joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x64
mov ebx, dword [ebp + 8]
cmp ebx, dword [0x55e594]
je 0x4263b3
mov ecx, dword [0x55e598]
test ecx, ecx
sete dl
test ebx, ebx
setne al
test al, dl
jne 0x4263c0
mov dword [0x55e594], ebx
mov eax, 1
add esp, 0x64
pop ebx
pop ebp
ret
mov dword [ebp - 0x58], 0x7378646c
xor edx, edx
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 0x65767265
mov dword [ebp - 0x50], 0x6f6c2e72
mov word [ebp - 0x4c], 0x67
mov dword [esp + 8], edx
mov dword [esp + 4], ebx
mov dword [esp], eax
call method.LogFile.open_char_const__int__char_
jmp 0x4263a8

Function at 0x428c70
Capabilities:
Delete file

Disassembly:
push ebp
mov edx, sym.___gxx_personality_sj0
mov ebp, esp
push edi
mov eax, 0x52035a
lea edi, [ebp - 0x18]
push esi
mov esi, 0x428e01
push ebx
sub esp, 0x17c
lea ebx, [ebp - 0x16c]
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], edi
xor edi, edi
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x144], esp
mov dword [esp], ebx
call sym.__Unwind_SjLj_Register
mov dword [esp], 0x532ab0
xor edx, edx
mov ecx, 1
mov dword [esp + 8], ecx
mov eax, 0xffffffff
mov dword [esp + 4], edx
mov dword [ebp - 0x168], eax
call sym.OutLogMsg_char__int__int_
mov dword [ebp - 0x170], edi
mov esi, dword [0x5635f4]
test esi, esi
jle 0x428dc0
mov edx, dword [ebp - 0x170]
lea ecx, [ebp - 0x128]
mov ebx, 0x532a7f
mov dword [esp], ecx
mov eax, dword [0x5635ec]
mov esi, dword [str.._data]
mov dword [esp + 4], ebx
lea edi, [edx + edx*4]
shl edi, 5
mov dword [esp + 8], esi
add edi, eax
mov edx, 0xffffffff
mov dword [ebp - 0x168], edx
add edi, 0x50
mov esi, 0x55e928
mov dword [esp + 0xc], edi
call sym._sprintf
lea edi, [ebp - 0x128]
lea eax, [ebp - 0x128]
lea ebx, [ebp - 0x128]
mov dword [esp], eax
call sym.os_dirtrans_char_
mov dword [esp], edi
call method.c_FileManager.CloseFile_char_
mov dword [ebp - 0x138], esi
mov dword [esp], 0x55e928
call sub.KERNEL32.dll_EnterCriticalSection
sub esp, 4
mov ecx, 1
mov dword [esp], ebx
mov dword [ebp - 0x168], ecx
call sym._remove
mov ebx, dword [ebp - 0x138]
mov ecx, 0xffffffff
mov dword [ebp - 0x168], ecx
mov dword [esp], ebx
call sub.KERNEL32.dll_LeaveCriticalSection
inc dword [ebp - 0x170]
sub esp, 4
mov edx, dword [ebp - 0x170]
cmp dword [0x5635f4], edx
jg 0x428cf6
nop
mov eax, dword [0x5631ac]
test eax, eax
jne 0x428e42
xor ecx, ecx
xor edx, edx
mov eax, 0xffffffff
mov dword [0x5631ac], ecx
mov dword [0x5631b0], edx
mov dword [0x5631b8], eax
xor edi, edi
lea esi, [ebp - 0x16c]
mov dword [esp], esi
mov dword [0x5631b4], edi
call sym.__Unwind_SjLj_Unregister
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], eax
call sym.operator_delete___void_
jmp 0x428dc9
Function at 0x4325c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov dword [ebp - 0xc], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov edx, eax
mov dword [ebp - 0x12c], eax
mov eax, dword [eax + 0x1c8]
test eax, eax
je 0x4325ee
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x432600
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
xor edi, edi
lea ebx, [ebp - 0x128]
mov eax, str.balance.dat
mov dword [esp + 8], edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
movzx esi, word [edx]
mov dword [esp], 0x5631e0
mov dword [esp + 4], esi
call method.c_HQserver.makeDataFilePath_unsigned_short__char_const__char_const__char_
mov dword [esp], ebx
mov edx, 0x532dd7
mov dword [esp + 4], edx
call sym._fopen
test eax, eax
mov edi, eax
je 0x4325ee
mov ecx, dword [ebp - 0x12c]
xor ebx, ebx
mov edx, dword [ecx + 0x1c8]
mov eax, dword [edx + 8]
cmp eax, 0
jle 0x4326a0
xor esi, esi
nop
lea esi, [esi]
test ebx, ebx
js 0x432669
dec eax
cmp eax, ebx
jge 0x4326b5
xor eax, eax
mov dword [esp + 0xc], edi
mov edx, 0x2f
mov ecx, 1
mov dword [esp + 4], edx
inc ebx
add esi, 0x2f
mov dword [esp + 8], ecx
mov dword [esp], eax
call sym._fwrite
mov eax, dword [ebp - 0x12c]
mov edx, dword [eax + 0x1c8]
mov eax, dword [edx + 8]
cmp eax, ebx
jg 0x432660
mov dword [esp], edi
call sym._fclose
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov eax, dword [edx]
add eax, esi
jmp 0x43266b
Function at 0x462d20
Capabilities:
Get socket status

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
sub esp, 0x148
mov eax, 1
mov ecx, dword [ebp + 8]
cmp byte [ebp + 0xc], 0
mov dword [ebp - 0x118], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x120], edx
lea edx, [ebp - 0x120]
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x11c], eax
je 0x462d84
mov dword [esp + 0x10], edx
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x118]
mov dword [esp + 8], edx
lea edx, [ecx + 1]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.WSOCK32.DLL_select
sub esp, 0x14
leave
ret
mov dword [esp + 0x10], edx
xor eax, eax
lea edx, [ebp - 0x118]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], edx
lea edx, [ecx + 1]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.WSOCK32.DLL_select
sub esp, 0x14
leave
ret
Function at 0x4634c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov edx, dword [ebp + 0x14]
test edx, edx
jne 0x4634d2
mov edx, 0x40000
mov dword [esp + 4], edx
xor eax, eax
lea ecx, [ebp - 4]
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp], 0
call sym.__beginthreadex
mov edx, eax
xor eax, eax
test edx, edx
je 0x463516
mov eax, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, 1
leave
ret

Function at 0x463520
Capabilities:
Create thread

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
lea edx, [ebp - 4]
sub esp, 0x28
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x14], edx
mov edx, dword [ebp + 8]
mov dword [esp + 0x10], eax
mov eax, 0x40000
mov dword [esp + 8], edx
mov dword [ebp - 4], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov dword [esp], 0
call sym.__beginthreadex
mov edx, eax
xor eax, eax
test edx, edx
je 0x46356f
mov ecx, dword [ebp + 0x10]
mov eax, 1
mov dword [ecx], edx
leave
movzx eax, al
ret

Function at 0x463580
Capabilities:
Create thread

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
lea eax, [ebp - 4]
sub esp, 0x28
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], ecx
mov ecx, 0x40000
mov dword [esp + 0xc], edx
mov dword [ebp - 4], 0
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], 0
call sym.__beginthreadex
leave
test eax, eax
setne dl
movzx eax, dl
movzx eax, al
ret
Function at 0x470fa0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 4], esi
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 8], ebx
mov edx, dword [ebp + 0x14]
cmp eax, 0x110
je 0x471061
ja 0x470fd5
cmp eax, 0x10
je 0x47103f
mov ebx, dword [ebp - 8]
xor eax, eax
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x10
cmp eax, 0x111
jne 0x470fc7
movzx eax, word [ebp + 0x10]
cmp eax, 0x3f4
je 0x47103f
jle 0x4710d2
cmp eax, 0x44e
je 0x47103f
cmp eax, 0x4b3
jne 0x470fc7
mov dword [esp], esi
mov eax, 0x4b1
lea ebx, [ebp - 0x18]
mov dword [esp + 4], eax
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov ecx, 8
mov dword [esp + 8], ecx
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.USER32.dll_GetWindowTextA
sub esp, 0xc
mov dword [esp], ebx
call sym._atoi
cmp eax, 0xa
ja 0x47103f
mov dword [esp], eax
call sym.SetLogLevel_int_
mov dword [esp], esi
xor edx, edx
mov dword [esp + 4], edx
call sub.USER32.dll_EndDialog
sub esp, 8
mov eax, 1
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x10
cmp edx, 2
je 0x471129
jg 0x4710a0
dec edx
jne 0x471050
call sym.MakeMachinaCode__
mov ebx, eax
mov eax, 0x44d
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.USER32.dll_GetDlgItem
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.USER32.dll_SetWindowTextA
sub esp, 8
jmp 0x471050
cmp edx, 3
jne 0x471050
mov ebx, 0x53497c
mov edx, str.V2.15.0822
mov eax, 0x534989
mov dword [esp + 8], ebx
lea ebx, [ebp - 0x48]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._sprintf
mov eax, 0x3eb
jmp 0x47107b
cmp eax, 0x3e9
je 0x47103f
cmp eax, 0x3f3
jne 0x470fc7
mov dword [esp], esi
xor edx, edx
xor ebx, ebx
mov dword [esp + 4], edx
call sub.USER32.dll_EndDialog
sub esp, 8
xor eax, eax
mov ecx, 0x10
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov esi, dword [0x563874]
mov dword [esp], esi
call sub.USER32.dll_SendMessageA
sub esp, 0x10
mov eax, 1
jmp 0x471055
call sym.GetLogLevel__
mov dword [esp + 8], eax
mov ecx, 0x53498e
lea ebx, [ebp - 0x18]
mov dword [esp + 4], ecx
mov dword [esp], ebx
call sym._sprintf
mov edx, 0x4b1
mov dword [esp + 4], edx
jmp 0x47107f

