joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d890
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 0
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0
jbe 0x45d9df
push esi
push edi
push 0
push 0
push ebx
push 0x45d780
push 0
push 0
call dword [sym.imp.MSVCR100.dll__beginthreadex]
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], edi
test edi, edi
je 0x45d9c2
mov eax, dword [ebx + 0x7c]
lea esi, [ebx + 0x78]
lea ecx, [ebp - 4]
cmp ecx, eax
jae 0x45d94b
mov edx, dword [esi]
cmp edx, ecx
ja 0x45d94b
mov edi, ecx
mov ecx, dword [esi + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x45d93b
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x45d9b7
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x45d93b
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x45d928
xor ecx, ecx
jmp 0x45d92a
add ecx, edx
cmp ecx, eax
jae 0x45d930
mov ecx, eax
push ecx
mov ecx, esi
call fcn.0046d0d0
mov ebx, dword [ebp - 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x45d999
mov edx, dword [esi]
mov ecx, dword [edx + edi*4]
mov dword [eax], ecx
jmp 0x45d999
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x45d990
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x45d9b7
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x45d990
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x45d97d
xor ecx, ecx
jmp 0x45d97f
add ecx, edx
cmp ecx, eax
jae 0x45d985
mov ecx, eax
push ecx
mov ecx, esi
call fcn.0046d0d0
mov ebx, dword [ebp - 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x45d999
mov dword [eax], edi
mov eax, dword [ebp - 0xc]
add dword [esi + 4], 4
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebx + 0x14]
jb 0x45d8b6
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.vector_T__too_long
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [ebx + 0x58], 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov dword [ebp - 0x10], 0
pop esi
mov eax, dword [ebp - 0x10]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45e300
Capabilities:
Create udp socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x1c
push esi
push edi
xor edi, edi
mov esi, ecx
test eax, eax
je 0x45e318
cmp word [eax], di
jne 0x45e31d
mov eax, str.0.0.0.0
xor ecx, ecx
lea edx, [ebp - 0x1c]
mov word [ebp - 0x1c], cx
mov ecx, dword [ebp + 0xc]
push edx
push ecx
push eax
call fcn.0043a340
add esp, 0xc
test eax, eax
je 0x45e45b
mov ax, word [ebp - 0x1c]
push 0x11
movzx edx, ax
push 2
push edx
mov word [esi + 0x124], ax
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x12c], eax
cmp eax, 0xffffffff
je 0x45e45b
push 0
push eax
call fcn.00439000
add esp, 8
test eax, eax
je 0x45e37d
push 0x80004005
call fcn.00423210
mov eax, dword [esi + 4]
mov ecx, dword [esi + 0x12c]
push eax
push ecx
call fcn.00438f00
add esp, 8
test eax, eax
je 0x45e39e
push 0x80004005
call fcn.00423210
mov edx, dword [esi + 0x12c]
push 1
push edx
call fcn.00438d50
add esp, 8
test eax, eax
je 0x45e3bd
push 0x80004005
call fcn.00423210
mov ecx, dword [esi + 0x12c]
xor eax, eax
cmp word [ebp - 0x1c], 2
setne al
dec eax
and eax, 0xfffffff4
add eax, 0x1c
push eax
lea eax, [ebp - 0x1c]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x45e43c
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edx, dword [esi]
mov eax, dword [esi + 0x12c]
mov edx, dword [edx + 0xe4]
push eax
mov ecx, esi
call edx
cmp eax, 2
je 0x45e414
mov edi, 1
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x45e423
mov eax, 0x4c7
push eax
push str.CUdpServer::CreateListenSocket
push 5
mov ecx, esi
call fcn.0045dbc0
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.CUdpServer::CreateListenSocket
push 4
mov ecx, esi
call fcn.0045dbc0
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
mov dword [esi + 0x138], 3
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x45e5e0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x2c]
push edi
mov edi, 1
call edx
test eax, eax
jne 0x45e601
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
mov eax, dword [ebp + 0xc]
add eax, 8
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
mov eax, dword [esi + 0x12c]
push 0
push 0
push 0
push eax
call dword [sym.imp.WS2_32.dll_sendto]
cmp eax, 0xffffffff
jne 0x45e657
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x45e657
mov edx, dword [esi]
mov eax, dword [edx + 0x2c]
mov ecx, esi
xor edi, edi
call eax
test eax, eax
je 0x45e5f9
push 0x80004005
call fcn.00423210
mov ecx, dword [ebp + 8]
push ecx
push str._S_CNNID:__Iu__send_0_bytes__detect_package__n
call fcn.00449e70
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebp
ret 8
Function at 0x45eba0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax]
xor eax, eax
cmp word [esi], 2
push edi
setne al
mov edx, 0x811c9dc5
lea edi, [eax - 1]
and edi, 0xffffffec
add edi, 0x1c
xor eax, eax
test edi, edi
jle 0x45ebe2
push ebx
jmp 0x45ebd0
movzx ebx, byte [eax + esi]
imul edx, edx, 0x1000193
inc eax
xor edx, ebx
cmp eax, edi
jl 0x45ebd0
pop ebx
mov esi, dword [ecx + 0x20]
mov eax, esi
and eax, edx
cmp dword [ecx + 0x24], eax
ja 0x45ebf7
shr esi, 1
or ecx, 0xffffffff
sub ecx, esi
add eax, ecx
pop edi
pop esi
pop ebp
ret 4

Function at 0x4604f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 4]
mov dword [ebp - 4], ebx
cmp eax, dword [ecx]
jne 0x460521
cmp dword [ebp + 0x10], ecx
jne 0x460521
mov ecx, ebx
call fcn.00460460
mov eax, dword [ebx + 4]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp eax, dword [ebp + 0x10]
je 0x4605df
push esi
push edi
lea esp, [esp]
mov edx, dword [eax]
mov dword [ebp + 0xc], edx
mov esi, dword [eax + 8]
xor ecx, ecx
cmp word [esi], 2
mov edx, 0x811c9dc5
setne cl
lea edi, [ecx - 1]
and edi, 0xffffffec
add edi, 0x1c
xor ecx, ecx
test edi, edi
jle 0x460569
movzx ebx, byte [ecx + esi]
imul edx, edx, 0x1000193
inc ecx
xor edx, ebx
cmp ecx, edi
jl 0x460555
mov ebx, dword [ebp - 4]
mov esi, dword [ebx + 0x20]
mov ecx, esi
and ecx, edx
cmp dword [ebx + 0x24], ecx
ja 0x46057e
shr esi, 1
or edx, 0xffffffff
sub edx, esi
add ecx, edx
mov edx, dword [ebx + 0x10]
cmp dword [edx + ecx*8 + 4], eax
lea edx, [edx + ecx*8]
jne 0x4605a7
cmp dword [edx], eax
jne 0x46059f
mov esi, dword [ebx + 4]
mov dword [edx], esi
mov edx, dword [ebx + 0x10]
mov esi, dword [ebx + 4]
mov dword [edx + ecx*8 + 4], esi
jmp 0x4605af
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
jmp 0x4605af
cmp dword [edx], eax
jne 0x4605af
mov ecx, dword [eax]
mov dword [edx], ecx
cmp eax, dword [ebx + 4]
je 0x4605cf
mov edx, dword [eax + 4]
mov ecx, dword [eax]
mov dword [edx], ecx
mov edx, dword [eax]
mov ecx, dword [eax + 4]
push eax
mov dword [edx + 4], ecx
call sub.mfc100u.dll_delete
add esp, 4
dec dword [ebx + 8]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
cmp eax, edx
jne 0x460530
pop edi
pop esi
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x461d60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
cmp dword [ebx + 0x14], 0
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0xc], 0
jbe 0x461eb8
push esi
push edi
push 0
push 0
push ebx
push 0x461bc0
push 0
push 0
call dword [sym.imp.MSVCR100.dll__beginthreadex]
mov edi, eax
add esp, 0x18
mov dword [ebp - 4], edi
test edi, edi
je 0x461e98
mov eax, dword [ebx + 0x140]
lea esi, [ebx + 0x13c]
lea ecx, [ebp - 4]
cmp ecx, eax
jae 0x461e21
mov edx, dword [esi]
cmp edx, ecx
ja 0x461e21
mov edi, ecx
mov ecx, dword [esi + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x461e11
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x461e8d
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x461e11
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x461dfe
xor ecx, ecx
jmp 0x461e00
add ecx, edx
cmp ecx, eax
jae 0x461e06
mov ecx, eax
push ecx
mov ecx, esi
call fcn.0046d0d0
mov ebx, dword [ebp - 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x461e6f
mov edx, dword [esi]
mov ecx, dword [edx + edi*4]
mov dword [eax], ecx
jmp 0x461e6f
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x461e66
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x461e8d
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x461e66
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x461e53
xor ecx, ecx
jmp 0x461e55
add ecx, edx
cmp ecx, eax
jae 0x461e5b
mov ecx, eax
push ecx
mov ecx, esi
call fcn.0046d0d0
mov ebx, dword [ebp - 8]
mov eax, dword [esi + 4]
test eax, eax
je 0x461e6f
mov dword [eax], edi
mov eax, dword [ebp - 0xc]
add dword [esi + 4], 4
inc eax
mov dword [ebp - 0xc], eax
cmp eax, dword [ebx + 0x14]
jb 0x461d86
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.vector_T__too_long
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov dword [ebx + 0x138], 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
mov dword [ebp - 0x10], 0
pop esi
mov eax, dword [ebp - 0x10]
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x465df0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
push edi
xor edi, edi
cmp eax, edi
je 0x465e24
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x465e24
xor eax, eax
cmp dword [ebp - 4], 0x103
sete al
cmp eax, edi
jne 0x465f12
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x465e4c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
push 0x18
call sub.mfc100u.dll_new
add esp, 4
cmp eax, edi
je 0x465e73
mov edx, dword [ebp + 8]
mov dword [eax], edx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov dword [eax + 0xc], edx
mov dword [eax + 0x10], ecx
mov edi, eax
mov edx, dword [edi]
mov dword [esi + 0x10], edx
mov eax, dword [edi + 4]
mov dword [esi + 0x14], eax
mov ecx, dword [edi + 8]
mov dword [esi + 0x18], ecx
mov edx, dword [edi + 0xc]
mov dword [esi + 0x1c], edx
mov eax, dword [edi + 0x10]
mov dword [esi + 0x20], eax
mov ecx, dword [edi + 0x14]
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x18]
lea edx, [esi + 8]
mov dword [esi + 0x24], ecx
mov ecx, dword [ebp + 0x20]
push edx
test ebx, ebx
jne 0x465ebf
push ebx
push edi
push 0x464b80
push eax
push ecx
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0xc], eax
jmp 0x465eeb
push 4
push edi
push 0x464b80
push eax
push ecx
call dword [sym.imp.MSVCR100.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0xc], eax
test eax, eax
je 0x465eeb
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp dword [esi + 0xc], 0
pop ebx
jne 0x465f27
push 0x65f
