joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484b50
Capabilities:
Get hostname

Disassembly:
push edi
push esi
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
mov byte [esi], 0
push edi
push esi
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
je 0x484b71
pop esi
pop edi
ret
push 0x2e
push esi
mov esi, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
mov ecx, eax
mov eax, esi
test ecx, ecx
je 0x484b6e
mov byte [ecx], 0
pop esi
pop edi
ret

Function at 0x487030
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov edi, dword [esp + 0x1c]
mov eax, dword [edi + 0xc]
mov ecx, dword [edi + 0x14]
lea eax, [ecx + eax*2]
add eax, 0xc
push str.hmac.c
push 0x43
push eax
call fcn.00405bd0
add esp, 0xc
mov esi, eax
test eax, eax
je 0x487146
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x20]
mov dword [esi], edi
add eax, 0xc
mov dword [esi + 4], eax
mov ecx, dword [edi + 0xc]
add ecx, eax
mov dword [esi + 8], ecx
cmp dword [edi + 0x10], ebx
jae 0x4870a5
push eax
call dword [edi]
add esp, 4
push ebx
push ebp
push dword [esi + 4]
call dword [edi + 4]
add esp, 0xc
mov ebp, dword [esi + 8]
add ebp, dword [edi + 0xc]
push dword [esi + 4]
push ebp
call dword [edi + 8]
add esp, 8
mov ebx, dword [edi + 0x14]
mov eax, dword [esi + 4]
push eax
call dword [edi]
add esp, 4
push dword [esi + 8]
call dword [edi]
add esp, 4
test ebx, ebx
mov ecx, edi
je 0x48710a
xor edi, edi
mov dword [esp + 4], ebx
nop
movzx eax, byte [ebp + edi]
xor al, 0x36
mov byte [esp + 3], al
push 1
lea eax, [esp + 7]
push eax
push dword [esi + 4]
mov ebx, esi
mov esi, ebp
mov ebp, ecx
call dword [ecx + 4]
add esp, 0xc
movzx eax, byte [esi + edi]
xor al, 0x5c
mov byte [esp + 3], al
push 1
lea eax, [esp + 7]
push eax
push dword [ebx + 8]
call dword [ebp + 4]
mov ecx, ebp
mov ebp, esi
mov esi, ebx
mov ebx, dword [esp + 0x10]
add esp, 0xc
inc edi
cmp ebx, edi
jne 0x4870c0
cmp ebx, dword [ecx + 0x10]
jae 0x487146
mov edi, ecx
nop word cs:[eax + eax]
push 1
push str.6_s__s_s_s_s_HTTP_1._d_r_n
push dword [esi + 4]
call dword [edi + 4]
add esp, 0xc
push 1
push 0x9ad525
push dword [esi + 8]
call dword [edi + 4]
add esp, 0xc
inc ebx
cmp ebx, dword [edi + 0x10]
jb 0x487120
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x487890
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push esi
sub esp, 0xc
mov dword [esp], 0
mov dword [esp + 4], 0
sub esp, 0x14
movaps xmm0, xmmword [0x9ad550]
movups xmmword [esp + 4], xmm0
lea eax, [esp + 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, 2
test eax, eax
je 0x48795e
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x8002
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x487965
mov esi, dword [esp + 0x18]
push dword [esp + 0x1c]
call fcn.00426230
add esp, 4
push 0
push eax
push esi
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
mov dword [esp + 8], 0
lea esi, [esp + 8]
push 0
push esi
push 0
push 2
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [esp + 8], 0x10
jne 0x48793d
push 0
push esi
push dword [esp + 0x1c]
push 2
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [esp + 4]
test eax, eax
je 0x48794c
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [esp]
test eax, eax
je 0x48795c
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor esi, esi
mov eax, esi
add esp, 0xc
pop esi
ret
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
add esp, 0xc
pop esi
ret
Function at 0x4991d0
Capabilities:
Parse credit card information

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 8]
mov ecx, eax
and ecx, 3
jmp dword [ecx*4 + 0x9b67a0]
Function at 0x4b3340
Capabilities:
Get hostname

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x18
mov esi, ecx
mov dword [esp], 0
test byte [ecx + 0x44], 1
jne 0x4b3385
mov dword [esi], 0x100
cmp dword [esi + 0x38], 0
jne 0x4b338b
mov dword [esi + 0x38], 0x4d0
cmp dword [esi + 4], 0
jne 0x4b3391
mov dword [esi + 4], 0x7d0
cmp dword [esi + 8], 0
jne 0x4b3397
mov dword [esi + 8], 3
jmp 0x4b3397
cmp dword [esi + 0x38], 0
je 0x4b3362
cmp dword [esi + 4], 0
je 0x4b336f
cmp dword [esi + 8], 0
je 0x4b337c
push dword [esi + 0x84]
call fcn.004bdd90
add esp, 4
test eax, eax
je 0x4b33f5
xor ebx, ebx
cmp dword [esi + 0x28], 0
je 0x4b3464
cmp dword [esi + 0x30], 0
je 0x4b34c9
xor eax, eax
cmp dword [esi + 0x34], 0
je 0x4b34dc
test byte [esi + 0x46], 0x80
jne 0x4b3502
mov word [esi + 0xd0], 0xa
mov dword [esi + 0xd4], 0x1388
test ebx, ebx
jne 0x4b3506
jmp 0x4b3516
mov eax, 0x1a
test byte [esi + 1], 2
jne 0x4b3516
mov dword [esp + 4], 2
push 0x7f000001
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [esp + 8], eax
lea eax, [esp + 4]
mov ecx, esp
push 0
push 0
push 0
push eax
push ecx
call fcn.004b9f80
add esp, 0x14
test eax, eax
jne 0x4b3516
push 0
push dword [esp + 4]
push esi
call fcn.004ba5d0
add esp, 0xc
mov edi, eax
push dword [esp]
call fcn.004bd5e0
add esp, 4
test edi, edi
je 0x4b33a9
mov eax, edi
jmp 0x4b3516
mov eax, dword [0xadb66c]
push 0x40
call dword [eax]
add esp, 4
test eax, eax
je 0x4b351e
mov edi, 0x40
mov ebp, 0x40
nop word cs:[eax + eax]
mov ebx, eax
push edi
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x4b3525
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x271e
jne 0x4b3529
add ebp, ebp
add edi, edi
push ebp
push ebx
mov eax, dword [0xadb670]
call dword [eax]
add esp, 8
test eax, eax
jne 0x4b3490
jmp 0x4b357e
mov dword [esi + 0x2c], 0
xor eax, eax
cmp dword [esi + 0x34], 0
jne 0x4b33cb
push 0x9bf804
call fcn.004c6290
add esp, 4
mov dword [esi + 0x34], eax
xor ecx, ecx
test eax, eax
mov eax, 0xf
cmovne eax, ecx
test byte [esi + 0x46], 0x80
je 0x4b33d5
test ebx, ebx
je 0x4b3516
mov ecx, dword [0xadb664]
push ebx
mov esi, eax
call dword [ecx]
mov eax, esi
add esp, 4
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, 0xf
jmp 0x4b3516
test eax, eax
je 0x4b352c
mov byte [ebx], 0
push 0x2e
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
test eax, eax
je 0x4b33b5
mov edi, eax
push 4
mov eax, dword [0xadb66c]
call dword [eax]
add esp, 4
mov ecx, eax
mov dword [esi + 0x24], eax
mov eax, 0xf
test ecx, ecx
je 0x4b3506
inc edi
push edi
call fcn.004c6290
add esp, 4
mov ecx, dword [esi + 0x24]
mov dword [ecx], eax
mov eax, dword [esi + 0x24]
cmp dword [eax], 0
je 0x4b357e
mov dword [esi + 0x28], 1
jmp 0x4b33b5
mov eax, 0xf
jmp 0x4b3506
Function at 0x4b48e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
mov ebp, dword [esp + 0x28]
mov ebx, dword [esp + 0x20]
mov edi, dword [ebx + 0x28]
push dword [edi + 0x84]
call fcn.004bdd90
add esp, 4
mov esi, eax
mov dword [esp + 4], edi
imul esi, dword [edi + 8]
push dword [ebx + 0x2c]
call fcn.004bddf0
add esp, 4
push dword [ebx + 0x30]
call fcn.004bd4b0
add esp, 4
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x38], 0
test ebp, ebp
je 0x4b494b
mov dword [ebx + 0x54], ebp
mov eax, dword [ebx + 0x48]
cmp dword [esp + 8], 0
je 0x4b4959
inc eax
mov dword [ebx + 0x48], eax
cmp eax, esi
jae 0x4b4967
cmp dword [ebx + 0x5c], 0
je 0x4b4a27
mov esi, dword [ebx + 0x54]
test esi, esi
jne 0x4b497a
mov dword [ebx + 0x54], 0xc
mov esi, 0xc
mov edi, dword [esp]
push edi
push esi
push 0
push ebx
call fcn.004cad10
add esp, 0x10
push edi
push dword [ebx + 0x58]
push esi
push dword [ebx + 0x44]
call dword [ebx + 0x40]
add esp, 0x10
push dword [ebx + 0x2c]
call fcn.004bddf0
add esp, 4
push dword [ebx + 0x30]
call fcn.004bd4b0
add esp, 4
mov dword [ebx + 0x2c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x38], 0
mov eax, dword [ebx + 0x28]
movzx ecx, word [ebx]
push ecx
push dword [eax + 0x90]
call fcn.004bd0e0
add esp, 8
push dword [ebx + 0x34]
call fcn.004bd4b0
add esp, 4
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
push dword [ebx + 0x3c]
call fcn.004c18c0
add esp, 4
mov eax, dword [0xadb664]
push ebx
call dword [eax]
add esp, 4
push dword [esp + 4]
call fcn.004c7270
add esp, 4
mov eax, 0xc
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
jmp fcn.004b4a40
Function at 0x4b6d40
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14c
mov ebp, dword [esp + 0x168]
mov esi, dword [esp + 0x164]
mov ecx, dword [esp + 0x160]
mov dword [esp + 8], 0
test ecx, ecx
sete al
test esi, esi
sete dl
or dl, al
test ebp, ebp
sete al
or al, dl
mov eax, 2
jne 0x4b6e2f
mov dword [ebp], 0
mov eax, 4
test byte [ecx], 0x40
jne 0x4b6e2f
push 0x2e
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
mov ecx, eax
mov eax, 4
test ecx, ecx
jne 0x4b6e2f
push str.HOSTALIASES
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
xor ebx, ebx
test eax, eax
je 0x4b6e07
mov edi, eax
mov dword [esp], 4
call fcn.004c4690
test eax, eax
je 0x4b6e10
push eax
push edi
mov ebx, eax
call fcn.004c61a0
add esp, 8
test eax, eax
jne 0x4b6e02
lea eax, [esp + 8]
push eax
push 0
push 0x30
push 1
push 0x9bf8e8
push ebx
call fcn.004c53b0
add esp, 0x18
test eax, eax
je 0x4b6e3a
mov dword [esp], eax
jmp 0x4b6e17
mov dword [esp], 4
jmp 0x4b6e17
mov dword [esp], 0xf
push ebx
call fcn.004c46f0
add esp, 4
push dword [esp + 8]
call fcn.004bd5e0
add esp, 4
mov eax, dword [esp]
add esp, 0x14c
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [esp + 4], ebx
push dword [esp + 8]
call fcn.004bd350
add esp, 4
test eax, eax
je 0x4b6fc1
mov edi, eax
jmp 0x4b6e69
push edi
call fcn.004bd3c0
add esp, 4
mov edi, eax
test eax, eax
je 0x4b6fc1
push edi
call fcn.004bd3e0
add esp, 4
mov ebx, eax
xorps xmm0, xmm0
movups xmmword [esp + 0x3c], xmm0
movups xmmword [esp + 0x2c], xmm0
movups xmmword [esp + 0x1c], xmm0
movups xmmword [esp + 0xc], xmm0
movups xmmword [esp + 0x13c], xmm0
movups xmmword [esp + 0x12c], xmm0
movups xmmword [esp + 0x11c], xmm0
movups xmmword [esp + 0x10c], xmm0
movups xmmword [esp + 0xfc], xmm0
movups xmmword [esp + 0xec], xmm0
movups xmmword [esp + 0xdc], xmm0
movups xmmword [esp + 0xcc], xmm0
movups xmmword [esp + 0xbc], xmm0
movups xmmword [esp + 0xac], xmm0
movups xmmword [esp + 0x9c], xmm0
movups xmmword [esp + 0x8c], xmm0
movups xmmword [esp + 0x7c], xmm0
movups xmmword [esp + 0x6c], xmm0
movups xmmword [esp + 0x5c], xmm0
movups xmmword [esp + 0x4c], xmm0
push eax
call fcn.004c4bf0
add esp, 4
push ebx
call fcn.004c51d0
add esp, 4
push 0x40
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.004c4d10
add esp, 0xc
test eax, eax
jne 0x4b6e56
push esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x4b6e56
push 1
push ebx
call fcn.004c5130
add esp, 8
push ebx
call fcn.004c4bf0
add esp, 4
push ebx
call fcn.004c51d0
add esp, 4
push 0x100
lea eax, [esp + 0x50]
push eax
push ebx
call fcn.004c4d10
add esp, 0xc
test eax, eax
jne 0x4b6e56
lea eax, [esp + 0x4c]
push eax
call fcn.004c6280
add esp, 4
test eax, eax
je 0x4b6e56
lea eax, [esp + 0x4c]
push eax
call fcn.004c6560
add esp, 4
test eax, eax
je 0x4b6e56
lea eax, [esp + 0x4c]
push eax
call fcn.004c6290
add esp, 4
mov dword [ebp], eax
xor ecx, ecx
test eax, eax
mov eax, 0xf
cmovne eax, ecx
mov dword [esp], eax
mov ebx, dword [esp + 4]
jmp 0x4b6e17
Function at 0x4b8550
Capabilities:
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x18]
push str.LOCALDOMAIN
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x4b860f
push eax
call fcn.004c6290
add esp, 4
mov esi, eax
mov eax, 0xf
test esi, esi
je 0x4b8642
mov eax, dword [edi + 0xc]
test eax, eax
je 0x4b85ac
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x4b85ac
push ecx
push eax
call fcn.004c6610
add esp, 8
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
lea ebx, [edi + 0x10]
push ebx
push 0x9bf9eb
push esi
call fcn.004c66e0
add esp, 0xc
mov dword [edi + 0xc], eax
test eax, eax
je 0x4b8632
cmp dword [ebx], 2
jb 0x4b8604
mov dword [esp], ebx
mov ebp, 1
mov ebx, dword [0xadb664]
nop dword [eax + eax]
mov eax, dword [edi + 0xc]
push dword [eax + ebp*4]
call dword [ebx]
add esp, 4
mov eax, dword [edi + 0xc]
mov dword [eax + ebp*4], 0
inc ebp
cmp ebp, dword [edi + 0x10]
jb 0x4b85e0
mov eax, dword [esp]
mov dword [eax], 1
mov eax, dword [0xadb664]
push esi
call dword [eax]
add esp, 4
push str.RES_OPTIONS
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x4b862e
push eax
push edi
call fcn.004b8270
add esp, 8
test eax, eax
jne 0x4b8642
xor eax, eax
jmp 0x4b8642
mov eax, dword [0xadb664]
push esi
call dword [eax]
add esp, 4
mov eax, 0xf
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4bbb10
Capabilities:
Check if file exists

Disassembly:
push esi
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
cmp eax, 0x17
je 0x4bbb3a
cmp eax, 2
jne 0x4bbb68
push 4
call fcn.004bb7e0
add esp, 4
mov esi, eax
cmp eax, 0xffffffff
jne 0x4bbb5e
jmp 0x4bbb4f
push 0x10
push edx
push ecx
push 0x17
call fcn.004bb2f0
add esp, 0x10
mov esi, eax
cmp eax, 0xffffffff
jne 0x4bbb5e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor eax, eax
cmp ecx, 2
je 0x4bbb66
sar esi, 0x1f
or esi, 1
mov eax, esi
pop esi
ret
push 0x273f
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 0xffffffff
pop esi
ret

Function at 0x4c61a0
Capabilities:
Check if file exists
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov dword [esp], 0
test ecx, ecx
sete al
test ebx, ebx
sete dl
or dl, al
mov eax, 2
jne 0x4c6217
push 0x9c0d6d
push ecx
call fcn.00786c50
add esp, 8
test eax, eax
je 0x4c61fe
mov esi, eax
push 2
push 0
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
mov ebp, 0xe
test eax, eax
je 0x4c621f
push esi
call fcn.00786c28
add esp, 4
mov eax, ebp
jmp 0x4c6217
call dword [sym.imp.KERNEL32.dll_GetLastError]
and eax, 0xfffffffe
cmp eax, 2
mov ecx, 4
mov eax, 0xe
cmove eax, ecx
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ftell
add esp, 4
test eax, eax
js 0x4c61f1
mov edi, eax
push 0
push 0
push esi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
add esp, 0xc
test eax, eax
jne 0x4c61f1
test edi, edi
je 0x4c626d
mov dword [esp], edi
mov eax, esp
push eax
push ebx
call fcn.004c4a40
add esp, 8
test eax, eax
je 0x4c6271
push esi
push edi
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
mov dword [esp], eax
cmp eax, edi
jne 0x4c61f1
add dword [ebx + 4], edi
xor ebp, ebp
jmp 0x4c61f1
mov ebp, 0xf
jmp 0x4c61f1

Function at 0x4c6ed0
Capabilities:
Create thread

Disassembly:
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
test ebx, ebx
sete al
test edi, edi
sete cl
or cl, al
mov eax, 2
jne 0x4c6f2a
push 0x14
call fcn.004b39d0
add esp, 4
test eax, eax
je 0x4c6f2e
mov esi, eax
mov eax, dword [esp + 0x18]
mov dword [esi + 8], ebx
mov dword [esi + 0xc], eax
mov eax, esi
add eax, 4
push eax
push 0
push esi
push 0x4c6f50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi], eax
test eax, eax
je 0x4c6f37
mov dword [edi], esi
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov eax, 0xf
pop esi
pop edi
pop ebx
ret
mov eax, dword [0xadb664]
push esi
call dword [eax]
add esp, 4
mov eax, 3
pop esi
pop edi
pop ebx
ret
Function at 0x4e27e0
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1004
call fcn.00787ee0
mov esi, dword [esp + 0x1018]
cmp dword [esp + 0x1020], 1
jne 0x4e2893
push 0x9dc464
push dword [esp + 0x1020]
call fcn.00786c50
add esp, 8
mov dword [esp], eax
test eax, eax
je 0x4e289c
lea eax, [esi + 4]
push eax
call fcn.004e34a0
add esp, 4
xor edi, edi
test eax, eax
je 0x4e28c5
mov ebp, eax
lea ebx, [esp + 8]
nop
mov dword [esp + 4], 0
mov ecx, esi
mov edx, ebp
push 1
lea eax, [esp + 8]
push eax
push 0xffc
push ebx
call fcn.004e2510
add esp, 0x10
test eax, eax
jne 0x4e28c3
mov edi, esi
mov esi, dword [esp + 4]
push dword [esp]
push esi
push 1
push ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp eax, esi
jne 0x4e28b2
push ebp
call fcn.004e34b0
add esp, 4
mov ebp, eax
test eax, eax
mov esi, edi
jne 0x4e2840
xor edi, edi
jmp 0x4e28c5
push str.Unsupported_type_of_known_host_information_store
push 0xffffffffffffffdf
jmp 0x4e28a3
push str.Failed_to_open_file
push 0xfffffffffffffff0
push dword [esi]
call fcn.004e2e90
add esp, 0x1010
jmp 0x4e28d8
push str.Write_failed
push 0xfffffffffffffff0
push dword [edi]
call fcn.004e2e90
add esp, 0xc
mov edi, eax
push dword [esp]
call fcn.00786c28
add esp, 4
mov eax, edi
add esp, 0x1004
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4e32a0
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov dword [eax], 0
test ebx, ebx
jne 0x4e32cc
push ebp
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ebx, eax
lea eax, [ebx*4]
mov ecx, 0xaaaaaaab
mul ecx
shr edx, 1
add edx, 4
push edi
push edx
call dword [edi + 4]
add esp, 8
test eax, eax
je 0x4e3399
mov dword [esp], eax
mov esi, eax
mov dword [esp + 4], ebx
test ebx, ebx
je 0x4e33ff
mov eax, dword [esp + 4]
lea ecx, [eax - 2]
mov dword [esp + 8], ecx
dec eax
mov dword [esp + 0xc], eax
xor ebx, ebx
mov esi, dword [esp]
nop word cs:[eax + eax]
movzx edx, byte [ebp + ebx]
cmp dword [esp + 0xc], ebx
je 0x4e33a0
movzx ecx, byte [ebp + ebx + 1]
cmp dword [esp + 8], ebx
je 0x4e33c2
mov eax, dword [esp + 0x28]
movzx ebp, byte [eax + ebx + 2]
mov edi, edx
shr edi, 2
shl edx, 4
and edx, 0x30
movzx eax, byte [edi + 0x9dcc8f]
mov byte [esi], al
mov eax, ecx
shr eax, 4
movzx eax, byte [eax + edx + 0x9dcc8f]
and ecx, 0xf
mov byte [esi + 1], al
mov eax, ebp
shr eax, 6
movzx eax, byte [eax + ecx*4 + 0x9dcc8f]
mov byte [esi + 2], al
and ebp, 0x3f
movzx eax, byte [ebp + 0x9dcc8f]
mov ebp, dword [esp + 0x28]
mov byte [esi + 3], al
add esi, 4
add ebx, 3
cmp dword [esp + 4], ebx
jne 0x4e3320
jmp 0x4e33ff
xor eax, eax
add esp, 0x10
jmp 0x4e3414
mov ecx, edx
shr ecx, 2
shl edx, 4
and edx, 0x30
movzx ecx, byte [ecx + 0x9dcc8f]
mov byte [esi], cl
movzx ecx, byte [edx + 0x9dcc8f]
mov byte [esi + 1], cl
mov cl, 0x3d
jmp 0x4e33f5
mov eax, edx
shr eax, 2
mov ebx, ecx
shr bl, 4
shl dl, 4
or dl, bl
and dl, 0x3f
and ecx, 0xf
movzx ebx, byte [eax + 0x9dcc8f]
mov byte [esi], bl
movzx edx, dl
movzx edx, byte [edx + 0x9dcc8f]
mov byte [esi + 1], dl
movzx ecx, byte [ecx*4 + 0x9dcc8f]
mov byte [esi + 2], cl
mov byte [esi + 3], 0x3d
add esi, 4
mov byte [esi], 0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp]
mov dword [eax], ecx
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4e8950
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x228
mov esi, dword [ebp + 8]
mov dword [esi + 0x170], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.004f47f0
add esp, 8
test eax, eax
jne 0x4e8ab2
mov eax, dword [esp + 4]
imul edx, eax, 0x3e8
mov ebx, dword [esi + 0x164]
test ebx, ebx
mov ecx, 0x3e8
cmovne ecx, edx
mov edx, dword [esi + 0x64]
test edx, edx
jle 0x4e89fe
test eax, eax
sete al
cmp ecx, edx
setg dl
or dl, al
cmp dl, 1
jne 0x4e89fe
mov edi, dword [ebp + 0x10]
push 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
add esp, 4
push edi
push dword [ebp + 0xc]
push edx
push eax
call sub.api_ms_win_crt_time_l1_1_0.dll__difftime64
add esp, 0x10
fstp qword [esp + 0x10]
movsd xmm0, qword [esp + 0x10]
mulsd xmm0, qword [0x9ddcb8]
cvttsd2si edx, xmm0
mov ecx, dword [esi + 0x64]
mov eax, str.API_timeout_expired
sub ecx, edx
jl 0x4e8aa6
mov dword [esp], 0
jmp 0x4e8a06
test ecx, ecx
setle al
mov dword [esp], eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
mov eax, edx
shr eax, 0x1f
sar edx, 6
add edx, eax
mov dword [esp + 8], edx
imul eax, edx, 0xfffffc18
add eax, ecx
imul eax, eax, 0x3e8
mov dword [esp + 0xc], eax
xor eax, eax
mov ecx, 0
test bl, 1
je 0x4e8a5a
mov ecx, dword [esi + 0x15c]
mov dword [esp + 0x124], ecx
mov dword [esp + 0x120], 1
lea ecx, [esp + 0x120]
mov edx, dword [esi + 0x15c]
test bl, 2
je 0x4e8a75
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], 1
lea eax, [esp + 0x1c]
inc edx
xor edi, edi
cmp byte [esp], 0
lea ebx, [esp + 8]
cmovne ebx, edi
push ebx
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x4e8aa1
mov eax, 0
jns 0x4e8ab2
mov eax, str.Error_waiting_on_socket
jmp 0x4e8aa6
mov eax, str.Timed_out_waiting_on_socket
push eax
push 0xfffffffffffffff7
push esi
call fcn.004e2e90
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4f2a70
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov esi, ecx
push 0x9df3f5
push dword [esp + 0x38]
call fcn.00786c50
add esp, 8
test eax, eax
je 0x4f2aaa
mov ebp, eax
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_feof
add esp, 4
test eax, eax
je 0x4f2ab1
push ebp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_rewind
add esp, 4
jmp 0x4f2afe
push str.Unable_to_open_public_key_file
jmp 0x4f2b0c
mov dword [esp + 8], edi
xor edi, edi
lea ebx, [esp + 3]
nop dword [eax + eax]
push ebp
push 1
push 1
push ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, 1
jne 0x4f2af0
movzx eax, byte [esp + 3]
cmp eax, 0xa
je 0x4f2af0
cmp eax, 0xd
je 0x4f2af0
inc edi
push ebp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_feof
add esp, 4
test eax, eax
je 0x4f2ac0
push ebp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_rewind
add esp, 4
cmp edi, 1
ja 0x4f2b1c
push ebp
call fcn.00786c28
add esp, 4
push str.Invalid_data_in_public_key_file
push 0xfffffffffffffff0
push esi
call fcn.004e2e90
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
push edi
call dword [esi + 4]
add esp, 8
test eax, eax
je 0x4f2b75
mov ebx, eax
push ebp
push edi
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, edi
jne 0x4f2b87
push ebp
call fcn.00786c28
add esp, 4
mov ebp, edi
neg ebp
dec edi
nop dword [eax]
movzx eax, byte [ebx + edi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
add esp, 4
test eax, eax
je 0x4f2ba2
dec edi
inc ebp
jne 0x4f2b50
push esi
push ebx
call dword [esi + 0xc]
add esp, 8
push str.Missing_public_key_data
jmp 0x4f2b0c
push ebp
call fcn.00786c28
add esp, 4
push str.Unable_to_allocate_memory_for_public_key_data
push 0xfffffffffffffffa
jmp 0x4f2b0e
push esi
push ebx
call dword [esi + 0xc]
add esp, 8
push ebp
call fcn.00786c28
add esp, 4
push str.Unable_to_read_public_key_from_file
jmp 0x4f2b0c
mov eax, ebp
neg eax
push eax
push 0x20
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_memchr
add esp, 0xc
test eax, eax
je 0x4f2c16
mov edi, ebx
sub edi, ebp
inc eax
mov ecx, ebx
sub ecx, eax
mov dword [esp + 4], ecx
mov ecx, eax
cmova ecx, ebx
mov edx, ebx
sub edx, ecx
sub edx, ebp
push edx
push 0x20
push eax
mov ebp, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memchr
add esp, 0xc
test eax, eax
cmovne edi, eax
sub edi, ebp
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push edi
push ebp
push eax
push ecx
push esi
call fcn.004e3120
add esp, 0x14
test eax, eax
je 0x4f2c28
push esi
push ebx
call dword [esi + 0xc]
add esp, 8
push str.Invalid_key_data__not_base64_encoded
push 0xfffffffffffffff0
push esi
call fcn.004e2e90
add esp, 0xc
jmp 0x4f2c51
push esi
push ebx
call dword [esi + 0xc]
add esp, 8
push str.Invalid_public_key_data
jmp 0x4f2b0c
mov ecx, dword [esp + 4]
neg ecx
mov eax, dword [esp + 8]
mov dword [eax], ebx
dec ecx
mov eax, dword [esp + 0x28]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
mov dword [ecx], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
xor eax, eax
add esp, 0x14
jmp 0x4f2b17