Function at 0x471ef9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push 0x80000000
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
test eax, eax
jne 0x471f51
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x5349fc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
test eax, eax
jne 0x471f44
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
mov eax, esi
jmp 0x471f53
xor eax, eax
pop esi
leave
ret 4
Function at 0x4723f0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push edi
push esi
push ebx
mov ecx, dword [esp + 0x1c]
push ecx
mov edx, dword [esp + 0x1c]
push edx
mov eax, dword [esp + 0x1c]
push eax
call sym._AES_set_encrypt_key
add esp, 0xc
test eax, eax
js 0x47263c
mov esi, dword [esp + 0x1c]
mov eax, dword [esi + 0xf0]
xor ebp, ebp
lea edi, [eax*4]
cmp ebp, edi
jge 0x472476
lea ebx, [esi + edi*4]
mov ecx, esi
nop
mov edx, dword [ecx]
mov eax, dword [ebx]
mov dword [ecx], eax
mov dword [ebx], edx
mov edx, dword [ecx + 4]
mov eax, dword [ebx + 4]
mov dword [ecx + 4], eax
mov dword [ebx + 4], edx
mov edx, dword [ecx + 8]
mov eax, dword [ebx + 8]
mov dword [ecx + 8], eax
mov dword [ebx + 8], edx
mov edx, dword [ecx + 0xc]
mov eax, dword [ebx + 0xc]
add ebp, 4
sub edi, 4
mov dword [ecx + 0xc], eax
mov dword [ebx + 0xc], edx
add ecx, 0x10
sub ebx, 0x10
cmp ebp, edi
jl 0x472430
mov ebx, dword [esp + 0x1c]
mov eax, dword [ebx + 0xf0]
mov ebx, 1
dec eax
jmp 0x472634
add esi, 0x10
mov ecx, dword [esi]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov al, byte [edi*4 + 0x536300]
mov ebp, ecx
shr ebp, 0x18
xor edx, edx
and eax, 0xff
mov dl, byte [ebp*4 + 0x536300]
mov eax, dword [eax*4 + 0x535300]
movzx ebp, ch
xor eax, dword [edx*4 + 0x535700]
mov dl, byte [ebp*4 + 0x536300]
and edx, 0xff
xor eax, dword [edx*4 + 0x534f00]
and ecx, 0xff
xor edx, edx
mov dl, byte [ecx*4 + 0x536300]
mov ecx, dword [esi + 4]
mov ebp, ecx
shr ebp, 0x10
xor eax, dword [edx*4 + 0x534b00]
and ebp, 0xff
mov dword [esi], eax
mov edi, ecx
mov al, byte [ebp*4 + 0x536300]
shr edi, 0x18
xor edx, edx
and eax, 0xff
mov dl, byte [edi*4 + 0x536300]
mov eax, dword [eax*4 + 0x535300]
movzx edi, ch
xor eax, dword [edx*4 + 0x535700]
mov dl, byte [edi*4 + 0x536300]
and edx, 0xff
xor eax, dword [edx*4 + 0x534f00]
and ecx, 0xff
xor edx, edx
mov dl, byte [ecx*4 + 0x536300]
mov ecx, dword [esi + 8]
mov edi, ecx
shr edi, 0x10
xor eax, dword [edx*4 + 0x534b00]
and edi, 0xff
mov dword [esi + 4], eax
mov ebp, ecx
mov al, byte [edi*4 + 0x536300]
shr ebp, 0x18
xor edx, edx
and eax, 0xff
mov dl, byte [ebp*4 + 0x536300]
mov eax, dword [eax*4 + 0x535300]
movzx ebp, ch
xor eax, dword [edx*4 + 0x535700]
mov dl, byte [ebp*4 + 0x536300]
and edx, 0xff
xor eax, dword [edx*4 + 0x534f00]
and ecx, 0xff
xor edx, edx
mov dl, byte [ecx*4 + 0x536300]
mov ecx, dword [esi + 0xc]
mov ebp, ecx
xor eax, dword [edx*4 + 0x534b00]
shr ebp, 0x10
and ebp, 0xff
mov dword [esi + 8], eax
mov edi, ecx
mov al, byte [ebp*4 + 0x536300]
shr edi, 0x18
xor edx, edx
and eax, 0xff
mov dl, byte [edi*4 + 0x536300]
mov ebp, dword [eax*4 + 0x535300]
movzx edi, ch
xor ebp, dword [edx*4 + 0x535700]
mov dl, byte [edi*4 + 0x536300]
and edx, 0xff
xor ebp, dword [edx*4 + 0x534f00]
and ecx, 0xff
xor edx, edx
mov dl, byte [ecx*4 + 0x536300]
xor ebp, dword [edx*4 + 0x534b00]
mov dword [esi + 0xc], ebp
inc ebx
mov edi, dword [esp + 0x1c]
cmp dword [edi + 0xf0], ebx
jg 0x472490
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x476190
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x476270
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x476205
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym._BF_encrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x4761cf
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x476330
call 0x476217
pop edx
lea ecx, [edx + 0x139]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x4762c8
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym._BF_decrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x47627d
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x476330
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call sym._BF_decrypt
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x476325
jmp 0x476330
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x476390
Capabilities:
Encrypt data using blowfish

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x28]
mov ebp, dword [esp + 0x24]
mov edi, dword [esp + 0x2c]
push 0x1048
push 0x536e10
push ebp
call sym._memcpy
add esp, 0x10
cmp ebx, 0x48
jle 0x4763c0
mov ebx, 0x48
mov eax, edi
lea ebx, [edi + ebx]
xor esi, esi
lea edx, [eax + 1]
xor ecx, ecx
cmp edx, ebx
mov cl, byte [eax]
jb 0x4763d4
mov edx, edi
xor eax, eax
shl ecx, 8
mov al, byte [edx]
inc edx
or ecx, eax
cmp edx, ebx
jb 0x4763e4
mov edx, edi
xor eax, eax
shl ecx, 8
mov al, byte [edx]
inc edx
or ecx, eax
cmp edx, ebx
jb 0x4763f4
mov edx, edi
xor eax, eax
shl ecx, 8
mov al, byte [edx]
or ecx, eax
lea eax, [edx + 1]
cmp eax, ebx
jb 0x476406
mov eax, edi
xor dword [ebp + esi*4], ecx
inc esi
cmp esi, 0x11
jle 0x4763c7
mov dword [esp], 0
mov edx, esp
mov dword [esp + 4], 0
xor ebx, ebx
mov esi, esp
sub esp, 8
push ebp
push edx
call sym._BF_encrypt
mov edx, dword [esp + 0x10]
mov dword [ebp + ebx*4], edx
mov ecx, dword [esp + 0x14]
mov dword [ebp + ebx*4 + 4], ecx
add ebx, 2
add esp, 0x10
cmp ebx, 0x11
mov edx, esi
jle 0x476425
lea esi, [ebp + 0x48]
xor ebx, ebx
mov edi, esp
lea esi, [esi]
lea edi, [edi]
sub esp, 8
push ebp
push edx
call sym._BF_encrypt
mov ecx, dword [esp + 0x10]
mov dword [esi + ebx*4], ecx
mov eax, dword [esp + 0x14]
mov dword [esi + ebx*4 + 4], eax
add ebx, 2
add esp, 0x10
cmp ebx, 0x3ff
mov edx, edi
jle 0x476460
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x482660
Capabilities:
Query environment variable

Disassembly:
sub esp, 0xc
mov ecx, dword [0x563a88]
test ecx, ecx
je 0x482680
add esp, 0xc
ret
sub esp, 0xc
push str.OPENSSL_ia32cap
mov dword [0x563a88], 1
call sym._getenv
add esp, 0x10
test eax, eax
je 0x4826b8
push edx
push 0
push 0
push eax
call sym._strtoul
or ah, 4
add esp, 0x10
mov dword [0x5639f4], eax
add esp, 0xc
ret
call sym._OPENSSL_ia32_cpuid
or ah, 4
mov dword [0x5639f4], eax
add esp, 0xc
ret

Function at 0x4827b0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x11c
mov ebx, dword [ebp + 8]
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
add esp, 0xc
test eax, eax
je 0x4827dc
sub esp, 0xc
push eax
call sub.KERNEL32.dll_GetFileType
add esp, 0xc
test eax, eax
jne 0x482830
lea edx, [ebp + 0xc]
push edx
push ebx
push 0xff
lea esi, [ebp - 0x108]
push esi
call sym.__vsnprintf
mov byte [ebp - 9], 0
call sub.KERNEL32.dll_GetVersion
add esp, 0x10
test eax, eax
js 0x48280b
call sym._OPENSSL_isservice
test eax, eax
jne 0x482850
push 0x10
push str.OpenSSL:_FATAL
push esi
push 0
call sub.USER32.dll_MessageBoxA
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea ecx, [ebp + 0xc]
push edx
push ecx
push ebx
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call sym._vfprintf
add esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
sub esp, 8
push str.OPENSSL
push 0
call sub.ADVAPI32.DLL_RegisterEventSourceA
mov dword [ebp - 0x10c], esi
push esi
push 0
lea esi, [ebp - 0x10c]
push esi
push 0
push 1
push 0
push 0
push 0
push 1
push eax
mov ebx, eax
call sub.ADVAPI32.DLL_ReportEventA
push ebx
call sub.ADVAPI32.DLL_DeregisterEventSource
add esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x4a44e0
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
xor esi, esi
test edx, edx
je 0x4a44f7
mov al, byte [edx]
test al, al
mov ebx, 0x100
jne 0x4a4500
pop ebx
xor eax, eax
pop esi
ret
movsx eax, al
or eax, ebx
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
imul eax, eax
rol esi, cl
inc edx
xor esi, eax
mov al, byte [edx]
add ebx, 0x100
test al, al
jne 0x4a4500
mov eax, esi
shr eax, 0x10
pop ebx
xor eax, esi
pop esi
ret
Function at 0x4e653e
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
push esi
call sym._UI_get_string_type
add esp, 0x10
cmp eax, 2
je 0x4e64c0
ja 0x4e6400
dec eax
je 0x4e6470
mov eax, 1
pop edx
pop ebx
pop esi
ret
cmp eax, 3
jne 0x4e63e8
sub esp, 8
mov edx, dword [0x5669e0]
push edx
push esi
call sym._UI_get0_output_string
mov dword [esp], eax
call sym._fputs
pop eax
pop edx
mov ecx, dword [0x5669e0]
push ecx
push esi
call sym._UI_get0_action_string
mov dword [esp], eax
call sym._fputs
pop edx
mov eax, dword [0x5669e0]
push eax
call sym._fflush
add esp, 0x10
mov dword [esp + 0x14], 0
sub esp, 0xc
push esi
call sym._UI_get_input_flags
and eax, 1
mov dword [esp + 0x20], eax
add esp, 0x14
mov eax, ebx
pop ebx
mov edx, esi
pop esi
jmp sym._read_string_inner
sub esp, 8
mov ecx, dword [0x5669e0]
push ecx
push esi
call sym._UI_get0_output_string
mov dword [esp], eax
call sym._fputs
pop eax
mov eax, dword [0x5669e0]
push eax
call sym._fflush
add esp, 0x10
mov dword [esp + 0x14], 1
sub esp, 0xc
push esi
call sym._UI_get_input_flags
and eax, 1
mov dword [esp + 0x20], eax
add esp, 0x14
mov eax, ebx
pop ebx
mov edx, esi
pop esi
jmp sym._read_string_inner
sub esp, 0xc
push esi
call sym._UI_get0_output_string
add esp, 0xc
push eax
push str.Verifying____s
mov eax, dword [0x5669e0]
push eax
call sym._fprintf
pop eax
mov edx, dword [0x5669e0]
push edx
call sym._fflush
pop eax
pop edx
push 1
push esi
call sym._UI_get_input_flags
and eax, 1
mov dword [esp], eax
mov edx, esi
mov eax, ebx
call sym._read_string_inner
add esp, 0x10
test eax, eax
jle 0x4e63ed
sub esp, 0xc
push esi
call sym._UI_get0_test_string
mov ebx, eax
mov dword [esp], esi
call sym._UI_get0_result_string
pop edx
pop ecx
push ebx
push eax
call sym._strcmp
add esp, 0x10
test eax, eax
je 0x4e63e8
mov ecx, dword [0x5669e0]
push ecx
push 0xf
push 1
push str.Verify_failure_n
call sym._fwrite
pop ebx
mov esi, dword [0x5669e0]
push esi
call sym._fflush
add esp, 0x10
pop edx
pop ebx
xor eax, eax
pop esi
ret
Function at 0x4f3184
Capabilities:
Capture screenshot

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
call sym._RAND_poll
call sub.KERNEL32.dll_GetVersion
test eax, eax
js 0x4f316e
call sym._OPENSSL_isservice
test eax, eax
jne 0x4f3180
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret
push 0
push 0
push 0
push str.DISPLAY
call sub.GDI32.dll_CreateDCA
mov dword [esp + 0x1c], eax
sub esp, 0xc
push eax
call sub.GDI32.dll_CreateCompatibleDC
pop edx
mov dword [esp + 0x20], eax
push 8
mov eax, dword [esp + 0x28]
push eax
call sub.GDI32.dll_GetDeviceCaps
mov dword [esp + 0x18], eax
push 0xa
mov ebp, dword [esp + 0x28]
push ebp
call sub.GDI32.dll_GetDeviceCaps
pop ebp
mov dword [esp + 0x10], eax
push 0x10
mov edi, dword [esp + 0x18]
push edi
mov esi, dword [esp + 0x28]
push esi
call sub.GDI32.dll_CreateCompatibleBitmap
push ebx
push eax
mov ebx, dword [esp + 0x24]
push ebx
mov ebp, eax
call sub.GDI32.dll_SelectObject
pop edx
lea ecx, [esp + 0x44]
mov dword [esp + 0x18], eax
push ecx
push 0x18
push ebp
call sub.GDI32.dll_GetObjectA
mov edx, dword [esp + 0x4c]
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
imul edi, edx
push 0x2d5
and eax, 0xffff
imul edi, eax
push str..crypto_rand_rand_win.c
push edi
call sym._CRYPTO_malloc
add esp, 0x10
test eax, eax
mov ebx, eax
je 0x4f32b4
mov edx, dword [esp + 0xc]
sub edx, 0x10
xor esi, esi
cmp edx, 0
mov dword [esp + 8], edx
jmp 0x4f32a6
sub esp, 0xc
push 0xcc0020
push esi
push 0
mov eax, dword [esp + 0x34]
push eax
push 0x10
mov ecx, dword [esp + 0x30]
push ecx
push 0
push 0
mov edx, dword [esp + 0x44]
push edx
call sub.GDI32.dll_BitBlt
pop eax
pop edx
push ebx
push edi
push ebp
call sub.GDI32.dll_GetBitmapBits
push eax
push 0
push eax
call sym._EVP_sha1
mov dword [esp], eax
push 0
lea eax, [esp + 0x34]
push eax
push edi
push ebx
call sym._EVP_Digest
add esp, 0x20
push 0
push 0
push 0x14
lea ecx, [esp + 0x2c]
push ecx
call sym._RAND_add
add esi, 0x10
add esp, 0x10
cmp dword [esp + 8], esi
jg 0x4f3240
sub esp, 0xc
push ebx
call sym._CRYPTO_free
add esp, 0x10
sub esp, 8
mov ebp, dword [esp + 0x1c]
push ebp
mov edi, dword [esp + 0x24]
push edi
call sub.GDI32.dll_SelectObject
push edi
push eax
call sub.GDI32.dll_DeleteObject
mov esi, dword [esp + 0x24]
push esi
call sub.GDI32.dll_DeleteDC
mov ebx, dword [esp + 0x28]
push ebx
call sub.GDI32.dll_DeleteDC
add esp, 0xc
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret