joyce8/EMBER2024-capa huggingface dataset:
Function at 0x617df0
Capabilities:
Delete file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push 0x104
lea esi, [esp + 8]
call fcn.00617b70
add esp, 4
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x20c]
neg eax
sbb eax, eax
neg eax
pop esi
xor ecx, esp
dec eax
call fcn.00564b24
add esp, 0x20c
ret

Function at 0x617e40
Capabilities:
Create directory

Disassembly:
sub esp, 0x310
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x30c], eax
mov eax, 0x104
lea ecx, [esp]
call fcn.00617610
lea eax, [esp]
push eax
call fcn.00617ae0
add esp, 4
push 0x208
lea ecx, [esp + 0x108]
push ecx
push 0xffffffffffffffff
lea edx, [esp + 0xc]
push edx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
lea eax, [esp + 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [esp + 0x30c]
neg eax
sbb eax, eax
neg eax
xor ecx, esp
dec eax
call fcn.00564b24
add esp, 0x310
ret

Function at 0x617ec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
xor esi, esi
test ebx, ebx
jne 0x617efe
push 0xa0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00564b24
add esp, 0x20c
ret
push edi
push 0x358
call fcn.00565d7e
mov edi, eax
add esp, 4
test edi, edi
jne 0x617f33
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00564b24
add esp, 0x20c
ret
push 0x104
lea esi, [esp + 0xc]
mov edx, ebx
call fcn.00617b70
add esp, 4
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x617fb0
test al, 0x10
je 0x617fb0
mov eax, esi
add eax, 0xfffffffe
lea ecx, [ecx]
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x617f60
mov ecx, dword [0x7d4d74]
mov dx, word [0x7d4d78]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [edi + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [edi], eax
mov byte [edi + 0x254], 0
mov eax, edi
pop edi
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.00564b24
add esp, 0x20c
ret
push edi
call fcn.00565e48
mov ecx, dword [esp + 0x214]
add esp, 4
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00564b24
add esp, 0x20c
ret

Function at 0x6180a0
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
push eax
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x6180be
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
neg eax
sbb eax, eax
neg eax
dec eax
pop esi
ret

Function at 0x618140
Capabilities:
Set socket configuration

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0x8004667e
push ecx
mov dword [esp + 0xc], 1
call sub.WS2_32.dll_ioctlsocket
pop ecx
ret
Function at 0x618160
Capabilities:
Send data
Send data on socket
Write file on windows

Disassembly:
sub esp, 8
push ebp
push esi
xor esi, esi
xor ebp, ebp
cmp dword [esp + 0x24], esi
jl 0x618224
mov ecx, dword [esp + 0x20]
jg 0x618181
test ecx, ecx
jbe 0x618224
push edi
jmp 0x618188
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
mov eax, ecx
sub eax, esi
sbb edx, ebp
mov dword [esp + 0x10], edx
js 0x6181a8
jg 0x6181a1
cmp eax, 0x7fffffff
jbe 0x6181a8
mov eax, accept
jmp 0x6181ac
mov eax, ecx
sub eax, esi
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x6181c5
push eax
lea eax, [esi + ebx]
push eax
push ecx
call dword [0x85c0ac]
add esp, 0xc
jmp 0x618200
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x6181ef
push ecx
push eax
lea ecx, [esi + ebx]
push 1
push ecx
call fcn.00564d88
mov edx, dword [esp + 0x28]
push edx
mov edi, eax
call fcn.006f636c
add esp, 0x14
test eax, eax
jne 0x618223
jmp 0x618202
mov ecx, dword [esp + 0x1c]
push 0
push eax
lea eax, [esi + ebx]
push eax
push ecx
call sub.WS2_32.dll_send
mov edi, eax
test edi, edi
jl 0x618223
mov eax, edi
cdq
add esi, eax
adc ebp, edx
cmp ebp, dword [esp + 0x28]
jl 0x618184
jg 0x618223
cmp esi, dword [esp + 0x24]
jb 0x618184
pop edi
mov eax, esi
pop esi
mov edx, ebp
pop ebp
add esp, 8
ret

Function at 0x618230
Capabilities:
Read file on windows
Receive data
Receive data on socket

Disassembly:
test edx, edx
je 0x618241
push eax
push ecx
push edx
call dword [0x85c0a4]
add esp, 0xc
ret
test esi, esi
je 0x618264
push edi
push esi
push eax
push 1
push ecx
call fcn.00566667
push esi
mov edi, eax
call fcn.006f636c
add esp, 0x14
test eax, eax
je 0x618273
or eax, 0xffffffff
pop edi
ret
push 0
push eax
mov eax, dword [esp + 0xc]
push ecx
push eax
call sub.WS2_32.dll_recv
ret
mov eax, edi
pop edi
ret

Function at 0x618be0
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
ret

Function at 0x619bb0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x2008
call fcn.00564f40
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x2004], eax
mov eax, dword [esp + 0x200c]
push ebx
mov ebx, dword [esp + 0x2018]
mov dword [esp + 4], eax
test ebx, ebx
jl 0x619c4c
push ebp
mov ebp, dword [esp + 0x2018]
jg 0x619bed
test ebp, ebp
jbe 0x619c4b
push edi
mov edi, edi
mov eax, 0x2000
test ebx, ebx
jg 0x619c01
jl 0x619bff
cmp ebp, eax
jae 0x619c01
mov eax, ebp
mov ecx, dword [esp + 0xc]
push ecx
push eax
lea edx, [esp + 0x18]
push 1
push edx
call fcn.00566667
mov edi, eax
add esp, 0x10
test edi, edi
je 0x619c4a
push edi
lea eax, [esp + 0x14]
push eax
push esi
call fcn.006183c0
add esp, 0xc
cmp eax, edi
jne 0x619c4a
cdq
add dword [esi + 0x278], eax
adc dword [esi + 0x27c], edx
sub ebp, eax
sbb ebx, edx
test ebx, ebx
jg 0x619bf0
jl 0x619c4a
test ebp, ebp
ja 0x619bf0
pop edi
pop ebp
mov ecx, dword [esp + 0x2008]
pop ebx
xor ecx, esp
call fcn.00564b24
add esp, 0x2008
ret
Function at 0x61aac0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
sub esp, 0x268
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x264], eax
mov eax, dword [esp + 0x270]
push ebx
mov ebx, dword [esp + 0x270]
push ebp
push esi
push edi
push 0x44
mov esi, edx
lea edx, [esp + 0x2c]
push 0
push edx
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], ecx
call fcn.00566330
xor eax, eax
add esp, 0xc
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], 0x44
mov dword [esp + 0x54], 0x101
mov word [esp + 0x58], ax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, dword [esp + 0x284]
push 2
push 1
push 0
lea ecx, [esp + 0x6c]
push ecx
mov edi, eax
push edi
push edx
call fcn.0057fc16
mov ebp, dword [sym.imp.KERNEL32.dll_DuplicateHandle]
add esp, 4
push eax
push edi
call ebp
mov ecx, dword [esp + 0x288]
push 2
push 1
push 0
lea eax, [esp + 0x70]
push eax
push edi
push ecx
call fcn.0057fc16
add esp, 4
push eax
push edi
call ebp
mov edx, dword [esi + 0x230]
mov eax, dword [edx + 0x14]
test eax, eax
jne 0x61ac15
mov byte [esp + 0x6e], al
lea eax, [esp + 0x170]
push 0x7c9bac
push eax
call fcn.00569be2
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x61ac11
push ebp
lea ecx, [esp + 0x70]
push 0x104
push ecx
call fcn.006f63a0
add esp, 0xc
cmp byte [esp + 0x6c], 0x23
jne 0x61ac03
cmp byte [esp + 0x6d], 0x21
jne 0x61ac03
lea eax, [esp + 0x6c]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x61abd0
sub eax, edx
lea edi, [esp + eax + 0x6b]
lea edx, [esp + 0x6c]
cmp edi, edx
jbe 0x61ac08
movsx eax, byte [edi]
push eax
call fcn.005692e4
add esp, 4
test eax, eax
je 0x61ac08
mov byte [edi], 0
dec edi
lea ecx, [esp + 0x6c]
cmp edi, ecx
ja 0x61abe5
jmp 0x61ac08
mov byte [esp + 0x6e], 0
push ebp
call fcn.00564baa
add esp, 4
lea eax, [esp + 0x6e]
cmp byte [eax], 0
mov ecx, 0x7b32cb
je 0x61ac24
mov ecx, 0x7c0c20
mov edx, dword [esp + 0x10]
push ebx
push 0x5c
push edx
push ecx
push eax
push str._s_s_s_c_s
push esi
mov edi, 0x104
lea ebx, [esp + 0x18c]
call fcn.0061aaa0
mov edx, dword [esp + 0x2c]
add esp, 0x1c
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x2c]
push ecx
push edx
push eax
push 0x200
push 1
push 0
push 0
mov ecx, ebx
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x61ac9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov edx, ebx
push edx
push str.spawn_process
push str._s:_CreateProcess__s_:__d
call fcn.0061a900
add esp, 0x10
mov dword [esp + 0x14], 0xffffffff
jmp 0x61acb9
mov eax, dword [esp + 0x284]
push eax
call fcn.0056c4ae
mov ecx, dword [esp + 0x28c]
push ecx
call fcn.0056c4ae
add esp, 8
mov edx, dword [esp + 0x64]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x60]
push eax
call esi
mov ecx, dword [esp + 0x18]
push ecx
