joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45338f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [eax], edx
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
mov edx, dword [ebp + 0xc]
add edx, 0x10
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00452097
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne al
movzx eax, al
test eax, eax
je 0x4533d1
mov eax, 0xc
jmp 0x4534e9
mov dword [ebp - 0xc], 0
jmp 0x453432
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
shl edx, 2
add eax, edx
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0x14]
shl edx, 3
add eax, edx
movzx eax, byte [eax + 4]
movzx eax, al
and eax, 8
test eax, eax
jne 0x45342e
mov eax, dword [ebp + 0xc]
lea edx, [eax + 0x10]
mov eax, dword [ebp - 0x14]
mov dword [esp + 4], eax
mov dword [esp], edx
call fcn.00452cbd
xor eax, 1
test al, al
je 0x45342e
mov eax, 0xc
jmp 0x4534e9
add dword [ebp - 0xc], 1
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 8]
cmp eax, dword [ebp - 0xc]
ja 0x4533da
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x44]
and eax, dword [ebp + 0x10]
mov edx, eax
mov eax, edx
add eax, eax
add eax, edx
shl eax, 2
add eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
cmp edx, eax
setbe al
movzx eax, al
test eax, eax
je 0x4534c6
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
add eax, 1
add eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
lea edx, [eax*4]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax + 8]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0044fc08
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
sete al
movzx eax, al
test eax, eax
je 0x4534b4
mov eax, 0xc
jmp 0x4534e9
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
lea ecx, [eax + 1]
mov edx, dword [ebp - 0x18]
mov dword [edx], ecx
shl eax, 2
lea edx, [ebx + eax]
mov eax, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, 0
add esp, 0x34
pop ebx
pop ebp
ret
Function at 0x45da8c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax + 0x34]
shr al, 5
and eax, 1
movzx eax, al
test eax, eax
je 0x45dadb
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0045df20
mov edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
setne al
movzx eax, al
test eax, eax
je 0x45dadb
mov eax, 0
jmp 0x45dbca
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax + 4]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x24]
lea ecx, [eax + 1]
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x24], ecx
add eax, ebx
movzx eax, byte [eax]
mov byte [ebp - 9], al
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x2c]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne al
movzx eax, al
test eax, eax
je 0x45db26
movzx eax, byte [ebp - 9]
lea edx, [eax*4]
mov eax, dword [ebp - 0x10]
add eax, edx
mov eax, dword [eax]
jmp 0x45dbca
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
setne al
movzx eax, al
test eax, eax
je 0x45db99
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x54]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x24]
lea ecx, [eax - 1]
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call fcn.00451f45
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
and eax, 1
test eax, eax
je 0x45db85
movzx eax, byte [ebp - 9]
add eax, 0x100
lea edx, [eax*4]
mov eax, dword [ebp - 0x10]
add eax, edx
mov eax, dword [eax]
jmp 0x45dbca
movzx eax, byte [ebp - 9]
lea edx, [eax*4]
mov eax, dword [ebp - 0x10]
add eax, edx
mov eax, dword [eax]
jmp 0x45dbca
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 0x50]
mov edx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0045f9d3
xor eax, 1
test al, al
je 0x45dbc5
mov eax, dword [ebp + 8]
mov dword [eax], 0xc
mov eax, 0
jmp 0x45dbca
jmp 0x45daf8
add esp, 0x24
pop ebx
pop ebp
ret
Function at 0x462e7c
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x34
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.0044f694
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x462eae
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov dword [eax], 9
mov eax, 0xffffffff
jmp 0x462f6f
cmp dword [ebp + 0xc], 0xffff
jne 0x462f32
cmp dword [ebp + 0x10], 0x1006
je 0x462ec9
cmp dword [ebp + 0x10], 0x1005
jne 0x462f32
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
imul ebx, eax, 0x3e8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 4]
mov edx, 0x10624dd3
mov eax, ecx
imul edx
sar edx, 6
mov eax, ecx
sar eax, 0x1f
sub edx, eax
mov eax, edx
add eax, ebx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
mov dword [ebp + 0x14], eax
mov dword [esp + 0x10], 4
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
call eax
sub esp, 0x14
mov dword [ebp - 0xc], eax
jmp 0x462f61
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_setsockopt]
call eax
sub esp, 0x14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jns 0x462f6c
call fcn.00462abc
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x463eb5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_ferror
test eax, eax
je 0x463eef
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
jmp 0x463f97
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_SetLastError]
call eax
sub esp, 4
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jae 0x463f94
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
cmp eax, 0xe8
jne 0x463f94
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call sub.msvcrt.dll_ferror
test eax, eax
je 0x463f94
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call sub.msvcrt.dll__fileno_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
js 0x463f94
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0044f694
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetFileType]
call eax
sub esp, 4
cmp eax, 3
jne 0x463f94
mov dword [esp], 0xd
call fcn.0046c0ea
mov eax, dword [sym.imp.msvcrt.dll__errno]
call eax
mov dword [eax], 0x20
jmp 0x463f94
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x46a7a9
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov eax, dword [0x6e5668]
cmp dword [ebp + 8], eax
jle 0x46a833
mov eax, dword [ebp + 8]
movzx eax, ax
lea edx, [ebp - 0x19c]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.WS2_32.dll_WSAStartup]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x46a7e9
mov eax, 1
jmp 0x46a838
movzx eax, word [ebp - 0x19c]
movzx eax, ax
cmp eax, dword [ebp + 8]
je 0x46a806
mov eax, dword [sym.imp.WS2_32.dll_WSACleanup]
call eax
mov eax, 2
jmp 0x46a838
mov eax, dword [0x6e5668]
test eax, eax
jne 0x46a82b
mov dword [esp + 8], 0x6e5658
mov dword [esp + 4], 0x46a707
mov dword [esp], 0x46a674
call fcn.0046a024
mov eax, dword [ebp + 8]
mov dword [0x6e5668], eax
mov eax, 0
leave
ret
Function at 0x46c10c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6e567c]
test eax, eax
je 0x46c125
mov eax, 1
jmp 0x46c1fc
mov dword [esp], str.mlang.dll
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call eax
sub esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x46c149
mov eax, 0
jmp 0x46c1fc
mov dword [esp + 4], str.ConvertINetString
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [0x6e567c], eax
mov dword [esp + 4], str.ConvertINetMultiByteToUnicode
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [0x6e5680], eax
mov dword [esp + 4], str.ConvertINetUnicodeToMultiByte
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [0x6e5684], eax
mov dword [esp + 4], str.IsConvertINetStringAvailable
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [0x6e5688], eax
mov dword [esp + 4], str.LcidToRfc1766A
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [0x6e568c], eax
mov dword [esp + 4], str.Rfc1766ToLcidA
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
sub esp, 8
mov dword [0x6e5690], eax
mov eax, 1
leave
ret
Function at 0x46f330
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [esp + 0x30]
call fcn.00470390
mov edi, eax
call fcn.0046f120
mov esi, eax
jmp 0x46f3d6
mov dword [esp + 4], 0x200
mov dword [esp], esi
call fcn.00612f00
test eax, eax
je 0x46f3f0
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x200
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
test eax, eax
mov ebp, eax
jne 0x46f3be
mov dword [esp], ebx
call sub.msvcrt.dll_feof
test eax, eax
jne 0x46f3e6
mov dword [esp], ebx
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x46f3f0
mov dword [esp + 8], 0xa9
mov dword [esp + 4], str.libexpat_metalink_parser.c
mov dword [esp], 0x66165f
call fcn.006220a0
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], esi
call fcn.00612d80
test eax, eax
je 0x46f3f0
mov dword [esp], ebx
call sub.msvcrt.dll_feof
test eax, eax
je 0x46f350
xor ebx, ebx
jmp 0x46f3f5
mov ebx, 0xc9
mov dword [esp], esi
call fcn.00611c00
mov eax, dword [esp + 0x34]
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], eax
call fcn.004702d0
mov dword [esp], edi
mov ebx, eax
call fcn.00470330
add esp, 0x1c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4b6ee0
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x6e5728]
test eax, eax
je 0x4b6ef0
ret
push edi
push esi
push ebx
sub esp, 0x20
mov dword [0x6e5728], 1
mov dword [esp], str.OPENSSL_ia32cap
call sub.msvcrt.dll_getenv
mov ebx, eax
test eax, eax
je 0x4b7050
cmp byte [eax], 0x7e
sete al
mov edi, eax
mov esi, eax
and esi, 0xff
add esi, ebx
lea eax, [esp + 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], str._I64i
mov dword [esp], esi
call sub.msvcrt.dll_sscanf
test eax, eax
je 0x4b6fd0
mov eax, edi
test al, al
jne 0x4b7000
cmp byte [ebx], 0x3a
je 0x4b7070
mov dword [0x6ea570], 0
mov dword [esp + 4], 0x3a
mov dword [esp], ebx
call sub.msvcrt.dll_strchr
test eax, eax
je 0x4b6fb0
cmp byte [eax + 1], 0x7e
sete bl
mov dword [esp + 8], 0
mov dword [esp + 4], 0
xor edx, edx
mov dl, bl
lea eax, [eax + edx + 1]
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
test bl, bl
je 0x4b7030
not eax
and dword [0x6ea570], eax
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
or ah, 4
mov dword [0x6ea568], eax
mov dword [0x6ea56c], edx
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.msvcrt.dll_strtoul
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0
jmp 0x4b6f48
mov dword [esp], 0x6ea568
call fcn.004bb200
mov esi, dword [esp + 0x18]
not esi
mov ecx, dword [esp + 0x1c]
not ecx
and eax, esi
mov dword [esp + 0x18], eax
and edx, ecx
mov dword [esp + 0x1c], edx
jmp 0x4b6f5b
mov dword [0x6ea570], eax
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
jmp 0x4b6fb8
mov dword [esp], 0x6ea568
call fcn.004bb200
jmp 0x4b6fb8
mov dword [esp], 0x6ea568
call fcn.004bb200
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
jmp 0x4b6f5b
Function at 0x4b7200
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x144
mov dword [esp], 0xfffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push ecx
mov ebx, eax
test eax, eax
je 0x4b722e
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
push edx
test eax, eax
jne 0x4b7330
lea eax, [esp + 0x154]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x150]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xff
lea esi, [esp + 0x40]
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__vsnprintf]
mov byte [esp + 0x13f], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x4b7300
call fcn.004b7090
test eax, eax
jle 0x4b7300
mov dword [esp + 4], str.OpenSSL
mov dword [esp], 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
sub esp, 8
mov ebx, eax
test eax, eax
je 0x4b72f4
mov dword [esp + 0x3c], esi
mov dword [esp + 0x20], 0
lea eax, [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
sub esp, 0x24
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
push eax
add esp, 0x144
pop ebx
pop esi
ret
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.OpenSSL:_FATAL
mov dword [esp + 4], esi
mov dword [esp], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
sub esp, 0x10
add esp, 0x144
pop ebx
pop esi
ret
lea eax, [esp + 0x154]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x150]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x100
lea esi, [esp + 0x40]
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__vsnprintf]
test eax, eax
js 0x4b7390
mov dword [esp + 0x10], 0
lea edx, [esp + 0x3c]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
add esp, 0x144
pop ebx
pop esi
ret
