add esi, 0x8a
inc edi
cmp esi, 0x4a64
jl 0x44fa40
movsx eax, word [ebp - 6]
mov edx, dword [ebp - 0x94d0]
mov esi, dword [ebp - 0x94d4]
mov dword [0x53ed90], eax
mov ebx, dword [ebp + 8]
xor edi, edi
test ebx, ebx
jle 0x44fad9
sub esi, edx
mov dword [ebp - 0x94d4], esi
mov ecx, 0x7f
lea esp, [esp]
lea esi, [edx + edi]
mov eax, edi
cdq
idiv ecx
mov eax, dword [ebp - 0x94d4]
inc edi
mov cl, byte [edx + str._Leah_also_with_her_children_came_near__and_bowed_themselves:_and_after_came_Joseph_near_and_Rachel__and_they_bowed_themselves.]
xor cl, byte [eax + esi]
mov edx, dword [ebp - 0x94d0]
mov byte [esi], cl
mov ecx, 0x7f
cmp edi, ebx
jl 0x44fab0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, edx
pop ebx
call fcn.004ac57a
mov esp, ebp
pop ebp
ret
Function at 0x453050
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4da882
mov eax, dword fs:[0]
push eax
mov eax, 0x1018
call fcn.004b17e0
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
push str._ver
lea ecx, [ebp - 0x1018]
call fcn.00417c70
mov dword [ebp - 4], 0
push 0xfff
lea eax, [ebp - 0x100f]
push 0
push eax
mov dword [ebp - 0x1020], 0
mov byte [ebp - 0x1010], 0
call fcn.004b1a50
add esp, 0x10
lea eax, [ebp - 0x1024]
push eax
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x101c]
push eax
push 0
push dword [ebp - 0x1018]
mov dword [ebp - 0x1024], 0x1000
push dword [esi]
mov dword [ebp - 0x101c], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or edi, 0xffffffff
test eax, eax
jne 0x453187
cmp dword [ebp - 0x101c], 3
jne 0x453187
cmp dword [ebp - 0x1024], 0x1000
je 0x453187
mov eax, dword [ebp - 0x1010]
inc eax
push 4
mov dword [ebp - 0x1020], eax
lea eax, [ebp - 0x1020]
push eax
push 3
push 0
push dword [ebp - 0x1018]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x453180
push str.error_writing_ver
lea ecx, [ebp - 0x1014]
call fcn.004033d0
mov byte [ebp - 4], 4
mov ecx, dword [ebx + 0x20]
lea eax, [ebp - 0x1014]
push eax
call fcn.0044a730
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1014]
call fcn.004024b0
jmp 0x453210
mov bl, 1
jmp 0x453212
mov eax, dword [0x5396d8]
mov ecx, 0x5396d8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1014], eax
mov byte [ebp - 4], 1
mov eax, str.error_reading_ver
test eax, 0xffff0000
jne 0x4531ca
movzx esi, ax
mov ecx, esi
call fcn.00401b90
test eax, eax
je 0x4531da
push esi
push eax
lea ecx, [ebp - 0x1014]
call fcn.00402860
jmp 0x4531da
push str.error_reading_ver
lea ecx, [ebp - 0x1014]
call fcn.00403570
mov byte [ebp - 4], 2
mov ecx, dword [ebx + 0x20]
lea eax, [ebp - 0x1014]
push eax
call fcn.0044a730
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x1014]
add edx, 0xfffffff0
mov ecx, edi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x453210
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x1018]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x453236
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ac57a
mov esp, ebp
pop ebp
ret 8
Function at 0x4536a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x4536b9
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4536c5
sub eax, edi
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x4536c0
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x453cb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4daba6
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x539c80]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x41c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x420], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov byte [ebp - 4], 1
push 0x60
push 0
push edi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x453d5c
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x453d5c
call fcn.004045c0
mov edi, eax
jmp 0x453e87
push dword [ebp - 0x420]
push dword [ebp - 0x41c]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x453d7f
call fcn.004045c0
jmp 0x453e7a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x41c], ebx
test ebx, ebx
jne 0x453d9d
call fcn.004045c0
jmp 0x453e7a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x420], edi
lea ecx, [edi + 1]
cmp ecx, edi
jae 0x453dbe
mov edi, 0x8007000e
jmp 0x453e7c
mov byte [ebp - 4], 2
xor eax, eax
shld eax, ecx, 1
add ecx, ecx
test eax, eax
jne 0x453e05
cmp ecx, 0xffffffff
ja 0x453e05
cmp ecx, 0x400
jbe 0x453df0
push ecx
lea ecx, [ebp - 0x418]
call fcn.00455f30
mov dword [ebp - 4], 1
jmp 0x453e2e
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
mov dword [ebp - 4], 1
jmp 0x453e2e
push 0x80070216
call fcn.00401a60
mov eax, 0x453e15
ret
mov eax, dword [ebp - 0x418]
test eax, eax
jne 0x453e3f
mov edi, 0x8007000e
jmp 0x453e7c
push edi
push eax
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x453e5a
call fcn.004045c0
jmp 0x453e7a
xor edx, edx
mov eax, dword [ebp - 0x418]
mov word [eax + ecx*2], dx
push dword [ebp + 0x14]
push dword [ebp - 0x418]
lea ecx, [ebp - 0x42c]
call fcn.00454bf0
mov edi, eax
test esi, esi
je 0x453e87
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [ebp - 4], 0
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x453ea4
lea ecx, [ebp - 0x418]
call fcn.00455f20
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004ac57a
mov esp, ebp
pop ebp
ret 0x10
Function at 0x45f150
Capabilities:
Access the windows event log

Disassembly:
mov eax, pe_nt_image_headers32
call fcn.004b17e0
mov eax, dword [0x539c80]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x45f1b5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x45f1b5
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.004b1e99
add eax, 0x40
push eax
call fcn.004b1cd1
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004ac57a
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.004b1c0c
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x45f244
call fcn.0045f010
test eax, eax
jle 0x45f244
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004ac57a
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004ac57a
add esp, 0x108
ret

Function at 0x45f2a0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x45f2c4
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
sub edi, 1
jne 0x45f2b6
pop esi
movzx eax, cl
pop edi
ret

Function at 0x461bc0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x461c07
mov al, byte [edx]
test al, al
je 0x461c07
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x461bd7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x469e60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.004b17e0
mov eax, dword [0x539c80]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x34]
push ebp
mov ebp, dword [esp + 0x30]
dec ebp
lea edx, [ebp - 0x29]
cmp ebx, edx
push edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
jle 0x469ec5
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.0045ae20
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004ac57a
add esp, 0x20
ret
cmp ebp, 0x29
jge 0x469ef3
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.0045ae20
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004ac57a
add esp, 0x20
ret
push esi
mov byte [edi], 0
lea esi, [edi + 1]
push 0
add edi, 0x15
call fcn.00476fe0
mov ecx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x50]
push 0
push edi
push eax
push ecx
call fcn.0047e3a0
mov edx, ebp
sub edx, ebx
sub edx, 0x29
push edx
lea eax, [edi + 0x14]
push 0
push eax
call fcn.004b1a50
mov edx, dword [esp + 0x34]
mov ecx, edi
sub ecx, ebx
lea eax, [ecx + ebp]
push ebx
mov byte [eax - 0x15], 1
push edx
add eax, 0xffffffec
push eax
call fcn.004b10e0
push 0x14
push esi
call fcn.004611d0
add esp, 0x38
test eax, eax
jle 0x469f85
push 0x48
add ebp, 0xffffffec
push str..crypto_rsa_rsa_oaep.c
push ebp
call fcn.0045de80
mov ebx, eax
add esp, 0xc
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x469f9a
push 0x4b
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.0045ae20
add esp, 0x14
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004ac57a
add esp, 0x20
ret
call fcn.00476fe0
push eax
push 0x14
push esi
push ebp
push ebx
call fcn.00469ce0
add esp, 0x14
test eax, eax
jl 0x469f85
test ebp, ebp
jle 0x469fcb
mov ecx, ebx
mov eax, edi
sub ecx, edi
mov edx, ebp
lea ecx, [ecx]
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
sub edx, 1
jne 0x469fc0
call fcn.00476fe0
push eax
push ebp
push edi
lea eax, [esp + 0x24]
push 0x14
push eax
call fcn.00469ce0
add esp, 0x14
test eax, eax
jl 0x469f85
lea ecx, [esp + 0x18]
lea edi, [esp + 0x19]
lea ebp, [esp + 0x1a]
lea edx, [esp + 0x1b]
sub ecx, esi
sub edi, esi
sub ebp, esi
sub edx, esi
lea ebx, [esp + 0x1c]
sub ebx, esi
mov eax, esi
mov dword [esp + 0x10], ebx
mov esi, 4
nop
movzx ebx, byte [ecx + eax]
xor byte [eax], bl
movzx ebx, byte [edi + eax]
xor byte [eax + 1], bl
movzx ebx, byte [eax + ebp]
xor byte [eax + 2], bl
movzx ebx, byte [edx + eax]
xor byte [eax + 3], bl
mov ebx, dword [esp + 0x10]
movzx ebx, byte [ebx + eax]
xor byte [eax + 4], bl
add eax, 5
sub esi, 1
jne 0x46a010
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0045e030
mov ecx, dword [esp + 0x30]
add esp, 4
lea eax, [esi + 1]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ac57a
add esp, 0x20
ret
Function at 0x46a650
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x46a71c
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x46a671
cmp al, 0x6b
jne 0x46a71c
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x46a6dd
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x46a691
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x46a691
cmp al, 0xbb
jne 0x46a6ba
inc ecx
cmp ecx, esi
jl 0x46a681
sub esi, ecx
test ecx, ecx
jne 0x46a6e0
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.0045ae20
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.0045ae20
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x46a709
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.0045ae20
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.004b10e0
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.0045ae20
add esp, 0x14
or eax, 0xffffffff
pop esi
ret