joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ae630
Capabilities:
Get socket status

Disassembly:
mov eax, dword [esp + 0x18]
test eax, eax
jl 0x4ae64f
jg 0x4ae646
mov ecx, dword [esp + 0x14]
cmp ecx, 0x7fffffff
jb 0x4ae653
mov ecx, accept
xor eax, eax
jmp 0x4ae653
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
test edx, edx
je 0x4ae66a
cmp dword [edx], 0
jne 0x4ae684
test edi, edi
je 0x4ae673
cmp dword [edi], 0
jne 0x4ae684
test esi, esi
je 0x4ae717
cmp dword [esi], 0
je 0x4ae717
push ebp
lea ebp, [esp + 0x20]
test eax, eax
jg 0x4ae6a1
jl 0x4ae693
test ecx, ecx
jae 0x4ae697
xor ebp, ebp
jmp 0x4ae6d6
test eax, eax
jl 0x4ae6ca
jg 0x4ae6a1
test ecx, ecx
jbe 0x4ae6ca
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [esp + 0x20], eax
imul eax, eax, 0x3e8
sub ecx, eax
imul ecx, ecx, 0x3e8
mov dword [esp + 0x24], ecx
jmp 0x4ae6d6
or ecx, eax
jne 0x4ae6d6
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
test esi, esi
je 0x4ae6e3
cmp dword [esi], 0
je 0x4ae6e3
mov edx, esi
jmp 0x4ae6e5
xor edx, edx
test edi, edi
je 0x4ae6f2
cmp dword [edi], 0
je 0x4ae6f2
mov ecx, edi
jmp 0x4ae6f4
xor ecx, ecx
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4ae701
cmp dword [eax], 0
jne 0x4ae703
xor eax, eax
push ebp
push edx
push ecx
push eax
mov eax, dword [esp + 0x20]
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
pop ebp
pop edi
pop esi
ret
push ecx
call fcn.004ae600
add esp, 4
pop edi
pop esi
ret

Function at 0x4b1340
Capabilities:
Set socket configuration

Disassembly:
sub esp, 8
push 0
push 0
lea eax, [esp + 0xc]
push eax
push 4
lea ecx, [esp + 0x10]
push ecx
push 0
push 0
push 0x4004747b
push esi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x4b137f
push 4
lea edx, [esp + 4]
push edx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
add esp, 8
ret
Function at 0x4b64d0
Capabilities:
Move file

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.00491d00
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ebx, dword [eax + 8]
mov ebp, dword [eax + 0xc]
add esp, 4
push 1
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x4b6577
lea eax, [esp + 0x10]
push eax
call fcn.00491d00
mov edx, dword [eax]
sub esp, 0xc
mov ecx, esp
mov dword [ecx], esi
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebp
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
call fcn.00491da0
add esp, 0x20
test edx, edx
jl 0x4b6581
jg 0x4b654c
test eax, eax
jb 0x4b6581
test edx, edx
jg 0x4b6581
jl 0x4b6559
cmp eax, 0x3e8
ja 0x4b6581
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x4b6505
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret

Function at 0x4b9890
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x4b98c3
push 0x2e
push esi
call dword [sym.imp.MSVCR90.dll_strchr]
add esp, 8
test eax, eax
je 0x4b98c1
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret
Function at 0x4bd800
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x618910]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4bd825
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x4bd86c
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x4bd870
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
mov dword [esp + 0x10], 0
test ebp, ebp
jbe 0x4bd8ce
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
inc ebx
call edx
add esp, 0x18
sub ebp, 1
jne 0x4bd893
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
cmp eax, dword [esi + 0x10]
jae 0x4bd911
lea esp, [esp]
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x5b80cc
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x5b80cd
push eax
call ecx
mov eax, dword [esp + 0x20]
inc eax
add esp, 0x18
mov dword [esp + 8], eax
cmp eax, dword [esi + 0x10]
jb 0x4bd8e0
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x4c0130
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.0058ee00
mov eax, dword [0x6204e0]
xor eax, esp
mov dword [esp + 0x470], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [esp + 0x3c], 0
test eax, eax
jne 0x4c0177
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.0058ecc6
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x4c0160
push 0x5ae3a0
push eax
call fcn.004d6a90
mov esi, eax
add esp, 8
mov dword [esp + 0x40], esi
test esi, esi
je 0x4c0294
push 0x30
lea eax, [esp + 0x4c]
push 0
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [esp + 0x48]
push ecx
push esi
call sub.MSVCR90.dll__fileno
add esp, 4
push eax
call sub.MSVCR90.dll__fstat64i32
add esp, 8
test eax, eax
jl 0x4c028b
mov eax, 8
call fcn.0058ee00
fldz
fstp qword [esp]
lea edx, [esp + 0x50]
push 0x30
push edx
call fcn.004c00b0
add esp, 0x10
test dword [esp + 0x4e], 0x2000
je 0x4c0214
cmp edi, 0xffffffff
jne 0x4c01fc
mov edi, 0x800
push 0
push esi
call sub.MSVCR90.dll_setbuf
add esp, 8
jmp 0x4c0214
mov esi, dword [esp + 0x40]
test edi, edi
jle 0x4c0222
cmp edi, 0x400
mov ebx, edi
jl 0x4c0227
mov ebx, 0x400
push esi
push ebx
lea eax, [esp + 0x80]
push 1
push eax
call sub.MSVCR90.dll_fread
mov esi, eax
add esp, 0x10
mov dword [esp + 0x44], esi
test esi, esi
jle 0x4c0275
fild dword [esp + 0x44]
mov eax, 8
call fcn.0058ee00
lea ecx, [esp + 0x80]
fstp qword [esp]
push esi
push ecx
call fcn.004c00b0
add dword [esp + 0x4c], esi
add esp, 0x10
test edi, edi
jle 0x4c0210
sub edi, ebx
test edi, edi
jg 0x4c0210
lea edx, [esp + 0x78]
push 0x400
push edx
call fcn.004d6a70
mov esi, dword [esp + 0x48]
add esp, 8
push esi
call sub.MSVCR90.dll_fclose
add esp, 4
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0058ecc6
mov esp, ebp
pop ebp
ret
Function at 0x4c02b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.0058ee00
mov eax, dword [0x6204e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push esi
push edi
push 0
push 0
mov edi, str.RANDFILE
push edi
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 1
call ebx
mov esi, eax
test esi, esi
jne 0x4c0323
push eax
push eax
mov edi, str.HOME
push edi
mov dword [ebp - 0xc], eax
call ebx
mov esi, eax
test esi, esi
jne 0x4c0323
push eax
push eax
mov edi, str.USERPROFILE
push edi
call ebx
mov esi, eax
test esi, esi
jne 0x4c0323
push eax
push eax
mov edi, str.SYSTEMROOT
push edi
call ebx
mov esi, eax
test esi, esi
je 0x4c038c
lea eax, [esi + esi]
call fcn.0058ef20
mov eax, esp
push esi
push eax
push edi
mov dword [ebp - 0x10], eax
call ebx
cmp eax, esi
jae 0x4c037f
mov eax, dword [ebp - 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push eax
push 0
push 0xfde9
call ebx
mov esi, eax
test esi, esi
je 0x4c037f
call fcn.0058ef20
mov ecx, dword [ebp - 0x10]
mov edi, esp
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push ecx
push 0
push 0xfde9
call ebx
test eax, eax
jne 0x4c0382
mov dword [ebp - 8], eax
mov edi, dword [ebp - 8]
cmp dword [ebp - 0xc], 0
jne 0x4c0398
test edi, edi
jne 0x4c039c
mov dword [ebp - 8], 0x5b86a0
mov edi, dword [ebp - 8]
jmp 0x4c03a1
test edi, edi
je 0x4c0416
cmp byte [edi], 0
je 0x4c0416
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c03a6
mov esi, dword [ebp + 0xc]
sub eax, edx
cmp dword [ebp - 0xc], 0
je 0x4c03e7
lea edx, [eax + 1]
cmp edx, esi
jae 0x4c03e7
mov eax, dword [ebp + 8]
push esi
push edi
push eax
call fcn.004d53c0
add esp, 0xc
cmp eax, esi
jb 0x4c041c
xor eax, eax
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058ecc6
mov esp, ebp
pop ebp
ret
add eax, 6
cmp eax, esi
jae 0x4c041c
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.004d53c0
push esi
push 0x5a1164
push edi
call fcn.004d5400
push esi
push str..rnd
push edi
call fcn.004d5400
add esp, 0x24
jmp 0x4c041c
mov ecx, dword [ebp + 8]
mov byte [ecx], 0
mov ecx, dword [ebp + 8]
movsx eax, byte [ecx]
neg eax
sbb eax, eax
and eax, ecx
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058ecc6
mov esp, ebp
pop ebp
ret
Function at 0x4c3180
Capabilities:
Query environment variable

Disassembly:
push str.OPENSSL_CONF
call sub.MSVCR90.dll_getenv
add esp, 4
test eax, eax
je 0x4c31a5
push 0x1e3
push str.....openssl_1.1.0fcryptoconfconf_mod.c
push eax
call fcn.004d52f0
add esp, 0xc
ret
call fcn.004da160
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4c31b0
push esi
push edi
sub eax, edx
push 0x1eb
lea edi, [eax + 0xd]
push str.....openssl_1.1.0fcryptoconfconf_mod.c
push edi
call fcn.004c4840
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4c31da
pop edi
pop esi
ret
push edi
call fcn.004da160
push eax
push esi
call fcn.004d53c0
push edi
push 0x5a1164
push esi
call fcn.004d5400
push edi
push str.openssl.cnf
push esi
call fcn.004d5400
add esp, 0x24
pop edi
mov eax, esi
pop esi
ret
Function at 0x4c40d0
Capabilities:
Query environment variable

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x4c40f5
push 0x11f
push str.....openssl_1.1.0fcryptoengineeng_list.c
push 0x43
push 0x6a
push 0x26
call fcn.004bf2b0
add esp, 0x14
xor eax, eax
pop ebx
ret
push 0x4c3da0
push 0x6229a4
call fcn.004d5210
add esp, 8
neg eax
sbb eax, eax
test dword [0x6229a8], eax
jne 0x4c412f
push 0x123
push str.....openssl_1.1.0fcryptoengineeng_list.c
push 0x41
push 0x6a
push 0x26
call fcn.004bf2b0
add esp, 0x14
xor eax, eax
pop ebx
ret
mov eax, dword [0x624688]
push esi
push eax
call fcn.004d5190
mov eax, dword [0x6229b4]
add esp, 4
mov esi, eax
test eax, eax
je 0x4c41ab
lea esp, [esp]
mov ecx, dword [esi]
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4c4174
test dl, dl
je 0x4c4170
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4c4174
add eax, 2
add ecx, 2
test dl, dl
jne 0x4c4154
xor eax, eax
jmp 0x4c4179
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4c4186
mov esi, dword [esi + 0x60]
test esi, esi
jne 0x4c4150
jmp 0x4c41ab
test byte [esi + 0x4c], 4
je 0x4c41a8
call fcn.004c3dd0
mov ecx, eax
test ecx, ecx
jne 0x4c419b
xor esi, esi
jmp 0x4c41ab
push esi
call fcn.004c4060
add esp, 4
mov esi, ecx
jmp 0x4c41ab
inc dword [esi + 0x50]
mov ecx, dword [0x624688]
push ecx
call fcn.004d51c0
add esp, 4
test esi, esi
je 0x4c41c3
mov eax, esi
pop esi
pop ebx
ret
mov ecx, str.dynamic
mov eax, ebx
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4c41f0
test dl, dl
je 0x4c41ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4c41f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4c41d0
xor eax, eax
jmp 0x4c41f5
sbb eax, eax
sbb eax, 0xffffffff
push edi
test eax, eax
je 0x4c42a1
push str.OPENSSL_ENGINES
call sub.MSVCR90.dll_getenv
mov edi, eax
add esp, 4
test edi, edi
jne 0x4c4216
mov edi, str.D:opensourceopenssl_dist_1.1.0f_vs2008openssl_x86_static_release_vs2008libengines_1_1
push str.dynamic
call fcn.004c40d0
mov esi, eax
add esp, 4
test esi, esi
je 0x4c42a1
push 0
push ebx
push 0x5b8bdc
push esi
call fcn.004cf6c0
add esp, 0x10
test eax, eax
je 0x4c42a1
push 0
push 0x5b8bd8
push str.DIR_LOAD
push esi
call fcn.004cf6c0
add esp, 0x10
test eax, eax
je 0x4c42a1
push 0
push edi
push str.DIR_ADD
push esi
call fcn.004cf6c0
add esp, 0x10
test eax, eax
je 0x4c42a1
push 0
push 0x59fc74
push str.LIST_ADD
push esi
call fcn.004cf6c0
add esp, 0x10
test eax, eax
je 0x4c42a1
push 0
push 0
push str.LOAD
push esi
call fcn.004cf6c0
add esp, 0x10
test eax, eax
je 0x4c42a1
pop edi
mov eax, esi
pop esi
pop ebx
ret
push esi
call fcn.004c3ad0
push 0x153
push str.....openssl_1.1.0fcryptoengineeng_list.c
push 0x74
push 0x6a
push 0x26
call fcn.004bf2b0
push ebx
push 0x5b8bac
push 2
call fcn.004bf5b0
add esp, 0x24
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x4cd890
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
push ebx
call fcn.004d6a90
push 0x62
push esi
mov edi, eax
mov ebp, 1
call sub.MSVCR90.dll_strchr
add esp, 0x10
test eax, eax
jne 0x4cd8bc
lea ebp, [eax + 0x11]
test edi, edi
jne 0x4cd945
push 0x4a
push str.....openssl_1.1.0fcrypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.004bf2b0
push 0x5bacac
push esi
push 0x5baca8
push ebx
push str.fopen_
push 5
call fcn.004bf5b0
add esp, 0x2c
call sub.MSVCR90.dll__errno
cmp dword [eax], 2
je 0x4cd926
call sub.MSVCR90.dll__errno
cmp dword [eax], 6
je 0x4cd926
push 0x53
push str.....openssl_1.1.0fcrypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.004bf2b0
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x51
push str.....openssl_1.1.0fcrypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.004bf2b0
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x5bac40
call fcn.004c1390
mov esi, eax
add esp, 4
test esi, esi
jne 0x4cd968
push edi
call sub.MSVCR90.dll_fclose
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.004c1560
push edi
push ebp
push 0x6a
push esi
call fcn.004c18e0
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x4d1e00
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
pop esi
ret
Function at 0x4d32f0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret
Function at 0x4d4f00
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x4d4f47
mov al, byte [edx]
test al, al
je 0x4d4f47
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x4d4f17
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4da630
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x208
call fcn.0058ee00
mov eax, dword [0x6204e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x4da6a5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4da6a5
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x204]
push 0x200
push edx
call sub.MSVCR90.dll__vsnprintf
add esp, 0x10
test eax, eax
jge 0x4da688
mov eax, 0x200
push 0
lea ecx, [ebp - 0x208]
push ecx
push eax
lea edx, [ebp - 0x204]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4da7ee
mov ebx, dword [ebp + 8]
mov eax, ebx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4da6b0
sub eax, edx
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.0058ef20
mov esi, esp
test esi, esi
jne 0x4da6d4
mov esi, str.no_stack_
jmp 0x4da75f
push edi
push esi
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x4da701
test edi, edi
jbe 0x4da701
lea ebx, [ebx]
mov ecx, dword [ebp + 8]
movsx dx, byte [eax + ecx]
mov word [esi + eax*2], dx
inc eax
cmp eax, edi
jb 0x4da6f0
xor eax, eax
test edi, edi
jbe 0x4da75f
cmp word [esi + eax*2], 0x25
jne case.0x4da724.43
lea ecx, [esi + eax*2 + 2]
movzx edx, word [ecx]
add edx, 0xffffffd6
cmp edx, 0x49
ja case.0x4da724.43
movzx edx, byte [edx + 0x4da820]
jmp dword [edx*4 + 0x4da808]
inc eax
add ecx, 2
jmp 0x4da712
mov ecx, 0x53
mov word [esi + eax*2 + 2], cx
jmp case.0x4da724.43
mov edx, 0x73
jmp 0x4da755
mov ecx, 0x43
mov word [esi + eax*2 + 2], cx
jmp case.0x4da724.43
mov edx, 0x63
mov word [esi + eax*2 + 2], dx
inc eax
cmp eax, edi
jb 0x4da707
lea eax, [ebp + 0xc]
push eax
push esi
lea ecx, [ebp - 0x204]
push 0xff
push ecx
call sub.MSVCR90.dll__vsnwprintf
xor edx, edx
add esp, 0x10
mov word [ebp - 6], dx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4da7d8
call fcn.004da4f0
test eax, eax
jle 0x4da7d8
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x4da7ee
push 0
lea ecx, [ebp - 0x208]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x204]
push esi
mov dword [ebp - 0x208], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x4da7ee
push 0x10
push str.OpenSSL:_FATAL
lea edx, [ebp - 0x204]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0058ecc6
mov esp, ebp
pop ebp
ret

Function at 0x4da8a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
xor cl, cl
test edi, edi
jbe 0x4da8c7
sub esi, eax
push ebx
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
or cl, dl
inc eax
sub edi, 1
jne 0x4da8b7
pop ebx
pop edi
movzx eax, cl
pop esi
ret
Function at 0x4de960
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
movzx edi, byte [esp + 0x10]
mov eax, edi
and eax, 1
add esi, ecx
add edx, ecx
test ecx, ecx
je 0x4de995
push ebx
lea esp, [esp]
movzx ebx, byte [edx - 1]
dec edx
xor ebx, edi
add eax, ebx
dec esi
dec ecx
mov byte [esi], al
shr eax, 8
test ecx, ecx
jne 0x4de980
pop ebx
pop edi
pop esi
ret
Function at 0x4f1af0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, edi
mov ecx, ebp
cmp edi, 4
jb 0x4f1b18
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x4f1b1c
sub esi, 4
add ecx, 4
add edx, 4
cmp esi, 4
jae 0x4f1b04
test esi, esi
je 0x4f1b76
movzx eax, byte [edx]
movzx ebx, byte [ecx]
sub eax, ebx
jne 0x4f1b57
cmp esi, 1
jbe 0x4f1b76
movzx eax, byte [edx + 1]
movzx ebx, byte [ecx + 1]
sub eax, ebx
jne 0x4f1b57
cmp esi, 2
jbe 0x4f1b76
movzx eax, byte [edx + 2]
movzx ebx, byte [ecx + 2]
sub eax, ebx
jne 0x4f1b57
cmp esi, 3
jbe 0x4f1b76
movzx eax, byte [edx + 3]
movzx ecx, byte [ecx + 3]
sub eax, ecx
sar eax, 0x1f
or eax, 1
jle 0x4f1b76
push 0x157
push str.....openssl_1.1.0fcryptox509v3_v3_addr.c
push str.assertion_failed:_memcmp_min__max__length____0
call fcn.004da870
add esp, 0xc
mov ebx, dword [esp + 0x10]
xor edx, edx
test edi, edi
jle 0x4f1b93
mov esi, ebx
mov eax, ebp
sub esi, ebp
mov cl, byte [esi + eax]
cmp cl, byte [eax]
jne 0x4f1b93
inc edx
inc eax
cmp edx, edi
jl 0x4f1b86
lea eax, [edi - 1]
test eax, eax
jl 0x4f1bb2
mov esi, ebx
lea ecx, [eax + ebp]
sub esi, ebp
cmp byte [ecx + esi], 0
jne 0x4f1bb2
cmp byte [ecx], 0xff
jne 0x4f1bb2
dec eax
dec ecx
test eax, eax
jge 0x4f1ba1
cmp edx, eax
jl case.0x4f1be1.2
jle 0x4f1bc3
pop esi
pop ebp
lea eax, [edx*8]
pop ebx
ret
mov cl, byte [edx + ebx]
mov bl, byte [edx + ebp]
mov al, bl
xor al, cl
mov byte [esp + 0x10], cl
movzx ecx, al
dec ecx
cmp ecx, 0x7e
ja case.0x4f1be1.2
movzx ecx, byte [ecx + 0x4f1c54]
jmp dword [ecx*4 + 0x4f1c34]
mov esi, 7
jmp 0x4f1c17
mov esi, 6
jmp 0x4f1c17
mov esi, 5
jmp 0x4f1c17
mov esi, 4
jmp 0x4f1c17
mov esi, 3
jmp 0x4f1c17
mov esi, 2
jmp 0x4f1c17
mov esi, 1
test byte [esp + 0x10], al
jne case.0x4f1be1.2
and bl, al
cmp bl, al
jne case.0x4f1be1.2
lea eax, [esi + edx*8]
pop esi
pop ebp
pop ebx
ret
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret

Function at 0x4f78c0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret