joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4310f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [eax]
mov edi, dword [ecx + 0x9c]
mov dword [ebp - 0x34], eax
call fcn.0043a250
mov ebx, eax
mov esi, edx
call fcn.0043a250
mov dword [esp + 4], edx
mov dword [esp + 8], ebx
mov dword [esp + 0xc], esi
mov dword [esp], eax
call fcn.0043a290
mov edx, 0x10624dd3
mov ecx, eax
imul edx
mov eax, ecx
mov ecx, dword [ebp - 0x34]
sar eax, 0x1f
sar edx, 6
sub edx, eax
mov eax, dword [ecx + 0x9c]
test eax, eax
jne 0x43115b
mov eax, dword [ecx + 0x98]
mov ecx, 0xea60
test eax, eax
je 0x43116b
sub eax, edx
test eax, eax
jle 0x431241
imul ecx, eax, 0x3e8
mov dword [esp + 8], ecx
mov eax, 0xffffffff
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0043a340
cmp eax, 0xffffffff
je 0x431236
test eax, eax
je 0x43120a
mov dword [ebp - 0x2c], 0x10
lea ebx, [ebp - 0x28]
lea esi, [ebp - 0x2c]
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp], edi
call sub.WS2_32.DLL_getsockname
sub esp, 0xc
mov dword [esp + 4], ebx
mov dword [esp + 8], esi
mov dword [esp], edi
call sub.WSOCK32.DLL_accept
sub esp, 0xc
mov ebx, eax
mov dword [esp], edi
call sub.WSOCK32.DLL_closesocket
sub esp, 4
cmp ebx, 0xffffffff
je 0x431225
mov eax, dword [ebp - 0x34]
mov esi, str.Connection_accepted_from_server_n
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.0042c910
mov ecx, dword [ebp - 0x30]
mov dword [ecx + 0x9c], ebx
mov ecx, 1
mov dword [esp + 4], ecx
mov dword [esp], ebx
call fcn.00438f70
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, str.Timeout_while_waiting_for_server_connect
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call fcn.0042c530
mov eax, 0x1e
jmp 0x431202
mov edi, str.Error_accept__ing_server_connect
mov dword [esp + 4], edi
mov ecx, dword [ebp - 0x34]
mov dword [esp], ecx
jmp 0x431219
mov eax, str.Error_while_waiting_for_server_connect
mov dword [esp + 4], eax
jmp 0x43122e
mov eax, str.Timed_out_before_server_could_connect_to_us
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x34]
mov dword [esp], eax
call fcn.0042c530
mov eax, 0x1c
jmp 0x431202
Function at 0x439cd0
Capabilities:
Check for time delay via gettickcount
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, dword [ebp + 8]
mov eax, dword [edi]
mov esi, dword [edi + 0x37c]
mov ebx, dword [eax + 0x9c]
mov dword [ebp - 0x10], eax
test ebx, ebx
jne 0x439d00
mov ebx, dword [eax + 0x98]
test ebx, ebx
je 0x439e00
nop
call sub.KERNEL32.dll_GetTickCount
imul eax, ebx, 0x3e8
mov dword [esp + 4], eax
mov eax, dword [esi + 0x18]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
mov ebx, eax
mov eax, dword [esi + 0x14]
sub esp, 8
mov dword [esp], eax
call sub.KERNEL32.dll_ReleaseMutex
mov eax, dword [esi + 0x14]
sub esp, 4
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov dword [esi + 0x14], 0
mov eax, dword [esi + 0x18]
sub esp, 4
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov dword [esi + 0x18], 0
sub esp, 4
test ebx, ebx
je 0x439e10
mov byte [edi + 0x374], 1
mov dword [esi + 8], 0xffffffff
mov eax, dword [esi]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
mov eax, dword [ebp + 0xc]
sub esp, 4
test eax, eax
je 0x439d8c
mov eax, dword [edi + 0x370]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [edi + 0x370]
xor ebx, ebx
test eax, eax
jne 0x439dd0
mov eax, dword [esi + 8]
cmp eax, 0x1b
je 0x439e90
inc eax
je 0x439ec0
mov eax, dword [edi + 0x378]
cmp eax, 0x2afc
je 0x439ec0
cmp byte [edi + 0x374], 0
mov ebx, 0x1c
jne 0x439e5b
mov esi, esi
lea eax, [edi + 0x368]
mov dword [esp], eax
call fcn.00439c30
mov eax, dword [edi + 0x370]
test eax, eax
jne 0x439def
mov byte [edi + 0xf8], 1
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, 0x12c
jmp 0x439d00
mov ecx, 0x1388
mov dword [esp + 4], ecx
mov eax, dword [esi]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
cmp eax, 0x102
je 0x439ee5
mov eax, dword [edi + 0x378]
mov dword [esp], eax
call sub.WS2_32.DLL_WSASetLastError
sub esp, 4
lea eax, [esi + 8]
mov dword [esp + 4], eax
mov eax, dword [esi]
mov dword [esp], eax
call sub.KERNEL32.dll_GetExitCodeThread
sub esp, 8
jmp 0x439d6d
mov dword [esp + 4], eax
mov ebx, 6
mov dword [esp], edi
call fcn.0043fea0
mov dword [esp + 0xc], eax
mov eax, dword [edi + 0x30]
mov dword [esp + 8], eax
mov eax, str.Could_not_resolve_host:__s___s
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0042c530
jmp 0x439dd0
mov dword [esp], 0x1b
call sym.fortis.exe_curl_easy_strerror
mov dword [esp + 8], eax
mov eax, str.Could_not_resolve_host:__s
mov ebx, 0x1b
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0042c530
jmp 0x439dd0
mov eax, dword [edi + 0x30]
mov ebx, 0x1c
mov edx, dword [ebp - 0x10]
mov dword [esp + 8], eax
mov eax, str.Resolving_host_timed_out:__s
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.0042c530
jmp 0x439dd0
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword [esi]
mov dword [esp], eax
call sub.KERNEL32.dll_TerminateThread
sub esp, 8
jmp 0x439d5f
Function at 0x43a340
Capabilities:
Get socket status

Disassembly:
push ebp
mov edx, 0x10624dd3
mov ebp, esp
push edi
xor edi, edi
push esi
xor esi, esi
push ebx
sub esp, 0x36c
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x348], edi
mov dword [ebp - 0x128], esi
mov eax, ebx
mov ecx, ebx
imul edx
sar ecx, 0x1f
sar edx, 6
sub edx, ecx
mov ecx, 0xffffffff
mov dword [ebp - 0x350], edx
imul edx, edx, 0x3e8
sub ebx, edx
imul eax, ebx, 0x3e8
cmp dword [ebp + 8], 0xffffffff
mov dword [ebp - 0x34c], eax
je 0x43a3b9
mov edx, dword [ebp + 8]
mov ebx, 1
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], edx
xor edx, edx
cmp edx, 0x3f
jbe 0x43a47b
mov ecx, dword [ebp + 8]
xor edx, edx
cmp dword [ebp + 0xc], 0xffffffff
mov dword [ebp - 0x238], edx
je 0x43a40d
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x348]
mov dword [ebp - 0x234], eax
mov eax, 1
mov dword [ebp - 0x238], eax
xor eax, eax
cmp edx, 0
jbe 0x43a401
nop
lea esi, [esi]
mov ebx, dword [ebp + 0xc]
cmp dword [ebp + eax*4 - 0x344], ebx
je 0x43a401
inc eax
cmp edx, eax
ja 0x43a3f0
cmp edx, eax
je 0x43a463
cmp dword [ebp + 0xc], ecx
jbe 0x43a40d
mov ecx, dword [ebp + 0xc]
lea edi, [ebp - 0x348]
lea esi, [ebp - 0x128]
lea ebx, [ecx + 1]
lea esi, [esi]
mov dword [esp + 0xc], edi
lea eax, [ebp - 0x350]
lea edx, [ebp - 0x238]
mov dword [esp + 0x10], eax
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.WS2_32.DLL_select
sub esp, 0x14
cmp eax, 0xffffffff
jne 0x43a494
call fcn.00438f60
cmp eax, 4
je 0x43a420
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x3f
ja 0x43a405
mov edx, dword [ebp + 0xc]
mov dword [ebp + eax*4 - 0x344], edx
inc eax
mov dword [ebp - 0x348], eax
jmp 0x43a405
mov ebx, dword [ebp + 8]
mov ecx, 1
mov dword [ebp - 0x348], ecx
mov dword [ebp - 0x344], ebx
jmp 0x43a3b6
test eax, eax
jl 0x43a456
jne 0x43a4a4
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebx, ebx
cmp dword [ebp + 8], 0xffffffff
je 0x43a4db
mov dword [esp + 4], esi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WS2_32.DLL___WSAFDIsSet
sub esp, 8
test eax, eax
jne 0x43a525
mov dword [esp + 4], edi
mov edx, dword [ebp + 8]
mov dword [esp], edx
call sub.WS2_32.DLL___WSAFDIsSet
sub esp, 8
test eax, eax
je 0x43a4db
or ebx, 4
cmp dword [ebp + 0xc], 0xffffffff
je 0x43a516
lea eax, [ebp - 0x238]
mov dword [esp + 4], eax
mov edx, dword [ebp + 0xc]
mov dword [esp], edx
call sub.WS2_32.DLL___WSAFDIsSet
sub esp, 8
test eax, eax
jne 0x43a520
mov dword [esp + 4], edi
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.WS2_32.DLL___WSAFDIsSet
sub esp, 8
test eax, eax
je 0x43a516
or ebx, 4
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
or ebx, 2
jmp 0x43a4fd
mov ebx, 1
jmp 0x43a4c2
Function at 0x440430
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
xor edx, edx
push esi
mov esi, eax
push ebx
xor ebx, ebx
mov esi, esi
movzx ecx, byte [ebx + edi]
mov al, cl
sub al, 0x41
cmp al, 0x19
ja 0x440470
shl edx, 6
movsx eax, cl
lea edx, [edx + eax - 0x41]
inc ebx
cmp ebx, 3
jle 0x440440
pop ebx
mov byte [esi + 2], dl
shr edx, 8
mov byte [esi + 1], dl
shr edx, 8
mov byte [esi], dl
pop esi
pop edi
pop ebp
ret
mov al, cl
sub al, 0x61
cmp al, 0x19
ja 0x440484
shl edx, 6
movsx eax, cl
lea edx, [edx + eax - 0x47]
jmp 0x440456
mov al, cl
sub al, 0x30
cmp al, 9
ja 0x440498
shl edx, 6
movsx eax, cl
lea edx, [edx + eax + 4]
jmp 0x440456
cmp cl, 0x2b
je 0x4404ac
cmp cl, 0x2f
je 0x4404b6
cmp cl, 0x3d
jne 0x440456
shl edx, 6
jmp 0x440456
mov eax, edx
shl eax, 6
lea edx, [eax + 0x3e]
jmp 0x440456
mov eax, edx
shl eax, 6
lea edx, [eax + 0x3f]
jmp 0x440456
Function at 0x4574d0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x58], 0
mov eax, 1
ret
Function at 0x45ed10
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebx
mov esi, dword [esp + 0x10]
test esi, esi
je 0x45eee0
push 0x167
push str..cryptoengineeng_list.c
push 0x1e
push 9
call fcn.0046fd40
mov ebx, dword [0x537e80]
add esp, 0x10
jmp 0x45ed56
sub esp, 8
mov eax, dword [ebx]
push eax
push esi
call sub.msvcrt.dll_strcmp
add esp, 0x10
test eax, eax
je 0x45ed80
mov ebx, dword [ebx + 0x60]
test ebx, ebx
jne 0x45ed40
push 0x181
push str..cryptoengineeng_list.c
push 0x1e
push 0xa
call fcn.0046fd40
add esp, 0x10
test ebx, ebx
mov edx, ebx
je 0x45ee11
pop ebx
pop esi
mov eax, edx
pop edi
ret
test byte [ebx + 0x48], 4
jne 0x45ed8b
inc dword [ebx + 0x4c]
jmp 0x45ed5a
call fcn.0045e2a0
test eax, eax
mov edx, eax
je 0x45ef02
mov ecx, dword [ebx]
mov dword [eax], ecx
mov eax, dword [ebx + 4]
mov edi, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
mov dword [edx + 4], eax
mov eax, dword [ebx + 0x10]
mov dword [edx + 8], edi
mov dword [edx + 0xc], ecx
mov edi, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x18]
mov dword [edx + 0x10], eax
mov eax, dword [ebx + 0x1c]
mov dword [edx + 0x14], edi
mov dword [edx + 0x18], ecx
mov edi, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
mov dword [edx + 0x1c], eax
mov eax, dword [ebx + 0x28]
mov dword [edx + 0x20], edi
mov dword [edx + 0x24], ecx
mov edi, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x30]
mov dword [edx + 0x28], eax
mov eax, dword [ebx + 0x34]
mov dword [edx + 0x2c], edi
mov dword [edx + 0x30], ecx
mov edi, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x3c]
mov dword [edx + 0x34], eax
mov eax, dword [ebx + 0x40]
mov dword [edx + 0x38], edi
mov dword [edx + 0x3c], ecx
mov dword [edx + 0x40], eax
mov edi, dword [ebx + 0x44]
mov ecx, dword [ebx + 0x48]
mov ebx, edx
mov dword [edx + 0x44], edi
mov dword [edx + 0x48], ecx
jmp 0x45ed5a
sub esp, 0xc
push str.OPENSSL_ENGINES
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
mov edi, eax
je 0x45ef09
sub esp, 0xc
push 0x51421b
call fcn.0045ed10
add esp, 0x10
test eax, eax
mov ebx, eax
je 0x45ee56
push 0
push esi
push 0x514223
push eax
call fcn.0048ab40
add esp, 0x10
test eax, eax
jne 0x45ee88
sub esp, 0xc
push 0x19b
push str..cryptoengineeng_list.c
push 0x74
push 0x6a
push 0x26
call fcn.0045de50
add esp, 0x1c
push esi
push 0x514226
push 2
call fcn.0045e060
xor edx, edx
add esp, 0x10
jmp 0x45ed7a
push 0
push 0x51422a
push 0x51422c
push ebx
call fcn.0048ab40
add esp, 0x10
test eax, eax
je 0x45ee56
push 0
push edi
push 0x514235
push ebx
call fcn.0048ab40
add esp, 0x10
test eax, eax
je 0x45ee56
push 0
push 0
push 0x51423d
push ebx
call fcn.0048ab40
add esp, 0x10
test eax, eax
mov edx, ebx
jne 0x45ed7a
jmp 0x45ee56
sub esp, 0xc
push 0x164
push str..cryptoengineeng_list.c
push 0x43
push 0x6a
push 0x26
call fcn.0045de50
xor edx, edx
add esp, 0x20
jmp 0x45ed7a
xor ebx, ebx
jmp 0x45ed5a
mov edi, str._usr_local_ssl_lib_engines
jmp 0x45ee2b
Function at 0x4644e0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [esp + 0x60]
xor eax, eax
test edi, edi
mov ebp, dword [esp + 0x64]
mov dword [esp + 0xc], 0
je 0x464526
sub esp, 8
lea ebx, [esp + 0x18]
push ebx
push edi
call sub.msvcrt.dll__stat
push 0
push 0
push 0x24
mov esi, eax
push ebx
call fcn.004655d0
add esp, 0x20
xor eax, eax
test esi, esi
js 0x464526
test ebp, ebp
jne 0x464530
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 8
push 0x514ab0
push edi
call sub.msvcrt.dll_fopen
add esp, 0x10
test eax, eax
mov edi, eax
je 0x4645d9
mov ax, word [esp + 0x16]
test ah, 0x30
je 0x464571
cmp ebp, 0xffffffff
mov eax, ebp
je 0x4645e9
push 0
push 4
push 0
push edi
mov ebp, eax
call sub.msvcrt.dll_setvbuf
add esp, 0x10
test ebp, ebp
jle 0x4645e2
cmp ebp, 0x400
mov esi, ebp
jg 0x4645e2
push edi
push esi
push 1
push 0x537f70
call sub.msvcrt.dll_fread
add esp, 0x10
test eax, eax
mov ebx, eax
jle 0x4645bc
push eax
fild dword [esp]
sub esp, 4
fstp qword [esp]
push esi
push 0x537f70
call fcn.004655d0
add dword [esp + 0x1c], ebx
add esp, 0x10
test ebp, ebp
jle 0x4645e2
sub ebp, esi
test ebp, ebp
jg 0x464575
sub esp, 0xc
push edi
call sub.msvcrt.dll_fclose
pop eax
pop edx
push 0x400
push 0x537f70
call fcn.004706f0
add esp, 0x10
mov eax, dword [esp + 0xc]
jmp 0x464526
mov esi, 0x400
jmp 0x46457f
mov eax, 0x800
jmp 0x464560

Function at 0x464710
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebx
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
call fcn.004a2630
xor ebx, ebx
test eax, eax
je 0x464760
call fcn.004a2630
test eax, eax
je 0x4647a0
test ebx, ebx
je 0x4647c0
cmp byte [ebx], 0
je 0x464753
sub esp, 0xc
push ebx
call sub.msvcrt.dll_strlen
add eax, 6
add esp, 0x10
cmp eax, edi
jb 0x4647d0
mov byte [esi], 0
mov edx, esi
pop ebx
pop esi
mov eax, edx
pop edi
ret
sub esp, 0xc
push str.RANDFILE
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
mov ebx, eax
je 0x464726
cmp byte [eax], 0
je 0x464726
sub esp, 0xc
push eax
call sub.msvcrt.dll_strlen
inc eax
add esp, 0x10
cmp eax, edi
jae 0x464726
push eax
push edi
push ebx
push esi
call fcn.00470480
add esp, 0x10
xor edx, edx
cmp eax, edi
jb 0x464756
jmp 0x464758
sub esp, 0xc
push str.HOME
call sub.msvcrt.dll_getenv
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x464737
lea esi, [esi]
lea edi, [edi]
mov ebx, 0x514ac4
jmp 0x464737
push eax
push edi
push ebx
push esi
call fcn.00470480
add esp, 0xc
push edi
push 0x514ac7
push esi
call fcn.00470670
add esp, 0xc
push edi
push str..rnd
push esi
call fcn.00470670
add esp, 0x10
jmp 0x464756
Function at 0x4651b0
Capabilities:
Capture screenshot

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
call fcn.00464960
call sub.KERNEL32.dll_GetVersion
test eax, eax
js 0x4651d2
call fcn.0046faf0
test eax, eax
jne 0x465334
push 0
push 0
push 0
push str.DISPLAY
call sub.GDI32.dll_CreateDCA
mov dword [esp + 0x1c], eax
sub esp, 0xc
push eax
call sub.GDI32.dll_CreateCompatibleDC
pop edx
mov dword [esp + 0x20], eax
push 8
mov eax, dword [esp + 0x28]
push eax
call sub.GDI32.dll_GetDeviceCaps
mov dword [esp + 0x18], eax
push 0xa
mov ebp, dword [esp + 0x28]
push ebp
call sub.GDI32.dll_GetDeviceCaps
pop ebp
mov dword [esp + 0x10], eax
push 0x10
mov edi, dword [esp + 0x18]
push edi
mov esi, dword [esp + 0x28]
push esi
call sub.GDI32.dll_CreateCompatibleBitmap
push ebx
push eax
mov ebx, dword [esp + 0x24]
push ebx
mov ebp, eax
call sub.GDI32.dll_SelectObject
pop edx
lea ecx, [esp + 0x44]
mov dword [esp + 0x18], eax
push ecx
push 0x18
push ebp
call sub.GDI32.dll_GetObjectA
mov edx, dword [esp + 0x4c]
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
imul edi, edx
push 0x2da
and eax, 0xffff
imul edi, eax
push str..crypto_rand_rand_win.c
push edi
call fcn.00458d40
add esp, 0x10
test eax, eax
mov ebx, eax
je 0x465304
mov edx, dword [esp + 0xc]
sub edx, 0x10
xor esi, esi
cmp edx, 0
mov dword [esp + 8], edx
jmp 0x4652f6
sub esp, 0xc
push 0xcc0020
push esi
push 0
mov eax, dword [esp + 0x34]
push eax
push 0x10
mov ecx, dword [esp + 0x30]
push ecx
push 0
push 0
mov edx, dword [esp + 0x44]
push edx
call sub.GDI32.dll_BitBlt
pop eax
pop edx
push ebx
push edi
push ebp
call sub.GDI32.dll_GetBitmapBits
push eax
push 0
push eax
call fcn.0047a3a0
mov dword [esp], eax
push 0
lea eax, [esp + 0x34]
push eax
push edi
push ebx
call fcn.00479270
add esp, 0x20
push 0
push 0
push 0x14
lea ecx, [esp + 0x2c]
push ecx
call fcn.004655d0
add esi, 0x10
add esp, 0x10
cmp dword [esp + 8], esi
jg 0x465290
sub esp, 0xc
push ebx
call fcn.00459050
add esp, 0x10
sub esp, 8
mov ebp, dword [esp + 0x1c]
push ebp
mov edi, dword [esp + 0x24]
push edi
call sub.GDI32.dll_SelectObject
push edi
push eax
call sub.GDI32.dll_DeleteObject
mov esi, dword [esp + 0x24]
push esi
call sub.GDI32.dll_DeleteDC
mov ebx, dword [esp + 0x28]
push ebx
call sub.GDI32.dll_DeleteDC
add esp, 0xc
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x465c50
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x58], 0
mov eax, 1
ret

Function at 0x46ebd0
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
xor esi, esi
test edx, edx
je 0x46ebe7
mov al, byte [edx]
test al, al
mov ebx, 0x100
jne 0x46ebf0
pop ebx
xor eax, eax
pop esi
ret
movsx eax, al
or eax, ebx
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
imul eax, eax
rol esi, cl
inc edx
xor esi, eax
mov al, byte [edx]
add ebx, 0x100
test al, al
jne 0x46ebf0
mov eax, esi
shr eax, 0x10
pop ebx
xor eax, esi
pop esi
ret
Function at 0x46fbd0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x14c
mov ebx, dword [ebp + 8]
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
add esp, 0xc
test eax, eax
je 0x46fc00
sub esp, 0xc
push eax
call sub.KERNEL32.dll_GetFileType
add esp, 0xc
test eax, eax
jne 0x46fcb0
lea edx, [ebp + 0xc]
push edx
push ebx
push 0xff
lea esi, [ebp - 0x108]
push esi
call sub.msvcrt.dll__vsnprintf
mov byte [ebp - 9], 0
call sub.KERNEL32.dll_GetVersion
add esp, 0x10
test eax, eax
js 0x46fc33
call fcn.0046faf0
test eax, eax
jne 0x46fcd0
sub esp, 0xc
lea eax, [ebp - 0x138]
mov dword [ebp - 0x138], 0x28
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x128], str.OpenSSL:_FATAL
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x120], 0x7f01
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0x409
mov dword [ebp - 0x12c], esi
push eax
call sub.USER32.dll_MessageBoxIndirectA
add esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea ecx, [ebp + 0xc]
push edx
push ecx
push ebx
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call sub.msvcrt.dll_vfprintf
add esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
sub esp, 8
push str.OPENSSL
push 0
call sub.ADVAPI32.DLL_RegisterEventSourceA
mov dword [ebp - 0x13c], esi
push esi
push 0
lea esi, [ebp - 0x13c]
push esi
push 0
push 1
push 0
push 0
push 0
push 1
push eax
mov ebx, eax
call sub.ADVAPI32.DLL_ReportEventA
push ebx
call sub.ADVAPI32.DLL_DeregisterEventSource
jmp 0x46fca2
Function at 0x474040
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x18
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], 0
push esi
call fcn.0046cf50
add esp, 0x10
cmp eax, dword [esp + 0x30]
je 0x474090
sub esp, 0xc
push 0x9a
push str..crypto_rsa_rsa_sign.c
push 0x77
push 0x77
push 4
call fcn.0045de50
xor eax, eax
add esp, 0x20
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [esi + 0x3c], 0x40
je 0x4740a4
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x30]
test eax, eax
jne 0x474200
push eax
push 0xa4
push str..crypto_rsa_rsa_sign.c
mov eax, dword [esp + 0x3c]
push eax
call fcn.00458d40
add esp, 0x10
test eax, eax
mov ebx, eax
je 0x47427d
cmp edi, 0x72
je 0x474130
sub esp, 0xc
push 1
push esi
push ebx
push ebp
mov esi, dword [esp + 0x4c]
push esi
call fcn.0046d010
add esp, 0x20
test eax, eax
jle 0x474155
cmp edi, 0x72
jne 0x474180
cmp eax, 0x24
jne 0x474110
cld
mov esi, ebx
mov edi, dword [esp + 0x24]
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x47421c
lea esi, [esi]
lea edi, [edi]
sub esp, 0xc
push 0xb5
push str..crypto_rsa_rsa_sign.c
push 0x68
jmp 0x474149
cmp dword [esp + 0x28], 0x24
je 0x4740cb
sub esp, 0xc
push 0xab
push str..crypto_rsa_rsa_sign.c
push 0x83
push 0x77
push 4
call fcn.0045de50
add esp, 0x20
test ebx, ebx
je 0x474172
sub esp, 8
mov ebp, dword [esp + 0x38]
push ebp
push ebx
call fcn.004706f0
mov dword [esp], ebx
call fcn.00459050
add esp, 0x10
mov eax, dword [esp + 4]
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
push edx
push eax
lea ebp, [esp + 0x10]
push ebp
push 0
call fcn.0049e4a0
add esp, 0x10
test eax, eax
mov ebp, eax
je 0x474155
mov eax, dword [eax]
sub esp, 0xc
mov edx, dword [eax]
push edx
call fcn.0046aa20
add esp, 0x10
cmp eax, edi
je 0x474249
cmp edi, 4
je 0x474278
cmp edi, 3
je 0x474229
sub esp, 0xc
push 0xd3
push str..crypto_rsa_rsa_sign.c
push 0x64
push 0x77
push 4
call fcn.0045de50
add esp, 0x20
test ebp, ebp
je 0x474155
sub esp, 0xc
push ebp
call fcn.0049e500
add esp, 0x10
jmp 0x474155
sub esp, 8
push esi
mov ebx, dword [esp + 0x3c]
push ebx
push ebp
mov ecx, dword [esp + 0x3c]
push ecx
mov edx, dword [esp + 0x3c]
push edx
push edi
call eax
jmp 0x474084
mov dword [esp + 4], 1
jmp 0x474155
cmp eax, 7
jne 0x4741c1
mov edi, dword [sym.imp.msvcrt.dll__iob]
add edi, 0x40
push edi
push 0x34
push 1
push str.signature_has_problems__re_make_with_post_SSLeay045_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
mov eax, dword [ebp + 4]
mov edx, dword [esp + 0x28]
cmp dword [eax], edx
jne 0x474264
mov edi, dword [eax + 8]
cld
cmp edx, edx
mov esi, dword [esp + 0x24]
mov ecx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x4742a1
sub esp, 0xc
push 0xda
push str..crypto_rsa_rsa_sign.c
push 0x68
jmp 0x4741d0
cmp eax, 8
jmp 0x47422c
sub esp, 0xc
push 0xa7
push str..crypto_rsa_rsa_sign.c
push 0x41
push 0x77
push 4
call fcn.0045de50
add esp, 0x20
mov eax, dword [esp + 4]
jmp 0x474176
mov dword [esp + 4], 1
jmp 0x4741dc
Function at 0x47e170
Capabilities:
Check if file exists

Disassembly:
push edi
push esi
push ebx
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
sub esp, 8
push ebx
push edi
call sub.msvcrt.dll_fopen
add esp, 0x10
test eax, eax
mov esi, eax
je 0x47e1ba
sub esp, 0xc
push 0x4ff3b0
call fcn.00466cd0
mov ebx, eax
add esp, 0x10
xor eax, eax
test ebx, ebx
je 0x47e1b6
push esi
push 1
push 0x6a
push ebx
call fcn.004672c0
mov eax, ebx
add esp, 0x10
pop ebx
pop esi
pop edi
ret
sub esp, 0xc
push 0x7a
push str..crypto_bio_bss_file.c
sub esp, 0xc
call sub.KERNEL32.dll_GetLastError
add esp, 0xc
push eax
push 1
push 2
call fcn.0045de50
add esp, 0x18
push 0x520a05
push ebx
push 0x520a08
push edi
push str.fopen_
push 5
call fcn.0045e060
add esp, 0x20
call sub.msvcrt.dll__errno
cmp dword [eax], 2
je 0x47e21f
sub esp, 0xc
push 0x7f
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.0045de50
add esp, 0x20
pop ebx
pop esi
xor eax, eax
pop edi
ret
sub esp, 0xc
push 0x7d
push str..crypto_bio_bss_file.c
push pe_nt_image_headers32
jmp 0x47e20d