joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409960
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x459b93
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
push esi
push edi
xor edi, edi
push 0x4738cc
push edi
push 2
push edi
push edi
push 1
push edi
push edi
push edi
push 0x2bc
push edi
mov esi, ecx
push edi
push edi
push 0xe
mov byte [esi + 0x1d8], 0
call dword [sym.imp.GDI32.dll_CreateFontA]
push 0x80
push edi
push eax
lea ecx, [esi + 0x19c]
call fcn.00413340
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov ebp, 1
add ebp, ebp
cmp ebp, 4
jl 0x4099c9
push ebp
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 4
cmp ebx, edi
jne 0x4099e6
push edi
call dword [sym.imp.MSVCRT.dll_exit]
mov ecx, ebp
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x14]
xor eax, eax
test ecx, ecx
mov dword [esp + 0x18], ebp
jle 0x409a1d
mov ecx, dword [esp + 0x1c]
inc eax
mov dl, byte [ecx + eax - 1]
mov byte [eax + ebx - 1], dl
mov ecx, dword [esp + 0x14]
cmp eax, ecx
jl 0x409a08
mov eax, dword [esp + 0x1c]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov dword [esp + 0x20], ebx
lea ecx, [esi + 0xf0]
push 0x473c9c
lea edx, [esp + 0x1c]
push ecx
push edx
mov dword [esp + 0x38], 0
call fcn.00405c40
lea edi, [esi + 0x112]
push 0x473c90
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00405c40
push 0x1dc
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 0x20
mov dword [esp + 0x10], ebx
test ebx, ebx
mov byte [esp + 0x28], 1
je 0x409ab3
mov eax, dword [esi]
xor ecx, ecx
mov cx, word [esi + 0x128]
xor edx, edx
mov dx, word [esi + 0x126]
push ecx
push edx
push 0x52
mov ecx, esi
call dword [eax + 0x24]
xor ecx, ecx
mov cx, word [esi + 0x126]
sub eax, ecx
mov ecx, ebx
cdq
sub eax, edx
sar eax, 1
push eax
push esi
call fcn.00411c90
jmp 0x409ab5
xor eax, eax
push 0x473c88
mov ecx, eax
mov byte [esp + 0x2c], 0
mov dword [esi + 0x138], eax
call fcn.00412070
mov eax, dword [0x473c78]
lea edx, [esi + 0x13c]
push edi
mov dword [edx], eax
mov ecx, dword [0x473c7c]
mov dword [edx + 4], ecx
mov eax, dword [0x473c80]
mov dword [edx + 8], eax
mov ecx, dword [0x473c84]
mov dword [edx + 0xc], ecx
mov edx, dword [esi + 0x138]
push edx
call fcn.00405c70
add esp, 8
mov ecx, esi
call fcn.0040fb80
push 1
mov ecx, esi
call fcn.0040f2a0
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x409b24
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x40ab90
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov esi, dword [ebp + 4]
test esi, esi
jge 0x40ac0a
jne 0x40aba8
mov esi, 1
jmp 0x40abb2
test esi, esi
jge 0x40abb2
add esi, esi
test esi, esi
jl 0x40abac
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40abc8
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp]
xor eax, eax
test ecx, ecx
mov dword [ebp + 4], esi
jle 0x40abfb
mov ecx, dword [ebp + 8]
inc eax
mov dl, byte [eax + ecx - 1]
mov byte [eax + ebx - 1], dl
mov ecx, dword [ebp]
cmp eax, ecx
jl 0x40abe8
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [ebp + 8], ebx
push 0
mov ecx, ebp
call fcn.004075f0
mov ebx, str.btn_Charge.jbg
mov ecx, ebx
test ecx, ecx
je 0x40ac48
mov esi, dword [esp + 0x14]
mov edi, dword [sym.imp.MSVCRT.dll__stricmp]
test ebx, ebx
je 0x40ac48
cmp byte [ebx], 0
je 0x40ac48
mov eax, dword [ebx + 0x40]
test eax, eax
je 0x40ac48
push esi
push ebx
call edi
add esp, 8
test eax, eax
je 0x40ac4f
add ebx, 0x48
jne 0x40ac28
pop edi
pop esi
pop ebp
xor al, al
pop ebx
ret
mov eax, dword [ebx + 0x44]
mov esi, dword [ebp + 4]
cmp eax, esi
mov dword [esp + 0x14], eax
jle 0x40acd6
test esi, esi
jne 0x40ac66
mov esi, 1
cmp esi, eax
jge 0x40ac70
add esi, esi
cmp esi, eax
jl 0x40ac6a
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
test edi, edi
mov dword [esp + 0x18], edi
jne 0x40ac8a
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov ecx, esi
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [ebp]
xor eax, eax
test ecx, ecx
mov dword [ebp + 4], esi
jle 0x40acbf
mov ecx, dword [ebp + 8]
inc eax
mov dl, byte [eax + ecx - 1]
mov ecx, dword [esp + 0x18]
mov byte [eax + ecx - 1], dl
mov ecx, dword [ebp]
cmp eax, ecx
jl 0x40aca8
mov edx, dword [ebp + 8]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x1c]
add esp, 4
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x14]
test eax, eax
jl 0x40ace2
cmp eax, dword [ebp + 4]
jg 0x40ace2
mov dword [ebp], eax
mov ecx, dword [ebx + 0x44]
