joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c55b3
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov eax, 0x5205f8
call fcn.004edf30
sub esp, 0x384
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
call fcn.004c4e32
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
call fcn.004c4a14
mov eax, dword [eax]
lea ecx, [ebp - 0x7c]
push 0xa
xor ebx, ebx
push ecx
push eax
mov dword [ebp - 4], ebx
call fcn.004c48e4
pop ecx
push ebx
push eax
call dword [sym.imp.MSVCRT.dll__i64toa]
add esp, 0x10
mov eax, dword [ebp - 0x24]
push 1
sub eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
pop edi
mov dword [ebp - 4], edi
je 0x4c5615
push eax
push dword [ebp - 0x2c]
call fcn.004094c0
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x7c]
push str.leavewordsystem.log
mov esi, 0x56f64c
push eax
push esi
lea eax, [ebp - 0x390]
push str.LOG_s_sCHAT_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x390]
push 0x55c5b8
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
add esp, 0x1c
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x4c577e
lea eax, [ebp - 0x3c]
push 0x56b0dc
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x3c]
push eax
call sub.MSVCRT.dll_strlen
add esp, 0xc
cmp eax, edi
mov dword [ebp - 0x18], eax
jg 0x4c5682
mov dword [ebp - 0x18], 2
push esi
call sub.MSVCRT.dll_strlen
pop ecx
mov dword [ebp - 0x20], eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x28c]
push 1
push 0x210
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
jne 0x4c5767
xor ecx, ecx
mov ebx, dword [ebp - 0x18]
mov eax, ecx
cdq
dec ebx
lea edi, [ecx + 1]
idiv ebx
lea esi, [ebp + ecx - 0x27c]
mov eax, ecx
mov ecx, dword [ebp - 0x20]
dec ecx
mov ebx, edx
cdq
idiv ecx
mov cl, byte [ebp + ebx - 0x3c]
mov eax, 0x5baacfb
mov ebx, 0x100
add cl, byte [edx + 0x56f64c]
cdq
idiv edi
cdq
idiv ebx
add cl, dl
xor byte [esi], cl
mov ecx, edi
cmp ecx, 0x200
jl 0x4c56b1
push 0x210
call sub.MFC42.DLL_operatornew
xor ebx, ebx
pop ecx
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0x4c5722
push str.D:CQ2ClientRelease_11.17.103DRoleChatLog.cpp
push 0x1e4
push 0x55f1ec
call fcn.004e9e6f
add esp, 0xc
lea eax, [ebp - 0x28c]
mov byte [ebp - 0x27d], bl
push eax
mov byte [ebp - 0x7d], bl
push dword [ebp - 0x14]
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x27c]
push eax
mov eax, dword [ebp - 0x14]
add eax, 0x10
push eax
call sub.MSVCRT.dll_strcpy
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
lea ecx, [eax + 0x120]
call fcn.004c5d97
jmp 0x4c568c
push dword [ebp - 0x1c]
call dword [sym.imp.MSVCRT.dll_fclose]
push ebx
push 0x421
call fcn.004a2911
add esp, 0xc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4c752c
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x520826
call fcn.004edf30
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x34]
call fcn.0040958c
xor ebx, ebx
lea ecx, [esi + 0x40]
mov dword [ebp - 4], ebx
call fcn.0040958c
or dword [esi + 0x18], 0xffffffff
or dword [esi + 0x30], 0xffffffff
mov edi, 0x568b08
mov byte [ebp - 4], 1
push edi
mov dword [esi], 0x533088
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov byte [esi + 6], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x40]
call fcn.0040928f
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x34]
call fcn.0040928f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4c7538
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x520826
call fcn.004edf30
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x34]
call fcn.0040958c
xor ebx, ebx
lea ecx, [esi + 0x40]
mov dword [ebp - 4], ebx
call fcn.0040958c
or dword [esi + 0x18], 0xffffffff
or dword [esi + 0x30], 0xffffffff
mov edi, 0x568b08
mov byte [ebp - 4], 1
push edi
mov dword [esi], 0x533088
mov byte [esi + 4], bl
mov byte [esi + 5], bl
mov byte [esi + 6], bl
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x40]
call fcn.0040928f
push edi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [esi + 0x34]
call fcn.0040928f
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4caaa5
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov edx, ecx
push ebx
push esi
push edi
lea eax, [edx + 4]
push 0x2b
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x18], eax
mov dword [eax], 0xb7e15163
pop esi
lea ecx, [eax + 4]
mov eax, dword [eax]
sub eax, 0x61c88647
dec esi
mov dword [ecx], eax
mov eax, ecx
jne 0x4caac2
mov eax, dword [ebp + 0xc]
shr eax, 5
je 0x4caae5
mov esi, dword [ebp + 8]
mov ecx, eax
lea edi, [ebp - 0x38]
rep movsd dword es:[edi], dword [esi]
dec eax
xor ebx, ebx
cmp eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
jbe 0x4caaf3
mov dword [ebp - 4], ebx
mov dword [ebp + 8], ebx
xor edi, edi
mov dword [ebp + 0xc], ebx
mov dword [ebp - 8], 0x84
jmp 0x4cab07
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
push 3
inc eax
mov dword [ebp - 0x14], eax
lea eax, [edx + eax*4]
mov dword [ebp - 0x10], eax
mov eax, dword [eax]
add eax, edi
add eax, dword [ebp + 0xc]
push eax
call sub.MSVCRT.dll__rotl
lea esi, [ebp + ebx*4 - 0x38]
mov dword [ebp + 0xc], eax
add edi, eax
mov eax, dword [esi]
push edi
add eax, edi
push eax
call sub.MSVCRT.dll__rotl
mov ecx, dword [ebp - 0x10]
mov edi, eax
mov eax, dword [ebp + 0xc]
add esp, 0x10
mov dword [ecx], eax
mov eax, dword [ebp + 8]
sub eax, 0x2b
mov dword [esi], edi
neg eax
sbb eax, eax
and eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
mov eax, ebx
sub eax, dword [ebp - 4]
inc ebx
neg eax
sbb eax, eax
and ebx, eax
dec dword [ebp - 8]
jne 0x4cab04
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4d235c
Capabilities:
Read file on windows

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push edi
push dword [esi + 8]
lea edi, [esi + 0xc]
push 1
push 4
push edi
call ebx
mov eax, dword [edi]
shl eax, 2
push eax
call sub.MFC42.DLL_operatornew
add esp, 0x14
mov dword [esi + 4], eax
test eax, eax
jne 0x4d239d
push str.D:CQ2ClientRelease_11.17.103DRoleMagicData.cpp
push 0x23
push 0x55f8d4
call fcn.004e9e6f
add esp, 0xc
push dword [esi + 8]
push dword [edi]
push 4
push dword [esi + 4]
call ebx
add esp, 0x10
pop edi
pop esi
pop ebx
ret

Function at 0x4d23d0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [eax + eax*4]
lea ebx, [esi + 0x10]
push edi
lea eax, [ecx + eax*2]
mov ecx, ebx
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
call fcn.004ac5a7
cmp eax, dword [ebx]
je 0x4d2418
add eax, 0x14
push 0x630
push eax
push dword [ebp + 0x10]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
jmp 0x4d24ab
mov edx, dword [esi + 4]
test edx, edx
je 0x4d243d
mov ecx, dword [esi + 0xc]
xor eax, eax
test ecx, ecx
jbe 0x4d243d
mov edi, dword [edx]
cmp edi, dword [ebp + 8]
je 0x4d2439
inc eax
add edx, 4
cmp eax, ecx
jb 0x4d2428
jmp 0x4d243d
test eax, eax
jge 0x4d2441
xor eax, eax
jmp 0x4d24ae
imul eax, eax, 0x18c
add eax, ecx
push 0
lea eax, [eax*4 + 4]
push eax
push dword [esi + 8]
call dword [sym.imp.MSVCRT.dll_fseek]
push dword [esi + 8]
mov esi, dword [ebp + 0x10]
push 1
push 0x630
push esi
call dword [sym.imp.MSVCRT.dll_fread]
push 0x20
lea eax, [esi + 0xd4]
push 0x7e
push eax
call fcn.004ea751
mov eax, dword [ebp + 8]
add esp, 0x28
mov dword [ebp - 0x63c], eax
lea eax, [ebp - 0x63c]
mov ecx, 0x18c
lea edi, [ebp - 0x638]
push eax
lea eax, [ebp - 8]
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, ebx
call fcn.004d25ad
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4db1ba
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x521ac0
call fcn.004edf30
sub esp, 0x1c
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4db23e
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4db23e
lea ecx, [ebp - 0x28]
call fcn.0040958c
and dword [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.0040958c
and dword [ebp - 0x10], 0
push edi
mov dword [ebp - 4], 1
call sub.MSVCRT.dll_strlen
pop ecx
add eax, edi
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.0040928f
push esi
call sub.MSVCRT.dll_strlen
pop ecx
add eax, esi
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040928f
lea eax, [ebp - 0x28]
push eax
push 0x4db0fd
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [ebp - 0x10]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004db24e
mov eax, esi
jmp 0x4db240
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4df672
Capabilities:
Encrypt data using rc6

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0x10
push dword [ebp + 8]
mov ebx, ecx
push ebx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov dword [ebx + 0x10], 0xb7e15163
lea eax, [ebx + 0x14]
push 0x19
pop ecx
mov edx, dword [eax - 4]
sub edx, 0x61c88647
mov dword [eax], edx
add eax, 4
dec ecx
jne 0x4df697
xor edi, edi
xor esi, esi
mov dword [ebp + 8], edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], 0x4e
mov eax, dword [ebx + esi*4 + 0x10]
push 3
add eax, dword [ebp + 8]
add eax, dword [ebp - 4]
push eax
call fcn.004df79b
mov dword [ebx + esi*4 + 0x10], eax
mov ecx, eax
lea eax, [esi + 1]
push 0x1a
cdq
pop esi
mov dword [ebp - 4], ecx
idiv esi
mov eax, dword [ebp + 8]
mov esi, edx
lea edx, [eax + ecx]
push edx
mov edx, dword [ebx + edi*4]
add edx, eax
add edx, ecx
push edx
call fcn.004df79b
add esp, 0x10
mov dword [ebx + edi*4], eax
mov dword [ebp + 8], eax
lea eax, [edi + 1]
push 4
cdq
pop ecx
idiv ecx
dec dword [ebp - 8]
mov edi, edx
jne 0x4df6b9
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4df713
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
push esi
push 8
mov dword [ebp - 8], ecx
cdq
pop esi
idiv esi
shl eax, 3
test eax, eax
jle 0x4df796
cdq
idiv esi
test eax, eax
jle 0x4df796
push ebx
mov ebx, dword [ebp + 8]
push edi
mov dword [ebp - 4], eax
jmp 0x4df740
mov ecx, dword [ebp - 8]
mov esi, dword [ebx]
mov edi, dword [ecx + 0x14]
add esi, dword [ecx + 0x10]
add edi, dword [ebx + 4]
add ecx, 0x1c
mov dword [ebp + 8], 0xc
mov dword [ebp + 0xc], ecx
mov eax, edi
push edi
xor eax, esi
push eax
call fcn.004df79b
mov ecx, dword [ebp + 0xc]
add eax, dword [ecx - 4]
mov esi, eax
xor edi, esi
push esi
push edi
call fcn.004df79b
mov ecx, dword [ebp + 0xc]
add dword [ebp + 0xc], 8
add esp, 0x10
add eax, dword [ecx]
dec dword [ebp + 8]
mov edi, eax
jne 0x4df758
mov dword [ebx], esi
mov dword [ebx + 4], edi
add ebx, 8
dec dword [ebp - 4]
jne 0x4df73d
pop edi
pop ebx
pop esi
leave
ret 8
Function at 0x4e2563
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edx, esi
mov edi, 0xfffffef8
imul edx, esi
lea eax, [ecx + 0x108]
sub edi, ecx
xor dword [eax - 0x100], esi
xor dword [eax], edx
add eax, 4
lea ecx, [edi + eax]
cmp ecx, 0x100
jl 0x4e257b
pop edi
pop esi
ret 4

Function at 0x4e9e6f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x504
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
je 0x4e9fc4
mov al, byte [0x568b08]
mov ecx, 0xff
mov byte [ebp - 0x504], al
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x504]
push dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_vsprintf]
mov esi, 0x56fca8
add esp, 0xc
mov edi, esi
lea eax, [ebp - 0x504]
push eax
push edi
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x4e9ee3
add edi, 0x400
inc ebx
cmp edi, 0x5708a8
jl 0x4e9ec1
cmp ebx, 3
jl 0x4e9fc4
mov eax, dword [0x5708a8]
lea ecx, [ebp - 0x504]
shl eax, 0xa
add eax, esi
inc dword [0x5708a8]
push ecx
push eax
call sub.MSVCRT.dll_strcpy
mov eax, dword [0x5708a8]
push 3
xor edx, edx
pop ecx
div ecx
lea eax, [ebp - 4]
push eax
mov dword [0x5708a8], edx
call dword [sym.imp.MSVCRT.dll_time]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_localtime]
mov esi, str.debug.log
lea edi, [ebp - 0x104]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x3d
mov ebx, eax
pop ecx
xor eax, eax
lea edi, [ebp - 0xfa]
push str.debug
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll__mkdir]
mov eax, dword [ebx + 0x10]
add esp, 0x14
push dword [ebx + 0xc]
inc eax
push eax
mov eax, dword [ebx + 0x14]
add eax, 0x76c
push eax
lea eax, [ebp - 0x104]
push str.._debug__u__u__u.log
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x104]
push 0x560438
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x4e9fc4
lea eax, [ebp - 4]
push eax
call dword [sym.imp.MSVCRT.dll_ctime]
pop ecx
push eax
lea eax, [ebp - 0x504]
push eax
push str._s_____s
push esi
call dword [sym.imp.MSVCRT.dll_fprintf]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4e9fc9
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x400]
push dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_vsprintf]
lea eax, [ebp - 0x400]
push 0x55b570
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x14
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
leave
ret
Function at 0x4ecb23
Capabilities:
Read file on windows

Disassembly:
cmp dword [esp + 4], 0
push esi
push edi
mov esi, ecx
je 0x4ecb89
call fcn.004ecba8
push 0x55c5b8
push dword [esp + 0x10]
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x4ecb89
push edi
call dword [sym.imp.MSVCRT.dll__fileno]
push eax
call dword [sym.imp.MSVCRT.dll__filelength]
push eax
mov dword [esi + 8], eax
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 0xc
mov dword [esi + 4], eax
test eax, eax
push edi
je 0x4ecb82
push 1
push dword [esi + 8]
push eax
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x10
cmp eax, 1
push edi
je 0x4ecb8d
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
xor al, al
jmp 0x4ecba3
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push dword [esi + 8]
mov ecx, esi
push dword [esi + 4]
call fcn.004ecc3a
mov al, 1
pop edi
pop esi
ret 4

Function at 0x4ecc3a
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
push edi
mov edi, ecx
je 0x4ecc83
cmp dword [ebp + 0xc], esi
jle 0x4ecc83
push ebx
mov eax, esi
mov ecx, 0x80
cdq
idiv ecx
mov eax, dword [ebp + 8]
push 8
pop ecx
mov bl, byte [edx + edi + 0x10]
xor bl, byte [esi + eax]
mov eax, esi
cdq
idiv ecx
mov al, bl
sub ecx, edx
shl al, cl
mov cl, dl
shr bl, cl
mov ecx, dword [ebp + 8]
add al, bl
mov byte [esi + ecx], al
inc esi
cmp esi, dword [ebp + 0xc]
jl 0x4ecc4e
pop ebx
pop edi
pop esi
pop ebp
ret 8

Function at 0x4ed66d
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 4]
mov dword [esi], 0x533ae0
push eax
call sub.MSVCRT.dll_memset
and dword [esi + 0x48], 0
and dword [esi + 0x44], 0
add esp, 0xc
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
mov eax, esi
pop esi
ret
Function at 0x4eef50
Capabilities:
Encrypt data using blowfish

Disassembly:
mov eax, 8
call fcn.004ee1d0
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
mov ecx, 0x412
mov esi, 0x533b78
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
cmp ecx, 0x48
jle 0x4eef7d
mov ecx, 0x48
mov edi, dword [esp + 0x20]
push ebp
mov eax, edi
mov ebp, ebx
lea esi, [ecx + edi]
mov dword [esp + 0x1c], 0x12
xor ecx, ecx
mov cl, byte [eax]
inc eax
cmp eax, esi
jb 0x4eef9c
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x4eefac
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x4eefbc
mov eax, edi
xor edx, edx
mov dl, byte [eax]
shl ecx, 8
or ecx, edx
inc eax
cmp eax, esi
jb 0x4eefcc
mov eax, edi
mov edx, dword [ebp]
add ebp, 4
xor edx, ecx
mov ecx, dword [esp + 0x1c]
mov dword [ebp - 4], edx
dec ecx
mov dword [esp + 0x1c], ecx
jne 0x4eef91
xor eax, eax
mov esi, ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov edi, 9
pop ebp
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.004f2b80
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
add esp, 8
add esi, 8
dec edi
jne 0x4eeff4
lea esi, [ebx + 0x48]
mov edi, 0x200
lea eax, [esp + 0xc]
push ebx
push eax
call fcn.004f2b80
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
add esp, 8
add esi, 8
dec edi
jne 0x4ef01d
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x4f20f0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.004ee1d0
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x4f213f
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4f213f
mov edx, dword [sym.imp.MSVCRT.dll__iob]
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
add edx, 0x40
push eax
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_vfprintf]
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x104]
push 0xff
push edx
call dword [sym.imp.MSVCRT.dll__vsnprintf]
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4f2243
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x4f21fe
lea eax, [ebp - 4]
push eax
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x4f21fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4f21fe
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x4f21fe
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.004ee1d0
lea ecx, [ebp - 4]
mov edi, esp
push ecx
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x4f21fe
mov edx, dword [ebp - 4]
push str.Service_0x
push edi
lea eax, [edx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call dword [sym.imp.MSVCRT.dll_wcsstr]
add esp, 8
test eax, eax
je 0x4f2243
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea ecx, [ebp - 4]
push 0
push ecx
push 0
push 1
push 0
push 0
mov esi, eax
push 0
lea eax, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea edx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403d30
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x403d62
jl 0x403d55
test ecx, ecx
jne 0x403d62
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x403e3f
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x2c]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
test eax, eax
je 0x403d92
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x403d94
xor eax, eax
cdq
mov dword [esp + 0x1c], edx
mov esi, eax
test edx, edx
jl 0x403de8
jg 0x403da5
test esi, esi
je 0x403de8
mov eax, dword [esp + 0x10]
cmp eax, edx
jg 0x403db9
jl 0x403db3
cmp ecx, esi
jae 0x403db9
mov esi, ecx
mov dword [esp + 0x1c], eax
push esi
push dword [esp + 0x1c]
push edi
call fcn.00409220
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
sub ecx, esi
mov eax, dword [eax]
sbb edx, dword [esp + 0x1c]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov eax, dword [esp + 0x14]
jmp 0x403e0c
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0x10]
cmp eax, 0xffffffff
je 0x403e28
mov ecx, dword [esp + 0xc]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
lea eax, [ebx + 0x2c]
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], ecx
test edx, edx
jg 0x403d77
jl 0x403e28
test ecx, ecx
jne 0x403d77
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0xc]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x403e83
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x403e83
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.00409220
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x403eec
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x403ea9
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x403ed7
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0040e211
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x403eec
cmp edi, eax
ja 0x403eb5
test edi, edi
je 0x403eec
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0040e211
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc