joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e27e0
Capabilities:
Write file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
mov eax, 0x1004
call fcn.00787ee0
mov esi, dword [esp + 0x1018]
cmp dword [esp + 0x1020], 1
jne 0x4e2893
push 0xa3b204
push dword [esp + 0x1020]
call fcn.00786c50
add esp, 8
mov dword [esp], eax
test eax, eax
je 0x4e289c
lea eax, [esi + 4]
push eax
call fcn.004e34a0
add esp, 4
xor edi, edi
test eax, eax
je 0x4e28c5
mov ebp, eax
lea ebx, [esp + 8]
nop
mov dword [esp + 4], 0
mov ecx, esi
mov edx, ebp
push 1
lea eax, [esp + 8]
push eax
push 0xffc
push ebx
call fcn.004e2510
add esp, 0x10
test eax, eax
jne 0x4e28c3
mov edi, esi
mov esi, dword [esp + 4]
push dword [esp]
push esi
push 1
push ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
add esp, 0x10
cmp eax, esi
jne 0x4e28b2
push ebp
call fcn.004e34b0
add esp, 4
mov ebp, eax
test eax, eax
mov esi, edi
jne 0x4e2840
xor edi, edi
jmp 0x4e28c5
push str.Unsupported_type_of_known_host_information_store
push 0xffffffffffffffdf
jmp 0x4e28a3
push str.Failed_to_open_file
push 0xfffffffffffffff0
push dword [esi]
call fcn.004e2e90
add esp, 0x1010
jmp 0x4e28d8
push str.Write_failed
push 0xfffffffffffffff0
push dword [edi]
call fcn.004e2e90
add esp, 0xc
mov edi, eax
push dword [esp]
call fcn.00786c28
add esp, 4
mov eax, edi
add esp, 0x1004
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4e32a0
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov dword [eax], 0
test ebx, ebx
jne 0x4e32cc
push ebp
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ebx, eax
lea eax, [ebx*4]
mov ecx, 0xaaaaaaab
mul ecx
shr edx, 1
add edx, 4
push edi
push edx
call dword [edi + 4]
add esp, 8
test eax, eax
je 0x4e3399
mov dword [esp], eax
mov esi, eax
mov dword [esp + 4], ebx
test ebx, ebx
je 0x4e33ff
mov eax, dword [esp + 4]
lea ecx, [eax - 2]
mov dword [esp + 8], ecx
dec eax
mov dword [esp + 0xc], eax
xor ebx, ebx
mov esi, dword [esp]
nop word cs:[eax + eax]
movzx edx, byte [ebp + ebx]
cmp dword [esp + 0xc], ebx
je 0x4e33a0
movzx ecx, byte [ebp + ebx + 1]
cmp dword [esp + 8], ebx
je 0x4e33c2
mov eax, dword [esp + 0x28]
movzx ebp, byte [eax + ebx + 2]
mov edi, edx
shr edi, 2
shl edx, 4
and edx, 0x30
movzx eax, byte [edi + 0xa3ba2f]
mov byte [esi], al
mov eax, ecx
shr eax, 4
movzx eax, byte [eax + edx + 0xa3ba2f]
and ecx, 0xf
mov byte [esi + 1], al
mov eax, ebp
shr eax, 6
movzx eax, byte [eax + ecx*4 + 0xa3ba2f]
mov byte [esi + 2], al
and ebp, 0x3f
movzx eax, byte [ebp + 0xa3ba2f]
mov ebp, dword [esp + 0x28]
mov byte [esi + 3], al
add esi, 4
add ebx, 3
cmp dword [esp + 4], ebx
jne 0x4e3320
jmp 0x4e33ff
xor eax, eax
add esp, 0x10
jmp 0x4e3414
mov ecx, edx
shr ecx, 2
shl edx, 4
and edx, 0x30
movzx ecx, byte [ecx + 0xa3ba2f]
mov byte [esi], cl
movzx ecx, byte [edx + 0xa3ba2f]
mov byte [esi + 1], cl
mov cl, 0x3d
jmp 0x4e33f5
mov eax, edx
shr eax, 2
mov ebx, ecx
shr bl, 4
shl dl, 4
or dl, bl
and dl, 0x3f
and ecx, 0xf
movzx ebx, byte [eax + 0xa3ba2f]
mov byte [esi], bl
movzx edx, dl
movzx edx, byte [edx + 0xa3ba2f]
mov byte [esi + 1], dl
movzx ecx, byte [ecx*4 + 0xa3ba2f]
mov byte [esi + 2], cl
mov byte [esi + 3], 0x3d
add esi, 4
mov byte [esi], 0
mov eax, dword [esp + 0x30]
mov ecx, dword [esp]
mov dword [eax], ecx
push ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4e8950
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x228
mov esi, dword [ebp + 8]
mov dword [esi + 0x170], 0
lea eax, [esp + 4]
push eax
push esi
call fcn.004f47f0
add esp, 8
test eax, eax
jne 0x4e8ab2
mov eax, dword [esp + 4]
imul edx, eax, 0x3e8
mov ebx, dword [esi + 0x164]
test ebx, ebx
mov ecx, 0x3e8
cmovne ecx, edx
mov edx, dword [esi + 0x64]
test edx, edx
jle 0x4e89fe
test eax, eax
sete al
cmp ecx, edx
setg dl
or dl, al
cmp dl, 1
jne 0x4e89fe
mov edi, dword [ebp + 0x10]
push 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
add esp, 4
push edi
push dword [ebp + 0xc]
push edx
push eax
call sub.api_ms_win_crt_time_l1_1_0.dll__difftime64
add esp, 0x10
fstp qword [esp + 0x10]
movsd xmm0, qword [esp + 0x10]
mulsd xmm0, qword [0xa3ca58]
cvttsd2si edx, xmm0
mov ecx, dword [esi + 0x64]
mov eax, str.API_timeout_expired
sub ecx, edx
jl 0x4e8aa6
mov dword [esp], 0
jmp 0x4e8a06
test ecx, ecx
setle al
mov dword [esp], eax
mov edx, 0x10624dd3
mov eax, ecx
imul edx
mov eax, edx
shr eax, 0x1f
sar edx, 6
add edx, eax
mov dword [esp + 8], edx
imul eax, edx, 0xfffffc18
add eax, ecx
imul eax, eax, 0x3e8
mov dword [esp + 0xc], eax
xor eax, eax
mov ecx, 0
test bl, 1
je 0x4e8a5a
mov ecx, dword [esi + 0x15c]
mov dword [esp + 0x124], ecx
mov dword [esp + 0x120], 1
lea ecx, [esp + 0x120]
mov edx, dword [esi + 0x15c]
test bl, 2
je 0x4e8a75
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], 1
lea eax, [esp + 0x1c]
inc edx
xor edi, edi
cmp byte [esp], 0
lea ebx, [esp + 8]
cmovne ebx, edi
push ebx
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_select]
test eax, eax
je 0x4e8aa1
mov eax, 0
jns 0x4e8ab2
mov eax, str.Error_waiting_on_socket
jmp 0x4e8aa6
mov eax, str.Timed_out_waiting_on_socket
push eax
push 0xfffffffffffffff7
push esi
call fcn.004e2e90
add esp, 0xc
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4f2a70
Capabilities:
Read file on windows

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov edi, edx
mov esi, ecx
push 0xa3e195
push dword [esp + 0x38]
call fcn.00786c50
add esp, 8
test eax, eax
je 0x4f2aaa
mov ebp, eax
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_feof
add esp, 4
test eax, eax
je 0x4f2ab1
push ebp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_rewind
add esp, 4
jmp 0x4f2afe
push str.Unable_to_open_public_key_file
jmp 0x4f2b0c
mov dword [esp + 8], edi
xor edi, edi
lea ebx, [esp + 3]
nop dword [eax + eax]
push ebp
push 1
push 1
push ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, 1
jne 0x4f2af0
movzx eax, byte [esp + 3]
cmp eax, 0xa
je 0x4f2af0
cmp eax, 0xd
je 0x4f2af0
inc edi
push ebp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_feof
add esp, 4
test eax, eax
je 0x4f2ac0
push ebp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_rewind
add esp, 4
cmp edi, 1
ja 0x4f2b1c
push ebp
call fcn.00786c28
add esp, 4
push str.Invalid_data_in_public_key_file
push 0xfffffffffffffff0
push esi
call fcn.004e2e90
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
push esi
push edi
call dword [esi + 4]
add esp, 8
test eax, eax
je 0x4f2b75
mov ebx, eax
push ebp
push edi
push 1
push eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
add esp, 0x10
cmp eax, edi
jne 0x4f2b87
push ebp
call fcn.00786c28
add esp, 4
mov ebp, edi
neg ebp
dec edi
nop dword [eax]
movzx eax, byte [ebx + edi]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
add esp, 4
test eax, eax
je 0x4f2ba2
dec edi
inc ebp
jne 0x4f2b50
push esi
push ebx
call dword [esi + 0xc]
add esp, 8
push str.Missing_public_key_data
jmp 0x4f2b0c
push ebp
call fcn.00786c28
add esp, 4
push str.Unable_to_allocate_memory_for_public_key_data
push 0xfffffffffffffffa
jmp 0x4f2b0e
push esi
push ebx
call dword [esi + 0xc]
add esp, 8
push ebp
call fcn.00786c28
add esp, 4
push str.Unable_to_read_public_key_from_file
jmp 0x4f2b0c
mov eax, ebp
neg eax
push eax
push 0x20
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_memchr
add esp, 0xc
test eax, eax
je 0x4f2c16
mov edi, ebx
sub edi, ebp
inc eax
mov ecx, ebx
sub ecx, eax
mov dword [esp + 4], ecx
mov ecx, eax
cmova ecx, ebx
mov edx, ebx
sub edx, ecx
sub edx, ebp
push edx
push 0x20
push eax
mov ebp, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memchr
add esp, 0xc
test eax, eax
cmovne edi, eax
sub edi, ebp
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push edi
push ebp
push eax
push ecx
push esi
call fcn.004e3120
add esp, 0x14
test eax, eax
je 0x4f2c28
push esi
push ebx
call dword [esi + 0xc]
add esp, 8
push str.Invalid_key_data__not_base64_encoded
push 0xfffffffffffffff0
push esi
call fcn.004e2e90
add esp, 0xc
jmp 0x4f2c51
push esi
push ebx
call dword [esi + 0xc]
add esp, 8
push str.Invalid_public_key_data
jmp 0x4f2b0c
mov ecx, dword [esp + 4]
neg ecx
mov eax, dword [esp + 8]
mov dword [eax], ebx
dec ecx
mov eax, dword [esp + 0x28]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
mov dword [ecx], eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
mov dword [ecx], eax
xor eax, eax
add esp, 0x14
jmp 0x4f2b17
Function at 0x580000
Capabilities:
Initialize winsock library

Disassembly:
push esi
mov esi, 1
cmp byte [0xb3e36c], 0
jne 0x5800a3
mov byte [0xb3e36c], 1
push 0x190
push 0
push 0xb3e1dc
call fcn.00786b68
add esp, 0xc
push 0xb3e1dc
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x5800a3
call fcn.005b5b10
push str.BIO_sock_init
push 0x96
push str.crypto_bio_bio_sock.c
call fcn.005b5c10
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.calling_wsastartup__
push eax
push 2
call fcn.005b5d00
add esp, 0xc
call fcn.005b5b10
push str.BIO_sock_init
push 0x98
push str.crypto_bio_bio_sock.c
call fcn.005b5c10
add esp, 0xc
push 0
push 0x7a
push 0x20
call fcn.005b5d00
add esp, 0xc
mov esi, 0xffffffff
mov eax, esi
pop esi
ret

Function at 0x5805a0
Capabilities:
Set socket configuration

Disassembly:
push esi
push eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov dword [esp], ecx
mov ecx, esp
push ecx
push 0x8004667e
push eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test eax, eax
jns 0x5805f4
call fcn.005b5b10
push str.BIO_socket_ioctl
push 0xf4
push str.crypto_bio_bio_sock.c
call fcn.005b5c10
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.calling_ioctlsocket__
push eax
push 2
call fcn.005b5d00
add esp, 0xc
xor eax, eax
test esi, esi
sete al
add esp, 4
pop esi
ret

Function at 0x5806f0
Capabilities:
Get socket status

Disassembly:
push ebx
push edi
push esi
sub esp, 0x10c
mov esi, dword [esp + 0x11c]
cmp esi, 0xffffffff
je 0x58076a
mov ebx, dword [esp + 0x128]
mov edi, dword [esp + 0x124]
mov eax, edi
or eax, ebx
je 0x580771
push 0
call sub.api_ms_win_crt_time_l1_1_0.dll__time64
add esp, 4
mov ecx, eax
xor eax, eax
sub edi, ecx
sbb ebx, edx
jl 0x580776
mov eax, dword [esp + 0x120]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], edi
inc esi
xor ecx, ecx
test eax, eax
lea edx, [esp + 8]
cmovne eax, edx
cmove ecx, edx
mov edx, esp
push edx
push 0
push ecx
push eax
push esi
call dword [sym.imp.WS2_32.dll_select]
jmp 0x580776
mov eax, 0xffffffff
jmp 0x580776
mov eax, 1
add esp, 0x10c
pop esi
pop edi
pop ebx
ret
Function at 0x580810
Capabilities:
Connect socket
Set socket configuration

Disassembly:
push ebx
push edi
push esi
push eax
mov edi, dword [esp + 0x14]
mov dword [esp], 1
cmp edi, 0xffffffff
je 0x5808bb
mov ebx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 3
and eax, 1
push eax
push edi
call fcn.005805a0
add esp, 8
test eax, eax
je 0x5808e5
test bl, 4
je 0x5808ee
mov eax, esp
push 4
push eax
push 8
push 0xffff
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x5808ee
call fcn.005b5b10
push str.BIO_connect
push 0x60
push str.crypto_bio_bio_sock2.c
call fcn.005b5c10
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0xa57f42
push eax
push 2
call fcn.005b5d00
add esp, 0xc
call fcn.005b5b10
push str.BIO_connect
push 0x62
push str.crypto_bio_bio_sock2.c
call fcn.005b5c10
add esp, 0xc
push 0
push 0x89
jmp 0x5808db
call fcn.005b5b10
push str.BIO_connect
push 0x56
push str.crypto_bio_bio_sock2.c
call fcn.005b5c10
add esp, 0xc
push 0
push 0x87
push 0x20
call fcn.005b5d00
add esp, 0xc
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
ret
test bl, 0x10
je 0x580958
mov eax, esp
push 4
push eax
push 1
push 6
push edi
call dword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
je 0x580958
call fcn.005b5b10
push str.BIO_connect
push 0x6a
push str.crypto_bio_bio_sock2.c
call fcn.005b5c10
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push 0xa57f42
push eax
push 2
call fcn.005b5d00
add esp, 0xc
call fcn.005b5b10
push str.BIO_connect
push 0x6c
push str.crypto_bio_bio_sock2.c
call fcn.005b5c10
add esp, 0xc
push 0
push 0x8a
jmp 0x5808db
mov ebx, dword [esp + 0x18]
push ebx
call fcn.0057b430
add esp, 4
mov esi, eax
push ebx
call fcn.0057b450
add esp, 4
push eax
push esi
push edi
call dword [sym.imp.WS2_32.dll_connect]
mov ecx, eax
mov eax, 1
cmp ecx, 0xffffffff
jne 0x5808e7
push 0xffffffffffffffff
call fcn.00583f40
add esp, 4
test eax, eax
jne 0x5808e5
call fcn.005b5b10
push str.BIO_connect
push 0xb2
push str.crypto_bio_bio_sock2.c
call fcn.005b5c10
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push str.calling_connect__
push eax
push 2
call fcn.005b5d00
add esp, 0xc
call fcn.005b5b10
push str.BIO_connect
push 0xb4
push str.crypto_bio_bio_sock2.c
call fcn.005b5c10
add esp, 0xc
push 0
push 0x67
jmp 0x5808db
Function at 0x580f40
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebx, dword [esp + 0x14]
mov edi, dword [ebx + 0x28]
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
cmp dword [edi + 0x38], 0
je 0x580f6e
push 0
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [ebx + 0x24]
call dword [sym.imp.WS2_32.dll_send]
jmp 0x580f98
push edi
call fcn.0057b450
add esp, 4
mov esi, eax
mov ebp, dword [ebx + 0x24]
push edi
call fcn.0057b430
add esp, 4
push esi
push eax
push 0
push dword [esp + 0x28]
push dword [esp + 0x28]
push ebp
call dword [sym.imp.WS2_32.dll_sendto]
mov esi, eax
push 0xf
push ebx
call fcn.0057c080
add esp, 8
lea eax, [esi + 1]
cmp eax, 1
ja case.0x580fc0.104
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x66
jle 0x580fe2
lea ecx, [eax - 0x67]
cmp ecx, 0x25
ja case.default.0x580fc0
jmp dword [ecx*4 + 0xa5806c]
push 0xa
push ebx
call fcn.0057c0a0
add esp, 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [edi + 0x3c], eax
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret
cmp eax, 4
je case.0x580fc0.103
cmp eax, 0xb
je case.0x580fc0.103
jmp case.0x580fc0.104
cmp eax, 0x2733
je case.0x580fc0.103
jmp case.0x580fc0.104

Function at 0x5831a0
Capabilities:
Check if file exists

Disassembly:
push ebp
push ebx
push edi
push esi
push eax
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0x18]
push ebp
push edi
call fcn.005dcfc0
add esp, 8
mov esi, eax
push 0x62
push ebp
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
add esp, 8
xor ebx, ebx
test eax, eax
sete al
test esi, esi
je 0x583214
mov byte [esp + 3], al
push 0xa588dc
call fcn.0057bf10
add esp, 4
test eax, eax
je 0x58327d
movzx ecx, byte [esp + 3]
mov bl, cl
shl ebx, 4
inc ebx
push 0
push eax
mov edi, eax
call fcn.0057c080
add esp, 8
push esi
push ebx
push 0x6a
push edi
call fcn.0057c940
mov eax, edi
add esp, 0x10
jmp 0x5832b4
call fcn.005b5b10
push str.BIO_new_file
push 0x43
push str.crypto_bio_bss_file.c
call fcn.005b5c10
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebp
push edi
push str.calling_fopen__s___s_
push eax
push 2
call fcn.005b5d00
add esp, 0x14
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 2
je 0x58325b
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
cmp dword [eax], 6
jne 0x583288
call fcn.005b5b10
push str.BIO_new_file
push 0x4b
push str.crypto_bio_bss_file.c
call fcn.005b5c10
add esp, 0xc
push 0
push pe_nt_image_headers32
jmp 0x5832a8
push esi
call fcn.00786c28
add esp, 4
jmp 0x5832b2
call fcn.005b5b10
push str.BIO_new_file
push 0x4d
push str.crypto_bio_bss_file.c
call fcn.005b5c10
add esp, 0xc
push 0
push 0x80002
push 0x20
call fcn.005b5d00
add esp, 0xc
xor eax, eax
add esp, 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x583fd0
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push edi
push esi
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push ebx
push esi
push dword [edi + 0x24]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
push 0xf
push edi
call fcn.0057c080
add esp, 8
mov eax, esi
inc eax
cmp eax, 1
ja case.0x58401c.104
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x66
jle 0x584034
lea ecx, [eax - 0x67]
cmp ecx, 0x25
ja case.default.0x58401c
jmp dword [ecx*4 + 0xa58de0]
push 0xa
push edi
call fcn.0057c0a0
add esp, 8
mov eax, esi
pop esi
pop edi
pop ebx
ret
cmp eax, 4
je case.0x58401c.103
cmp eax, 0xb
je case.0x58401c.103
jmp case.0x58401c.104
cmp eax, 0x2733
je case.0x58401c.103
jmp case.0x58401c.104
Function at 0x5d8950
Capabilities:
Access the windows event log
Check os version
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x220
mov esi, esp
mov ebx, dword [ebp + 8]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x5d89b6
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x5d89b6
lea eax, [ebp + 0xc]
mov dword [esi + 0xc], eax
lea ecx, [esi + 0x10]
push eax
push ebx
push 0x200
push ecx
mov ebx, ecx
call fcn.00786820
add esp, 0x10
test eax, eax
mov ecx, 0x200
cmovns ecx, eax
lea eax, [esi + 8]
push 0
push eax
push ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x5d8b4e
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov edi, eax
lea eax, [eax*2 + 5]
inc edi
and eax, 0xfffffffc
call fcn.00787ee0
mov ebx, esp
and ebx, 0xfffffff0
mov esp, ebx
push edi
push ebx
push edi
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edx, dword [ebp + 8]
test eax, eax
setne al
test edi, edi
sete cl
or cl, al
jne 0x5d8a4e
xor eax, eax
cmp edi, 0x10
jb 0x5d8a41
mov eax, edi
and eax, 0xfffffff0
xor ecx, ecx
nop word [eax + eax]
movq xmm0, qword [edx + ecx]
punpcklbw xmm0, xmm0
movq xmm1, qword [edx + ecx + 8]
punpcklbw xmm1, xmm1
psraw xmm0, 8
psraw xmm1, 8
movdqa xmmword [ebx + ecx*2], xmm0
movdqa xmmword [ebx + ecx*2 + 0x10], xmm1
add ecx, 0x10
cmp eax, ecx
jne 0x5d8a10
jmp 0x5d8a4a
movsx ecx, byte [edx + eax]
mov word [ebx + eax*2], cx
inc eax
cmp edi, eax
jne 0x5d8a41
test edi, edi
je 0x5d8ab1
xor eax, eax
jmp 0x5d8a65
inc eax
cmp eax, edi
jae 0x5d8ab1
cmp word [ebx + eax*2], 0x25
jne 0x5d8a60
nop dword [eax]
inc eax
movzx ecx, word [ebx + eax*2]
lea edx, [ecx - 0x30]
cmp edx, 0xa
jb case.0x5d8a85.42
lea edx, [ecx - 0x2a]
cmp edx, 0x39
ja case.default.0x5d8a85
jmp dword [edx*4 + 0xa6cb54]
mov word [ebx + eax*2], 0x63
jmp case.0x5d8a85.43
cmp ecx, 0x73
jne case.0x5d8a85.43
mov word [ebx + eax*2], 0x53
jmp case.0x5d8a85.43
mov word [ebx + eax*2], 0x43
jmp case.0x5d8a85.43
mov word [ebx + eax*2], 0x73
jmp case.0x5d8a85.43
lea eax, [ebp + 0xc]
mov dword [esi + 0xc], eax
lea edi, [esi + 0x10]
push eax
push ebx
push 0xff
push edi
call fcn.007867d0
add esp, 0x10
mov word [esi + 0x20e], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
js 0x5d8b3e
call fcn.005d8850
test eax, eax
jle 0x5d8b3e
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x5d8b4e
mov dword [esi + 8], edi
sub esp, 0x24
lea ecx, [esi + 8]
mov dword [esp + 0x1c], ecx
movd xmm0, dword [0xa6cb50]
movdqu xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x5d8b4e
push 0x10
push str.OpenSSL:_FATAL
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5ea510
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [esp + 0x30]
test eax, eax
je 0x5ea5e7
xor eax, eax
nop word cs:[eax + eax]
mov dword [esp], eax
mov ebp, eax
shr ebp, 3
mov eax, dword [esp + 0x28]
movzx eax, byte [eax + ebp]
mov ecx, dword [esp]
mov bh, cl
and bh, 7
mov dl, bh
xor dl, 7
movzx ecx, dl
mov esi, edx
bt eax, ecx
setb bl
shl bl, 7
mov edi, dword [esp + 0x38]
movups xmm0, xmmword [edi]
movups xmmword [esp + 4], xmm0
push dword [esp + 0x34]
push edi
push edi
call dword [esp + 0x50]
add esp, 0xc
movzx eax, bl
xor bl, byte [edi]
cmp dword [esp + 0x40], 0
movzx ecx, bl
cmove ecx, eax
movdqu xmm2, xmmword [esp + 4]
movdqa xmm0, xmm2
psrldq xmm0, 1
movd xmm1, ecx
pslldq xmm1, 0xf
por xmm1, xmm0
psrlw xmm1, 7
pand xmm1, xmmword [0xa6e780]
movdqa xmm0, xmm2
paddb xmm0, xmm2
por xmm0, xmm1
movdqu xmmword [edi], xmm0
mov edi, dword [esp + 0x2c]
movzx eax, byte [edi + ebp]
btr eax, esi
and bl, 0x80
movzx edx, bl
mov cl, bh
shr edx, cl
or edx, eax
mov eax, dword [esp]
mov ecx, dword [esp + 0x30]
mov byte [edi + ebp], dl
inc eax
cmp ecx, eax
jne 0x5ea530
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x5ea5f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
cmp dword [esp + 0x2c], 0
je 0x5ea6b2
mov ebx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x24]
cmp dword [esp + 0x3c], 0
lea ebp, [esp + 1]
je 0x5ea661
xor edi, edi
nop dword [eax + eax]
movups xmm0, xmmword [ebx]
movups xmmword [esp], xmm0
push eax
push ebx
push ebx
call dword [esp + 0x4c]
add esp, 0xc
movzx eax, byte [ebx]
xor al, byte [esi + edi]
mov ecx, dword [esp + 0x28]
mov byte [ecx + edi], al
movsd xmm0, qword [ebp]
movsd xmm1, qword [ebp + 7]
movsd qword [ebx + 7], xmm1
movsd qword [ebx], xmm0
mov byte [ebx + 0xf], al
mov eax, dword [esp + 0x30]
inc edi
cmp dword [esp + 0x2c], edi
jne 0x5ea620
jmp 0x5ea6b2
xor edi, edi
nop word cs:[eax + eax]
movups xmm0, xmmword [ebx]
movups xmmword [esp], xmm0
push eax
push ebx
push ebx
call dword [esp + 0x4c]
add esp, 0xc
movzx eax, byte [esi + edi]
movzx ecx, byte [ebx]
xor cl, al
mov edx, dword [esp + 0x28]
mov byte [edx + edi], cl
movsd xmm0, qword [ebp]
movsd xmm1, qword [ebp + 7]
movsd qword [ebx + 7], xmm1
movsd qword [ebx], xmm0
mov byte [ebx + 0xf], al
mov eax, dword [esp + 0x30]
inc edi
cmp dword [esp + 0x2c], edi
jne 0x5ea670
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x5ee910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x30
mov eax, edx
mov dword [esp + 0xc], ecx
mov esi, dword [ecx + 0x14]
cmp esi, edx
jae 0x5eea5b
mov ecx, dword [esp + 0xc]
mov edx, dword [ecx + 0x18]
mov ebx, eax
sub ebx, edx
jb 0x5ee971
mov edi, eax
and ebx, 0xfffffffc
lea eax, [edx + ebx]
add eax, 4
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x18], eax
shl eax, 4
push 0x71
push str.crypto_modes_ocb128.c
push eax
mov ebx, ecx
push dword [ecx + 0x40]
call fcn.005db4d0
add esp, 0x10
test eax, eax
je 0x5eea6d
mov dword [ebx + 0x40], eax
mov eax, edi
mov edx, esi
shl edx, 4
add edx, 0x1f
movdqa xmm0, xmmword [0xa6e800]
movdqa xmm1, xmmword [0xa6e810]
nop dword [eax]
mov ecx, dword [esp + 0xc]
mov edi, dword [ecx + 0x40]
mov bh, byte [edi + edx - 0x10]
mov bl, bh
movzx ecx, byte [edi + edx - 0x11]
shr bh, 7
mov ch, cl
add ch, cl
or ch, bh
mov byte [edi + edx - 1], ch
mov ch, byte [edi + edx - 0x12]
shr cl, 7
mov bh, ch
add bh, ch
or bh, cl
mov byte [edi + edx - 2], bh
mov cl, byte [edi + edx - 0x13]
shr ch, 7
add cl, cl
or cl, ch
add bl, bl
mov byte [edi + edx - 3], cl
movd xmm2, dword [edi + edx - 0x17]
movd xmm4, dword [edi + edx - 0x16]
psrlw xmm4, 7
pand xmm4, xmm0
movq xmm3, xmm2
paddb xmm2, xmm2
por xmm2, xmm4
movd dword [edi + edx - 7], xmm2
movq xmm2, qword [edi + edx - 0x1f]
movdqa xmmword [esp + 0x10], xmm2
mov bh, byte [esp + 0x10]
sar bh, 7
and bh, 0x87
xor bh, bl
movdqa xmm4, xmm2
pand xmm4, xmm1
por xmm4, xmm3
psllq xmm4, 0x38
movdqa xmm3, xmm2
psrlq xmm3, 8
por xmm3, xmm4
psrlw xmm3, 7
pand xmm3, xmm0
paddb xmm2, xmm2
por xmm2, xmm3
movq qword [edi + edx - 0xf], xmm2
mov byte [edi + edx], bh
inc esi
add edx, 0x10
cmp eax, esi
jne 0x5ee990
mov ecx, dword [esp + 0xc]
mov dword [ecx + 0x14], eax
shl eax, 4
mov ecx, dword [esp + 0xc]
add eax, dword [ecx + 0x40]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp 0x5eea65