joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40349c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x3c
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x40356f
mov esi, edx
lea edx, [ebp - 0x28]
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp], edx
mov dword [esp + 4], 0x10
call sym._fill_sockaddr
lea edx, [ebp - 0x28]
mov dword [esp], ebx
mov dword [esp + 0x14], 0x10
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
call dword [sym.imp.WS2_32.dll_sendto]
sub esp, 0x18
mov ebx, eax
test eax, eax
jns 0x403545
mov edi, dword [sym.imp.msvcrt.dll__errno]
call edi
mov eax, dword [eax]
mov dword [esp], eax
call sym._strerror
mov esi, eax
call edi
mov dword [esp + 0x14], esi
mov eax, dword [eax]
mov dword [esp + 0xc], str.sendto_failed___d___s
mov dword [esp + 8], 0x2c9
mov dword [esp + 0x10], eax
mov dword [esp + 4], str._n2n_lucktu_cnn2n_src_edge_utils.c
mov dword [esp], 0
call sym._traceEvent
jmp 0x403571
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.sendto_sent_d_to
mov dword [esp + 8], 0x2cd
mov dword [esp + 4], str._n2n_lucktu_cnn2n_src_edge_utils.c
mov dword [esp], 4
call sym._traceEvent
jmp 0x403571
xor ebx, ebx
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x403fca
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
movzx eax, dx
sub esp, 0x17c
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x15c], 0
mov edi, dword [ebp - 0x164]
cmp dword [ebp - 0x15c], edi
jge 0x404105
mov eax, dword [ebx]
test eax, eax
jne 0x404035
cmp byte [ebx + 4], 0
jne 0x404035
mov dword [esp + 0xc], str.Warning:_The_0.0.0.0_0_route_settings_are_not_supported_on_Windows
mov dword [esp + 8], 0xa54
mov dword [esp + 4], str._n2n_lucktu_cnn2n_src_edge_utils.c
mov dword [esp], 2
call sym._traceEvent
or eax, 0xffffffff
jmp 0x404107
mov edx, dword [ebx + 8]
mov ecx, dword [sym.imp.WS2_32.dll_inet_ntoa]
mov dword [esp], eax
add ebx, 0xc
lea esi, [ebp - 0x158]
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x168], ecx
call ecx
mov edi, dword [sym.imp.msvcrt.dll__snprintf]
push edx
mov dword [esp], esi
mov dword [esp + 8], eax
mov dword [esp + 4], 0x20
call edi
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x168]
mov dword [esp], eax
call ecx
push ecx
lea ecx, [ebp - 0x138]
mov dword [esp], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x20
call edi
lea ecx, [ebp - 0x138]
mov dword [esp + 0x14], ecx
movzx eax, byte [ebx - 8]
mov dword [esp + 0xc], esi
lea esi, [ebp - 0x118]
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.route_add__s__d__s___nul
mov dword [esp + 4], 0x100
mov dword [esp], esi
call edi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], str.ROUTE_CMD___s_n
mov dword [esp + 8], 0xa5f
mov dword [esp + 4], str._n2n_lucktu_cnn2n_src_edge_utils.c
mov dword [esp], 2
call sym._traceEvent
mov dword [esp], esi
call sym._system
inc dword [ebp - 0x15c]
jmp 0x403feb
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4086a2
Capabilities:
Query environment variable

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x29
mov ebp, esp
push edi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov edi, ebx
rep stosd dword es:[edi], eax
mov byte [ebx + 0x74], 1
mov dword [ebx + 0xa0], 0x160c
mov dword [ebx + 0x80], 1
mov word [ebx + 0x8a], 0x101
mov byte [ebx + 0x8c], 1
mov dword [ebx + 0x94], 0x14
mov dword [esp], str.N2N_KEY
call sym._getenv
test eax, eax
je 0x40871f
mov dword [esp], str.N2N_KEY
call sym._getenv
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__strdup]
mov dword [ebx + 0x80], 2
mov dword [ebx + 0x90], eax
add esp, 0x10
pop ebx
pop edi
pop ebp
ret
Function at 0x40bbbf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov ebx, dword [ecx + 8]
mov esi, dword [ecx + 0xc]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
lea ecx, [eax*8]
mov eax, dword [ebp + 0xc]
mov dword [eax + ecx], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [eax + ecx + 4], esi
mov ecx, dword [ebp - 0x20]
mov eax, ecx
shrd ecx, ebx, 8
shrd ebx, eax, 8
mov eax, dword [ebp - 0x18]
add ecx, dword [ebp - 0x28]
adc ebx, dword [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
xor eax, ebx
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov eax, ecx
shld ecx, ebx, 3
shld ebx, eax, 3
mov eax, dword [ebp - 0x20]
xor eax, ecx
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
xor eax, ebx
add dword [ebp - 0x18], 1
mov ecx, dword [ebp - 0x18]
adc dword [ebp - 0x14], 0
xor ecx, 0x20
or ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
jne 0x40bbf0
add esp, 0x1c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40bc70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
mov eax, dword [ebp + 8]
mov edx, dword [eax + 4]
mov eax, dword [eax]
shld edx, eax, 0x10
shl eax, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], edx
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
xor ax, ax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
xor eax, eax
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
shrd ecx, ebx, 8
shr ebx, 8
mov esi, ecx
mov ecx, dword [ebp + 0xc]
shl edx, 8
or edx, ebx
xor si, si
mov ebx, dword [ecx + eax*8]
mov dword [ebp - 0x28], esi
mov esi, dword [ebp - 0x28]
add esi, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
mov edi, dword [ebp - 0x24]
adc edi, dword [ebp - 0x1c]
xor ebx, esi
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ecx + eax*8 + 4]
inc eax
shr edx, 0xd
xor ebx, edi
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ebx
shld edi, esi, 3
shl esi, 3
or edx, esi
mov esi, edi
xor dx, dx
xor esi, ebx
xor edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], esi
cmp eax, 0x1c
jne 0x40bca8
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
shrd eax, edx, 0x10
shr edx, 0x10
mov dword [ebx], eax
mov eax, dword [ebp - 0x14]
or ecx, edx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], eax
add esp, 0x24
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40be05
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x24
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
mov edi, dword [ecx + 4]
xor ax, ax
mov dword [ebp - 0x18], eax
mov eax, dword [ecx + 8]
shld edi, esi, 0x10
shl esi, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [eax], esi
mov edx, dword [ebp - 0x18]
mov dword [eax + 4], edi
shrd ecx, ebx, 8
shr ebx, 8
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
shl edx, 8
mov dword [ebp - 0x2c], ebx
or edx, dword [ebp - 0x2c]
xor cx, cx
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
add ecx, esi
adc ebx, edi
xor edx, ecx
mov ecx, esi
xor ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edx
mov edx, edi
shl ecx, 3
add eax, 8
shr edx, 0xd
mov dword [ebp - 0x14], ebx
mov ebx, edi
or edx, ecx
shld ebx, esi, 3
xor dx, dx
xor edx, dword [ebp - 0x18]
mov ecx, ebx
xor ecx, dword [ebp - 0x14]
mov esi, edx
add dword [ebp - 0x20], 0x10000
mov edx, dword [ebp - 0x20]
mov edi, ecx
adc dword [ebp - 0x1c], 0
xor edx, 0x1c0000
or edx, dword [ebp - 0x1c]
jne 0x40be3d
add esp, 0x24
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40cb2c
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10
movzx eax, byte [ecx + 0x429ea0]
mov ebx, eax
mov esi, eax
mov edx, eax
shr ebx, 2
and esi, 2
mov edi, ebx
mov ebx, esi
neg bl
sbb esi, esi
shl edx, 0x1f
and esi, 0xb4
sar edx, 0x1f
xor edi, esi
mov esi, eax
and edx, 0xb4
shl esi, 0x1f
mov ebx, edi
sar esi, 0x1f
and esi, 0x5a
xor ebx, esi
mov esi, eax
shr esi, 1
mov edi, ebx
xor esi, eax
xor edi, eax
xor ebx, esi
mov dword [ebp - 0x14], edi
xor ebx, edx
movzx edx, byte [ecx + 0x429fa0]
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x10], dl
mov esi, dword [ebp - 0x10]
mov edi, edx
shr edi, 2
and esi, 2
mov ebx, esi
neg bl
mov ebx, dword [ebp - 0x10]
sbb esi, esi
and esi, 0xb4
shl ebx, 0x1f
xor esi, edi
mov edi, dword [ebp - 0x10]
sar ebx, 0x1f
and ebx, 0xb4
shl edi, 0x1f
sar edi, 0x1f
and edi, 0x5a
xor esi, edi
mov edi, esi
xor edi, edx
mov dword [ebp - 0x1c], edi
mov edi, edx
shr edi, 1
xor edi, edx
xor edi, esi
xor edi, ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], edi
mov esi, edi
shl edi, 0x10
shl ebx, 8
shl esi, 0x18
or ebx, edx
shl edx, 0x10
or edx, dword [ebp - 0x1c]
or ebx, edi
mov edi, eax
or edx, esi
or ebx, esi
shl edi, 0x18
mov dword [ecx*4 + 0x462080], ebx
mov ebx, dword [ebp - 0x14]
shl ebx, 0x10
or ebx, edi
mov edi, dword [ebp - 0x18]
or ebx, dword [ebp - 0x18]
shl edi, 8
or ebx, edi
mov dword [ecx*4 + 0x462480], ebx
mov ebx, dword [ebp - 0x10]
shl ebx, 8
or edx, ebx
shl eax, 8
or eax, dword [ebp - 0x14]
mov dword [ecx*4 + 0x462880], edx
mov edx, dword [ebp - 0x14]
shl edx, 0x18
or eax, edx
mov edx, dword [ebp - 0x18]
shl edx, 0x10
or eax, edx
mov dword [ecx*4 + 0x462c80], eax
inc ecx
cmp ecx, 0x100
jne 0x40cb37
mov dword [0x463080], 1
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40ce2a
Capabilities:
Encrypt data using twofish

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 0xc]
mov al, byte [ebp + 0xc]
mov edi, dword [edi]
shr esi, 0x10
mov ebx, esi
shr edx, 8
mov byte [ebp - 0x11], al
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp - 0x10]
mov eax, edx
mov byte [ebp - 0x12], bl
mov edi, dword [ebp + 8]
shr ecx, 0x18
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x10]
and edi, 3
shr ebx, 0x18
shr ecx, 0x10
mov byte [ebp - 0x13], bl
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x10]
shr ecx, 8
mov dword [ebp - 0x20], ecx
cmp edi, 2
je 0x40cf71
cmp edi, 3
je 0x40cf2a
dec edi
mov ecx, esi
movzx eax, byte [ebp + 0xc]
movzx edi, dl
movzx esi, cl
jne 0x40cef0
mov cl, byte [ebp - 0x10]
mov dl, byte [ebp - 0x18]
xor cl, byte [eax + 0x429ea0]
xor dl, byte [ebx + 0x429fa0]
movzx edx, dl
movzx eax, cl
mov eax, dword [eax*4 + 0x462080]
xor eax, dword [edx*4 + 0x462c80]
mov dl, byte [ebp - 0x20]
xor dl, byte [edi + 0x429ea0]
movzx edx, dl
xor eax, dword [edx*4 + 0x462480]
mov dl, byte [ebp - 0x1c]
xor dl, byte [esi + 0x429fa0]
movzx edx, dl
xor eax, dword [edx*4 + 0x462880]
jmp 0x40d005
mov edx, dword [ebp + 0x10]
mov cl, byte [eax + 0x429fa0]
mov edx, dword [edx + 0xc]
mov eax, edx
xor ecx, edx
shr eax, 8
xor al, byte [edi + 0x429ea0]
mov edi, edx
mov byte [ebp - 0x11], cl
shr edi, 0x10
shr edx, 0x18
mov ecx, edi
xor cl, byte [esi + 0x429ea0]
mov byte [ebp - 0x12], cl
mov cl, byte [ebx + 0x429fa0]
xor ecx, edx
mov byte [ebp - 0x13], cl
mov esi, dword [ebp + 0x10]
movzx ebx, byte [ebp - 0x11]
mov edx, dword [esi + 8]
mov cl, byte [ebx + 0x429fa0]
movzx ebx, al
movzx esi, byte [ebp - 0x12]
mov eax, edx
xor ecx, edx
shr eax, 8
xor al, byte [ebx + 0x429fa0]
mov ebx, edx
mov byte [ebp - 0x11], cl
shr ebx, 0x10
xor bl, byte [esi + 0x429ea0]
shr edx, 0x18
mov byte [ebp - 0x12], bl
movzx ebx, byte [ebp - 0x13]
mov cl, byte [ebx + 0x429ea0]
xor ecx, edx
mov byte [ebp - 0x13], cl
mov esi, dword [ebp + 0x10]
movzx ecx, al
mov bl, byte [ebp - 0x20]
mov edx, dword [esi + 4]
mov eax, edx
shr eax, 8
xor al, byte [ecx + 0x429fa0]
movzx ecx, byte [ebp - 0x11]
movzx eax, al
xor bl, byte [eax + 0x429ea0]
movzx eax, bl
mov bl, byte [ecx + 0x429ea0]
mov eax, dword [eax*4 + 0x462480]
xor ebx, edx
movzx ecx, bl
mov bl, byte [ebp - 0x10]
xor bl, byte [ecx + 0x429ea0]
movzx ecx, bl
movzx ebx, byte [ebp - 0x12]
xor eax, dword [ecx*4 + 0x462080]
mov ecx, edx
shr edx, 0x18
shr ecx, 0x10
xor cl, byte [ebx + 0x429ea0]
mov bl, byte [ebp - 0x1c]
movzx ecx, cl
xor bl, byte [ecx + 0x429fa0]
movzx ecx, bl
mov bl, byte [ebp - 0x18]
xor eax, dword [ecx*4 + 0x462880]
movzx ecx, byte [ebp - 0x13]
xor dl, byte [ecx + 0x429fa0]
movzx edx, dl
xor bl, byte [edx + 0x429fa0]
movzx edx, bl
xor eax, dword [edx*4 + 0x462c80]
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40dcee
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], sym._tunReadThread
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
sub esp, 0x18
leave
ret
Function at 0x40e917
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc4c
mov dword [ebp - 0xc2c], eax
lea eax, [ebp - 0xc28]
mov dword [ebp - 0xc30], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
mov dword [esp], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
mov ebx, eax
test eax, eax
je 0x40e9eb
mov dword [esp + 4], eax
mov dword [esp], str.Unable_to_read_registry:__rc_d__n
call sym._printf_2
mov dword [esp], 1
call sym._exit
lea edx, [ebp - 0xc1c]
mov dword [esp + 0x10], esi
mov dword [esp], edx
mov dword [esp + 0xc], str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
mov dword [esp + 8], str._s_sConnection
mov dword [esp + 4], 0x400
call dword [sym.imp.msvcrt.dll__snprintf]
lea eax, [ebp - 0xc24]
lea edx, [ebp - 0xc1c]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], eax
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x40ea4c
inc ebx
mov eax, dword [ebp - 0xc28]
lea edi, [ebp - 0xc20]
lea esi, [ebp - 0x818]
mov dword [ebp - 0xc20], 0x400
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
sub esp, 0x20
test eax, eax
je 0x40e987
jmp 0x40eaf0
lea eax, [ebp - 0x418]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0xc24]
mov dword [ebp - 0xc20], 0x400
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Name
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov eax, dword [ebp - 0xc24]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
test edi, edi
jne 0x40e9ea
mov eax, esi
call sym._open_tap_device
mov dword [ebp - 0x81c], eax
inc eax
je 0x40e9ea
mov eax, dword [ebp - 0xc30]
mov dword [esp + 4], eax
lea eax, [ebp - 0x81c]
mov dword [esp], eax
mov eax, dword [ebp - 0xc2c]
call eax
test eax, eax
je 0x40eaf0
mov eax, dword [ebp - 0x81c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
jmp 0x40e9ea
mov eax, dword [ebp - 0xc28]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40ebd0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
xor edx, edx
mov eax, sym._print_adapter_callback
jmp sym._iterate_win_network_adapters
Function at 0x40f1f2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x1c]
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [ebp + 0x10]
push edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
jne 0x40f27a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x40f27f
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebx + 0x1c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push eax
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
jmp 0x40f292
mov dword [esp + 4], eax
mov dword [esp], str.GetLastError___returned__d_n
call sym._printf_2
or eax, 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40f29a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x1c]
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
lea esi, [ebx + 0x20]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [ebp + 0x10]
push edx
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
jne 0x40f328
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
or eax, 0xffffffff
cmp edx, 0x3e5
jne 0x40f32b
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push eax
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov eax, dword [ebx]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
sub esp, 0x10
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40f360
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40f378
mov dword [esp + 0x18], sym._AES_encrypt
jmp sym._CRYPTO_cbc128_encrypt
mov dword [esp + 0x18], sym._AES_decrypt
jmp sym._CRYPTO_cbc128_decrypt
Function at 0x40fef0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], edi
mov dword [esp], eax
call sym._AES_set_encrypt_key
test eax, eax
js 0x41011f
mov eax, dword [edi + 0xf0]
mov edx, edi
lea ebp, [eax*4]
test ebp, ebp
jle 0x40ff89
mov dword [esp + 0xc], edi
shl eax, 4
mov ecx, edi
xor ebx, ebx
add eax, edi
lea esi, [esi]
nop
mov esi, dword [ecx]
mov edx, dword [eax]
add ebx, 4
add ecx, 0x10
sub eax, 0x10
mov dword [ecx - 0x10], edx
mov edx, dword [eax + 0x14]
mov dword [eax + 0x10], esi
mov esi, dword [ecx - 0xc]
mov dword [ecx - 0xc], edx
mov edx, dword [eax + 0x18]
mov dword [eax + 0x14], esi
mov esi, dword [ecx - 8]
mov dword [ecx - 8], edx
mov edx, dword [eax + 0x1c]
mov dword [eax + 0x18], esi
mov esi, dword [ecx - 4]
mov dword [ecx - 4], edx
mov dword [eax + 0x1c], esi
mov esi, ebp
sub esi, ebx
cmp ebx, esi
jl 0x40ff40
mov edx, dword [esp + 0xc]
mov eax, dword [edi + 0xf0]
mov ecx, 1
cmp eax, 1
jle 0x41011d
lea esi, [esi]
nop
mov esi, dword [edx + 0x10]
add edx, 0x10
add ecx, 1
mov ebx, esi
mov eax, esi
movzx ebx, bl
shr eax, 0x18
movzx ebp, byte [ebx*4 + 0x42c000]
mov ebx, esi
movzx eax, byte [eax*4 + 0x42c000]
shr ebx, 0x10
movzx ebx, bl
mov eax, dword [eax*4 + 0x42b400]
xor eax, dword [ebp*4 + 0x42a800]
movzx ebx, byte [ebx*4 + 0x42c000]
xor eax, dword [ebx*4 + 0x42b000]
mov ebx, eax
mov eax, esi
mov esi, dword [edx + 4]
movzx eax, ah
movzx eax, byte [eax*4 + 0x42c000]
xor ebx, dword [eax*4 + 0x42ac00]
mov eax, esi
mov dword [edx], ebx
mov ebx, esi
shr eax, 0x18
movzx ebx, bl
movzx eax, byte [eax*4 + 0x42c000]
movzx ebp, byte [ebx*4 + 0x42c000]
mov ebx, esi
shr ebx, 0x10
mov eax, dword [eax*4 + 0x42b400]
movzx ebx, bl
xor eax, dword [ebp*4 + 0x42a800]
movzx ebx, byte [ebx*4 + 0x42c000]
xor eax, dword [ebx*4 + 0x42b000]
mov ebx, eax
mov eax, esi
mov esi, dword [edx + 8]
movzx eax, ah
movzx eax, byte [eax*4 + 0x42c000]
xor ebx, dword [eax*4 + 0x42ac00]
mov eax, esi
mov dword [edx + 4], ebx
mov ebx, esi
shr eax, 0x18
movzx ebx, bl
movzx eax, byte [eax*4 + 0x42c000]
movzx ebp, byte [ebx*4 + 0x42c000]
mov ebx, esi
shr ebx, 0x10
mov eax, dword [eax*4 + 0x42b400]
movzx ebx, bl
xor eax, dword [ebp*4 + 0x42a800]
movzx ebx, byte [ebx*4 + 0x42c000]
xor eax, dword [ebx*4 + 0x42b000]
mov ebx, eax
mov eax, esi
mov esi, dword [edx + 0xc]
movzx eax, ah
movzx eax, byte [eax*4 + 0x42c000]
xor ebx, dword [eax*4 + 0x42ac00]
mov eax, esi
mov dword [edx + 8], ebx
mov ebx, esi
shr eax, 0x18
movzx ebx, bl
movzx eax, byte [eax*4 + 0x42c000]
movzx ebp, byte [ebx*4 + 0x42c000]
mov ebx, esi
shr ebx, 0x10
mov eax, dword [eax*4 + 0x42b400]
movzx ebx, bl
xor eax, dword [ebp*4 + 0x42a800]
movzx ebx, byte [ebx*4 + 0x42c000]
xor eax, dword [ebx*4 + 0x42b000]
mov ebx, eax
mov eax, esi
movzx eax, ah
movzx eax, byte [eax*4 + 0x42c000]
xor ebx, dword [eax*4 + 0x42ac00]
mov dword [edx + 0xc], ebx
cmp dword [edi + 0xf0], ecx
jg 0x40ffa0
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x410980
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
cmp dword [esp + 0x10], 1
je 0x410990
jmp sym._AES_decrypt
jmp sym._AES_encrypt
Function at 0x412a50
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov eax, 0x4630c0
mov ecx, 0x13
push edi
push esi
push ebx
sub esp, 0x8c
mov ebx, dword [esp + 0xa8]
lea edx, [esp + 0x30]
mov ebp, dword [esp + 0xa4]
mov dword [esp + 0x10], 0x6a09e667
mov edi, edx
mov dword [esp + 0x7c], 0x20
lea esi, [esp + 0x10]
test ebx, ebx
cmove ebx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], 0xbb67ae85
mov dword [esp + 0x18], 0x3c6ef372
mov dword [esp + 0x1c], 0xa54ff53a
mov dword [esp + 0x20], 0x510e527f
mov dword [esp + 0x24], 0x9b05688c
mov dword [esp + 0x28], 0x1f83d9ab
mov dword [esp + 0x2c], 0x5be0cd19
test ebp, ebp
je 0x412ae1
mov edx, dword [esp + 0xa0]
mov ecx, ebp
mov eax, esi
call sym._SHA256_Update.part.0
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._SHA256_Final
mov dword [esp], esi
mov dword [esp + 4], 0x70
call sym._OPENSSL_cleanse
add esp, 0x8c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret