joyce8/EMBER2024-capa huggingface dataset:
Function at 0x484bc0
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x338
mov eax, dword [0x595978]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
push edi
mov edi, eax
mov esi, 1
and edi, esi
mov dword [ebp - 0x338], ecx
mov dword [ecx + 0x191b8], ebx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x320], ebx
mov dword [ebp - 0x324], ebx
je 0x484c13
lea ebx, [ebp - 0x31c]
mov dword [ebp - 0x318], ecx
mov dword [ebp - 0x31c], esi
mov edx, eax
and edx, 2
mov dword [ebp - 0x334], edx
je 0x484c38
lea edx, [ebp - 0x218]
mov dword [ebp - 0x324], edx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x218], esi
and eax, 4
mov dword [ebp - 0x330], eax
je 0x484c5b
lea eax, [ebp - 0x114]
mov dword [ebp - 0x320], eax
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x114], esi
mov esi, dword [ebp + 0x10]
test esi, esi
js 0x484c74
mov dword [ebp - 0x32c], esi
mov dword [ebp - 0x328], 0
jmp 0x484c9d
mov eax, 0xbce4217d
imul esi
sar edx, 0x12
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 0x32c], eax
mov eax, esi
neg eax
cdq
mov esi, 0xf4240
idiv esi
mov dword [ebp - 0x328], edx
mov eax, dword [ebp - 0x320]
lea edx, [ebp - 0x32c]
push edx
mov edx, dword [ebp - 0x324]
push eax
push edx
push ebx
inc ecx
push ecx
call dword [sym.imp.WS2_32.dll_select]
mov esi, eax
test esi, esi
jle 0x484d29
xor esi, esi
test edi, edi
mov edi, dword [sym.imp.WS2_32.dll___WSAFDIsSet]
je 0x484cdf
push ebx
mov ebx, dword [ebp + 8]
push ebx
call edi
test eax, eax
je 0x484ce2
mov esi, 1
jmp 0x484ce2
mov ebx, dword [ebp + 8]
cmp dword [ebp - 0x334], 0
je 0x484cfc
mov eax, dword [ebp - 0x324]
push eax
push ebx
call edi
test eax, eax
je 0x484cfc
or esi, 2
cmp dword [ebp - 0x330], 0
je 0x484d3d
mov ecx, dword [ebp - 0x320]
push ecx
push ebx
call edi
test eax, eax
je 0x484d3d
or esi, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0049cc86
mov esp, ebp
pop ebp
ret
jns 0x484d3d
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [ebp - 0x338]
mov dword [edx + 0x191b8], eax
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049cc86
mov esp, ebp
pop ebp
ret
Function at 0x492240
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
push edi
mov ebx, ecx
test esi, esi
jne 0x492281
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
add ecx, 2
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
lea eax, [eax*4 + 1]
call fcn.00487650
mov esi, eax
test esi, esi
jne 0x492281
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], esi
mov byte [esi], 0
test ebx, ebx
jne 0x492294
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp + 0xc]
cmp edi, 2
jle 0x492301
lea ecx, [edi - 3]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
inc edx
lea eax, [edx*4]
sub eax, edx
neg eax
mov dword [ebp - 4], edx
add edi, eax
lea esp, [esp]
movzx eax, byte [ebx]
movzx ecx, byte [ebx + 1]
movzx edx, byte [ebx + 2]
shl eax, 8
or eax, ecx
shl eax, 8
or eax, edx
mov ecx, 4
lea ebx, [ebx]
mov edx, eax
and edx, 0x3f
mov dl, byte [edx + 0x57db00]
dec ecx
shr eax, 6
mov byte [ecx + esi], dl
test ecx, ecx
jg 0x4922e0
add esi, 4
add ebx, 3
dec dword [ebp - 4]
jne 0x4922c0
mov byte [esi], 0
test edi, edi
jle 0x49236d
xor ecx, ecx
xor eax, eax
test edi, edi
jle 0x492328
mov dword [ebp - 4], edi
mov eax, edi
movzx edx, byte [ebx]
shl ecx, 8
or ecx, edx
inc ebx
dec dword [ebp - 4]
jne 0x492315
cmp edi, 3
jge 0x492337
mov edx, 3
sub edx, eax
add eax, edx
shl ecx, 8
dec edx
jne 0x492331
inc eax
test eax, eax
jle 0x492356
lea esp, [esp]
mov edx, ecx
and edx, 0x3f
mov dl, byte [edx + 0x57db00]
dec eax
shr ecx, 6
mov byte [eax + esi], dl
test eax, eax
jg 0x492340
mov eax, 3
cmp edi, eax
jge 0x492369
nop
mov byte [eax + esi], 0x3d
dec eax
cmp eax, edi
jg 0x492360
mov byte [esi + 4], 0
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x495d20
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x547f77
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x595978]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [edi], 0x57a540
mov dword [edi + 0x10], 0x578c20
mov dword [edi + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 0x18]
push esi
mov dword [ebp - 4], ebx
push edi
mov dword [ebp - 0x10], 1
call fcn.00424c30
mov dword [ebp - 4], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
mov dword [edi + ecx], vtable.std::basic_fstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.00410fa0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], bl
mov byte [esi + 0x49], bl
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x54], ebx
mov edx, dword [0x5b072c]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ebx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x497b90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x541f70
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x595978]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
push 0x54d56c
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
mov dword [esi], vtable.std::codecvt_wchar_t__char__int_.0
call fcn.004010f0
mov byte [esp + 0x38], 1
call fcn.00496486
lea ecx, [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esp + 0x38], 0
call fcn.004011a0
mov dword [esi], vtable.windows_file_codecvt.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x49a880
Capabilities:
Delete directory
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x542610
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x595978]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x595978]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x60]
mov esi, dword [esp + 0x5c]
mov edi, dword [esp + 0x64]
cmp eax, 1
jne 0x49a8db
test edi, edi
je 0x49a8d4
mov dword [edi], 0
call fcn.0049be80
mov dword [edi + 4], eax
xor al, al
jmp 0x49a9da
cmp eax, 3
je 0x49a964
cmp eax, 0xb
je 0x49a964
push 0x19
push str.boost::filesystem::remove
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.00410af0
cmp dword [esi + 0x14], 8
mov dword [esp + 0x54], 1
jb 0x49a920
mov eax, dword [esi]
jmp 0x49a922
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
test al, al
lea ecx, [esp + 0x10]
push ecx
sete dl
push edi
movzx eax, dl
push esi
push eax
call fcn.0049a740
add esp, 0x10
cmp dword [esp + 0x24], 0x10
mov bl, al
jb 0x49a95c
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0049cf83
add esp, 4
test bl, bl
je 0x49a9d8
xor al, al
jmp 0x49a9da
push 0x19
xor ebx, ebx
push str.boost::filesystem::remove
lea ecx, [esp + 0x34]
mov dword [esp + 0x48], 0xf
mov dword [esp + 0x44], ebx
mov byte [esp + 0x34], bl
call fcn.00410af0
cmp dword [esi + 0x14], 8
mov dword [esp + 0x54], ebx
jb 0x49a994
mov eax, dword [esi]
jmp 0x49a996
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
lea edx, [esp + 0x2c]
push edx
test al, al
sete al
push edi
movzx ecx, al
push esi
push ecx
call fcn.0049a740
add esp, 0x10
cmp dword [esp + 0x40], 0x10
mov bl, al
jb 0x49a9d0
mov edx, dword [esp + 0x2c]
push edx
call fcn.0049cf83
add esp, 4
test bl, bl
jne 0x49a8d4
mov al, 1
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.0049cc86
add esp, 0x48
ret

Function at 0x49ab20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
cmp dword [ebx + 0x14], 8
push edi
jb 0x49ab33
mov eax, dword [ebx]
jmp 0x49ab35
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x49ab5e
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0xc]
push ebx
push ecx
call fcn.0049aa00
mov eax, dword [eax]
add esp, 0xc
pop edi
pop ebx
add esp, 8
ret
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x49ab75
mov dword [esi], 0
call fcn.0049be80
mov dword [esi + 4], eax
pop esi
test edi, 0x400
je 0x49abae
push ebx
call fcn.00499650
add esp, 4
test al, al
je 0x49aba3
mov edx, edi
and dl, 0x10
movzx eax, dl
neg eax
sbb eax, eax
and eax, 7
pop edi
add eax, 4
pop ebx
add esp, 8
ret
pop edi
mov eax, 9
pop ebx
add esp, 8
ret
mov eax, edi
and eax, 0x10
or eax, 0x20
pop edi
shr eax, 4
pop ebx
add esp, 8
ret
Function at 0x49ae40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x5426c0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x595978]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x595978]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, dword [esp + 0x54]
cmp dword [edi + 0x14], 8
mov esi, dword [esp + 0x58]
mov ebp, dword [esp + 0x50]
mov dword [esp + 0x1c], esi
jb 0x49ae8c
mov eax, dword [edi]
jmp 0x49ae8e
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x49aeac
push esi
push edi
push ebp
call fcn.0049aa00
add esp, 0xc
jmp 0x49afff
test ebx, 0x400
je 0x49afbb
cmp dword [edi + 0x14], 8
jb 0x49aec2
mov edx, dword [edi]
jmp 0x49aec4
mov edx, edi
xor eax, eax
mov word [esp + 0x20], ax
mov eax, edx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49aee0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x28]
call fcn.0040d980
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
mov dword [esp + 0x48], 0
jae 0x49af11
lea eax, [esp + 0x20]
push 0
push 0x2000000
push 3
push 0
push 7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x14], esi
cmp dword [esp + 0x34], 8
mov byte [esp + 0x48], 2
jb 0x49af46
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0049cf83
add esp, 4
xor edx, edx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], dx
cmp esi, 0xffffffff
jne 0x49af76
mov eax, dword [esp + 0x1c]
push eax
push edi
push ebp
call fcn.0049aa00
add esp, 0xc
jmp 0x49afff
push edi
call fcn.00499650
add esp, 4
test al, al
jne 0x49afa8
push ebx
push edi
call fcn.00499a40
add esp, 8
push esi
mov dword [ebp], 9
mov dword [ebp + 4], eax
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x49afff
push esi
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x49afcd
mov dword [esi], 0
call fcn.0049be80
mov dword [esi + 4], eax
push ebx
push edi
mov dword [esp + 0x1c], 3
test bl, 0x10
jne 0x49afe4
mov dword [esp + 0x1c], 2
call fcn.00499a40
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
add esp, 8
mov dword [ebp], ecx
mov dword [ebp + 4], edx
mov eax, ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0049cc86
add esp, 0x38
ret
Function at 0x49b2e0
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x542758
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x595978]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x595978]
xor eax, esp
push eax
lea eax, [esp + 0x7c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x8c]
cmp dword [edi + 0x14], 8
mov esi, dword [esp + 0x90]
jb 0x49b32a
mov eax, dword [edi]
jmp 0x49b32c
mov eax, edi
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x49b34f
cmp esi, ebx
je 0x49b348
mov dword [esi], ebx
call fcn.0049be80
mov dword [esi + 4], eax
mov al, 1
jmp 0x49b3f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov dword [esp + 0x14], ebx
call fcn.0049be80
mov dword [esp + 0x18], eax
cmp ebp, 0xb7
jne 0x49b39a
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push edi
push ecx
call fcn.0049ae40
mov ecx, dword [eax]
mov edx, dword [eax + 4]
add esp, 0xc
mov dword [esp + 0x20], edx
cmp ecx, 3
jne 0x49b39a
cmp esi, ebx
je 0x49b3f4
mov dword [esi], ebx
call fcn.0049be80
jmp 0x49b3f1
cmp esi, ebx
jne 0x49b3ea
push 0x23
push str.boost::filesystem::create_directory
lea ecx, [esp + 0x2c]
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
call fcn.00410af0
mov dword [esp + 0x84], ebx
call fcn.0049be80
push eax
push ebp
push edi
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x50]
call fcn.0049a590
push 0x58a1c8
lea ecx, [esp + 0x44]
push ecx
call fcn.004a60bb
call fcn.0049be80
mov dword [esi], ebp
mov dword [esi + 4], eax
xor al, al
mov ecx, dword [esp + 0x7c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0049cc86
add esp, 0x74
ret

Function at 0x49cc86
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x595978]
jne 0x49cc90
repz ret
jmp fcn.004a731b
Function at 0x4b588c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x595978]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004a7b81
and dword [ebp - 0x14], 0
cmp dword [0x5ae748], 0
mov dword [ebp - 0x18], eax
jne 0x4b593f
push 0x5509d0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4b59e7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4b59e7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x5ae748], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x5ae74c], eax
call edi
push eax
call esi
push 0x550984
push ebx
mov dword [0x5ae750], eax
call edi
push eax
call esi
mov dword [0x5ae758], eax
test eax, eax
je 0x4b593f
push 0x55096c
push ebx
call edi
push eax
call esi
mov dword [0x5ae754], eax
mov eax, dword [0x5ae754]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4b5998
cmp dword [0x5ae758], ecx
je 0x4b5998
push eax
call esi
push dword [0x5ae758]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4b5998
test ebx, ebx
je 0x4b5998
call edi
test eax, eax
je 0x4b598f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4b598f
test byte [ebp - 8], 1
jne 0x4b5998
or dword [ebp + 0x10], 0x200000
jmp 0x4b59cb
mov eax, dword [0x5ae74c]
cmp eax, dword [ebp - 0x18]
je 0x4b59cb
push eax
call esi
test eax, eax
je 0x4b59cb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4b59cb
mov eax, dword [0x5ae750]
cmp eax, dword [ebp - 0x18]
je 0x4b59cb
push eax
call esi
test eax, eax
je 0x4b59cb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x5ae748]
call esi
test eax, eax
je 0x4b59e7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4b59e9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049cc86
leave
ret
Function at 0x4c0350
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push ebx
call fcn.004a16c4
mov edi, eax
add esp, 8
test edi, edi
jne 0x4c03e6
push 0x7e
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.004c0430
push 0x556638
push esi
push 0x556634
push ebx
push str.fopen_
push 5
call fcn.004c0590
add esp, 0x2c
call fcn.004a2bdc
cmp dword [eax], 2
jne 0x4c03c8
push 0x81
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.004c0430
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x83
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.004c0430
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x59fd64
call fcn.004ba960
mov esi, eax
add esp, 4
test esi, esi
jne 0x4c0408
push edi
call fcn.0049f074
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.004ba3d0
push edi
push 1
push 0x6a
push esi
call fcn.004ba6e0
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4c2300
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.004a72f0
mov eax, dword [0x595978]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x3c], 0
test esi, esi
jne 0x4c2347
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.0049cc86
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call fcn.0053d82d
add esp, 8
test eax, eax
js 0x4c2330
mov eax, 8
call fcn.004a72f0
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.004b9850
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x4c2330
push 0x57be5c
push esi
call fcn.004a16c4
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
je 0x4c2421
jmp 0x4c23a4
mov eax, dword [esp + 0x40]
test ebx, ebx
jle 0x4c23b2
mov esi, ebx
cmp ebx, 0x400
jl 0x4c23b7
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x80]
push 1
push edx
call fcn.004a19ae
mov edi, eax
add esp, 0x10
mov dword [esp + 0x44], edi
test edi, edi
jle 0x4c2405
fild dword [esp + 0x44]
mov eax, 8
call fcn.004a72f0
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.004b9850
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x4c23a0
sub ebx, esi
test ebx, ebx
jg 0x4c23a0
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0049f074
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.004d97e0
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049cc86
mov esp, ebp
pop ebp
ret
Function at 0x4c7610
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.004a72f0
mov eax, dword [0x595978]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x4c7675
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4c7675
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.0049e7f4
add eax, 0x40
push eax
call fcn.004b097a
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0049cc86
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.004b0852
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4c7704
call fcn.004c7530
test eax, eax
jle 0x4c7704
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0049cc86
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0049cc86
add esp, 0x108
ret

Function at 0x4c7760
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
je 0x4c7782
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
dec edi
jne 0x4c7776
pop esi
movzx eax, cl
pop edi
ret

Function at 0x4d0d60
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x4d0da4
mov al, byte [edx]
test al, al
je 0x4d0da4
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
inc edx
xor esi, eax
mov al, byte [edx]
test al, al
jne 0x4d0d77
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4e7a90
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.004a72f0
mov eax, dword [0x595978]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x34]
push ebp
mov ebp, dword [esp + 0x30]
dec ebp
lea edx, [ebp - 0x29]
push edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
cmp ebx, edx
jle 0x4e7af5
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.004c0430
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0049cc86
add esp, 0x20
ret
cmp ebp, 0x29
jge 0x4e7b23
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.004c0430
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0049cc86
add esp, 0x20
ret
push esi
mov byte [edi], 0
lea esi, [edi + 1]
push 0
add edi, 0x15
call fcn.004dad60
mov ecx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x50]
push 0
push edi
push eax
push ecx
call fcn.004db770
mov edx, ebp
sub edx, ebx
sub edx, 0x29
push edx
lea eax, [edi + 0x14]
push 0
push eax
call fcn.004a6110
mov edx, dword [esp + 0x34]
mov eax, edi
sub eax, ebx
add eax, ebp
push ebx
mov byte [eax - 0x15], 1
push edx
add eax, 0xffffffec
push eax
call fcn.004a5720
push 0x14
push esi
call fcn.004b98c0
add esp, 0x38
test eax, eax
jle 0x4e7bb4
push 0x48
add ebp, 0xffffffec
push str..crypto_rsa_rsa_oaep.c
push ebp
call fcn.004c1fe0
mov ebx, eax
add esp, 0xc
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x4e7bc9
push 0x4b
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.004c0430
add esp, 0x14
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0049cc86
add esp, 0x20
ret
call fcn.004dad60
push eax
push 0x14
push esi
push ebp
push ebx
call fcn.004e7950
add esp, 0x14
test ebp, ebp
jle 0x4e7bef
mov eax, edi
sub ebx, edi
mov ecx, ebp
mov dl, byte [ebx + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x4e7be6
call fcn.004dad60
push eax
push ebp
push edi
lea eax, [esp + 0x24]
push 0x14
push eax
call fcn.004e7950
lea ecx, [esp + 0x2c]
lea edi, [esp + 0x2d]
lea ebp, [esp + 0x2e]
lea edx, [esp + 0x2f]
sub ecx, esi
sub edi, esi
sub ebp, esi
sub edx, esi
lea ebx, [esp + 0x30]
add esp, 0x14
sub ebx, esi
mov eax, esi
mov dword [esp + 0x10], ebx
mov esi, 4
nop
movzx ebx, byte [ecx + eax]
xor byte [eax], bl
movzx ebx, byte [edi + eax]
xor byte [eax + 1], bl
movzx ebx, byte [eax + ebp]
xor byte [eax + 2], bl
movzx ebx, byte [edx + eax]
xor byte [eax + 3], bl
mov ebx, dword [esp + 0x10]
movzx ebx, byte [ebx + eax]
xor byte [eax + 4], bl
add eax, 5
dec esi
jne 0x4e7c30
mov ecx, dword [esp + 0x14]
push ecx
call fcn.004c2190
mov ecx, dword [esp + 0x30]
add esp, 4
lea eax, [esi + 1]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049cc86
add esp, 0x20
ret