mov eax, 0x100
jmp 0x4b735f

Function at 0x4b75c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4b7600
xor eax, eax
xor edx, edx
nop
lea esi, [esi]
lea ecx, [esi + edx]
mov cl, byte [ecx]
lea ebp, [edi + edx]
mov bl, byte [ebp]
xor ecx, ebx
or eax, ecx
inc edx
cmp edx, dword [esp + 0x1c]
jne 0x4b75e0
and eax, 0xff
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x4b75fb
Function at 0x4bede0
Capabilities:
Hash data with md5

Disassembly:
push edi
mov edx, dword [esp + 8]
mov dword [edx + 0x58], 0
lea edi, [edx + 4]
and edi, 0xfffffffc
mov ecx, edx
sub ecx, edi
add ecx, 0x5c
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov al, 1
pop edi
ret
Function at 0x4e88c0
Capabilities:
Check if file exists

Disassembly:
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
call fcn.004e8030
mov esi, eax
test eax, eax
je 0x4e8930
mov dword [esp], 0x636320
call fcn.004e5dd0
mov ebx, eax
test eax, eax
je 0x4e8a20
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.004e6150
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 0x6a
mov dword [esp], ebx
call fcn.004e6a70
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], 0xaf
mov dword [esp + 0xc], str.bss_file.c
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], 2
call fcn.004f0560
mov dword [esp + 0x14], 0x67f08f
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x67f092
mov eax, dword [esp + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], str.fopen_
mov dword [esp], 5
call fcn.004f0ed0
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 2
je 0x4e89e0
mov dword [esp + 0x10], 0xb4
mov dword [esp + 0xc], str.bss_file.c
mov dword [esp + 8], 2
mov dword [esp + 4], 0x6d
mov dword [esp], 0x20
call fcn.004f0560
xor eax, eax
add esp, 0x24
pop ebx
pop esi
ret
mov dword [esp + 0x10], 0xb2
mov dword [esp + 0xc], str.bss_file.c
mov dword [esp + 8], pe_nt_image_headers32
mov dword [esp + 4], 0x6d
mov dword [esp], 0x20
call fcn.004f0560
xor eax, eax
jmp 0x4e891c
mov dword [esp], esi
call sub.msvcrt.dll_fclose
xor eax, eax
jmp 0x4e891c

Function at 0x4ec640
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x4ec690
movsx edx, byte [ebx]
xor eax, eax
test dl, dl
je 0x4ec688
mov esi, 0x100
nop
lea esi, [esi]
or edx, esi
add esi, 0x100
mov ecx, edx
shr ecx, 2
xor ecx, edx
and ecx, 0xf
rol eax, cl
imul edx, edx
xor eax, edx
inc ebx
movsx edx, byte [ebx]
test dl, dl
jne 0x4ec660
mov edx, eax
shr edx, 0x10
xor eax, edx
pop ebx
pop esi
ret
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4ece20
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov esi, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
test esi, esi
je 0x4ece6c
lea edi, [esp + 0x2c]
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__stat]
test eax, eax
js 0x4ece6c
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x24
mov dword [esp], edi
call fcn.004ed460
test ebx, ebx
jne 0x4ece80
xor eax, eax
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x67f3c0
mov dword [esp], esi
call sub.msvcrt.dll_fopen
mov edi, eax
test eax, eax
je 0x4ece6c
test word [esp + 0x32], 0x3000
je 0x4ecec8
cmp ebx, 0xffffffff
je 0x4ecfc0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], edi
call sub.msvcrt.dll_setvbuf
xor ebp, ebp
test ebx, ebx
jle 0x4ecf60
mov esi, ebx
cmp ebx, 0x400
jle 0x4ecee1
mov esi, 0x400
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], 0x6e5b80
call sub.msvcrt.dll_fread
test eax, eax
jle 0x4ecf30
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
fild dword [esp + 0x18]
fstp qword [esp + 8]
mov dword [esp + 4], esi
mov dword [esp], 0x6e5b80
call fcn.004ed460
mov eax, dword [esp + 0x1c]
add ebp, eax
sub ebx, esi
test ebx, ebx
jg 0x4ececa
lea esi, [esi]
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov dword [esp + 4], 0x400
mov dword [esp], 0x6e5b80
call fcn.004bb500
mov eax, ebp
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], edi
mov dword [esp + 8], 0x400
mov dword [esp + 4], 1
mov dword [esp], 0x6e5b80
call sub.msvcrt.dll_fread
test eax, eax
jle 0x4ecf30
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
fild dword [esp + 0x18]
fstp qword [esp + 8]
mov dword [esp + 4], 0x400
mov dword [esp], 0x6e5b80
call fcn.004ed460
mov eax, dword [esp + 0x1c]
add ebp, eax
jmp 0x4ececa
mov ebx, 0x800
jmp 0x4ecea8
Function at 0x4ed120
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x14
mov ebx, dword [esp + 0x20]
call fcn.00567a00
test eax, eax
je 0x4ed170
call fcn.00567a00
test eax, eax
je 0x4ed19f
mov esi, 0x67f3c6
cmp byte [esi], 0
je 0x4ed156
mov dword [esp], esi
call sub.msvcrt.dll_strlen
add eax, 6
cmp dword [esp + 0x24], eax
ja 0x4ed1c0
mov byte [ebx], 0
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp], str.RANDFILE
call sub.msvcrt.dll_getenv
mov esi, eax
test eax, eax
je 0x4ed132
cmp byte [eax], 0
je 0x4ed196
mov dword [esp], eax
call sub.msvcrt.dll_strlen
inc eax
cmp eax, dword [esp + 0x24]
jb 0x4ed210
call fcn.00567a00
test eax, eax
jne 0x4ed140
mov dword [esp], str.HOME
call sub.msvcrt.dll_getenv
mov esi, eax
test eax, eax
jne 0x4ed140
jmp 0x4ed13b
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.004e5cd0
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x67f3d7
mov dword [esp], ebx
call fcn.004e5d50
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], str..rnd
mov dword [esp], ebx
call fcn.004e5d50
mov eax, ebx
add esp, 0x14
pop ebx
pop esi
ret
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.004e5cd0
cmp dword [esp + 0x24], eax
ja 0x4ed159
xor eax, eax
jmp 0x4ed15b
Function at 0x532ae0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
mov ebp, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
mov esi, dword [esp + 0x4c]
mov edi, dword [esp + 0x50]
test ebp, ebp
je 0x532bc0
test ecx, ecx
je 0x532b70
cmp ecx, 1
jbe 0x532b90
lea edx, [ecx - 1]
mov dword [esp + 0x1c], ecx
mov dword [esp + 8], edx
mov dword [esp + 0x18], edx
mov dword [esp + 4], 0
mov dword [esp], ebp
call sub.msvcrt.dll_memchr
test eax, eax
jne 0x532bc0
mov edx, dword [esp + 0x18]
mov eax, edx
mov ecx, dword [esp + 0x1c]
cmp byte [ebp + eax], 0
jne 0x532b4a
mov ecx, eax
mov dword [esp + 0x48], edi
mov dword [esp + 0x44], 2
mov dword [esp + 0x40], esi
mov edx, ebp
mov eax, ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00530640
mov dword [esp], ebp
call sub.msvcrt.dll_strlen
mov ecx, eax
cmp eax, 1
jbe 0x532b4a
lea eax, [eax - 1]
jmp 0x532b41
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], ebp
call sub.msvcrt.dll_memchr
test eax, eax
jne 0x532bc0
mov ecx, 1
jmp 0x532b4a
mov eax, 0xfffffffe
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x541140
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x30]
mov dword [esp], 0
call fcn.005c6100
mov ebx, eax
test eax, eax
je 0x5411f0
test esi, esi
je 0x541200
mov edi, esi
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], ebx
call fcn.005c61a0
test eax, eax
jle 0x5411c0
mov eax, dword [esp + 0x38]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00540bc0
mov ebp, eax
test esi, esi
je 0x541230
mov dword [esp], ebx
call fcn.005c6160
mov eax, ebp
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [esp + 0x38], 0x10
jne 0x5411d0
xor ebp, ebp
jmp 0x54119d
call fcn.004f0910
and eax, 0xfff
cmp eax, 0x72
jne 0x5411c7
call fcn.004f0660
mov ebp, 1
jmp 0x54119d
xor ebp, ebp
xor edi, edi
jmp 0x54119d
mov dword [esp], str.OPENSSL_CONF
call sub.msvcrt.dll_getenv
test eax, eax
je 0x541240
mov dword [esp], eax
call fcn.004e59a0
mov edi, eax
test eax, eax
jne 0x54116b
xor edi, edi
xor ebp, ebp
lea esi, [esi]
lea edi, [edi]
mov dword [esp], edi
call fcn.004b8030
jmp 0x5411a5
call fcn.005c1a20
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea ebp, [eax + 0xd]
mov dword [esp + 8], 0x21b
mov dword [esp + 4], str.conf_mod.c
mov dword [esp], ebp
call fcn.004b7b20
mov edi, eax
test eax, eax
je 0x541222
call fcn.005c1a20
mov dword [esp + 8], ebp
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.004e5cd0
mov dword [esp + 8], ebp
mov dword [esp + 4], 0x68a89f
mov dword [esp], edi
call fcn.004e5d50
mov dword [esp + 8], ebp
mov dword [esp + 4], str.openssl.cnf
mov dword [esp], edi
call fcn.004e5d50
jmp 0x54116b