joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d0b2f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x84c], edi
je 0x4d0b99
cmp dword [ebp + 8], 0x100
jne 0x4d0b88
cmp word [ebp + 0xc], 0xd
jne 0x4d0b88
cmp byte [esi + 0x852], 0
je 0x4d0b6f
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x4d0b88
cmp byte [esi + 0x853], 0
jne 0x4d0b88
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x4d0b84
push edi
push edi
push edi
push str.return
push esi
call fcn.004b3237
xor eax, eax
jmp 0x4d0b9c
mov eax, dword [esi + 0x84c]
pop edi
pop esi
mov ecx, dword [eax + 0xc]
mov eax, dword [ecx]
pop ebp
jmp dword [eax + 0xc]
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x4d0fd8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4d108e
movzx eax, word [esi]
test ax, ax
je 0x4d108e
push edi
mov edi, esi
mov ecx, esi
cmp ax, 0x2f
je 0x4d1018
cmp ax, 0x5c
jne 0x4d101a
mov edi, ecx
add ecx, 2
movzx eax, word [ecx]
test ax, ax
jne 0x4d100c
cmp edi, esi
je 0x4d1061
sub edi, esi
lea eax, [ebp - 0x20c]
sar edi, 1
push edi
push esi
push eax
call fcn.0060143b
add edi, edi
add esp, 0xc
cmp edi, 0x208
jae 0x4d109e
xor eax, eax
mov word [ebp + edi - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.004d0fd8
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00601419
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.0060a1ab
add esp, 0x10
lea eax, [ebp - 0x414]
push 0
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa758
mov esp, ebp
pop ebp
ret
call fcn.004aaf06
int3

Function at 0x4d1a12
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x4d1a8e
cmp dword [edi + 4], 0xffffffff
jne 0x4d1a8e
push esi
lea esi, [edi + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
push 0x6ea880
push esi
call fcn.0060a1ab
cmp dword [ebp + 0x10], 1
pop ecx
pop ecx
pop esi
jne 0x4d1a60
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileType]
cmp eax, 1
je 0x4d1a60
mov eax, 0x2000000
jmp 0x4d1a93
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004d3f8e
add esp, 0x10
test eax, eax
jne 0x4d1a7e
mov eax, dword [ebp - 4]
jmp 0x4d1a93
push eax
call fcn.004d4847
mov dword [edi], eax
mov eax, dword [0x728a50]
pop ecx
jmp 0x4d1a93
mov eax, 0x1000000
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4d3f8e
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
sub esp, 0x10
cmp ecx, 1
je 0x4d3fb6
cmp ecx, 2
je 0x4d3fb6
cmp ecx, 3
je 0x4d3fb6
mov eax, dword [ebp + 0x14]
mov dword [eax], 0x10000
xor eax, eax
jmp 0x4d413d
push ebx
mov ebx, dword [ebp + 8]
xor al, al
push esi
push edi
mov edi, dword [ebp + 0x14]
xor edx, edx
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], edx
mov dword [edi], eax
cmp ecx, 1
jne 0x4d4017
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push 2
push eax
push eax
lea eax, [ebp - 4]
push eax
call esi
push eax
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
test eax, eax
jne 0x4d3ffc
mov dword [edi], 0x100
jmp 0x4d40d3
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetFileType]
mov edx, dword [ebp - 4]
dec eax
mov ecx, dword [ebp + 0x10]
neg eax
sbb al, al
inc al
mov dword [ebp - 8], eax
xor eax, eax
cmp ecx, 2
jne 0x4d40bf
push eax
push 0x80
push 3
push eax
push 1
push accept
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x4d404a
mov dword [edi], 0x200
jmp 0x4d40d3
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileType]
dec eax
neg eax
push 0
push dword [ebp - 4]
sbb al, al
inc al
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
xor ebx, ebx
mov dword [ebp - 0xc], esi
test esi, esi
je 0x4d40af
push esi
call fcn.0060a1f7
mov ebx, eax
pop ecx
test ebx, ebx
je 0x4d40af
push 0
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov ecx, 0x800
test eax, eax
jne 0x4d409a
mov dword [edi], ecx
cmp dword [ebp - 0x10], esi
je 0x4d40a1
mov dword [edi], ecx
cmp dword [edi], 0
je 0x4d40af
push ebx
call fcn.005fa0fb
pop ecx
xor ebx, ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x4d40c5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
test edx, edx
jne 0x4d40d7
test ebx, ebx
jne 0x4d40d7
mov dword [edi], 0x300
xor eax, eax
jmp 0x4d413a
push 0x24
call fcn.004aab32
mov esi, eax
mov eax, dword [ebp + 0x10]
pop ecx
mov dword [esi + 4], eax
cmp dword [ebp - 4], 0
je 0x4d411c
mov eax, dword [ebp - 8]
mov byte [esi], 1
mov byte [esi + 8], al
mov ecx, dword [ebp - 4]
mov dword [esi + 0xc], ecx
xor ecx, ecx
mov byte [esi + 0x10], cl
mov dword [esi + 0x14], ecx
test al, al
je 0x4d4136
push 1
push ecx
push ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov dword [esi + 0x14], eax
xor ecx, ecx
jmp 0x4d4136
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov byte [esi], cl
mov byte [esi + 8], 1
mov dword [esi + 0xc], ecx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], ecx
mov dword [esi + 0x14], ecx
mov dword [edi], ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4d4141
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
imul esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x14]
cmp byte [edi], 0
je 0x4d4175
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push dword [ebp + 8]
push dword [edi + 0xc]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4d4170
mov byte [edi + 0x10], 1
mov eax, dword [ebp + 0x10]
jmp 0x4d419c
mov edx, dword [edi + 0x20]
lea eax, [edx + esi]
cmp eax, dword [edi + 0x1c]
jbe 0x4d4185
mov esi, dword [edi + 0x1c]
sub esi, edx
mov ecx, dword [edi + 0x18]
push esi
add ecx, edx
push ecx
push dword [ebp + 8]
call fcn.005f40c0
add esp, 0xc
mov eax, esi
add dword [edi + 0x20], esi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret

Function at 0x4d430f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4d431d
xor eax, eax
pop ebp
ret
mov ecx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
not ecx
cmp esi, 8
jb 0x4d43dc
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x66bce0]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x66bce0]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x66bce0]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x66bce0]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x66bce0]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x66bce0]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x66bce0]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x66bce0]
sub edi, 1
jne 0x4d4335
pop edi
test esi, esi
je 0x4d43f8
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x66bce0]
inc edx
sub esi, 1
jne 0x4d43e0
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x4ea122
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi + 0x18], 0
je 0x4ea18f
cmp dword [esi + 0x10], 0
je 0x4ea18f
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.0065e060
mov ebx, esp
test ebx, ebx
je 0x4ea18f
push edi
push ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0x10]
push ebx
add ecx, 0x1c4
call fcn.004b4863
mov ecx, dword [esi + 0x10]
xor eax, eax
push eax
push eax
push eax
mov eax, dword [ecx]
push str.textchanged
push ecx
call dword [eax + 0x1c]
mov ecx, eax
call fcn.004b3237
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4ea99e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x18]
lea esi, [ebp + 8]
mov ebx, ecx
sub esp, 0x10
mov dword [ebp - 0x3c], ebx
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.004c05ba
mov ecx, dword [ebx + 0x904]
test ecx, ecx
je 0x4eaa9e
lea eax, [ebp - 0x14]
push eax
call fcn.004e969d
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x4eaa08
mov ecx, dword [ebx + 0x904]
push 0
call fcn.0064a060
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4eaa9e
mov dword [ebp - 0x38], 1
jmp 0x4eaa50
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x30]
mov esi, eax
lea edi, [ebp - 0x24]
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
lea eax, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x34]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movups xmmword [ebp - 0x34], xmm0
call dword [sym.imp.USER32.dll_UnionRect]
test eax, eax
je 0x4eaa50
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_EqualRect]
test eax, eax
je 0x4eaa5f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
mov ebx, eax
test ebx, ebx
jne 0x4eaa11
jmp 0x4eaa63
and dword [ebp - 0x38], 0
cmp dword [ebp - 0x38], 0
mov eax, 0x94
push 0x54
pop ecx
cmovne eax, ecx
mov ecx, dword [ebp - 0x3c]
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ecx + 0x904]
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
call fcn.0064a060
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004aa758
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4f7c69
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 8]
and edi, 7
je 0x4f7c8d
cmp dword [esi + 8], edi
jge 0x4f7c85
push esi
call fcn.004f3d68
pop ecx
mov ecx, edi
shr dword [esi + 0xc], cl
sub dword [esi + 8], edi
mov edx, dword [esi + 8]
xor ecx, ecx
test edx, edx
jle 0x4f7cb6
mov edi, dword [esi + 0xc]
mov al, byte [esi + 0xc]
sub edx, 8
mov byte [ebp + ecx + 8], al
inc ecx
shr edi, 8
mov dword [esi + 0xc], edi
test edx, edx
jg 0x4f7c99
mov dword [esi + 8], edx
cmp ecx, 4
jge 0x4f7cd0
mov eax, dword [esi]
cmp eax, dword [esi + 4]
jb 0x4f7cc1
xor dl, dl
jmp 0x4f7cc6
mov dl, byte [eax]
inc eax
mov dword [esi], eax
mov byte [ebp + ecx + 8], dl
inc ecx
cmp ecx, 4
jl 0x4f7cb8
mov eax, dword [ebp + 8]
movzx ecx, byte [ebp + 0xb]
movzx edi, ah
movzx eax, al
shl edi, 8
add edi, eax
shl ecx, 8
movzx eax, byte [ebp + 0xa]
add ecx, eax
mov eax, edi
xor eax, 0xffff
cmp ecx, eax
je 0x4f7d05
push str.zlib_corrupt
call fcn.004f3c91
add esp, 4
jmp 0x4f7d45
mov eax, dword [esi]
add eax, edi
cmp eax, dword [esi + 4]
jbe 0x4f7d15
push str.read_past_buffer
jmp 0x4f7cfb
mov ecx, dword [esi + 0x10]
lea eax, [ecx + edi]
cmp eax, dword [esi + 0x18]
jbe 0x4f7d2f
push edi
push ecx
push esi
call fcn.004fac5e
add esp, 0xc
test eax, eax
je 0x4f7d45
push edi
push dword [esi]
push dword [esi + 0x10]
call fcn.005f40c0
add dword [esi], edi
xor eax, eax
add dword [esi + 0x10], edi
add esp, 0xc
inc eax
pop edi
pop esi
pop ebp
ret

Function at 0x4fbdf8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4fbe2a
xor edx, edx
inc edx
cmp byte [ebp + 0xc], 0
push 4
pop eax
cmovne edx, eax
xor eax, eax
cmp byte [ebp + 8], al
cmovne eax, edx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
Function at 0x507030
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.0065e090
mov eax, dword [0x70e00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], 1
push edi
push edi
push str.RANDFILE
mov dword [ebp - 8], str.RANDFILE
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
mov ebx, dword [ebp + 8]
mov esi, eax
test esi, esi
jne 0x5070c1
push edi
push edi
push 0x6747b4
mov dword [ebp - 8], 0x6747b4
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
jne 0x5070c1
push eax
push eax
push str.USERPROFILE
mov dword [ebp - 8], str.USERPROFILE
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
jne 0x5070c1
push eax
push eax
push str.SYSTEMROOT
mov dword [ebp - 8], str.SYSTEMROOT
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x507139
lea eax, [esi + esi]
call fcn.0065e060
mov eax, esp
push esi
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
cmp eax, esi
jae 0x507127
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0x10]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov dword [ebp - 8], eax
test eax, eax
je 0x507127
call fcn.0065e060
mov esi, esp
push 0
push 0
push dword [ebp - 8]
push esi
push 0xffffffffffffffff
push dword [ebp - 0x10]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov edi, eax
neg edi
sbb edi, edi
and edi, esi
mov edx, dword [ebp - 0xc]
test edx, edx
jne 0x507142
test edi, edi
jne 0x507146
mov edi, 0x6747f0
jmp 0x50714b
mov edx, edi
mov edi, 0x6747f0
jmp 0x50714b
test edi, edi
je 0x5071b8
cmp byte [edi], 0
je 0x5071b8
mov ecx, edi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x507150
sub ecx, esi
mov esi, dword [ebp + 0xc]
test edx, edx
je 0x50718c
lea eax, [ecx + 1]
cmp eax, esi
jae 0x50718c
push esi
push edi
push ebx
call fcn.00523660
add esp, 0xc
cmp eax, esi
jb 0x5071bb
xor eax, eax
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
lea eax, [ecx + 6]
cmp eax, esi
jae 0x5071bb
push esi
push edi
push ebx
call fcn.00523660
push esi
push 0x6f5ecc
push ebx
call fcn.00523600
push esi
push str..rnd
push ebx
call fcn.00523600
add esp, 0x24
jmp 0x5071bb
mov byte [ebx], 0
xor eax, eax
cmp byte [ebx], al
cmovne eax, ebx
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
Function at 0x5071e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.0065e090
mov eax, dword [0x70e00c]
xor eax, esp
mov dword [esp + 0x470], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x44], edi
test eax, eax
jne 0x507225
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.004aa758
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x50720e
push 0x6e9f40
push eax
call fcn.00542b40
mov ebx, eax
add esp, 8
mov dword [esp + 0x40], ebx
test ebx, ebx
je 0x507345
push 0x30
lea eax, [esp + 0x4c]
push 0
push eax
call fcn.005f46f0
add esp, 0xc
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.00627ea2
add esp, 4
push eax
call fcn.00627979
add esp, 8
test eax, eax
js 0x50733c
mov eax, 8
call fcn.0065e090
xorps xmm0, xmm0
lea eax, [esp + 0x50]
movsd qword [esp], xmm0
push 0x30
push eax
call fcn.00509970
add esp, 0x10
test dword [esp + 0x4e], 0x2000
je 0x5072c0
mov eax, 0x800
cmp esi, 0xffffffff
push 0
push ebx
cmove esi, eax
call fcn.00627ec8
add esp, 8
nop dword [eax]
mov edi, 0x400
test esi, esi
jle 0x5072ce
cmp esi, edi
cmovl edi, esi
push ebx
push edi
lea eax, [esp + 0x80]
push 1
push eax
call fcn.006254e3
mov ebx, eax
add esp, 0x10
test ebx, ebx
jle 0x507322
movd xmm0, ebx
mov eax, 8
cvtdq2pd xmm0, xmm0
call fcn.0065e090
lea eax, [esp + 0x80]
movsd qword [esp], xmm0
push ebx
push eax
call fcn.00509970
add dword [esp + 0x54], ebx
add esp, 0x10
mov ebx, dword [esp + 0x40]
test esi, esi
jle 0x5072c0
sub esi, edi
test esi, esi
jg 0x5072c0
lea eax, [esp + 0x78]
push 0x400
push eax
call fcn.005279f0
mov ebx, dword [esp + 0x48]
add esp, 8
mov edi, dword [esp + 0x44]
push ebx
call fcn.0060b444
add esp, 4
mov ecx, dword [esp + 0x47c]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004aa758
mov esp, ebp
pop ebp
ret

Function at 0x528310
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor dl, dl
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
test esi, esi
je 0x528336
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x528326
pop edi
movzx eax, dl
pop esi
ret
Function at 0x54cb20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ebp
push edi
sub ecx, 4
jb 0x54cb51
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x54cb58
add edx, 4
add esi, 4
sub ecx, 4
jae 0x54cb40
xor edi, edi
cmp ecx, 0xfffffffc
je 0x54cb93
movzx edi, byte [edx]
movzx eax, byte [esi]
sub edi, eax
jne 0x54cb93
cmp ecx, 0xfffffffd
je 0x54cb93
movzx edi, byte [edx + 1]
movzx eax, byte [esi + 1]
sub edi, eax
jne 0x54cb93
cmp ecx, 0xfffffffe
je 0x54cb93
movzx edi, byte [edx + 2]
movzx eax, byte [esi + 2]
sub edi, eax
jne 0x54cb93
cmp ecx, 0xffffffff
je 0x54cb93
movzx edi, byte [edx + 3]
movzx eax, byte [esi + 3]
sub edi, eax
test edi, edi
jle 0x54cbae
push 0x157
push str.cryptox509v3_v3_addr.c
push str.assertion_failed:_memcmp_min__max__length____0
call fcn.00528340
add esp, 0xc
mov edi, dword [esp + 0x14]
xor ecx, ecx
test ebx, ebx
jle 0x54cbcd
mov esi, edi
mov edx, ebp
sub esi, ebp
nop
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x54cbcd
inc ecx
inc edx
cmp ecx, ebx
jl 0x54cbc0
lea edx, [ebx - 1]
test edx, edx
js 0x54cbf1
mov esi, edi
lea eax, [edx + ebp]
sub esi, ebp
nop dword [eax + eax]
cmp byte [eax + esi], 0
jne 0x54cbf1
cmp byte [eax], 0xff
jne 0x54cbf1
dec eax
sub edx, 1
jns 0x54cbe0
cmp ecx, edx
jl case.0x54cc1d.2
jle 0x54cc03
pop edi
pop esi
pop ebp
lea eax, [ecx*8]
pop ebx
ret
mov bl, byte [ecx + ebp]
mov dh, byte [ecx + edi]
mov dl, bl
xor dl, dh
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x54cc1d.2
movzx eax, byte [eax + 0x54cc90]
jmp dword [eax*4 + 0x54cc70]
mov eax, 7
jmp 0x54cc53
mov eax, 6
jmp 0x54cc53
mov eax, 5
jmp 0x54cc53
mov eax, 4
jmp 0x54cc53
mov eax, 3
jmp 0x54cc53
mov eax, 2
jmp 0x54cc53
mov eax, 1
test dl, dh
jne case.0x54cc1d.2
and bl, dl
cmp bl, dl
jne case.0x54cc1d.2
pop edi
pop esi
pop ebp
lea eax, [eax + ecx*8]
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x551360
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.00542b40
push 0x62
push esi
mov edi, eax
mov ebx, 1
call fcn.005fa980
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x551417
push 0x4a
push str.crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 1
push 2
call fcn.00509290
push 0x68c23c
push esi
push 0x68e7d0
push dword [esp + 0x30]
push str.fopen_
push 5
call fcn.00508720
add esp, 0x2c
call fcn.0060a381
cmp dword [eax], 2
je 0x5513f9
call fcn.0060a381
cmp dword [eax], 6
je 0x5513f9
push 0x53
push str.crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.00509290
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x51
push str.crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.00509290
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x68e780
call fcn.0050fc40
mov esi, eax
add esp, 4
test esi, esi
jne 0x551439
push edi
call fcn.0060b444
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push esi
call fcn.0050f720
push edi
push ebx
push 0x6a
push esi
call fcn.0050f750
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x554900
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push esi
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x554940
push 0xcc
push str.crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call fcn.00509290
add esp, 0x14
xor eax, eax
test esi, esi
pop esi
sete al
ret
Function at 0x5956a0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x59578c
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
inc edi
nop word [eax + eax]
cmp esi, 3
jl 0x59571d
movzx ecx, byte [edi - 1]
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + 0x69ee00]
mov byte [edx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x69ee00]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x69ee00]
mov byte [edx + 2], al
add edx, 3
and ecx, 0x3f
movzx eax, byte [ecx + 0x69ee00]
mov byte [edx], al
jmp 0x595771
movzx eax, byte [edi - 1]
shl eax, 0x10
cmp esi, 2
jne 0x595731
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + 0x69ee00]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x69ee00]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x59575b
lea eax, [esi + 0x3c]
jmp 0x595768
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x69ee00]
mov byte [edx + 2], al
add edx, 3
mov byte [edx], 0x3d
sub esi, 3
add ebx, 4
add edi, 3
inc edx
test esi, esi
jg 0x5956c0
pop edi
pop esi
mov eax, ebx
mov byte [edx], 0
pop ebx
ret
mov eax, dword [esp + 0xc]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
ret