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
xor esi, esi
call sub.mfc100u.dll_delete
add esp, 4
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x1c
push 0x139f
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x1c
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x46cbc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
movzx ecx, word [edx]
mov eax, 0x811c9dc5
test cx, cx
je 0x46cbf9
push esi
lea esi, [ecx - 0x41]
add edx, 2
cmp si, 0x19
ja 0x46cbe5
add ecx, 0x20
imul eax, eax, 0x1000193
movzx ecx, cx
xor eax, ecx
movzx ecx, word [edx]
test cx, cx
jne 0x46cbd6
pop esi
pop ebp
ret 4
Function at 0x4754c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x24]
cdq
push esi
mov esi, eax
mov eax, dword [ebp + 0x20]
push edi
mov edi, eax
or edi, ecx
jne 0x475536
mov eax, esi
mov ecx, edx
movzx edi, byte [ebp + 0xc]
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
mov esi, dword [ebp + 0x28]
setne bl
and edi, 7
mov dword [esi], 0
mov edx, 2
add ebx, ebx
add ebx, ebx
add ebx, ebx
or ebx, edi
movzx edi, byte [ebp + 0x10]
shl ebx, 4
and edi, 0xf
or ebx, edi
mov edi, dword [ebp + 0x14]
mov dword [esi], ebx
xor ebx, ebx
test edi, edi
setne bl
shl ebx, 0xf
or dword [esi], ebx
test ecx, ecx
ja 0x475577
jb 0x475529
cmp eax, 0x7e
jae 0x47554e
movzx eax, al
and eax, 0x7f
shl eax, 8
or dword [esi], eax
jmp 0x475592
cmp ecx, edx
ja 0x4754db
jb 0x475540
cmp eax, esi
jae 0x4754db
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
pop ebp
ret
test ecx, ecx
ja 0x475577
jb 0x47555b
cmp eax, 0xffff
ja 0x475577
or dword [esi], 0x7e00
push eax
call dword [sym.imp.WS2_32.dll_htons]
movzx ecx, ax
shl ecx, 0x10
or dword [esi], ecx
mov edx, 4
jmp 0x475592
or dword [esi], 0x7f00
push ecx
push eax
call fcn.00438740
mov dword [esi + 6], edx
add esp, 8
mov dword [esi + 2], eax
mov edx, 0xa
mov ecx, dword [ebp + 0x18]
test edi, edi
je 0x4755b9
mov eax, dword [edi]
mov dword [edx + esi], eax
xor eax, eax
cmp dword [ebp + 0x1c], eax
jle 0x4755b6
mov ebx, eax
and ebx, 3
mov bl, byte [ebx + edi]
xor byte [eax + ecx], bl
inc eax
cmp eax, dword [ebp + 0x1c]
jl 0x4755a5
add edx, 4
mov eax, dword [ebp + 0x2c]
mov dword [eax + 0xc], ecx
mov ecx, dword [ebp + 0x1c]
pop ebx
mov dword [eax + 4], esi
pop edi
mov dword [eax], edx
mov dword [eax + 8], ecx
mov eax, 1
pop esi
pop ebp
ret
Function at 0x4881e0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
test esi, esi
je 0x488237
mov al, byte [esi]
test al, al
je 0x488237
push ebx
mov ebx, 0x100
jmp 0x488200
movsx eax, al
push eax
call fcn.004d2cc0
or eax, ebx
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
add esp, 4
rol edi, cl
inc esi
add ebx, 0x100
xor edi, eax
mov al, byte [esi]
test al, al
jne 0x488200
mov eax, edi
shr eax, 0x10
pop ebx
xor eax, edi
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x48e840
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048e5d0
Function at 0x48ef90
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x644a10]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
push ebx
jg 0x48efc5
jl 0x48efb3
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jne 0x48efc8
mov eax, dword [ebp + 8]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b2129
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0x10]
mov edx, 1
mov dword [ebp - 0x84], 0xedb88320
mov ecx, edx
lea esp, [esp]
mov dword [ebp + ecx*4 - 0x84], edx
inc ecx
add edx, edx
cmp ecx, 0x20
jl 0x48efe0
push esi
push edi
xor edi, edi
jmp 0x48f000
mov ecx, dword [ebp + edi - 0x84]
xor esi, esi
lea edx, [ebp - 0x84]
test ecx, ecx
je 0x48f021
test cl, 1
je 0x48f01a
xor esi, dword [edx]
add edx, 4
shr ecx, 1
jne 0x48f013
mov dword [ebp + edi - 0x104], esi
add edi, 4
cmp edi, 0x80
jl 0x48f000
xor edi, edi
jmp 0x48f040
mov ecx, dword [ebp + edi - 0x104]
xor esi, esi
lea edx, [ebp - 0x104]
test ecx, ecx
je 0x48f061
test cl, 1
je 0x48f05a
xor esi, dword [edx]
add edx, 4
shr ecx, 1
jne 0x48f053
mov dword [ebp + edi - 0x84], esi
add edi, 4
cmp edi, 0x80
jl 0x48f040
jmp 0x48f083
mov ebx, dword [ebp + 0x10]
xor edi, edi
jmp 0x48f090
mov ecx, dword [ebp + edi - 0x84]
xor esi, esi
lea edx, [ebp - 0x84]
test ecx, ecx
je 0x48f0b1
test cl, 1
je 0x48f0aa
xor esi, dword [edx]
add edx, 4
shr ecx, 1
jne 0x48f0a3
mov dword [ebp + edi - 0x104], esi
add edi, 4
cmp edi, 0x80
jl 0x48f090
mov ecx, ebx
and ecx, 1
xor edx, edx
or ecx, edx
je 0x48f0f0
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x104]
test eax, eax
je 0x48f0ed
jmp 0x48f0e0
test al, 1
je 0x48f0e6
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x48f0e0
mov dword [ebp + 8], edx
mov eax, dword [ebp + 0x14]
shrd ebx, eax, 1
sar eax, 1
mov dword [ebp - 0x108], eax
mov eax, ebx
mov ebx, dword [ebp - 0x108]
mov ecx, eax
or ecx, ebx
mov dword [ebp + 0x10], eax
je 0x48f199
xor edi, edi
jmp 0x48f120
mov ecx, dword [ebp + edi - 0x104]
xor esi, esi
lea edx, [ebp - 0x104]
test ecx, ecx
je 0x48f141
test cl, 1
je 0x48f13a
xor esi, dword [edx]
add edx, 4
shr ecx, 1
jne 0x48f133
mov dword [ebp + edi - 0x84], esi
add edi, 4
cmp edi, 0x80
jl 0x48f120
mov ecx, eax
and ecx, 1
xor edx, edx
or ecx, edx
je 0x48f183
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x84]
test eax, eax
je 0x48f17d
jmp 0x48f170
test al, 1
je 0x48f176
xor edx, dword [ecx]
add ecx, 4
shr eax, 1
jne 0x48f170
mov eax, dword [ebp + 0x10]
mov dword [ebp + 8], edx
shrd eax, ebx, 1
mov ecx, eax
sar ebx, 1
mov dword [ebp + 0x10], ecx
or ecx, ebx
mov dword [ebp + 0x14], ebx
jne 0x48f080
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
xor eax, dword [ebp + 0xc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005b2129
mov esp, ebp
pop ebp
ret
Function at 0x49c690
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
ret

Function at 0x4a2f70
Capabilities:
Allocate thread local storage

Disassembly:
push 0
push 0
push 0
call fcn.00477a90
add esp, 0xc
test eax, eax
jne 0x4a2f85
xor eax, eax
ret
push 0
push 0x6480a8
call fcn.0049c670
add esp, 8
test eax, eax
je 0x4a2f82
push ebx
push 0
push 0x6480ac
call fcn.0049c670
add esp, 8
test eax, eax
je 0x4a3012
mov eax, dword [0x6480b8]
mov ecx, dword [0x641510]
push esi
push eax
push ecx
xor ecx, ecx
lea ebx, [ecx + 1]
call fcn.004a2d70
mov esi, eax
add esp, 8
test esi, esi
je 0x4a2ffa
push esi
call fcn.004a2be0
add esp, 4
test eax, eax
jne 0x4a2fe7
push esi
call fcn.004a2070
add esp, 4
xor esi, esi
jmp 0x4a2ffa
push 0x1c
push str.OpenSSL_NIST_SP_800_90A_DRBG
push esi
mov dword [esi + 0x58], ebx
call fcn.004a20f0
add esp, 0xc
mov dword [0x6480b0], esi
test esi, esi
pop esi
jne 0x4a3023
push 0x6480ac
call fcn.0049c6e0
add esp, 4
push 0x6480a8
call fcn.0049c6e0
add esp, 4
xor eax, eax
pop ebx
ret
mov eax, ebx
pop ebx
ret
Function at 0x4a5980
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x208
call fcn.005b2630
mov eax, dword [0x644a10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x4a59f5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4a59f5
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x204]
push 0x200
push edx
call sub.MSVCR100.dll__vsnprintf
add esp, 0x10
test eax, eax
jns 0x4a59d8
mov eax, 0x200
push 0
lea ecx, [ebp - 0x208]
push ecx
push eax
lea edx, [ebp - 0x204]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4a5b3e
mov ebx, dword [ebp + 8]
mov eax, ebx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4a5a00
sub eax, edx
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.005b2670
mov esi, esp
test esi, esi
jne 0x4a5a24
mov esi, str.no_stack_
jmp 0x4a5aaf
push edi
push esi
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x4a5a51
test edi, edi
je 0x4a5a51
lea ebx, [ebx]
mov ecx, dword [ebp + 8]
movsx dx, byte [eax + ecx]
mov word [esi + eax*2], dx
inc eax
cmp eax, edi
jb 0x4a5a40
xor eax, eax
test edi, edi
je 0x4a5aaf
cmp word [esi + eax*2], 0x25
jne case.0x4a5a74.43
lea ecx, [esi + eax*2 + 2]
movzx edx, word [ecx]
add edx, 0xffffffd6
cmp edx, 0x49
ja case.0x4a5a74.43
movzx edx, byte [edx + 0x4a5b70]
jmp dword [edx*4 + 0x4a5b58]
inc eax
add ecx, 2
jmp 0x4a5a62
mov ecx, 0x53
mov word [esi + eax*2 + 2], cx
jmp case.0x4a5a74.43
mov edx, 0x73
jmp 0x4a5aa5
mov ecx, 0x43
mov word [esi + eax*2 + 2], cx
jmp case.0x4a5a74.43
mov edx, 0x63
mov word [esi + eax*2 + 2], dx
inc eax
cmp eax, edi
jb 0x4a5a57
lea eax, [ebp + 0xc]
push eax
push esi
lea ecx, [ebp - 0x204]
push 0xff
push ecx
call sub.MSVCR100.dll__vsnwprintf
xor edx, edx
add esp, 0x10
mov word [ebp - 6], dx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4a5b28
call fcn.004a5840
test eax, eax
jle 0x4a5b28
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x4a5b3e
push 0
lea ecx, [ebp - 0x208]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x204]
push esi
mov dword [ebp - 0x208], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x4a5b3e
push 0x10
push str.OpenSSL:_FATAL
lea edx, [ebp - 0x204]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b2129
mov esp, ebp
pop ebp
ret

Function at 0x4a5bf0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
je 0x4a5c16
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
sub esi, eax
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
or cl, dl
inc eax
dec edi
jne 0x4a5c07
pop esi
pop ebx
movzx eax, cl
pop edi
ret
Function at 0x4c48f0
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
push ebx
call fcn.0052dbc0
push 0x62
push esi
mov edi, eax
mov ebp, 1
call sub.MSVCR100.dll_strchr
add esp, 0x10
test eax, eax
jne 0x4c491c
lea ebp, [eax + 0x11]
test edi, edi
jne 0x4c49a5
push 0x45
push str.crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.00486d00
push 0x5c82a0
push esi
push 0x5ec6d4
push ebx
push str.fopen_
push 5
call fcn.004872b0
add esp, 0x2c
call sub.MSVCR100.dll__errno
cmp dword [eax], 2
je 0x4c4986
call sub.MSVCR100.dll__errno
cmp dword [eax], 6
je 0x4c4986
push 0x4e
push str.crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.00486d00
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x4c
push str.crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.00486d00
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x5ec678
call fcn.00482ca0
mov esi, eax
add esp, 4
test esi, esi
jne 0x4c49c8
push edi
call sub.MSVCR100.dll_fclose
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.00482e70
push edi
push ebp
push 0x6a
push esi
call fcn.00483650
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret