joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a250
Capabilities:
Move file

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
call fcn.00465d60
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov esi, dword [eax]
mov edi, dword [eax + 4]
mov ebx, dword [eax + 8]
mov ebp, dword [eax + 0xc]
add esp, 4
push 1
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x48a2f7
lea eax, [esp + 0x10]
push eax
call fcn.00465d60
mov edx, dword [eax]
sub esp, 0xc
mov ecx, esp
mov dword [ecx], esi
mov dword [ecx + 4], edi
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], ebp
sub esp, 0x10
mov ecx, esp
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ecx + 8], edx
mov dword [ecx + 0xc], eax
call fcn.00465e00
add esp, 0x20
test edx, edx
jl 0x48a301
jg 0x48a2cc
test eax, eax
jb 0x48a301
test edx, edx
jg 0x48a301
jl 0x48a2d9
cmp eax, 0x3e8
ja 0x48a301
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push 1
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x48a285
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret

Function at 0x48d3d0
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
mov byte [esi + edi - 1], 0
jne 0x48d403
push 0x2e
push esi
call dword [sym.imp.MSVCR80.dll_strchr]
add esp, 8
test eax, eax
je 0x48d401
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret
Function at 0x491410
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x5d2038]
mov edi, eax
add esp, 4
test edi, edi
jne 0x491435
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x49147c
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x491480
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
test ebp, ebp
mov dword [esp + 0x10], 0
jbe 0x4914e0
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
add ebx, 1
call edx
add esp, 0x18
sub ebp, 1
jne 0x4914a3
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 0x10]
pop ebp
pop ebx
jae 0x491523
jmp 0x4914f0
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x584564
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x584565
push eax
call ecx
mov eax, dword [esp + 0x20]
add eax, 1
add esp, 0x18
cmp eax, dword [esi + 0x10]
mov dword [esp + 8], eax
jb 0x4914f0
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x4c8110
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.00497d50
mov eax, dword [0x5d2020]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
mov dword [esp + 0x3c], 0
jne 0x4c8157
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.0044e502
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call sub.MSVCR80.dll__stat64i32
add esp, 8
test eax, eax
jl 0x4c8140
mov eax, 8
call fcn.00497d50
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.004c7f80
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x4c8140
push 0x5c6138
push esi
call sub.MSVCR80.dll_fopen
add esp, 8
test eax, eax
mov dword [esp + 0x40], eax
je 0x4c8231
jmp 0x4c81b4
mov eax, dword [esp + 0x40]
test ebx, ebx
jle 0x4c81c2
cmp ebx, 0x400
mov esi, ebx
jl 0x4c81c7
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x80]
push 1
push edx
call sub.MSVCR80.dll_fread
mov edi, eax
add esp, 0x10
test edi, edi
mov dword [esp + 0x44], edi
jle 0x4c8215
fild dword [esp + 0x44]
mov eax, 8
call fcn.00497d50
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.004c7f80
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x4c81b0
sub ebx, esi
test ebx, ebx
jg 0x4c81b0
mov ecx, dword [esp + 0x40]
push ecx
call sub.MSVCR80.dll_fclose
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.004da4a0
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044e502
mov esp, ebp
pop ebp
ret

Function at 0x4c8250
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
xor esi, esi
call fcn.004545e0
test eax, eax
mov edi, dword [esp + 0x10]
jne 0x4c82aa
push str.RANDFILE
call sub.MSVCR80.dll_getenv
mov esi, eax
add esp, 4
test esi, esi
je 0x4c82aa
cmp byte [esi], 0
je 0x4c82aa
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4c8280
sub eax, edx
add eax, 1
cmp eax, edi
jae 0x4c82aa
push edi
push esi
mov esi, dword [esp + 0x14]
push esi
call fcn.004dbd90
add esp, 0xc
cmp eax, edi
jb 0x4c831c
pop edi
xor eax, eax
pop esi
ret
call fcn.004545e0
test eax, eax
jne 0x4c82c2
push str.HOME
call sub.MSVCR80.dll_getenv
add esp, 4
mov esi, eax
test esi, esi
jne 0x4c82cd
mov esi, 0x58c10c
jmp 0x4c82d2
cmp byte [esi], 0
je 0x4c8315
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4c82d7
sub eax, edx
add eax, 6
cmp eax, edi
jae 0x4c8315
push edi
push esi
mov esi, dword [esp + 0x14]
push esi
call fcn.004dbd90
push edi
push 0x5c68fc
push esi
call fcn.004dbde0
push edi
push str..rnd
push esi
call fcn.004dbde0
add esp, 0x24
pop edi
mov eax, esi
pop esi
ret
mov esi, dword [esp + 0xc]
mov byte [esi], 0
pop edi
mov eax, esi
pop esi
ret
Function at 0x4caee0
Capabilities:
Query environment variable

Disassembly:
push str.OPENSSL_CONF
call sub.MSVCR80.dll_getenv
add esp, 4
test eax, eax
je 0x4caefb
push eax
call fcn.004dbec0
add esp, 4
ret
call fcn.004f3760
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4caf03
push esi
push edi
sub eax, edx
push 0x21b
lea edi, [eax + 0xd]
push str..cryptoconfconf_mod.c
push edi
call fcn.004cc280
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4caf2f
pop edi
pop esi
ret
push edi
call fcn.004f3760
push eax
push esi
call fcn.004dbd90
push edi
push 0x5c68fc
push esi
call fcn.004dbde0
push edi
push str.openssl.cnf
push esi
call fcn.004dbde0
add esp, 0x24
pop edi
mov eax, esi
pop esi
ret
Function at 0x4d8450
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.0044ea7c
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret
Function at 0x4d90a0
Capabilities:
Query environment variable

Disassembly:
mov eax, 8
call fcn.00497d50
cmp dword [0x5deb74], 0
jne 0x4d91af
push esi
push str.OPENSSL_ia32cap
mov dword [0x5deb74], 1
call sub.MSVCR80.dll_getenv
mov esi, eax
add esp, 4
test esi, esi
je 0x4d91ba
xor eax, eax
cmp byte [esi], 0x7e
push ebx
sete al
push edi
lea ecx, [esp + 0xc]
push ecx
push str._I64i
mov edi, eax
lea ebx, [edi + esi]
push ebx
call sub.MSVCR80.dll_sscanf
add esp, 0xc
test eax, eax
jne 0x4d9116
push eax
push eax
push ebx
call sub.MSVCR80.dll_strtoul
add esp, 0xc
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
test edi, edi
je 0x4d9139
push 0x5dff30
call fcn.004da140
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
not ecx
not edi
add esp, 4
and eax, ecx
and edx, edi
jmp 0x4d914b
cmp byte [esi], 0x3a
jne 0x4d9153
push 0x5dff30
call fcn.004da140
add esp, 4
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
push 0x3a
push esi
mov dword [0x5dff38], 0
call sub.MSVCR80.dll_strchr
add esp, 8
test eax, eax
pop edi
pop ebx
je 0x4d9196
add eax, 1
xor edx, edx
cmp byte [eax], 0x7e
push 0
sete dl
push 0
mov esi, edx
add eax, esi
push eax
call sub.MSVCR80.dll_strtoul
add esp, 0xc
test esi, esi
je 0x4d91b3
not eax
and dword [0x5dff38], eax
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
or eax, 0x400
mov dword [0x5dff30], eax
mov dword [0x5dff34], ecx
pop esi
add esp, 8
ret
mov dword [0x5dff38], eax
jmp 0x4d9196
push 0x5dff30
call fcn.004da140
add esp, 4
mov dword [esp + 8], edx
jmp 0x4d919a
Function at 0x4d9310
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.00497d50
mov eax, dword [0x5d2020]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x4d9397
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4d9397
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push pe_nt_image_headers32
push edx
call sub.MSVCR80.dll__vsnprintf
add esp, 0x10
test eax, eax
jge 0x4d936d
mov eax, pe_nt_image_headers32
push 0
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0044e502
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0xff
push edx
call sub.MSVCR80.dll__vsnprintf
add esp, 0x10
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4d9425
call fcn.004d91d0
test eax, eax
jle 0x4d9425
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 1
push 0
push 0
push 0
mov esi, eax
push 1
lea eax, [esp + 0x28]
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0044e502
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0044e502
add esp, 0x108
ret

Function at 0x4d9480
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x4d94a6
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
add eax, 1
or cl, dl
sub edi, 1
jne 0x4d9496
pop esi
movzx eax, cl
pop edi
ret
Function at 0x4ee770
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.00497d50
mov eax, dword [0x5d2020]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x9c]
push ebx
mov ebx, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x94]
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
push edi
mov edi, dword [esp + 0x9c]
je 0x4ee7e5
cmp ebx, dword [esi]
je 0x4ee7dc
test edi, edi
je 0x4ee7c2
cmp dword [esp + 0xa0], eax
jge 0x4ee7dc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.0044e502
add esp, 0x88
ret
mov eax, 1
mov dword [esi], ebx
jmp 0x4ee7eb
mov ebx, dword [esi]
test ebx, ebx
je 0x4ee7c2
test edi, edi
push ebp
je 0x4ee8bd
push ebx
call fcn.004eb770
mov ebp, eax
add esp, 4
cmp ebp, 0x80
jle 0x4ee81b
push str.j____int_sizeof_ctx__key_
push 0x74
push str..cryptohmachmac.c
call fcn.004d9450
add esp, 0xc
mov eax, dword [esp + 0xa4]
cmp ebp, eax
jge 0x4ee875
mov ecx, dword [esp + 0x10]
push ecx
lea ebp, [esi + 4]
push ebx
push ebp
call fcn.004d4440
add esp, 0xc
test eax, eax
je 0x4ee978
mov edx, dword [esp + 0xa4]
push edx
push edi
push ebp
call fcn.004d45f0
add esp, 0xc
test eax, eax
je 0x4ee978
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebp
call fcn.004d4600
add esp, 0xc
test eax, eax
je 0x4ee978
jmp 0x4ee89a
cmp eax, 0x80
ja 0x4ee978
push eax
lea ecx, [esi + 0x50]
push edi
push ecx
call sub.MSVCR80.dll_memcpy
mov edx, dword [esp + 0xb0]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], edx
mov edi, dword [edi]
cmp edi, 0x80
je 0x4ee8c5
mov eax, 0x80
sub eax, edi
push eax
lea ecx, [edi + esi + 0x50]
push 0
push ecx
call fcn.0044ea7c
add esp, 0xc
jmp 0x4ee8c5
test eax, eax
je 0x4ee964
xor eax, eax
jmp 0x4ee8d0
mov dl, byte [esi + eax + 0x50]
xor dl, 0x36
mov byte [esp + eax + 0x14], dl
add eax, 1
cmp eax, 0x80
jl 0x4ee8d0
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x1c]
push ebx
push ebp
call fcn.004d4440
add esp, 0xc
test eax, eax
je 0x4ee978
push ebx
call fcn.004eb770
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.004d45f0
add esp, 0x10
test eax, eax
je 0x4ee978
xor eax, eax
jmp 0x4ee920
mov dl, byte [esi + eax + 0x50]
xor dl, 0x5c
mov byte [esp + eax + 0x14], dl
add eax, 1
cmp eax, 0x80
jl 0x4ee920
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x34]
push ebx
push ebp
call fcn.004d4440
add esp, 0xc
test eax, eax
je 0x4ee978
push ebx
call fcn.004eb770
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.004d45f0
add esp, 0x10
test eax, eax
je 0x4ee978
lea edx, [esi + 0x1c]
push edx
add esi, 4
push esi
call fcn.004d4790
add esp, 8
test eax, eax
jne 0x4ee97c
xor eax, eax
jmp 0x4ee981
mov eax, 1
mov ecx, dword [esp + 0x94]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0044e502
add esp, 0x88
ret
Function at 0x516dc0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x516eb0
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
jl 0x516e42
movzx eax, byte [esi + 2]
xor edx, edx
mov dh, byte [esi]
add ecx, 1
add ecx, 1
add ecx, 1
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x5ab760]
mov byte [ecx - 3], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x5ab760]
mov byte [ecx - 2], al
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x5ab760]
mov byte [ecx - 1], al
and edx, 0x3f
movzx edx, byte [edx + 0x5ab760]
mov byte [ecx], dl
jmp 0x516e9b
movzx edx, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x516e54
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x5ab760]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x5ab760]
add ecx, 1
mov byte [ecx], al
add ecx, 1
cmp edi, 1
jne 0x516e86
lea edx, [edi + 0x3c]
jmp 0x516e93
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x5ab760]
mov byte [ecx], dl
add ecx, 1
mov byte [ecx], 0x3d
sub edi, 3
add ecx, 1
add ebp, 4
add esi, 3
test edi, edi
jg 0x516de0
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret

Function at 0x533cf0
Capabilities:
Set socket configuration

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push esi
lea ecx, [esp + 0xc]
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jge 0x533d31
push 0x233
push str..crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call fcn.004c7a20
add esp, 0x14
xor eax, eax
test esi, esi
sete al
pop esi
ret
Function at 0x533d40
Capabilities:
Resolve dns

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
mov ecx, ebp
mov ebx, 1
call fcn.00533c30
mov edi, eax
add esp, 4
test edi, edi
jge 0x533d7c
push 0x7b
push str..crypto_bio_b_sock.c
push 0x6c
push 0x6a
push 0x20
call fcn.004c7a20
add esp, 0x14
jmp 0x533e3a
call fcn.00533bb0
cmp eax, 1
jne 0x533e4a
test edi, edi
jle 0x533d95
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
push 0x8e
push str..crypto_bio_b_sock.c
push 0x16
push 9
call fcn.004d94b0
add esp, 0x10
push ebp
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x533dd0
push 0x92
push str..crypto_bio_b_sock.c
push 0x66
push 0x6a
push 0x20
call fcn.004c7a20
add esp, 0x14
jmp 0x533e20
cmp word [eax + 8], 2
je 0x533df1
push 0x99
push str..crypto_bio_b_sock.c
push 0x6b
push 0x6a
push 0x20
call fcn.004c7a20
add esp, 0x14
jmp 0x533e20
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
movzx ecx, byte [edx]
mov byte [esi], cl
mov edx, dword [eax + 0xc]
mov ecx, dword [edx]
mov dl, byte [ecx + 1]
mov byte [esi + 1], dl
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
movzx ecx, byte [edx + 2]
mov byte [esi + 2], cl
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
movzx ecx, byte [eax + 3]
mov byte [esi + 3], cl
xor ebx, ebx
push 0xa2
push str..crypto_bio_b_sock.c
push 0x16
push 0xa
call fcn.004d94b0
add esp, 0x10
test ebx, ebx
je 0x533e51
push ebp
push 0x5a1394
push 2
call fcn.004c7d10
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x543170
Capabilities:
Query environment variable

Disassembly:
mov eax, 0xc
call fcn.00497d50
push ebx
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jne 0x54318a
xor eax, eax
pop ebx
add esp, 0xc
ret
push ebp
mov ebp, dword [esp + 0x18]
test ebp, ebp
je 0x54320c
push esi
mov esi, dword [esp + 0x20]
test esi, esi
je 0x5431d8
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
call fcn.004dc430
add esp, 8
test eax, eax
jne 0x5431f9
push edi
mov edi, 0x5b7f44
mov ecx, 4
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
pop edi
jne 0x5431d8
push ebx
call sub.MSVCR80.dll_getenv
add esp, 4
test eax, eax
jne 0x5431fc
mov ecx, dword [ebp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [esp + 0x14], str.default
mov dword [esp + 0x18], ebx
call fcn.004dc430
add esp, 8
test eax, eax
je 0x543203
mov eax, dword [eax + 8]
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
push ebx
call sub.MSVCR80.dll_getenv
add esp, 4
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x543ce0
Capabilities:
Query environment variable

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
ja 0x543d34
mov eax, dword [ecx*4 + 0x5dfd60]
test eax, eax
push esi
lea esi, [ecx*4 + 0x5dfd60]
jne 0x543d2d
mov eax, dword [ecx*4 + 0x5db810]
push edi
push eax
call sub.MSVCR80.dll_getenv
mov edi, eax
add esp, 4
test edi, edi
je 0x543d2f
mov eax, dword [esi]
test eax, eax
je 0x543d21
push eax
call fcn.004cc480
add esp, 4
push edi
call fcn.004dbec0
add esp, 4
mov dword [esi], eax
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
xor eax, eax
ret

Function at 0x5579f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x557a09
mov esi, edi
mov edi, eax
jmp 0x557a0b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x557a1b
mov eax, ebx
jmp 0x557a25
push eax
push ebx
call fcn.004d0dd0
add esp, 8
test eax, eax
jne 0x557a2d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x557a4b
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [edi + 4]
jl 0x557a34
cmp eax, dword [esi + 4]
jge 0x557a62
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [esi + 4]
jl 0x557a50
mov eax, dword [esi + 4]
test eax, eax
mov dword [ebx + 4], eax
jle 0x557a85
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x557a82
sub eax, 1
test eax, eax
jg 0x557a72
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x55d699
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.00497d50
mov eax, dword [0x5d2020]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
test eax, eax
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
jbe 0x55d82c
push ebx
add eax, 0xffffffff
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
add eax, 1
mov dword [esp + 0x18], eax
movzx ebx, byte [esi]
xor eax, eax
mov ah, byte [esi + 1]
add esi, 1
movzx ecx, byte [esi + 1]
add esi, 1
movzx edx, byte [esi + 1]
or ebx, eax
add esi, 1
movzx eax, byte [esi + 1]
shl ecx, 0x10
add esi, 1
or ebx, ecx
xor ecx, ecx
mov ch, byte [esi + 1]
add esi, 1
shl edx, 0x18
or ebx, edx
movzx edx, byte [esi + 1]
or eax, ecx
add esi, 1
movzx ecx, byte [esi + 1]
add esi, 1
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
add esi, 1
mov byte [edi], dl
mov byte [ebp], al
call fcn.004d76b0
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.004d7830
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.00510580
push ebp
call fcn.004d76b0
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.004d7830
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.00510580
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
add eax, 1
shr edx, 8
add esp, 0x30
mov byte [eax], dl
add eax, 1
add eax, 1
mov edx, ebx
shr edx, 0x10
mov byte [eax - 1], dl
mov edx, dword [esp + 0x14]
add eax, 1
shr ebx, 0x18
mov byte [eax - 1], bl
mov byte [eax], dl
mov ebx, edx
add eax, 1
add eax, 1
shr ebx, 8
mov byte [eax - 1], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax], bl
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 8
mov eax, ebp
mov byte [eax], cl
mov byte [eax + 1], dl
add eax, 1
add eax, 1
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
add eax, 1
shr ecx, 0x18
mov byte [eax], cl
mov ecx, dword [esp + 0x10]
add eax, 1
mov byte [eax], cl
mov edx, ecx
shr edx, 8
add eax, 1
mov byte [eax], dl
mov edx, ecx
add eax, 1
shr edx, 0x10
shr ecx, 0x18
sub dword [esp + 0x18], 1
mov byte [eax], dl
mov byte [eax + 1], cl
jne 0x55d6b7
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.0044e502
add esp, 0xa0
ret