mov esi, dword [ebx + 0x40]
mov edi, dword [ebp + 8]
mov edx, ecx
add esi, 0x473cb0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebx, dword [ebx + 0x44]
mov esi, 0x20
cmp ebx, 0x20
jg 0x40ad0e
mov esi, ebx
xor ecx, ecx
test esi, esi
jle 0x40ad43
test ecx, ecx
jl 0x40ad26
cmp ecx, dword [ebp]
jge 0x40ad26
mov edx, dword [ebp + 8]
mov eax, ecx
add eax, edx
jmp 0x40ad32
mov byte [0x56f811], 0
mov eax, 0x56f811
mov dl, byte [ecx + 0x473cb0]
mov bl, byte [eax]
xor bl, dl
inc ecx
cmp ecx, esi
mov byte [eax], bl
jl 0x40ad14
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
ret
Function at 0x40aef0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x459c28
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 4]
lea ecx, [esp + 4]
push ecx
push 1
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov dword [esi], eax
jne 0x40af84
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 4]
push eax
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 1
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [esi], eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi], 0
jne 0x40af84
mov esi, dword [esp + 8]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00458d70
mov eax, esi
pop esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00458d70
mov ecx, dword [esp + 0xc]
xor eax, eax
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 4

Function at 0x40afb0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x459c6a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], 0
push ecx
lea eax, [esp + 0x134]
mov ebx, 1
mov ecx, esp
mov dword [esp + 0x14], esp
push eax
mov dword [esp + 0x12c], 2
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0xff
mov edi, ebx
call sub.MFC42.DLL_CString::CString
mov ecx, esi
call fcn.0040aef0
cmp eax, ebx
mov dword [esp + 0x14], eax
je 0x40b03d
cmp eax, 2
je 0x40b03d
mov esi, dword [esp + 0x12c]
lea ecx, [esp + 0x134]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString
mov dword [esp + 0xc], ebx
jmp 0x40b0df
mov eax, dword [esi + 0xc]
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
push eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov dword [esi], eax
je 0x40b075
mov esi, dword [esp + 0x12c]
lea ecx, [esp + 0x134]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString
jmp 0x40b0db
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x134]
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov dword [esi], eax
je 0x40b0a1
xor edi, edi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x40b0c8
mov esi, dword [esp + 0x12c]
lea edx, [esp + 0x134]
push edx
mov ecx, esi
call sub.MFC42.DLL_CString::CString
jmp 0x40b0db
mov esi, dword [esp + 0x12c]
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0xc], ebx
lea ecx, [esp + 0x130]
mov byte [esp + 0x124], bl
call fcn.00458d70
lea ecx, [esp + 0x134]
mov byte [esp + 0x124], 0
call fcn.00458d70
mov ecx, dword [esp + 0x11c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x11c
ret 0xc
Function at 0x40b130
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x459c88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, 4
lea edx, [esp]
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
mov eax, dword [ecx + 0xc]
push edx
push 0x20019
push 0
push eax
mov eax, dword [ecx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40b199
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.00458d70
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
lea ecx, [esp + 8]
lea edx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 8]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40b1c6
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov ecx, dword [esp]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 8]
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00458d70
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 8

Function at 0x40b200
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x459ca8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov eax, dword [ecx + 0xc]
lea edx, [esp]
push edx
push 0x20019
push 0
push eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x1c], 3
push eax
mov dword [esp + 0x1c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40b26c
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0xffffffff
call fcn.00458d70
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
lea ecx, [esp + 8]
lea edx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x10]
push edx
mov edx, dword [esp + 8]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40b299
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
mov ecx, dword [esp]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 8]
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.00458d70
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x40b2d0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x459cc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0xc]
mov edx, dword [esi + 4]
lea ecx, [esp + 8]
mov edi, 1
push ecx
push 0x20006
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40b333
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00458d70
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 8
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 8]
lea eax, [esp + 0x20]
push 4
push eax
push 3
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40b354
xor edi, edi
mov eax, dword [esi + 8]
test eax, eax
jne 0x40b366
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.00458d70
mov ecx, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8

Function at 0x40b3a0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x459cf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x104
push ebx
push ebp
push edi
mov ebp, ecx
mov dword [esp + 0x118], 0
mov edi, dword [esp + 0x124]
mov ebx, 1
cmp dword [edi - 8], 0xfe
jg 0x40b421
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push esi
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp + 0xc]
and ecx, 3
mov edx, dword [ebp + 4]
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
push ecx
push 0x20006
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop esi
je 0x40b450
lea ecx, [esp + 0x120]
mov byte [esp + 0x118], 0
call fcn.00458d70
lea ecx, [esp + 0x124]
mov dword [esp + 0x118], 0xffffffff
call fcn.00458d70
xor eax, eax
jmp 0x40b4ca
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esp + 0xc]
repne scasb al, byte es:[edi]
not ecx
lea eax, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x124]
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40b480
xor ebx, ebx
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40b492
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x120]
mov byte [esp + 0x118], 0
call fcn.00458d70
lea ecx, [esp + 0x124]
mov dword [esp + 0x118], 0xffffffff
call fcn.00458d70
mov eax, ebx
mov ecx, dword [esp + 0x110]
pop edi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x110
ret 8
Function at 0x40bc40
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x459d31
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push ecx
push ebx
push edx
lea ecx, [esp + 0x30]
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___unsigned_int__unsigned_int_]
lea eax, [esp + 0x20]
lea ecx, [esp + 8]
push eax
push ecx
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.0040beb0
mov esi, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], edx
je 0x40bceb
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x40bce2
cmp al, 0xff
je 0x40bce2
dec al
mov byte [ecx], al
jmp 0x40bceb
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x40bd1c
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x40bd13
cmp al, 0xff
je 0x40bd13
dec al
mov byte [ecx], al
jmp 0x40bd1c
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x40e070
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push 0xffffffffffffffff
push 0x45a048
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
push edi
push 0xbb8
mov esi, ecx
push 0xde
push str.E:ChenlpVcfJEngine_src_acutil.cpp
push esi
lea ecx, [esp + 0x20]
call fcn.0040e4f0
lea edi, [esi + 0x20]
mov esi, dword [esp + 0x34]
mov ebp, 1
mov dword [esp + 0x2c], 0
mov dword [edi], esi
mov eax, ebp
mov ecx, edi
mov edx, dword [ecx]
add ecx, 4
mov ebx, edx
shr ebx, 0x1e
xor ebx, edx
imul ebx, ebx, 0x6c078965
add ebx, eax
inc eax
mov dword [ecx], ebx
cmp eax, 0x270
jl 0x40e0c1
push esi
mov dword [edi + 0x9c0], ebp
mov dword [edi + 0x9c4], ebp
call sub.MSVCRT.dll_srand
add esp, 4
mov ebx, 0x25
mov ecx, 0x56d390
call fcn.00414c10
mov esi, eax
call sub.MSVCRT.dll_rand
imul esi, eax
mov dword [edi], esi
mov eax, ebp
mov ecx, edi
mov edx, dword [ecx]
add ecx, 4
mov esi, edx
shr esi, 0x1e
xor esi, edx
imul esi, esi, 0x6c078965
add esi, eax
inc eax
mov dword [ecx], esi
cmp eax, 0x270
jl 0x40e113
mov dword [edi + 0x9c0], ebp
mov dword [edi + 0x9c4], ebp
add edi, 0x9cc
dec ebx
jne 0x40e0f9
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0040e630
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 4
Function at 0x414e10
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x4279e0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.00458700
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x427a29
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x427a29
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push sym.imp.MSVCRT.dll__snprintf
call sub.MSVCRT.dll_vfprintf
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call sub.MSVCRT.dll__vsnprintf
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x427b2b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x427ae6
lea edx, [ebp - 4]
push edx
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x427ae6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x427ae6
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x427ae6
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.00458700
lea eax, [ebp - 4]
mov edi, esp
push eax
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x427ae6
mov ecx, dword [ebp - 4]
push str.Service_0x
push edi
lea eax, [ecx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call sub.MSVCRT.dll_wcsstr
add esp, 8
test eax, eax
je 0x427b2b
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push 0
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea ecx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431bf0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x54
call fcn.00458700
mov eax, dword [esp + 0x58]
push ebx
push ebp
push esi
mov ebp, dword [eax + 0xc]
push edi
mov edi, dword [eax + 8]
xor esi, esi
cmp edi, 0x20
mov dword [esp + 0x10], esi
jle 0x431c27
push str.nkey___EVP_MAX_KEY_LENGTH
push 0x79
push str..cryptoevpevp_key.c
call fcn.00427b50
add esp, 0xc
cmp ebp, 0x10
jle 0x431c40
push str.niv___EVP_MAX_IV_LENGTH
push 0x7a
push str..cryptoevpevp_key.c
call fcn.00427b50
add esp, 0xc
cmp dword [esp + 0x74], esi
jne 0x431c50
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
lea eax, [esp + 0x14]
push eax
call fcn.00423b40
mov ecx, dword [esp + 0x70]
push esi
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.00423b60
add esp, 0x10
test eax, eax
je 0x431db3
mov ebx, dword [esp + 0x84]
jmp 0x431c85
mov esi, dword [esp + 0x84]
mov eax, esi
inc esi
test eax, eax
mov dword [esp + 0x84], esi
je 0x431caa
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x24]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
call fcn.00423c90
add esp, 0xc
mov ecx, dword [esp + 0x78]
mov edx, dword [esp + 0x74]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
call fcn.00423c90
mov eax, dword [esp + 0x7c]
add esp, 0xc
test eax, eax
je 0x431cd9
push 8
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00423c90
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00423cb0
mov esi, dword [esp + 0x88]
add esp, 0xc
cmp esi, 1
jbe 0x431d3c
dec esi
mov edx, dword [esp + 0x6c]
push 0
lea eax, [esp + 0x18]
push edx
push eax
call fcn.00423b60
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x30]
push ecx
lea eax, [esp + 0x24]
push edx
push eax
call fcn.00423c90
lea ecx, [esp + 0x28]
lea edx, [esp + 0x3c]
push ecx
lea eax, [esp + 0x30]
push edx
push eax
call fcn.00423cb0
add esp, 0x24
dec esi
jne 0x431cfd
mov ecx, dword [esp + 0x10]
xor eax, eax
test edi, edi
je 0x431d72
cmp eax, ecx
je 0x431d72
mov edx, dword [esp + 0x80]
test edx, edx
je 0x431d6c
mov esi, dword [esp + 0x80]
mov dl, byte [esp + eax + 0x24]
mov byte [esi], dl
mov edx, esi
inc edx
mov dword [esp + 0x80], edx
dec edi
inc eax
test edi, edi
jne 0x431d46
test ebp, ebp
je 0x431d8f
cmp eax, ecx
je 0x431d8f
cmp eax, ecx
je 0x431d8f
test ebx, ebx
je 0x431d89
mov dl, byte [esp + eax + 0x24]
mov byte [ebx], dl
inc ebx
dec ebp
inc eax
test ebp, ebp
jne 0x431d7a
test edi, edi
jne 0x431d97
test ebp, ebp
je 0x431dbd
mov eax, dword [esp + 0x6c]
push 0
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.00423b60
add esp, 0xc
test eax, eax
jne 0x431c7e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x54
ret
lea edx, [esp + 0x14]
push edx
call fcn.00423ec0
lea eax, [esp + 0x28]
push 0x40
push eax
call fcn.0041b7b0
mov ecx, dword [esp + 0x74]
add esp, 0xc
mov eax, dword [ecx + 8]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret