joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408d60
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
xor edi, edi
push esi
push ebx
mov esi, edx
sub esp, 0x43c
mov dword [esp], str.AVCONV_DATADIR
mov dword [esp + 0x2c], ecx
lea ebx, [esp + 0x48]
mov dword [esp + 0x28], eax
call sub.msvcrt.dll_getenv
mov dword [esp], str.HOME
mov ebp, eax
mov dword [esp + 0x3c], eax
call sub.msvcrt.dll_getenv
mov dword [esp + 0x44], str._usr_local_share_ffmpeg
mov dword [esp + 0x40], eax
mov eax, 0xffffffff
test ebp, ebp
je 0x408e83
test esi, esi
je 0x408e25
cmp edi, 1
je 0x408ea0
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 0xc21254
mov dword [esp + 0xc], ebp
mov dword [esp + 8], str._s_s__s__s.avpreset
mov dword [esp + 4], 0x3e8
mov dword [esp + 0x18], eax
mov dword [esp], ebx
call fcn.00bd2660
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xc28b8c
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0045da30
test eax, eax
js 0x408e2e
add esp, 0x43c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp edi, 1
je 0x408f00
mov eax, 0xc21254
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ebp
mov dword [esp + 8], str._s_s__s.avpreset
mov dword [esp + 4], 0x3e8
mov dword [esp], ebx
mov dword [esp + 0x14], ecx
call fcn.00bd2660
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xc28b8c
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0045da30
add edi, 1
cmp edi, 2
ja 0x408e1a
mov edx, eax
shr edx, 0x1f
test dl, dl
je 0x408e1a
mov ebp, dword [esp + edi*4 + 0x3c]
jmp 0x408da9
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], str._.avconv
mov dword [esp + 0xc], ebp
mov dword [esp + 8], str._s_s__s__s.avpreset
mov dword [esp + 4], 0x3e8
mov dword [esp + 0x18], eax
mov dword [esp], ebx
call fcn.00bd2660
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xc28b8c
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], eax
call fcn.0045da30
test eax, eax
jns 0x408e1a
mov eax, str._.avconv
jmp 0x408e33
Function at 0x4340e0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0xeea21c
call sub.KERNEL32.dll_InterlockedCompareExchange
sub esp, 0xc
test eax, eax
je 0x4341f3
cmp eax, 1
je 0x43413f
mov eax, dword [0xeea214]
test eax, eax
je 0x434157
mov dword [esp], ebx
call eax
xor eax, eax
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp], 0
call sub.KERNEL32.dll_Sleep
sub esp, 4
lock or dword [esp], 0
mov eax, dword [0xeea21c]
cmp eax, 2
jne 0x434130
mov eax, dword [0xeea214]
test eax, eax
jne 0x43411c
mov dword [esp], 0x40
call fcn.00894240
test eax, eax
mov esi, eax
je 0x4342b0
mov dword [ebx], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x7fffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateSemaphoreA
sub esp, 0x10
test eax, eax
mov dword [esi + 0x34], eax
je 0x4342b0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
test eax, eax
mov dword [esi + 0x38], eax
je 0x4342b0
lea eax, [esi + 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_InitializeCriticalSection
sub esp, 4
mov dword [esp], esi
call sub.KERNEL32.dll_InitializeCriticalSection
xor eax, eax
sub esp, 4
jmp 0x434126
mov dword [esp], 0xc2c728
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov esi, eax
mov dword [esp + 4], 0xc2c735
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0xeea214], eax
mov dword [esp + 4], 0xc2c751
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0xeea218], eax
mov dword [esp + 4], 0xc2c76a
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0xeea210], eax
mov dword [esp + 4], 0xc2c780
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0xeea20c], eax
mov dword [esp + 4], 0xc2c799
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 4], 0xc2c7b1
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 4], 2
mov dword [esp], 0xeea21c
call sub.KERNEL32.dll_InterlockedExchange
sub esp, 8
jmp 0x434113
add esp, 0x14
mov eax, 0xc
pop ebx
pop esi
ret
Function at 0x517f20
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1ac
mov eax, dword [0x1019f5c]
test eax, eax
je 0x517f55
lea eax, [esp + 0x10]
mov dword [esp], 0x101
mov dword [esp + 4], eax
call sub.WS2_32.dll_WSAStartup
sub esp, 8
test eax, eax
sete al
add esp, 0x1ac
movzx eax, al
ret
mov dword [esp + 8], str.Using_network_protocols_without_global_network_initialization._Please_use_avformat_network_init____this_will_become_mandatory_later._n
mov dword [esp + 4], 0x18
mov dword [esp], 0
call fcn.00891920
jmp 0x517f2f

Function at 0x566e00
Capabilities:
Resolve dns

Disassembly:
push esi
push ebx
mov esi, edx
mov ebx, eax
xor eax, eax
sub esp, 0x64
mov dword [esp + eax + 0x40], 0
add eax, 4
cmp eax, 0x20
jb 0x566e0b
mov dword [esp + 8], 5
mov dword [esp + 4], 0xc65316
mov dword [esp], esi
call fcn.00874e80
cmp byte [ebx], 0
jne 0x566e40
add esp, 0x64
xor eax, eax
pop ebx
pop esi
ret
lea eax, [esp + 0x3c]
mov dword [esp + 4], 0
mov dword [esp], ebx
mov dword [esp + 0xc], eax
lea eax, [esp + 0x40]
mov dword [esp + 8], eax
call sub.WS2_32.dll_getaddrinfo
sub esp, 0x10
test eax, eax
jne 0x566e38
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x18], 2
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x20
mov dword [esp + 8], ebx
mov edx, dword [eax + 0x10]
mov dword [esp + 4], edx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call sub.WS2_32.dll_getnameinfo
sub esp, 0x1c
mov eax, dword [esp + 0x3c]
cmp dword [eax + 4], 0x17
je 0x566ee0
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call fcn.005183e0
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x2c], eax
mov dword [esp], edx
call sub.WS2_32.dll_freeaddrinfo
sub esp, 4
mov eax, dword [esp + 0x2c]
add esp, 0x64
pop ebx
pop esi
ret
mov dword [esp + 8], 5
mov dword [esp + 4], 0xc6531a
mov dword [esp], esi
call fcn.00874e80
mov eax, dword [esp + 0x3c]
jmp 0x566eae
Function at 0x6433b0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0xfa1314
call sub.KERNEL32.dll_InterlockedCompareExchange
sub esp, 0xc
test eax, eax
je 0x6434c3
cmp eax, 1
je 0x64340f
mov eax, dword [0xfa130c]
test eax, eax
je 0x643427
mov dword [esp], ebx
call eax
xor eax, eax
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp], 0
call sub.KERNEL32.dll_Sleep
sub esp, 4
lock or dword [esp], 0
mov eax, dword [0xfa1314]
cmp eax, 2
jne 0x643400
mov eax, dword [0xfa130c]
test eax, eax
jne 0x6433ec
mov dword [esp], 0x40
call fcn.00894240
test eax, eax
mov esi, eax
je 0x643580
mov dword [ebx], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x7fffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateSemaphoreA
sub esp, 0x10
test eax, eax
mov dword [esi + 0x34], eax
je 0x643580
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
test eax, eax
mov dword [esi + 0x38], eax
je 0x643580
lea eax, [esi + 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_InitializeCriticalSection
sub esp, 4
mov dword [esp], esi
call sub.KERNEL32.dll_InitializeCriticalSection
xor eax, eax
sub esp, 4
jmp 0x6433f6
mov dword [esp], 0xc9c640
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov esi, eax
mov dword [esp + 4], 0xc9c64d
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0xfa130c], eax
mov dword [esp + 4], 0xc9c669
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0xfa1310], eax
mov dword [esp + 4], 0xc9c682
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0xfa1308], eax
mov dword [esp + 4], 0xc9c698
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0xfa1304], eax
mov dword [esp + 4], 0xc9c6b1
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 4], 0xc9c6c9
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 4], 2
mov dword [esp], 0xfa1314
call sub.KERNEL32.dll_InterlockedExchange
sub esp, 8
jmp 0x6433e3
add esp, 0x14
mov eax, 0xc
pop ebx
pop esi
ret
Function at 0x6b4600
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0xfbf3b0
call sub.KERNEL32.dll_InterlockedCompareExchange
sub esp, 0xc
test eax, eax
je 0x6b4713
cmp eax, 1
je 0x6b465f
mov eax, dword [0xfbf3a8]
test eax, eax
je 0x6b4677
mov dword [esp], ebx
call eax
xor eax, eax
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp], 0
call sub.KERNEL32.dll_Sleep
sub esp, 4
lock or dword [esp], 0
mov eax, dword [0xfbf3b0]
cmp eax, 2
jne 0x6b4650
mov eax, dword [0xfbf3a8]
test eax, eax
jne 0x6b463c
mov dword [esp], 0x40
call fcn.00894240
test eax, eax
mov esi, eax
je 0x6b47d0
mov dword [ebx], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x7fffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateSemaphoreA
sub esp, 0x10
test eax, eax
mov dword [esi + 0x34], eax
je 0x6b47d0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
test eax, eax
mov dword [esi + 0x38], eax
je 0x6b47d0
lea eax, [esi + 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_InitializeCriticalSection
sub esp, 4
mov dword [esp], esi
call sub.KERNEL32.dll_InitializeCriticalSection
xor eax, eax
sub esp, 4
jmp 0x6b4646
mov dword [esp], 0xcba5e0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov esi, eax
mov dword [esp + 4], 0xcba5ed
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0xfbf3a8], eax
mov dword [esp + 4], 0xcba609
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0xfbf3ac], eax
mov dword [esp + 4], 0xcba622
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0xfbf3a4], eax
mov dword [esp + 4], 0xcba638
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0xfbf3a0], eax
mov dword [esp + 4], 0xcba651
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 4], 0xcba669
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 4], 2
mov dword [esp], 0xfbf3b0
call sub.KERNEL32.dll_InterlockedExchange
sub esp, 8
jmp 0x6b4633
add esp, 0x14
mov eax, 0xc
pop ebx
pop esi
ret
Function at 0x762430
Capabilities:
Create thread
Link many functions at runtime
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x28
mov ebx, dword [esp + 0x30]
mov eax, dword [ebx + 0xc]
mov eax, dword [eax + 0x10]
test ah, 0x10
je 0x76244c
test dword [ebx + 0x5c], 0x90000
je 0x7624c0
mov edx, dword [ebx + 0x320]
cmp edx, 1
jne 0x762470
mov dword [ebx + 0x328], 0
add esp, 0x28
xor eax, eax
pop ebx
ret
test ah, 0x20
jne 0x7624a5
and eax, 0x8000
jne 0x762500
mov dword [ebx + 0x320], 1
mov dword [ebx + 0x328], 0
test al, 1
je 0x762461
mov dword [esp + 0x30], ebx
add esp, 0x28
pop ebx
jmp fcn.00644d90
test byte [ebx + 0x324], 2
je 0x762475
cmp edx, 0x10
mov dword [ebx + 0x328], 2
jg 0x762505
jmp 0x76253c
test byte [ebx + 0x61], 0x80
jne 0x76244c
mov edx, dword [ebx + 0x320]
cmp edx, 1
je 0x762457
test byte [ebx + 0x324], 1
je 0x762470
cmp edx, 0x10
mov dword [ebx + 0x328], 1
jg 0x762505
mov dword [esp + 0x30], ebx
add esp, 0x28
pop ebx
jmp fcn.00644d90
cmp edx, 0x10
jle 0x762529
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.Application_has_requested__d_threads._Using_a_thread_count_greater_than__d_is_not_recommended._n
mov dword [esp + 4], 0x18
mov dword [esp], ebx
call fcn.00891920
mov eax, dword [ebx + 0x328]
mov edx, eax
and edx, 2
test edx, edx
je 0x762494
mov dword [esp + 0x30], ebx
add esp, 0x28
pop ebx
jmp fcn.007633b0
Function at 0x762dc0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0xfd2490
call sub.KERNEL32.dll_InterlockedCompareExchange
sub esp, 0xc
test eax, eax
je 0x762ed3
cmp eax, 1
je 0x762e1f
mov eax, dword [0xfd2488]
test eax, eax
je 0x762e37
mov dword [esp], ebx
call eax
xor eax, eax
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp], 0
call sub.KERNEL32.dll_Sleep
sub esp, 4
lock or dword [esp], 0
mov eax, dword [0xfd2490]
cmp eax, 2
jne 0x762e10
mov eax, dword [0xfd2488]
test eax, eax
jne 0x762dfc
mov dword [esp], 0x40
call fcn.00894240
test eax, eax
mov esi, eax
je 0x762f90
mov dword [ebx], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x7fffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateSemaphoreA
sub esp, 0x10
test eax, eax
mov dword [esi + 0x34], eax
je 0x762f90
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateEventA
sub esp, 0x10
test eax, eax
mov dword [esi + 0x38], eax
je 0x762f90
lea eax, [esi + 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_InitializeCriticalSection
sub esp, 4
mov dword [esp], esi
call sub.KERNEL32.dll_InitializeCriticalSection
xor eax, eax
sub esp, 4
jmp 0x762e06
mov dword [esp], 0xcbd710
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov esi, eax
mov dword [esp + 4], 0xcbd71d
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0xfd2488], eax
mov dword [esp + 4], 0xcbd739
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0xfd248c], eax
mov dword [esp + 4], 0xcbd752
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0xfd2484], eax
mov dword [esp + 4], 0xcbd768
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [0xfd2480], eax
mov dword [esp + 4], 0xcbd781
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 4], 0xcbd799
mov dword [esp], esi
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov dword [esp + 4], 2
mov dword [esp], 0xfd2490
call sub.KERNEL32.dll_InterlockedExchange
sub esp, 8
jmp 0x762df3
add esp, 0x14
mov eax, 0xc
pop ebx
pop esi
ret
Function at 0x875df0
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
push ebx
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
cmp ecx, 0x3ffffffe
ja 0x875ef0
lea edi, [ecx + 2]
mov edx, 0x55555556
mov eax, edi
sar edi, 0x1f
imul edx
sub edx, edi
shl edx, 2
cmp edx, dword [esp + 0x18]
jge 0x875ef0
cmp ecx, 3
mov edi, esi
jle 0x875ef7
mov ebp, dword [ebx]
sub ecx, 3
add edi, 4
add ebx, 3
bswap ebp
mov eax, ebp
shr eax, 0x1a
movzx eax, byte [eax + 0xcc9de0]
mov byte [edi - 4], al
mov eax, ebp
shr eax, 0x14
and eax, 0x3f
movzx edx, byte [eax + 0xcc9de0]
mov eax, ebp
shr ebp, 8
shr eax, 0xe
and ebp, 0x3f
and eax, 0x3f
movzx eax, byte [eax + 0xcc9de0]
mov byte [edi - 3], dl
mov byte [edi - 2], al
movzx eax, byte [ebp + 0xcc9de0]
cmp ecx, 3
mov byte [edi - 1], al
jg 0x875e35
cmp ecx, 1
movzx edx, byte [ebx]
je 0x875ea9
movzx eax, byte [ebx + 1]
shl edx, 8
add edx, eax
cmp ecx, 2
je 0x875ea9
movzx eax, byte [ebx + 2]
shl edx, 8
add edx, eax
shl ecx, 3
shl edx, 6
nop
mov eax, edx
add edi, 1
shr eax, cl
sub ecx, 6
and eax, 0x3f
test ecx, ecx
movzx eax, byte [eax + 0xcc9de0]
mov byte [edi - 1], al
jg 0x875eb0
mov eax, edi
sub eax, esi
test al, 3
je 0x875ee2
add edi, 1
mov byte [edi - 1], 0x3d
mov eax, edi
sub eax, esi
test al, 3
jne 0x875ed3
mov byte [edi], 0
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
pop ebx
xor eax, eax
pop esi
pop edi
pop ebp
ret
test ecx, ecx
je 0x875eda
jmp 0x875e8a
Function at 0x890e50
Capabilities:
Query environment variable

Disassembly:
cmp byte [edx], 0
je 0x890e93
push esi
push ebx
mov ebx, edx
mov esi, eax
sub esp, 0x34
mov edx, dword [0xc14ec8]
test edx, edx
js 0x890ef0
cmp esi, 4
je 0x890e7a
mov eax, dword [0xc14ec8]
test eax, eax
jne 0x890e95
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], ebx
add eax, 0x40
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
add esp, 0x34
pop ebx
pop esi
repz ret
movzx eax, byte [esi + 0xccea00]
or ax, word [0xff6c8a]
movzx eax, ax
mov dword [esp + 4], eax
mov eax, dword [0xff6c84]
mov dword [esp], eax
call sub.KERNEL32.dll_SetConsoleTextAttribute
mov eax, dword [sym.imp.msvcrt.dll__iob]
sub esp, 8
mov dword [esp], ebx
add eax, 0x40
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputs
movzx eax, word [0xff6c88]
mov dword [esp + 4], eax
mov eax, dword [0xff6c84]
mov dword [esp], eax
call sub.KERNEL32.dll_SetConsoleTextAttribute
sub esp, 8
jmp 0x890e8e
mov dword [esp], 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
sub esp, 4
cmp eax, 0xffffffff
mov dword [0xff6c84], eax
je 0x890f19
mov dword [esp], str.NO_COLOR
call sub.msvcrt.dll_getenv
test eax, eax
je 0x890f28
mov dword [0xc14ec8], 0
jmp 0x890e6c
mov dword [esp], str.AV_LOG_FORCE_NOCOLOR
call sub.msvcrt.dll_getenv
test eax, eax
jne 0x890f19
lea eax, [esp + 0x1a]
mov dword [0xc14ec8], 1
mov dword [esp + 4], eax
mov eax, dword [0xff6c84]
mov dword [esp], eax
call sub.KERNEL32.dll_GetConsoleScreenBufferInfo
sub esp, 8
movzx eax, word [esp + 0x22]
mov word [0xff6c88], ax
and ax, 0xf0
mov word [0xff6c8a], ax
jmp 0x890e6c
Function at 0x8926e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
imul dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edx
mov eax, ecx
imul dword [esp + 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], edx
jmp fcn.00892180
Function at 0x89a860
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test ecx, ecx
je 0x89a891
cmp dword [ecx + 0xc], 0
jne 0x89a891
test byte [ecx + 0x28], 0x80
jne 0x89a891
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov edx, eax
pop ebx
jmp fcn.008998b0
mov eax, 0xffffffea
pop ebx
ret

Function at 0x89a8a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
test ecx, ecx
je 0x89a8d1
cmp dword [ecx + 0xc], 1
jne 0x89a8d1
test byte [ecx + 0x28], 0x80
jne 0x89a8d1
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov edx, eax
pop ebx
jmp fcn.008998b0
mov eax, 0xffffffea
pop ebx
ret
Function at 0x9151f0
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x144
mov dword [esp], 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
push ecx
test eax, eax
je 0x91521c
mov ebx, eax
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileType
push edx
test eax, eax
jne 0x915320
lea eax, [esp + 0x154]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x150]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xff
lea esi, [esp + 0x40]
mov dword [esp], esi
call sub.msvcrt.dll__vsnprintf
mov byte [esp + 0x13f], 0
call sub.KERNEL32.dll_GetVersion
test eax, eax
js 0x9152f0
call fcn.00915090
test eax, eax
jle 0x9152f0
mov dword [esp + 4], str.OpenSSL
mov dword [esp], 0
call sub.ADVAPI32.DLL_RegisterEventSourceA
sub esp, 8
mov ebx, eax
test eax, eax
je 0x9152dd
mov dword [esp + 0x3c], esi
mov dword [esp + 0x20], 0
lea eax, [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], ebx
call sub.ADVAPI32.DLL_ReportEventA
sub esp, 0x24
mov dword [esp], ebx
call sub.ADVAPI32.DLL_DeregisterEventSource
push eax
add esp, 0x144
pop ebx
pop esi
ret
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.OpenSSL:_FATAL
mov dword [esp + 4], esi
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
add esp, 0x144
pop ebx
pop esi
ret
lea eax, [esp + 0x154]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x150]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x100
lea esi, [esp + 0x40]
mov dword [esp], esi
call sub.msvcrt.dll__vsnprintf
test eax, eax
js 0x915380
mov dword [esp + 0x10], 0
lea edx, [esp + 0x3c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
add esp, 0x144
pop ebx
pop esi
ret
mov eax, 0x100
jmp 0x91534e
Function at 0xa2de60
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x7c
mov eax, dword [esp + 0x80]
mov dword [esp + 0x6c], ebx
mov ebx, 0xde2dac
mov dword [esp + 4], ebx
mov dword [esp + 0x70], esi
mov dword [esp], eax
mov dword [esp + 0x74], edi
mov dword [esp + 0x78], ebp
call fcn.00a2ec20
test eax, eax
je 0xa2e024
xor edx, edx
xor ecx, ecx
mov ebp, eax
mov eax, 2
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov dword [esp], ebp
call fcn.00bd25b0
mov dword [esp], ebp
mov ebx, eax
lea eax, [esp + 0x58]
mov dword [esp + 4], eax
call sub.msvcrt.dll_fgetpos
test eax, eax
jne 0xa2dfc0
mov esi, dword [esp + 0x58]
mov cl, 1
mov edi, dword [esp + 0x5c]
mov eax, esi
add eax, 0xffffffff
mov edx, edi
adc edx, 0xffffffff
cmp edx, 0
ja 0xa2def0
cmp eax, 0x7ffffffe
jbe 0xa2dff0
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], eax
xor eax, eax
shr ebx, 0x1f
mov dword [esp + 8], eax
or bl, cl
mov dword [esp], ebp
call fcn.00bd25b0
shr eax, 0x1f
test al, al
jne 0xa2dfda
test bl, bl
jne 0xa2dfda
lea eax, [esi + 0x25]
mov dword [esp], eax
mov dword [esp + 0x30], esi
call sub.msvcrt.dll_malloc
mov ecx, dword [esp + 0x30]
test eax, eax
je 0xa2e000
lea ebx, [eax + 0x23]
and ebx, 0xffffffe0
mov dword [ebx - 4], eax
mov eax, 1
mov dword [esp + 0xc], ebp
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x34], ecx
call sub.msvcrt.dll_fread
mov dword [esp], ebp
mov edx, eax
mov dword [esp + 0x38], eax
xor eax, eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x3c], eax
call sub.msvcrt.dll_fclose
mov edx, dword [esp + 0x30]
mov eax, edi
mov ecx, dword [esp + 0x34]
xor edx, esi
or eax, edx
jne 0xa2e030
cmp byte [ebx + ecx - 1], 0xa
je 0xa2df9f
mov esi, dword [esp + 0x38]
mov byte [ebx + ecx], 0xa
inc esi
mov byte [ebx + esi], 0
mov eax, ebx
mov ebx, dword [esp + 0x6c]
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x74]
mov ebp, dword [esp + 0x78]
add esp, 0x7c
ret
xor ecx, ecx
xor ebx, ebx
xor esi, esi
mov dword [esp + 0xc], ecx
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp], ebp
call fcn.00bd25b0
mov dword [esp], ebp
call sub.msvcrt.dll_fclose
xor eax, eax
jmp 0xa2dfa5
xor ecx, ecx
jmp 0xa2def0
add ecx, 2
mov eax, str.malloc_of_size__d_failed_n
xor edx, edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], 0
call fcn.00a28900
jmp 0xa2dfda
xor eax, eax
jmp 0xa2dfa5
mov eax, dword [ebx - 4]
mov dword [esp], eax
call fcn.00bdd2e8
xor eax, eax
jmp 0xa2dfa5