call esi
mov ecx, dword [esp + 0x274]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00564b24
add esp, 0x268
ret
Function at 0x61adb0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
sub esp, 0x18
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x14], eax
push ebp
push esi
mov esi, dword [esp + 0x24]
mov eax, dword [esi + 0x230]
xor ebp, ebp
push edi
mov edi, dword [esp + 0x2c]
cmp dword [eax + 4], ebp
jne 0x61ae02
cmp dword [esp + 0x34], ebp
je 0x61ae02
push str.mg_connect
push str._s:_SSL_is_not_initialized
call fcn.0061a900
add esp, 8
pop edi
pop esi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00564b24
add esp, 0x18
ret
push edi
call sub.WS2_32.dll_gethostbyname
mov dword [esp + 0xc], eax
test eax, eax
jne 0x61ae44
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.006f67f8
push eax
push edi
push str.mg_connect
push str._s:_gethostbyname__s_:__s
call fcn.0061a900
add esp, 0x14
pop edi
pop esi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00564b24
add esp, 0x18
ret
push ebx
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x61ae8b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.006f67f8
push eax
push str.mg_connect
push str._s:_socket:__s
call fcn.0061a900
add esp, 0x10
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00564b24
add esp, 0x18
ret
mov edx, dword [esp + 0x34]
mov ecx, 2
push edx
mov word [esp + 0x18], cx
call sub.WS2_32.dll_htons
mov word [esp + 0x16], ax
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
push 0x10
lea ecx, [esp + 0x18]
push ecx
push ebx
mov dword [esp + 0x24], eax
call sub.WS2_32.dll_connect
test eax, eax
je 0x61af04
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.006f67f8
mov edx, dword [esp + 0x38]
push eax
push edx
push edi
push str.mg_connect
push str._s:_connect__s:_d_:__s
call fcn.0061a900
add esp, 0x18
push ebx
call sub.WS2_32.dll_closesocket
pop ebx
pop edi
pop esi
mov eax, ebp
pop ebp
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00564b24
add esp, 0x18
ret
push 0x2a0
push 1
call fcn.00566cae
mov edi, eax
add esp, 8
test edi, edi
jne 0x61af53
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.006f67f8
push eax
push str.mg_connect
push str._s:_calloc:__s
call fcn.0061a900
add esp, 0x10
push ebx
call sub.WS2_32.dll_closesocket
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00564b24
add esp, 0x18
ret
mov dword [edi + 0x23c], ebx
mov eax, dword [esp + 0x14]
mov dword [edi + 0x258], eax
mov ecx, dword [esp + 0x18]
mov dword [edi + 0x25c], ecx
mov edx, dword [esp + 0x1c]
mov dword [edi + 0x260], edx
mov eax, dword [esp + 0x20]
mov dword [edi + 0x264], eax
cmp dword [esp + 0x38], ebp
je 0x61af98
mov ecx, dword [0x85c09c]
push ecx
mov esi, edi
call fcn.00618790
add esp, 4
mov ecx, dword [esp + 0x24]
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00564b24
add esp, 0x18
ret
Function at 0x61bfc0
Capabilities:
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x50], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [esp + 0xc], eax
mov eax, dword [eax + 0x4c]
push edi
mov dword [esp + 0x1c], 1
lea esp, [esp]
xor ebx, ebx
lea esi, [esp + 0x14]
call fcn.006177c0
mov dword [esp + 0x20], eax
test eax, eax
je 0x61c1cc
lea esi, [esp + 0x24]
lea edi, [esp + 0x14]
call fcn.0061a270
test eax, eax
je 0x61c0a6
mov edi, dword [esp + 0x10]
cmp dword [esp + 0x54], ebx
je 0x61c02f
cmp dword [edi + 4], ebx
je 0x61c0f3
push 6
push 1
push 2
call sub.WS2_32.dll_socket
mov ebx, eax
cmp ebx, 0xffffffff
je 0x61c174
mov eax, dword [esp + 0x2c]
push eax
lea ecx, [esp + 0x34]
push ecx
push ebx
call sub.WS2_32.dll_bind
test eax, eax
jne 0x61c174
push 0x14
push ebx
call sub.WS2_32.dll_listen
test eax, eax
jne 0x61c174
push 0x38
push 1
call fcn.00566cae
add esp, 8
test eax, eax
je 0x61c126
mov edi, eax
mov ecx, 0xe
lea esi, [esp + 0x24]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x10]
mov dword [eax + 4], ebx
mov edx, dword [ecx + 0x64]
mov dword [eax], edx
mov dword [ecx + 0x64], eax
mov eax, dword [esp + 0x20]
jmp 0x61bff0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push str._IP_ADDRESS:_PORT_sp_
push eax
mov eax, dword [esp + 0x18]
push ecx
push str.set_ports_option
push str._s:__.s:_invalid_port_spec._Expecting_list_of:__s
call fcn.006175f0
mov esi, eax
call fcn.0061a900
mov edi, dword [esp + 0x24]
add esp, 0x14
mov eax, edi
xor esi, esi
call fcn.0061a240
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00564b24
mov esp, ebp
pop ebp
ret
push str.Cannot_add_SSL_socket__is__ssl_cert_option_set_
mov eax, edi
call fcn.006175f0
mov esi, eax
call fcn.0061a900
add esp, 4
mov eax, edi
xor esi, esi
call fcn.0061a240
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00564b24
mov esp, ebp
pop ebp
ret
push ebx
call sub.WS2_32.dll_closesocket
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.006f67f8
add esp, 4
push eax
push str.set_ports_option
push str._s:__s
mov eax, edi
call fcn.006175f0
mov esi, eax
call fcn.0061a900
add esp, 0xc
mov eax, edi
xor esi, esi
call fcn.0061a240
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00564b24
mov esp, ebp
pop ebp
ret
push ebx
call sub.WS2_32.dll_closesocket
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.006f67f8
mov edx, dword [esp + 0x18]
add esp, 4
push eax
mov eax, dword [esp + 0x1c]
push edx
push eax
push str.set_ports_option
push str._s:_cannot_bind_to__.s:__s
mov eax, edi
call fcn.006175f0
mov esi, eax
call fcn.0061a900
add esp, 0x14
mov eax, edi
xor esi, esi
call fcn.0061a240
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00564b24
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00564b24
mov esp, ebp
pop ebp
ret
Function at 0x61e160
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x856918]
xor eax, esp
mov dword [esp + 0x190], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1a8]
push edi
lea eax, [esp + 0x10]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
push 0x4f0
push 1
call fcn.00566cae
mov ecx, dword [esp + 0x1b0]
add esp, 8
mov edi, eax
mov dword [edi + 0x60], ecx
test esi, esi
je 0x61e1e3
lea ecx, [ecx]
mov ebx, dword [esi]
add esi, 4
test ebx, ebx
je 0x61e1e3
call fcn.00617500
mov ebp, eax
cmp ebp, 0xffffffff
je 0x61e2db
mov edx, dword [esi]
add esi, 4
test edx, edx
je 0x61e314
call fcn.006176f0
mov dword [edi + ebp*4 + 8], eax
test esi, esi
jne 0x61e1b0
xor esi, esi
cmp dword [0x85c178], esi
je 0x61e21e
xor eax, eax
lea ebx, [edi + 8]
cmp dword [ebx], 0
mov eax, dword [eax + 0x85c180]
jne 0x61e20a
test eax, eax
je 0x61e20a
mov edx, eax
call fcn.006176f0
mov dword [ebx], eax
inc esi
lea eax, [esi + esi*2]
add eax, eax
add eax, eax
add ebx, 4
cmp dword [eax + 0x85c178], 0
jne 0x61e1f2
mov eax, edi
call fcn.0061a510
test eax, eax
je 0x61e2f2
call fcn.0061c4c0
test eax, eax
je 0x61e2f2
push edi
call fcn.0061bfc0
add esp, 4
test eax, eax
je 0x61e2f2
push edi
call fcn.0061c670
add esp, 4
test eax, eax
je 0x61e2f2
lea edx, [edi + 0x6c]
push edx
call fcn.00617970
lea esi, [edi + 0x70]
call fcn.006179e0
lea esi, [edi + 0x4e8]
call fcn.006179e0
lea esi, [edi + 0x4e0]
call fcn.006179e0
mov eax, edi
mov ecx, 0x61c790
call fcn.006180a0
mov eax, dword [edi + 0x58]
push eax
xor ebx, ebx
call fcn.00567819
add esp, 8
test eax, eax
jle 0x61e330
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x61e2b0
mov eax, edi
mov ecx, 0x61e060
call fcn.006180a0
test eax, eax
je 0x61e31c
call ebp
push eax
push str.Cannot_start_worker_thread:__d
mov eax, edi
call fcn.006175f0
mov esi, eax
call fcn.0061a900
add esp, 8
jmp 0x61e31f
push ebx
push str.Invalid_option:__s
mov eax, edi
call fcn.006175f0
mov esi, eax
call fcn.0061a900
add esp, 8
mov ebx, edi
call fcn.0061a870
xor eax, eax
mov ecx, dword [esp + 0x1a0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00564b24
add esp, 0x194
ret
push ebx
push str._s:_option_value_cannot_be_NULL
jmp 0x61e2e1
inc dword [edi + 0x68]
mov ecx, dword [edi + 0x58]
push ecx
inc ebx
call fcn.00567819
add esp, 4
cmp ebx, eax
jl 0x61e2b0
mov eax, edi
jmp 0x61e2fb
Function at 0x64d360
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.00564f40
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x64d3a5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x64d3a5
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x856b48
call fcn.005756f4
add esp, 0xc
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.006f67b3
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x64d41e
call fcn.0064d240
test eax, eax
jle 0x64d41e
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push 0
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
push 0x10
lea ecx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x65f170
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14
call fcn.00564f40
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp + 8], 8
repne scasb al, byte es:[edi]
not ecx
dec ecx
push eax
mov esi, ecx
push eax
inc esi
push esi
push ebx
push 8
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jg 0x65f1f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ec
jne 0x65f1dd
push 0
push 0
push esi
push ebx
push 0
push 0xfde9
mov dword [ebp + 8], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jg 0x65f1f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x65f286
mov eax, dword [ebp + 0xc]
push eax
jmp 0x65f273
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.00564f40
mov ecx, dword [ebp + 8]
mov eax, esp
push edi
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ecx
push 0xfde9
mov dword [ebp - 4], eax
call esi
test eax, eax
je 0x65f286
lea edx, [ebp - 0x14]
push 8
push edx
mov edx, dword [ebp + 0xc]
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
push eax
push 0xfde9
call esi
test eax, eax
je 0x65f286
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
push ecx
call fcn.00564ed0
mov esi, eax
add esp, 8
test esi, esi
jne 0x65f313
call fcn.005678a0
cmp dword [eax], 2
je 0x65f26f
call fcn.005678a0
cmp dword [eax], 9
jne 0x65f27e
mov edx, dword [ebp + 0xc]
push edx
push ebx
call fcn.00569be2
add esp, 8
mov esi, eax
test esi, esi
jne 0x65f313
push 0xa9
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.0064b030
mov eax, dword [ebp + 0xc]
push 0x7d736c
push eax
push 0x7ecee4
push ebx
push str.fopen_
push 5
call fcn.0064bd90
add esp, 0x2c
call fcn.005678a0
cmp dword [eax], 2
jne 0x65f2ef
push 0xac
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.0064b030
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xae
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.0064b030
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x85f398
call fcn.00647b20
mov edi, eax
add esp, 4
test edi, edi
jne 0x65f33b
push esi
call fcn.00564baa
add esp, 4
xor eax, eax
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push edi
call fcn.00647d40
push esi
push 1
push 0x6a
push edi
call fcn.00648200
add esp, 0x18
mov eax, edi
lea esp, [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6631e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x663241
mov al, byte [edi]
test al, al
je 0x663241
push ebx
push ebp
mov ebx, 0x100
movsx eax, al
or eax, ebx
mov ebp, esi
mov edx, eax
mov ecx, eax
shr edx, 2
and edx, 0xf
and ecx, 0xf
xor edx, ecx
mov ecx, 0x20
sub ecx, edx
add ebx, 0x100
shr ebp, cl
mov ecx, edx
mov edx, eax
imul edx, eax
shl esi, cl
mov al, byte [edi + 1]
or ebp, esi
xor ebp, edx
inc edi
test al, al
mov esi, ebp
jne 0x6631f9
mov eax, esi
pop ebp
shr eax, 0x10
pop ebx
xor eax, esi
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret