joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438f60
Capabilities:
Check for time delay via gettickcount
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov esi, dword [edi + 0x37c]
mov ebx, dword [eax + 0x9c]
mov dword [ebp - 0x10], eax
test ebx, ebx
jne 0x438f90
mov ebx, dword [eax + 0x98]
test ebx, ebx
je 0x439090
nop
call sub.KERNEL32.dll_GetTickCount
imul eax, ebx, 0x3e8
mov dword [esp + 4], eax
mov eax, dword [esi + 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
mov ebx, eax
mov eax, dword [esi + 0x14]
sub esp, 8
mov dword [esp], eax
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [esi + 0x14]
sub esp, 4
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x18]
sub esp, 4
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov dword [esi + 0x18], 0
sub esp, 4
test ebx, ebx
je 0x4390a0
mov byte [edi + 0x374], 1
mov dword [esi + 8], 0xffffffff
mov eax, dword [esi]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp + 0xc]
sub esp, 4
test eax, eax
je 0x43901c
mov eax, dword [edi + 0x370]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [edi + 0x370]
xor ebx, ebx
test eax, eax
jne 0x439060
mov eax, dword [esi + 8]
cmp eax, 0x1b
je 0x439120
inc eax
je 0x439150
mov eax, dword [edi + 0x378]
cmp eax, 0x2afc
je 0x439150
cmp byte [edi + 0x374], 0
mov ebx, 0x1c
jne 0x4390eb
mov esi, esi
lea eax, [edi + 0x368]
mov dword [esp], eax
call fcn.00438ec0
mov eax, dword [edi + 0x370]
test eax, eax
jne 0x43907f
mov byte [edi + 0xf8], 1
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, 0x12c
jmp 0x438f90
mov ecx, 0x1388
mov dword [esp + 4], ecx
mov eax, dword [esi]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
cmp eax, 0x102
je 0x439175
mov eax, dword [edi + 0x378]
mov dword [esp], eax
call sub.WS2_32.DLL_WSASetLastError
sub esp, 4
lea eax, [esi + 8]
mov dword [esp + 4], eax
mov eax, dword [esi]
mov dword [esp], eax
call sub.KERNEL32.dll_GetExitCodeThread
sub esp, 8
jmp 0x438ffd
mov dword [esp + 4], eax
mov ebx, 6
mov dword [esp], edi
call fcn.0043f130
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0x30]
mov dword [esp + 8], eax
mov eax, str.Could_not_resolve_host:__s___s
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0042b7c0
jmp 0x439060
mov dword [esp], 0x1b
call sym.fortis.exe_curl_easy_strerror
mov dword [esp + 8], eax
mov eax, str.Could_not_resolve_host:__s
mov ebx, 0x1b
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0042b7c0
jmp 0x439060
mov eax, dword [edi + 0x30]
mov ebx, 0x1c
mov edx, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov eax, str.Resolving_host_timed_out:__s
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.0042b7c0
jmp 0x439060
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword [esi]
mov dword [esp], eax
call sub.KERNEL32.dll_TerminateThread
sub esp, 8
jmp 0x438fef
Function at 0x4395d0
Capabilities:
Get socket status

Disassembly:
push ebp
mov edx, 0x10624dd3
mov ebp, esp
push edi
xor edi, edi
push esi
xor esi, esi
push ebx
sub esp, 0x36c
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x348], edi
mov dword [ebp - 0x128], esi
mov eax, ebx
mov ecx, ebx
imul edx
sar ecx, 0x1f
sar edx, 6
sub edx, ecx
mov ecx, 0xffffffff
mov dword [ebp - 0x350], edx
imul edx, edx, 0x3e8
sub ebx, edx
imul eax, ebx, 0x3e8
cmp dword [ebp + 8], 0xffffffff
mov dword [ebp - 0x34c], eax
je 0x439649
mov edx, dword [ebp + 8]
mov ebx, 1
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], edx
xor edx, edx
cmp edx, 0x3f
jbe 0x43970b
mov ecx, dword [ebp + 8]
xor edx, edx
cmp dword [ebp + 0xc], 0xffffffff
mov dword [ebp - 0x238], edx
je 0x43969d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x348]
mov dword [ebp - 0x234], eax
mov eax, 1
mov dword [ebp - 0x238], eax
xor eax, eax
cmp edx, 0
jbe 0x439691
nop
lea esi, [esi]
mov ebx, dword [ebp + 0xc]
cmp dword [ebp + eax*4 - 0x344], ebx
je 0x439691
inc eax
cmp edx, eax
ja 0x439680
cmp edx, eax
je 0x4396f3
cmp dword [ebp + 0xc], ecx
jbe 0x43969d
mov ecx, dword [ebp + 0xc]
lea edi, [ebp - 0x348]
lea esi, [ebp - 0x128]
lea ebx, [ecx + 1]
lea esi, [esi]
mov dword [esp + 0xc], edi
lea eax, [ebp - 0x350]
lea edx, [ebp - 0x238]
mov dword [esp + 0x10], eax
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.WS2_32.DLL_select
sub esp, 0x14
cmp eax, 0xffffffff
jne 0x439724
call fcn.004381f0
cmp eax, 4
je 0x4396b0
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x3f
ja 0x439695
mov edx, dword [ebp + 0xc]
mov dword [ebp + eax*4 - 0x344], edx
inc eax
mov dword [ebp - 0x348], eax
jmp 0x439695
mov ebx, dword [ebp + 8]
mov ecx, 1
mov dword [ebp - 0x348], ecx
mov dword [ebp - 0x344], ebx
jmp 0x439646
test eax, eax
jl 0x4396e6
jne 0x439734
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebx, ebx
cmp dword [ebp + 8], 0xffffffff
je 0x43976b
mov dword [esp + 4], esi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WS2_32.DLL___WSAFDIsSet
sub esp, 8
test eax, eax
jne 0x4397b5
mov dword [esp + 4], edi
mov edx, dword [ebp + 8]
mov dword [esp], edx
call sub.WS2_32.DLL___WSAFDIsSet
sub esp, 8
test eax, eax
je 0x43976b
or ebx, 4
cmp dword [ebp + 0xc], 0xffffffff
je 0x4397a6
lea eax, [ebp - 0x238]
mov dword [esp + 4], eax
mov edx, dword [ebp + 0xc]
mov dword [esp], edx
call sub.WS2_32.DLL___WSAFDIsSet
sub esp, 8
test eax, eax
jne 0x4397b0
mov dword [esp + 4], edi
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.WS2_32.DLL___WSAFDIsSet
sub esp, 8
test eax, eax
je 0x4397a6
or ebx, 4
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
or ebx, 2
jmp 0x43978d
mov ebx, 1
jmp 0x439752
Function at 0x43f6c0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
xor edx, edx
push esi
mov esi, eax
push ebx
xor ebx, ebx
mov esi, esi
movzx ecx, byte [ebx + edi]
mov al, cl
sub al, 0x41
cmp al, 0x19
ja 0x43f700
shl edx, 6
movsx eax, cl
lea edx, [edx + eax - 0x41]
inc ebx
cmp ebx, 3
jle 0x43f6d0
pop ebx
mov byte [esi + 2], dl
shr edx, 8
mov byte [esi + 1], dl
shr edx, 8
mov byte [esi], dl
pop esi
pop edi
pop ebp
ret
mov al, cl
sub al, 0x61
cmp al, 0x19
ja 0x43f714
shl edx, 6
movsx eax, cl
lea edx, [edx + eax - 0x47]
jmp 0x43f6e6
mov al, cl
sub al, 0x30
cmp al, 9
ja 0x43f728
shl edx, 6
movsx eax, cl
lea edx, [edx + eax + 4]
jmp 0x43f6e6
cmp cl, 0x2b
je 0x43f73c
cmp cl, 0x2f
je 0x43f746
cmp cl, 0x3d
jne 0x43f6e6
shl edx, 6
jmp 0x43f6e6
mov eax, edx
shl eax, 6
lea edx, [eax + 0x3e]
jmp 0x43f6e6
mov eax, edx
shl eax, 6
lea edx, [eax + 0x3f]
jmp 0x43f6e6
Function at 0x456760
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x58], 0
mov eax, 1
ret
Function at 0x45dfa0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebx
mov esi, dword [esp + 0x10]
test esi, esi
je 0x45e170
push 0x167
push str..cryptoengineeng_list.c
push 0x1e
push 9
call fcn.0046efd0
mov ebx, dword [0x536e80]
add esp, 0x10
jmp 0x45dfe6
sub esp, 8
mov eax, dword [ebx]
push eax
push esi
call sub.msvcrt.dll_strcmp
add esp, 0x10
test eax, eax
je 0x45e010
mov ebx, dword [ebx + 0x60]
test ebx, ebx
jne 0x45dfd0
push 0x181
push str..cryptoengineeng_list.c
push 0x1e
push 0xa
call fcn.0046efd0
add esp, 0x10
test ebx, ebx
mov edx, ebx
je 0x45e0a1
pop ebx
pop esi
mov eax, edx
pop edi
ret
test byte [ebx + 0x48], 4
jne 0x45e01b
inc dword [ebx + 0x4c]
jmp 0x45dfea
call fcn.0045d530
test eax, eax
mov edx, eax
je 0x45e192
mov ecx, dword [ebx]
mov dword [eax], ecx
mov eax, dword [ebx + 4]
mov edi, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
mov dword [edx + 4], eax
mov eax, dword [ebx + 0x10]
mov dword [edx + 8], edi
mov dword [edx + 0xc], ecx
mov edi, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x18]
mov dword [edx + 0x10], eax
mov eax, dword [ebx + 0x1c]
mov dword [edx + 0x14], edi
mov dword [edx + 0x18], ecx
mov edi, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
mov dword [edx + 0x1c], eax
mov eax, dword [ebx + 0x28]
mov dword [edx + 0x20], edi
mov dword [edx + 0x24], ecx
mov edi, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x30]
mov dword [edx + 0x28], eax
mov eax, dword [ebx + 0x34]
mov dword [edx + 0x2c], edi
mov dword [edx + 0x30], ecx
mov edi, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x3c]
mov dword [edx + 0x34], eax
mov eax, dword [ebx + 0x40]
mov dword [edx + 0x38], edi
mov dword [edx + 0x3c], ecx
mov dword [edx + 0x40], eax
mov edi, dword [ebx + 0x44]
mov ecx, dword [ebx + 0x48]
mov ebx, edx
mov dword [edx + 0x44], edi
mov dword [edx + 0x48], ecx
jmp 0x45dfea
sub esp, 0xc
push str.OPENSSL_ENGINES
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
mov edi, eax
je 0x45e199
sub esp, 0xc
push 0x51307b
call fcn.0045dfa0
add esp, 0x10
test eax, eax
mov ebx, eax
je 0x45e0e6
push 0
push esi
push 0x513083
push eax
call fcn.00489dd0
add esp, 0x10
test eax, eax
jne 0x45e118
sub esp, 0xc
push 0x19b
push str..cryptoengineeng_list.c
push 0x74
push 0x6a
push 0x26
call fcn.0045d0e0
add esp, 0x1c
push esi
push 0x513086
push 2
call fcn.0045d2f0
xor edx, edx
add esp, 0x10
jmp 0x45e00a
push 0
push 0x51308a
push 0x51308c
push ebx
call fcn.00489dd0
add esp, 0x10
test eax, eax
je 0x45e0e6
push 0
push edi
push 0x513095
push ebx
call fcn.00489dd0
add esp, 0x10
test eax, eax
je 0x45e0e6
push 0
push 0
push 0x51309d
push ebx
call fcn.00489dd0
add esp, 0x10
test eax, eax
mov edx, ebx
jne 0x45e00a
jmp 0x45e0e6
sub esp, 0xc
push 0x164
push str..cryptoengineeng_list.c
push 0x43
push 0x6a
push 0x26
call fcn.0045d0e0
xor edx, edx
add esp, 0x20
jmp 0x45e00a
xor ebx, ebx
jmp 0x45dfea
mov edi, str._usr_local_ssl_lib_engines
jmp 0x45e0bb
Function at 0x463770
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [esp + 0x60]
xor eax, eax
test edi, edi
mov ebp, dword [esp + 0x64]
mov dword [esp + 0xc], 0
je 0x4637b6
sub esp, 8
lea ebx, [esp + 0x18]
push ebx
push edi
call sub.msvcrt.dll__stat
push 0
push 0
push 0x24
mov esi, eax
push ebx
call fcn.00464860
add esp, 0x20
xor eax, eax
test esi, esi
js 0x4637b6
test ebp, ebp
jne 0x4637c0
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 8
push 0x513910
push edi
call sub.msvcrt.dll_fopen
add esp, 0x10
test eax, eax
mov edi, eax
je 0x463869
mov ax, word [esp + 0x16]
test ah, 0x30
je 0x463801
cmp ebp, 0xffffffff
mov eax, ebp
je 0x463879
push 0
push 4
push 0
push edi
mov ebp, eax
call sub.msvcrt.dll_setvbuf
add esp, 0x10
test ebp, ebp
jle 0x463872
cmp ebp, 0x400
mov esi, ebp
jg 0x463872
push edi
push esi
push 1
push 0x536f70
call sub.msvcrt.dll_fread
add esp, 0x10
test eax, eax
mov ebx, eax
jle 0x46384c
push eax
fild dword [esp]
sub esp, 4
fstp qword [esp]
push esi
push 0x536f70
call fcn.00464860
add dword [esp + 0x1c], ebx
add esp, 0x10
test ebp, ebp
jle 0x463872
sub ebp, esi
test ebp, ebp
jg 0x463805
sub esp, 0xc
push edi
call sub.msvcrt.dll_fclose
pop eax
pop edx
push 0x400
push 0x536f70
call fcn.0046f980
add esp, 0x10
mov eax, dword [esp + 0xc]
jmp 0x4637b6
mov esi, 0x400
jmp 0x46380f
mov eax, 0x800
jmp 0x4637f0

Function at 0x4639a0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebx
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
call fcn.004a18c0
xor ebx, ebx
test eax, eax
je 0x4639f0
call fcn.004a18c0
test eax, eax
je 0x463a30
test ebx, ebx
je 0x463a50
cmp byte [ebx], 0
je 0x4639e3
sub esp, 0xc
push ebx
call sub.msvcrt.dll_strlen
add eax, 6
add esp, 0x10
cmp eax, edi
jb 0x463a60
mov byte [esi], 0
mov edx, esi
pop ebx
pop esi
mov eax, edx
pop edi
ret
sub esp, 0xc
push str.RANDFILE
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
mov ebx, eax
je 0x4639b6
cmp byte [eax], 0
je 0x4639b6
sub esp, 0xc
push eax
call sub.msvcrt.dll_strlen
inc eax
add esp, 0x10
cmp eax, edi
jae 0x4639b6
push eax
push edi
push ebx
push esi
call fcn.0046f710
add esp, 0x10
xor edx, edx
cmp eax, edi
jb 0x4639e6
jmp 0x4639e8
sub esp, 0xc
push str.HOME
call sub.msvcrt.dll_getenv
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x4639c7
lea esi, [esi]
lea edi, [edi]
mov ebx, 0x513924
jmp 0x4639c7
push eax
push edi
push ebx
push esi
call fcn.0046f710
add esp, 0xc
push edi
push 0x513927
push esi
call fcn.0046f900
add esp, 0xc
push edi
push str..rnd
push esi
call fcn.0046f900
add esp, 0x10
jmp 0x4639e6
Function at 0x464440
Capabilities:
Capture screenshot

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
call fcn.00463bf0
call sub.KERNEL32.dll_GetVersion
test eax, eax
js 0x464462
call fcn.0046ed80
test eax, eax
jne 0x4645c4
push 0
push 0
push 0
push str.DISPLAY
call sub.GDI32.dll_CreateDCA
mov dword [esp + 0x1c], eax
sub esp, 0xc
push eax
call sub.GDI32.dll_CreateCompatibleDC
pop edx
mov dword [esp + 0x20], eax
push 8
mov eax, dword [esp + 0x28]
push eax
call sub.GDI32.dll_GetDeviceCaps
mov dword [esp + 0x18], eax
push 0xa
mov ebp, dword [esp + 0x28]
push ebp
call sub.GDI32.dll_GetDeviceCaps
pop ebp
mov dword [esp + 0x10], eax
push 0x10
mov edi, dword [esp + 0x18]
push edi
mov esi, dword [esp + 0x28]
push esi
call sub.GDI32.dll_CreateCompatibleBitmap
push ebx
push eax
mov ebx, dword [esp + 0x24]
push ebx
mov ebp, eax
call sub.GDI32.dll_SelectObject
pop edx
lea ecx, [esp + 0x44]
mov dword [esp + 0x18], eax
push ecx
push 0x18
push ebp
call sub.GDI32.dll_GetObjectA
mov edx, dword [esp + 0x4c]
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
imul edi, edx
push 0x2da
and eax, 0xffff
imul edi, eax
push str..crypto_rand_rand_win.c
push edi
call fcn.00457fd0
add esp, 0x10
test eax, eax
mov ebx, eax
je 0x464594
mov edx, dword [esp + 0xc]
sub edx, 0x10
xor esi, esi
cmp edx, 0
mov dword [esp + 8], edx
jmp 0x464586
sub esp, 0xc
push 0xcc0020
push esi
push 0
mov eax, dword [esp + 0x34]
push eax
push 0x10
mov ecx, dword [esp + 0x30]
push ecx
push 0
push 0
mov edx, dword [esp + 0x44]
push edx
call sub.GDI32.dll_BitBlt
pop eax
pop edx
push ebx
push edi
push ebp
call sub.GDI32.dll_GetBitmapBits
push eax
push 0
push eax
call fcn.00479630
mov dword [esp], eax
push 0
lea eax, [esp + 0x34]
push eax
push edi
push ebx
call fcn.00478500
add esp, 0x20
push 0
push 0
push 0x14
lea ecx, [esp + 0x2c]
push ecx
call fcn.00464860
add esi, 0x10
add esp, 0x10
cmp dword [esp + 8], esi
jg 0x464520
sub esp, 0xc
push ebx
call fcn.004582e0
add esp, 0x10
sub esp, 8
mov ebp, dword [esp + 0x1c]
push ebp
mov edi, dword [esp + 0x24]
push edi
call sub.GDI32.dll_SelectObject
push edi
push eax
call sub.GDI32.dll_DeleteObject
mov esi, dword [esp + 0x24]
push esi
call sub.GDI32.dll_DeleteDC
mov ebx, dword [esp + 0x28]
push ebx
call sub.GDI32.dll_DeleteDC
add esp, 0xc
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x464ee0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x58], 0
mov eax, 1
ret

Function at 0x46de60
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
xor esi, esi
test edx, edx
je 0x46de77
mov al, byte [edx]
test al, al
mov ebx, 0x100
jne 0x46de80
pop ebx
xor eax, eax
pop esi
ret
movsx eax, al
or eax, ebx
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
imul eax, eax
rol esi, cl
inc edx
xor esi, eax
mov al, byte [edx]
add ebx, 0x100
test al, al
jne 0x46de80
mov eax, esi
shr eax, 0x10
pop ebx
xor eax, esi
pop esi
ret
Function at 0x46ee60
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x14c
mov ebx, dword [ebp + 8]
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
add esp, 0xc
test eax, eax
je 0x46ee90
sub esp, 0xc
push eax
call sub.KERNEL32.dll_GetFileType
add esp, 0xc
test eax, eax
jne 0x46ef40
lea edx, [ebp + 0xc]
push edx
push ebx
push 0xff
lea esi, [ebp - 0x108]
push esi
call sub.msvcrt.dll__vsnprintf
mov byte [ebp - 9], 0
call sub.KERNEL32.dll_GetVersion
add esp, 0x10
test eax, eax
js 0x46eec3
call fcn.0046ed80
test eax, eax
jne 0x46ef60
sub esp, 0xc
lea eax, [ebp - 0x138]
mov dword [ebp - 0x138], 0x28
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x128], str.OpenSSL:_FATAL
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x120], 0x7f01
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0x409
mov dword [ebp - 0x12c], esi
push eax
call sub.USER32.dll_MessageBoxIndirectA
add esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea ecx, [ebp + 0xc]
push edx
push ecx
push ebx
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call sub.msvcrt.dll_vfprintf
add esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
sub esp, 8
push str.OPENSSL
push 0
call sub.ADVAPI32.DLL_RegisterEventSourceA
mov dword [ebp - 0x13c], esi
push esi
push 0
lea esi, [ebp - 0x13c]
push esi
push 0
push 1
push 0
push 0
push 0
push 1
push eax
mov ebx, eax
call sub.ADVAPI32.DLL_ReportEventA
push ebx
call sub.ADVAPI32.DLL_DeregisterEventSource
jmp 0x46ef32
Function at 0x4732d0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x18
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], 0
push esi
call fcn.0046c1e0
add esp, 0x10
cmp eax, dword [esp + 0x30]
je 0x473320
sub esp, 0xc
push 0x9a
push str..crypto_rsa_rsa_sign.c
push 0x77
push 0x77
push 4
call fcn.0045d0e0
xor eax, eax
add esp, 0x20
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [esi + 0x3c], 0x40
je 0x473334
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x30]
test eax, eax
jne 0x473490
push eax
push 0xa4
push str..crypto_rsa_rsa_sign.c
mov eax, dword [esp + 0x3c]
push eax
call fcn.00457fd0
add esp, 0x10
test eax, eax
mov ebx, eax
je 0x47350d
cmp edi, 0x72
je 0x4733c0
sub esp, 0xc
push 1
push esi
push ebx
push ebp
mov esi, dword [esp + 0x4c]
push esi
call fcn.0046c2a0
add esp, 0x20
test eax, eax
jle 0x4733e5
cmp edi, 0x72
jne 0x473410
cmp eax, 0x24
jne 0x4733a0
cld
mov esi, ebx
mov edi, dword [esp + 0x24]
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4734ac
lea esi, [esi]
lea edi, [edi]
sub esp, 0xc
push 0xb5
push str..crypto_rsa_rsa_sign.c
push 0x68
jmp 0x4733d9
cmp dword [esp + 0x28], 0x24
je 0x47335b
sub esp, 0xc
push 0xab
push str..crypto_rsa_rsa_sign.c
push 0x83
push 0x77
push 4
call fcn.0045d0e0
add esp, 0x20
test ebx, ebx
je 0x473402
sub esp, 8
mov ebp, dword [esp + 0x38]
push ebp
push ebx
call fcn.0046f980
mov dword [esp], ebx
call fcn.004582e0
add esp, 0x10
mov eax, dword [esp + 4]
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
push edx
push eax
lea ebp, [esp + 0x10]
push ebp
push 0
call fcn.0049d730
add esp, 0x10
test eax, eax
mov ebp, eax
je 0x4733e5
mov eax, dword [eax]
sub esp, 0xc
mov edx, dword [eax]
push edx
call fcn.00469cb0
add esp, 0x10
cmp eax, edi
je 0x4734d9
cmp edi, 4
je 0x473508
cmp edi, 3
je 0x4734b9
sub esp, 0xc
push 0xd3
push str..crypto_rsa_rsa_sign.c
push 0x64
push 0x77
push 4
call fcn.0045d0e0
add esp, 0x20
test ebp, ebp
je 0x4733e5
sub esp, 0xc
push ebp
call fcn.0049d790
add esp, 0x10
jmp 0x4733e5
sub esp, 8
push esi
mov ebx, dword [esp + 0x3c]
push ebx
push ebp
mov ecx, dword [esp + 0x3c]
push ecx
mov edx, dword [esp + 0x3c]
push edx
push edi
call eax
jmp 0x473314
mov dword [esp + 4], 1
jmp 0x4733e5
cmp eax, 7
jne 0x473451
mov edi, dword [sym.imp.msvcrt.dll__iob]
add edi, 0x40
push edi
push 0x34
push 1
push str.signature_has_problems__re_make_with_post_SSLeay045_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
mov eax, dword [ebp + 4]
mov edx, dword [esp + 0x28]
cmp dword [eax], edx
jne 0x4734f4
mov edi, dword [eax + 8]
cld
cmp edx, edx
mov esi, dword [esp + 0x24]
mov ecx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x473531
sub esp, 0xc
push 0xda
push str..crypto_rsa_rsa_sign.c
push 0x68
jmp 0x473460
cmp eax, 8
jmp 0x4734bc
sub esp, 0xc
push 0xa7
push str..crypto_rsa_rsa_sign.c
push 0x41
push 0x77
push 4
call fcn.0045d0e0
add esp, 0x20
mov eax, dword [esp + 4]
jmp 0x473406
mov dword [esp + 4], 1
jmp 0x47346c
Function at 0x47d400
Capabilities:
Check if file exists

Disassembly:
push edi
push esi
push ebx
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
sub esp, 8
push ebx
push edi
call sub.msvcrt.dll_fopen
add esp, 0x10
test eax, eax
mov esi, eax
je 0x47d44a
sub esp, 0xc
push 0x4fe3b0
call fcn.00465f60
mov ebx, eax
add esp, 0x10
xor eax, eax
test ebx, ebx
je 0x47d446
push esi
push 1
push 0x6a
push ebx
call fcn.00466550
mov eax, ebx
add esp, 0x10
pop ebx
pop esi
pop edi
ret
sub esp, 0xc
push 0x7a
push str..crypto_bio_bss_file.c
sub esp, 0xc
call sub.KERNEL32.dll_GetLastError
add esp, 0xc
push eax
push 1
push 2
call fcn.0045d0e0
add esp, 0x18
push 0x51f865
push ebx
push 0x51f868
push edi
push str.fopen_
push 5
call fcn.0045d2f0
add esp, 0x20
call sub.msvcrt.dll__errno
cmp dword [eax], 2
je 0x47d4af
sub esp, 0xc
push 0x7f
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.0045d0e0
add esp, 0x20
pop ebx
pop esi
xor eax, eax
pop edi
ret
sub esp, 0xc
push 0x7d
push str..crypto_bio_bss_file.c
push pe_nt_image_headers32
jmp 0x47d49d
Function at 0x47dbb0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x9c
mov edi, dword [esp + 0xbc]
xor eax, eax
test edi, edi
mov ebx, dword [esp + 0xb0]
mov ebp, dword [esp + 0xb8]
je 0x47dd6f
mov edx, dword [esp + 0xb4]
test edx, edx
mov al, 1
mov dword [ebx], edi
je 0x47dd80
mov esi, dword [edi + 0x40]
cmp esi, 0x80
jg 0x47dd3b
cmp esi, ebp
jl 0x47dcee
cmp ebp, 0x80
ja 0x47dd55
push edx
push ebp
mov edx, dword [esp + 0xbc]
push edx
lea eax, [ebx + 0x38]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0x10
lea ecx, [ebx + 4]
mov edx, ebp
mov dword [ebx + 0x34], ebp
mov dword [esp + 0xc], ecx
cmp edx, 0x80
je 0x47dc51
mov esi, pe_nt_image_headers32
sub esi, edx
push ecx
push esi
push 0
lea ebp, [edx + ebx + 0x38]
push ebp
call sub.msvcrt.dll_memset
add esp, 0x10
xor edx, edx
lea esi, [esi]
lea edi, [edi]
mov al, byte [ebx + edx + 0x38]
xor eax, 0x36
mov byte [esp + edx + 0x10], al
inc edx
cmp edx, 0x7f
jle 0x47dc60
push eax
mov ebp, dword [esp + 0xc4]
push ebp
push edi
lea esi, [ebx + 0x14]
push esi
call fcn.00478120
add esp, 0xc
mov edx, dword [edi + 0x40]
push edx
lea ebp, [esp + 0x18]
push ebp
push esi
call fcn.004782c0
xor edx, edx
add esp, 0x10
nop
lea esi, [esi]
mov cl, byte [ebx + edx + 0x38]
xor ecx, 0x5c
mov byte [esp + edx + 0x10], cl
inc edx
cmp edx, 0x7f
jle 0x47dca0
push eax
mov edx, dword [esp + 0xc4]
push edx
push edi
add ebx, 0x24
push ebx
call fcn.00478120
add esp, 0xc
mov eax, dword [edi + 0x40]
push eax
push ebp
push ebx
call fcn.004782c0
add esp, 0x10
sub esp, 8
push esi
mov ebx, dword [esp + 0x18]
push ebx
call fcn.004786c0
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
mov eax, dword [esp + 0xc4]
push eax
push edi
lea esi, [ebx + 4]
mov dword [esp + 0x18], esi
push esi
call fcn.00478120
add esp, 0xc
push ebp
mov edx, dword [esp + 0xbc]
push edx
mov ebp, dword [esp + 0x18]
push ebp
call fcn.004782c0
add esp, 0xc
lea ecx, [ebx + 0x34]
push ecx
lea eax, [ebx + 0x38]
push eax
mov esi, dword [esp + 0x18]
push esi
call fcn.004782e0
add esp, 0x10
mov edx, dword [ebx + 0x34]
jmp 0x47dc31
push eax
push str.j____int_sizeof_ctx__key_
push 0x52
push str..cryptohmachmac.c
call fcn.0046efa0
add esp, 0x10
jmp 0x47dbfb
push ecx
push str.len_0__len__int_sizeof_ctx__key_
push 0x5c
push str..cryptohmachmac.c
call fcn.0046efa0
add esp, 0x10
jmp 0x47dc0f
mov edx, dword [esp + 0xb4]
test edx, edx
mov edi, dword [ebx]
jne 0x47dbec
lea ecx, [ebx + 4]
test eax, eax
mov dword [esp + 0xc], ecx
lea esi, [ebx + 0x14]
jne 0x47dc51
sub esp, 8
push esi
mov ebx, dword [esp + 0x18]
push ebx
call fcn.004786c0
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret