joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d3b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x670638
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x74b738]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x45d3e8
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push 0x38
mov esi, dword [eax]
mov edi, dword [eax + 4]
call fcn.00669e77
mov dword [eax + 4], 1
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
lea ecx, [eax + 0x10]
mov dword [eax + 8], 1
mov dword [eax], 0x6eb948
lea edx, [eax + 4]
mov dword [ecx], 0x6eb910
mov dword [ecx + 4], esi
mov dword [ecx + 8], edi
mov dword [ebp + 8], ecx
mov dword [ecx + 0x24], ecx
mov dword [ebp - 0x1c], ecx
lock inc dword [edx]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
mov eax, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x28]
inc eax
cmp ecx, eax
ja 0x45d45a
push ecx
lea ecx, [ebx + 0x20]
call fcn.00439d60
mov ecx, dword [ebx + 0x28]
lea eax, [ecx - 1]
and dword [ebx + 0x2c], eax
mov eax, dword [ebx + 0x30]
add eax, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x28]
dec ecx
and ecx, eax
mov eax, dword [ebx + 0x24]
cmp dword [eax + ecx*4], 0
lea edi, [ecx*4]
jne 0x45d48f
push 0x28
call fcn.00669e77
mov ecx, dword [ebx + 0x24]
add esp, 4
mov dword [edi + ecx], eax
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + edi]
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x10]
mov dword [eax], 0x6eb92c
mov dword [eax + 4], ecx
mov dword [eax + 8], edi
mov dword [eax + 0x24], eax
inc dword [ebx + 0x30]
cmp dword [ebx + 0x18], 0
jne 0x45d4d2
lea eax, [ebx + 0x1c]
push eax
push 0
push ebx
push 0x43f580
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebx + 0x18], eax
mov byte [ebp + 0xb], 1
jmp 0x45d4d6
mov byte [ebp + 0xb], 0
or esi, 0xffffffff
mov byte [ebp - 4], 6
mov eax, esi
lea ecx, [edi + 4]
lock xadd dword [ecx], eax
jne 0x45d4ff
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lea eax, [edi + 8]
lock xadd dword [eax], esi
dec esi
jne 0x45d4ff
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, byte [ebp + 0xb]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x476940
Capabilities:
Check if file exists
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x476b4f
mov edx, esi
lea ecx, [edx + 2]
nop word [eax + eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x476970
sub edx, ecx
sar edx, 1
cmp edx, 3
jbe 0x476b4f
push ebx
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, 1
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
add esp, 0x18
push esi
push eax
call ebx
push 0x6ec280
lea eax, [ebp - 0x414]
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4769f1
test al, 1
je 0x4769f1
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x668], eax
cmp eax, 0xffffffff
je 0x476b35
lea ecx, [ebp - 0x664]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x476b29
nop word [eax + eax]
test byte [ebp - 0x664], 0x10
je 0x476aa4
cmp word [ebp - 0x638], 0x2e
jne 0x476a67
mov ax, word [ebp - 0x636]
test ax, ax
je 0x476b0e
cmp ax, 0x2e
jne 0x476a67
cmp word [ebp - 0x634], 0
je 0x476b0e
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea ecx, [ebp - 0x20c]
call fcn.00476940
jmp 0x476b0c
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x476afb
test al, 1
je 0x476afb
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
and edi, eax
lea eax, [ebp - 0x664]
push eax
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x476a30
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
and eax, edi
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
Function at 0x47dd60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x672c88
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x74b738]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x47dd98
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push 0x38
mov esi, dword [eax]
mov edi, dword [eax + 4]
call fcn.00669e77
mov dword [eax + 4], 1
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
lea ecx, [eax + 0x10]
mov dword [eax + 8], 1
mov dword [eax], 0x6ea9b4
lea edx, [eax + 4]
mov dword [ecx], 0x6ec45c
mov dword [ecx + 4], esi
mov dword [ecx + 8], edi
mov dword [ebp + 8], ecx
mov dword [ecx + 0x24], ecx
mov dword [ebp - 0x1c], ecx
lock inc dword [edx]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 2
mov eax, dword [ebx + 0x30]
mov ecx, dword [ebx + 0x28]
inc eax
cmp ecx, eax
ja 0x47de0a
push ecx
lea ecx, [ebx + 0x20]
call fcn.00439d60
mov ecx, dword [ebx + 0x28]
lea eax, [ecx - 1]
and dword [ebx + 0x2c], eax
mov eax, dword [ebx + 0x30]
add eax, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x28]
dec ecx
and ecx, eax
mov eax, dword [ebx + 0x24]
cmp dword [eax + ecx*4], 0
lea edi, [ecx*4]
jne 0x47de3f
push 0x28
call fcn.00669e77
mov ecx, dword [ebx + 0x24]
add esp, 4
mov dword [edi + ecx], eax
mov eax, dword [ebx + 0x24]
mov eax, dword [eax + edi]
mov ecx, dword [ebp + 8]
mov edi, dword [ebp - 0x10]
mov dword [eax], 0x6ec4b0
mov dword [eax + 4], ecx
mov dword [eax + 8], edi
mov dword [eax + 0x24], eax
inc dword [ebx + 0x30]
cmp dword [ebx + 0x18], 0
jne 0x47de82
lea eax, [ebx + 0x1c]
push eax
push 0
push ebx
push 0x43f580
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebx + 0x18], eax
mov byte [ebp + 0xb], 1
jmp 0x47de86
mov byte [ebp + 0xb], 0
or esi, 0xffffffff
mov byte [ebp - 4], 6
mov eax, esi
lea ecx, [edi + 4]
lock xadd dword [ecx], eax
jne 0x47deaf
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lea eax, [edi + 8]
lock xadd dword [eax], esi
dec esi
jne 0x47deaf
mov edx, dword [edi]
mov ecx, edi
call dword [edx + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, byte [ebp + 0xb]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4a9530
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x74b738]
xor eax, esp
mov dword [esp + 0x194], eax
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x4a9585
mov eax, dword [esp]
cmp al, 2
jne 0x4a957f
shr eax, 8
cmp al, 2
jne 0x4a957f
xor eax, eax
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [esp + 0x194]
mov eax, 2
xor ecx, esp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret

Function at 0x4ac600
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
push 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ecx + eax*4 + 0x154]
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [ebp + 0x18]
mov esi, eax
mov dword [edi], 0
cmp esi, 0xffffffff
jne 0x4ac67e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x2733
jne 0x4ac64e
mov dword [edi], 0x51
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov ecx, dword [ebp + 8]
mov edx, ebx
call fcn.004c21a0
push eax
mov eax, dword [ebp + 8]
push str.Send_failure:__s
push dword [eax]
call fcn.004ac430
mov eax, dword [ebp + 8]
add esp, 0xc
mov eax, dword [eax]
mov dword [eax + 0x85b4], ebx
mov eax, esi
mov dword [edi], 0x37
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4acb10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
mov eax, dword [edi + 0x1d0]
test eax, eax
je 0x4acb36
push dword [edi + 0x15c]
push dword [ebp + 0xc]
push dword [ebp + 8]
push edx
push edi
call eax
add esp, 0x14
pop edi
pop ebp
ret
cmp edx, 2
ja 0x4acb6c
push dword [edi + 0x158]
lea eax, [edx*2 + 0x6d3e80]
push 1
add eax, edx
push 2
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push dword [edi + 0x158]
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x20
xor eax, eax
pop edi
pop ebp
ret
Function at 0x4acd80
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x74b738]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
xor eax, eax
push edi
push 4
mov edi, edx
cmp byte [esi + 0x41c], al
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x4acddb
push edi
push str.Failed_to_set_SO_KEEPALIVE_on_fd__d_n
push esi
call fcn.004ac3b0
add esp, 0xc
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 0x420]
mov dword [ebp - 0x10], 1
call fcn.004b9aa0
mov ecx, dword [esi + 0x424]
imul eax, eax, 0x3e8
mov dword [ebp - 0xc], eax
call fcn.004b9aa0
imul eax, eax, 0x3e8
push 0
push 0
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x98000004
push edi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x4ace45
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push edi
push str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d_n
push esi
call fcn.004ac3b0
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00669a1e
mov esp, ebp
pop ebp
ret
Function at 0x5084a0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x679b1a
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x74b738]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x685f30
lea edi, [esi + 0x14]
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov byte [esi + 0xc], 1
mov dword [esi + 0x10], 0
call fcn.004225c0
mov ecx, eax
test ecx, ecx
je 0x508664
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov dword [ebp - 4], 0
lea ebx, [esi + 0x18]
call fcn.004225c0
mov ecx, eax
test ecx, ecx
je 0x50866e
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov byte [ebp - 4], 1
call fcn.004225c0
mov ecx, eax
test ecx, ecx
je 0x508678
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], 0xffffffff
lea eax, [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], 5
mov dword [esi + 0x10], eax
test edx, edx
jne 0x508582
xor ecx, ecx
jmp 0x5085a0
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x508590
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00441d80
push edi
mov ecx, ebx
call fcn.00436f20
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x5085bc
xor ecx, ecx
jmp 0x5085d4
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp + 0x10], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5085c4
sub ecx, dword [ebp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esi + 0x1c]
call fcn.00441d80
push ebx
lea eax, [ebp + 0x10]
mov ecx, esi
push eax
call fcn.00508ea0
push eax
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.00436f20
mov edx, dword [ebp + 0x10]
or eax, 0xffffffff
mov byte [ebp - 4], 5
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x508615
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebx]
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 4], eax
test eax, eax
je 0x50864e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x50864e
cmp dword [esi + 0x10], 0
je 0x508645
push dword [edi]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__wunlink
add esp, 4
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push 0x80004005
call fcn.00422220
push 0x80004005
call fcn.00422220
push 0x80004005
call fcn.00422220
int3
Function at 0x58b0c0
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x753770]
test eax, eax
je 0x58b148
push esi
mov esi, dword [0x753668]
cmp esi, 0x753668
je 0x58b147
push ebx
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
push edi
mov edi, dword [esi]
mov ecx, edi
test eax, eax
je 0x58b114
push eax
push 1
push dword [esi + 0xc]
push dword [esi + 8]
call ebx
push 0x6f16a4
push dword [0x753770]
call fcn.0054fa70
push dword [0x753770]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov ecx, dword [esi]
add esp, 0x1c
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
mov dword [eax], ecx
push dword [esi + 8]
call fcn.00556740
push esi
mov dword [esi + 8], 0
call fcn.00556740
add esp, 8
mov esi, edi
cmp edi, 0x753668
je 0x58b145
mov eax, dword [0x753770]
jmp 0x58b0e0
pop edi
pop ebx
pop esi
ret

Function at 0x592df0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00592990

Function at 0x59bcc0
Capabilities:
Query environment variable

Disassembly:
push esi
push edi
xor esi, esi
call fcn.005d53e0
mov edi, dword [esp + 0x10]
test eax, eax
jne 0x59bd18
push str.RANDFILE
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov esi, eax
add esp, 4
test esi, esi
je 0x59bd18
cmp byte [esi], 0
je 0x59bd18
mov ecx, esi
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x59bcf0
sub ecx, edx
lea eax, [ecx + 1]
cmp eax, edi
jae 0x59bd18
push edi
push esi
mov esi, dword [esp + 0x14]
push esi
call fcn.005bf470
add esp, 0xc
cmp eax, edi
jb 0x59bd88
pop edi
xor eax, eax
pop esi
ret
call fcn.005d53e0
test eax, eax
jne 0x59bd30
push str.HOME
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
mov esi, eax
test esi, esi
jne 0x59bd3b
mov esi, 0x697818
jmp 0x59bd40
cmp byte [esi], 0
je 0x59bd81
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x59bd45
sub ecx, edx
lea eax, [ecx + 6]
cmp eax, edi
jae 0x59bd81
push edi
push esi
mov esi, dword [esp + 0x14]
push esi
call fcn.005bf470
push edi
push 0x6f0eb4
push esi
call fcn.005bf410
push edi
push str..rnd
push esi
call fcn.005bf410
add esp, 0x24
mov eax, esi
pop edi
pop esi
ret
mov esi, dword [esp + 0xc]
mov byte [esi], 0
pop edi
mov eax, esi
pop esi
ret
Function at 0x5a3730
Capabilities:
Query environment variable

Disassembly:
mov eax, 4
call fcn.0066af60
push ebx
push ebp
push esi
push edi
xor ebx, ebx
xor edi, edi
push ebx
call fcn.005e8ad0
mov esi, dword [esp + 0x1c]
mov ebp, eax
add esp, 4
mov dword [esp + 0x10], ebp
test ebp, ebp
je 0x5a38cc
test esi, esi
jne 0x5a37eb
push str.OPENSSL_CONF
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x5a3783
push eax
call fcn.005bf380
add esp, 4
mov edi, eax
jmp 0x5a37e1
call fcn.005e9470
lea edx, [eax + 1]
nop dword [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x5a3790
sub eax, edx
push 0x21f
push str..cryptoconfconf_mod.c
lea esi, [eax + 0xd]
push esi
call fcn.005ae120
mov edi, eax
add esp, 0xc
test edi, edi
je 0x5a38d3
push esi
call fcn.005e9470
push eax
push edi
call fcn.005bf470
push esi
push 0x6f0eb4
push edi
call fcn.005bf410
push esi
push str.openssl.cnf
push edi
call fcn.005bf410
add esp, 0x24
test edi, edi
je 0x5a38d3
jmp 0x5a37ed
mov edi, esi
push 0
push edi
push ebp
call fcn.005e89e0
add esp, 0xc
test eax, eax
jg 0x5a3825
test byte [esp + 0x20], 0x10
je 0x5a38cc
call fcn.0059e690
and eax, 0xfff
cmp eax, 0x72
jne 0x5a38cc
call fcn.0059d960
jmp 0x5a38c7
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
test eax, eax
je 0x5a3846
push eax
push 0
push ebp
call fcn.005e8970
add esp, 0xc
test eax, eax
jne 0x5a3861
test bl, 0x20
je 0x5a385a
push str.openssl_conf
push 0
push ebp
call fcn.005e8970
add esp, 0xc
test eax, eax
jne 0x5a3861
call fcn.0059d960
jmp 0x5a38c7
push eax
push ebp
call fcn.005e8910
mov ebp, eax
add esp, 8
test ebp, ebp
jne 0x5a3879
xor ebx, ebx
mov ebp, dword [esp + 0x10]
jmp 0x5a38cc
push ebp
xor esi, esi
call fcn.0059b780
add esp, 4
test eax, eax
jle 0x5a38c3
push esi
push ebp
call fcn.0059b910
push ebx
push dword [eax + 8]
push dword [eax + 4]
push dword [esp + 0x24]
call fcn.005a3df0
mov ebx, eax
add esp, 0x18
test ebx, ebx
jg 0x5a38af
test byte [esp + 0x20], 1
je 0x5a3873
push ebp
inc esi
call fcn.0059b780
add esp, 4
cmp esi, eax
jge 0x5a38c3
mov ebx, dword [esp + 0x20]
jmp 0x5a3888
mov ebp, dword [esp + 0x10]
mov ebx, 1
cmp dword [esp + 0x18], 0
jne 0x5a38dc
push edi
call fcn.005adf40
add esp, 4
push ebp
call fcn.005e8830
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x5b79a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x5b79c7
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x5b79b6
pop edi
movzx eax, dl
pop esi
ret
Function at 0x401290
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x18]
push edi
push eax
xor edi, edi
push 0x8004667e
push ebx
mov dword [esp + 0x28], edi
call dword [sym.imp.WSOCK32.dll_ioctlsocket]
test esi, esi
jle 0x4012d5
mov ebp, dword [esp + 0x18]
push 0
lea ecx, [edi + ebp]
push esi
push ecx
push ebx
call dword [sym.imp.WSOCK32.dll_send]
test eax, eax
jle 0x4012d5
sub esi, eax
add edi, eax
test esi, esi
jg 0x4012bb
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4012e0
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov eax, 0x5104
call fcn.00412ce0
push ebx
push ebp
push esi
push edi
mov ecx, 0x13ff
xor eax, eax
lea edi, [esp + 0x115]
mov byte [esp + 0x114], 0
rep stosd dword es:[edi], eax
mov ebx, dword [esp + 0x5118]
mov ebp, dword [sym.imp.WSOCK32.dll_recv]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x511c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 1
xor eax, eax
lea ecx, [esp + 0x14]
cmp dword [ecx], edi
je 0x40133c
inc eax
add ecx, 4
cmp eax, 1
jb 0x40132f
cmp eax, 1
jne 0x40134d
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], 2
push 0
push 0
lea eax, [esp + 0x18]
push 0
push eax
push 0
call dword [sym.imp.WSOCK32.dll_select]
test eax, eax
jle 0x4013f7
lea ecx, [esp + 0x10]
push ecx
push ebx
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x4013a9
push 0
lea edx, [esp + 0x118]
push 0x5000
push edx
push ebx
call ebp
mov esi, eax
test esi, esi
jle 0x4013f7
lea eax, [esp + 0x114]
push esi
push eax
push edi
call fcn.00401290
add esp, 0xc
test eax, eax
je 0x4013f7
cmp eax, esi
jne 0x4013f7
lea ecx, [esp + 0x10]
push ecx
push edi
call sub.WSOCK32.dll___WSAFDIsSet
test eax, eax
je 0x4013ea
push 0
lea edx, [esp + 0x118]
push 0x5000
push edx
push edi
call ebp
mov esi, eax
test esi, esi
jle 0x4013f7
lea eax, [esp + 0x114]
push esi
push eax
push ebx
call fcn.00401290
add esp, 0xc
test eax, eax
je 0x4013f7
cmp eax, esi
jne 0x4013f7
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40131d
mov esi, dword [sym.imp.WSOCK32.dll_closesocket]
push ebx
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x5104
ret 8
Function at 0x407530
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x462908
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
xor ebx, ebx
mov edi, ecx
push ebx
mov dword [esp + 0x10], edi
call fcn.0042a3c0
mov eax, dword [esp + 0x44]
mov ecx, edi
push eax
mov dword [esp + 0x40], ebx
call fcn.0042a470
lea esi, [edi + 0x18]
mov dword [esp + 0x3c], 1
mov ecx, esi
mov dword [esp + 0x44], esi
call fcn.00409b80
mov dword [esi + 0xc], 0xffffffff
mov byte [esi + 0x10], bl
push ebx
push ebx
lea ecx, [esp + 0x30]
mov byte [esp + 0x44], 2
mov dword [esi], vtable.CryptoPP::StringStore.1.0
mov dword [esi + 4], vtable.CryptoPP::StringStore.0
mov dword [esp + 0x34], ebx
call fcn.00407860
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x1c], bl
lea ecx, [esp + 0x1c]
push 1
push ecx
lea edx, [esp + 0x18]
push str.InputBuffer
push edx
mov byte [esp + 0x4c], 4
call fcn.00404df0
add esp, 0x10
push eax
mov ecx, esi
mov byte [esp + 0x40], 5
call fcn.0042c680
mov ecx, dword [esp + 0x14]
mov byte [esp + 0x3c], 6
cmp ecx, ebx
je 0x4075f8
mov eax, dword [ecx]
push 1
call dword [eax]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
mov edx, eax
add eax, ecx
cmp ecx, ebx
mov byte [esp + 0x3c], 2
je 0x407613
dec eax
mov byte [eax], bl
dec ecx
jne 0x40760d
push edx
call fcn.0042ccf0
mov ecx, dword [esp + 0x38]
add esp, 4
mov dword [edi], vtable.CryptoPP::SourceTemplate_class_CryptoPP::StringStore_.0
mov dword [edi + 4], vtable.CryptoPP::SourceTemplate_class_CryptoPP::StringStore_.1.0
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 4

Function at 0x4275b8
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4649c8
push eax
mov dword fs:[0], esp
sub esp, 0x28
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 0xa4]
test eax, eax
je 0x4275f4
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0xa4]
mov ecx, dword [esp + 0x40]
mov edx, dword [eax]
push ecx
mov ecx, dword [esp + 0x40]
push ecx
mov ecx, eax
call dword [edx + 0x44]
pop esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 8
push edi
xor edi, edi
push edi
lea ecx, [esp + 0x14]
call fcn.00425a90
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x10], vtable.CryptoPP::ArraySink.1.0
mov dword [esp + 0x14], vtable.CryptoPP::ArraySink.0
push 1
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [esi]
push 0x488950
lea edx, [esp + 0x18]
push ecx
push edx
mov ecx, esi
mov dword [esp + 0x48], edi
mov dword [esp + 0x1c], edi
call dword [eax + 0x7c]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x34
ret 8