joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0c90
Capabilities:
Send data
Send data on socket

Disassembly:
sub esp, 0x90c
mov eax, dword [0x62c930]
xor eax, esp
mov dword [esp + 0x908], eax
push ebx
push ebp
push esi
push edi
push 0x7f
lea eax, [esp + 0x9d]
mov ebx, ecx
push 0
push eax
mov dword [esp + 0x20], ebx
mov byte [esp + 0xa4], 0
call fcn.00587fb0
push 0x7f
lea ecx, [esp + 0x29]
push 0
push ecx
mov byte [esp + 0x30], 0
call fcn.00587fb0
mov ebp, dword [ebx]
mov edi, dword [ebp + 0x128]
mov edx, dword [edi + 0x1eb4]
sub edx, dword [edi + 0x1eb0]
lea eax, [edi + 0x1cb0]
add edx, 2
push edx
push 0x3c
mov esi, ebp
mov dword [esp + 0x30], ebp
call fcn.004b06b0
mov eax, dword [edi + 0x1eb0]
movzx ecx, byte [eax]
inc eax
add esp, 0x20
mov dword [edi + 0x1eb0], eax
cmp ecx, 0x18
je 0x4b0e78
cmp ecx, 0x23
je 0x4b0e52
cmp ecx, 0x27
jne 0x4b0f0a
push 0
push ecx
push 0xfa
push 0xff
push 0x5ba124
lea eax, [esp + 0x12c]
push 0x800
push eax
call fcn.004a10c0
mov esi, dword [edi + 0x1cac]
add esp, 0x1c
mov ebp, 4
test esi, esi
je 0x4b0de6
lea esp, [esp]
mov ebx, dword [esi]
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4b0d77
sub eax, edx
lea edi, [eax + ebp + 1]
cmp edi, 0x7fa
jae 0x4b0ddb
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x9c]
push edx
push str._127_____127s
push ebx
call fcn.00585e2d
add esp, 0x10
test eax, eax
je 0x4b0ddb
lea eax, [esp + 0x18]
push eax
push 1
lea ecx, [esp + 0xa0]
push ecx
push 0
mov edx, 0x800
push str._c_s_c_s
sub edx, ebp
push edx
lea eax, [esp + ebp + 0x130]
push eax
call fcn.004a10c0
add esp, 0x1c
mov ebp, edi
mov esi, dword [esi + 4]
test esi, esi
jne 0x4b0d70
mov ebx, dword [esp + 0x14]
push 0xf0
push 0xff
mov ecx, 0x800
push 0x5bbebc
sub ecx, ebp
push ecx
lea edx, [esp + ebp + 0x128]
push edx
call fcn.004a10c0
mov ecx, dword [ebx + 0x154]
add esp, 0x14
push 0
add ebp, 2
push ebp
lea eax, [esp + 0x120]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x4b0e45
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, dword [esp + 0x10]
push eax
push str.Sending_data_failed___d_
push edx
call fcn.0049d4e0
add esp, 0xc
mov esi, dword [esp + 0x10]
add ebp, 0xfffffffe
push ebp
jmp 0x4b0ef9
lea ecx, [edi + 0x1c28]
mov eax, ecx
lea esi, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4b0e60
push 0xf0
push 0xff
push ecx
push 0
push 0x23
jmp 0x4b0e99
lea ecx, [edi + 0x1c08]
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4b0e83
push 0xf0
push 0xff
push ecx
push 0
push 0x18
push 0xfa
push 0xff
sub eax, esi
push str._c_c_c_c_s_c_c
lea edi, [eax + 6]
lea eax, [esp + 0x138]
push 0x800
push eax
call fcn.004a10c0
mov edx, dword [ebx + 0x154]
add esp, 0x28
push 0
push edi
lea ecx, [esp + 0x120]
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jge 0x4b0ef3
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push ebp
call fcn.0049d4e0
add esp, 0xc
add edi, 0xfffffffe
mov esi, ebp
push edi
push 0x3e
lea eax, [esp + 0x122]
call fcn.004b06b0
add esp, 8
mov ecx, dword [esp + 0x918]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005832f8
add esp, 0x90c
ret
Function at 0x4b1090
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
mov eax, dword [esp + 8]
mov eax, dword [eax]
push ebx
mov ebx, dword [eax + 0x128]
mov dword [esp + 4], eax
jne 0x4b11f9
push ebp
push esi
push edi
lea edi, [ebx + 0x1cb0]
lea ebp, [ebx + 0x1eb0]
mov dword [ebp], edi
cmp edi, ebp
jae 0x4b10c9
mov byte [edi], 0xff
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x4b10d6
mov byte [eax], 0xfa
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x4b10e3
mov byte [eax], 0x1f
inc dword [ebp]
movzx ecx, word [ebx + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push ecx
call esi
movzx edx, ax
movzx eax, word [ebx + 0x1caa]
push eax
mov dword [esp + 0x20], edx
call esi
movzx ecx, ax
mov eax, dword [ebp]
cmp eax, ebp
jae 0x4b1117
mov dl, byte [esp + 0x1c]
mov byte [eax], dl
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x4b1127
mov dl, byte [esp + 0x1d]
mov byte [eax], dl
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x4b1133
mov byte [eax], cl
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x4b113f
mov byte [eax], ch
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x4b114c
mov byte [eax], 0xff
inc dword [ebp]
mov eax, dword [ebp]
cmp eax, ebp
jae 0x4b1159
mov byte [eax], 0xf0
inc dword [ebp]
mov eax, dword [ebp]
mov esi, dword [esp + 0x10]
mov ecx, eax
sub ecx, edi
sub ecx, 2
push ecx
mov dword [ebx + 0x1eb4], eax
lea eax, [ebx + 0x1cb2]
push 0x3e
mov dword [ebp], edi
call fcn.004b06b0
mov ebp, dword [sym.imp.WS2_32.dll_send]
add esp, 8
push 0
push 3
push edi
mov edi, dword [esp + 0x24]
mov edx, dword [edi + 0x154]
push edx
call ebp
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jge 0x4b11b8
call esi
push eax
mov eax, dword [esp + 0x14]
push str.Sending_data_failed___d_
push eax
call fcn.0049d4e0
add esp, 0xc
lea ecx, [ebx + 0x1cb3]
push 4
push ecx
call fcn.004b0f30
mov edx, dword [edi + 0x154]
add esp, 8
push 0
push 2
add ebx, 0x1cb7
push ebx
push edx
call ebp
test eax, eax
jge 0x4b11f6
call esi
push eax
mov eax, dword [esp + 0x14]
push str.Sending_data_failed___d_
push eax
call fcn.0049d4e0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x4b1c40
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x18
mov eax, dword [0x62c930]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esi + 0x158]
push ebp
mov ebp, dword [esi]
push edi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
or edi, 0xffffffff
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x4b1c94
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push ebx
push esi
call fcn.0049ffe0
add esp, 8
cmp edi, 0xffffffff
jne 0x4b1cc8
push str.Error_accept__ing_server_connect
push ebp
call fcn.0049d4e0
add esp, 8
pop edi
pop ebp
mov eax, 0x1e
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.005832f8
add esp, 0x18
ret
push str.Connection_accepted_from_server_n
push ebp
call fcn.0049d450
push 1
push edi
mov dword [esi + 0x158], edi
call fcn.004bfb90
mov dword [esi + 0x168], 1
mov eax, dword [ebp + 0x1b0]
add esp, 0x10
test eax, eax
je 0x4b1d36
mov ecx, dword [ebp + 0x1b4]
push 1
push edi
push ecx
call eax
add esp, 0xc
test eax, eax
je 0x4b1d36
push edi
push esi
call fcn.0049ffe0
add esp, 8
pop edi
pop ebp
mov dword [esi + 0x158], 0xffffffff
mov eax, 0x2a
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.005832f8
add esp, 0x18
ret
mov ecx, dword [esp + 0x20]
pop edi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.005832f8
add esp, 0x18
ret
Function at 0x4b5460
Capabilities:
Check http status code

Disassembly:
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebx
mov ebx, dword [edi]
mov eax, edx
push ebp
mov ebp, dword [esp + 0xc]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x4b5496
push str.Couldnt_set_desired_mode
push ebx
call fcn.0049d4e0
add esp, 8
lea eax, [esi + 0x11]
pop esi
pop ebp
pop ebx
ret
cmp ecx, 0xc8
je 0x4b54ad
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.0049d450
add esp, 0xc
cmp ebp, 0x13
jne 0x4b54c1
push edi
call fcn.004b53f0
add esp, 4
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x14
jne 0x4b54d5
push edi
call fcn.004b2740
add esp, 4
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x15
jne 0x4b54e7
mov eax, edi
call fcn.004b5440
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x16
jne 0x4b54f5
mov eax, edi
call fcn.004b5450
mov esi, eax
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x4bc180
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x62c930]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.00589ea9
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x4bc1e5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x4bc1e5
lea edx, [esp]
push edx
call dword [0x62300c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.005832f8
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.005832f8
add esp, 0x108
ret
jmp 0x4bc180

Function at 0x4bc200
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x62c930]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.00589ea9
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x4bc1e5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x4bc1e5
lea edx, [esp]
push edx
call dword [0x62300c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.005832f8
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.005832f8
add esp, 0x108
ret
jmp 0x4bc180
Function at 0x4bfda0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.0058a1c0
mov eax, dword [0x62c930]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x3c], 0
test esi, esi
jne 0x4bfde7
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.005832f8
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call fcn.0058544b
add esp, 8
test eax, eax
jl 0x4bfdd0
mov eax, 8
call fcn.0058a1c0
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.004bfc10
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x4bfdd0
push 0x60489c
push esi
call fcn.005867c9
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
je 0x4bfec1
jmp 0x4bfe44
mov eax, dword [esp + 0x40]
test ebx, ebx
jle 0x4bfe52
cmp ebx, 0x400
mov esi, ebx
jl 0x4bfe57
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x80]
push 1
push edx
call fcn.00584b8e
mov edi, eax
add esp, 0x10
mov dword [esp + 0x44], edi
test edi, edi
jle 0x4bfea5
fild dword [esp + 0x44]
mov eax, 8
call fcn.0058a1c0
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.004bfc10
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x4bfe40
sub ebx, esi
test ebx, ebx
jg 0x4bfe40
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0058392a
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.004df410
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005832f8
mov esp, ebp
pop ebp
ret
Function at 0x4d5c40
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
mov edx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
dec ecx
push edi
mov edi, dword [esi + 4]
shr ecx, 0x1f
xor edx, edi
dec ecx
and edx, ecx
xor edi, edx
mov dword [esi + 4], edi
xor dword [eax + 4], edx
lea edx, [ebx - 1]
cmp edx, 9
ja case.default.0x4d5c72
jmp dword [edx*4 + 0x4d5d9c]
mov edi, 0xa
cmp ebx, edi
jle case.0x4d5c72.10
push ebp
mov edx, dword [esi]
mov ebx, dword [edx + edi*4]
lea ebp, [edx + edi*4]
mov edx, dword [eax]
mov edx, dword [edx + edi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + edi*4], edx
lea ebx, [ebx + edi*4]
inc edi
cmp edi, dword [esp + 0x20]
jl 0x4d5c83
pop ebp
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x24]
mov edx, dword [edx + 0x24]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x24], edi
mov edi, dword [eax]
xor dword [edi + 0x24], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x20]
mov edx, dword [edx + 0x20]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x20], edi
mov edi, dword [eax]
xor dword [edi + 0x20], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x1c]
mov edx, dword [edx + 0x1c]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x1c], edi
mov edi, dword [eax]
xor dword [edi + 0x1c], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x18]
mov edx, dword [edx + 0x18]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x18], edi
mov edi, dword [eax]
xor dword [edi + 0x18], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x14]
mov edx, dword [edx + 0x14]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x14], edi
mov edi, dword [eax]
xor dword [edi + 0x14], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x10]
mov edx, dword [edx + 0x10]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x10], edi
mov edi, dword [eax]
xor dword [edi + 0x10], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0xc]
mov edx, dword [edx + 0xc]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0xc], edi
mov edi, dword [eax]
xor dword [edi + 0xc], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 8]
mov edx, dword [edx + 8]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 8], edi
mov edi, dword [eax]
xor dword [edi + 8], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 4]
mov edx, dword [edx + 4]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 4], edi
mov edi, dword [eax]
xor dword [edi + 4], edx
mov esi, dword [esi]
mov edx, dword [eax]
mov edi, dword [esi]
mov edx, dword [edx]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [esi], edi
mov eax, dword [eax]
xor dword [eax], edx
pop edi
pop esi
pop ebx
ret
Function at 0x4d7fc0
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.00587fb0
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
mov eax, 1
pop esi
ret

Function at 0x4d8020
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.00587fb0
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
pop esi
ret
Function at 0x4d9510
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1ec]
test esi, esi
jne 0x4d9529
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.0049d030
push edx
push eax
call fcn.0049d060
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x1e0], 0
je 0x4d9576
mov eax, dword [ebx + 0x148]
mov ecx, dword [ebx + 0x144]
push eax
push ecx
call fcn.0049d030
push edx
push eax
call fcn.0049d060
mov ecx, dword [edi + 0x1e0]
sub ecx, eax
add esp, 0x10
cmp esi, ecx
mov eax, ecx
jge 0x4d9578
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x4db8e0
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x4db912
push 0x2e
push esi
call fcn.00587470
add esp, 8
test eax, eax
je 0x4db910
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret

Function at 0x4dd2e0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x4dd302
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x4dd2f6
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x4dd332
cmp dword [esi + 8], 0
jne 0x4dd325
mov ecx, dword [eax + 8]
push 0x60489c
push ecx
call fcn.005867c9
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x4dd325
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.00584b8e
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x4dd354
mov eax, dword [esi + 8]
test eax, eax
je 0x4dd34e
push eax
call fcn.0058392a
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x4df960
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, pe_nt_image_headers32
call fcn.0058a1c0
mov eax, dword [0x62c930]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x4df9e7
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4df9e7
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x100
push edx
call fcn.0058b3ff
add esp, 0x10
test eax, eax
jge 0x4df9bd
mov eax, 0x100
push 0
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.005832f8
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0xff
push edx
call fcn.0058b3ff
add esp, 0x10
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4dfa75
call fcn.004df820
test eax, eax
jle 0x4dfa75
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 1
push 0
push 0
push 0
mov esi, eax
push 1
lea eax, [esp + 0x28]
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.005832f8
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.005832f8
add esp, 0x108
ret

Function at 0x4dfad0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x4dfaf4
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
sub edi, 1
jne 0x4dfae6
pop esi
movzx eax, cl
pop edi
ret

Function at 0x4dfee0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x4dff27
mov al, byte [edx]
test al, al
je 0x4dff27
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x4dfef7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4e1d40
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov edx, dword [edi + 0x1c]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.004c5350
add esp, 8
test esi, esi
jg 0x4e1d9e
je 0x4e1d7c
cmp esi, 0xffffffff
jne 0x4e1d9e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 4
je 0x4e1d93
cmp eax, 0xb
je 0x4e1d93
cmp eax, 0x2733
jne 0x4e1d9e
push 0xa
push edi
call fcn.004c5370
add esp, 8
pop edi
mov eax, esi
pop esi
ret
Function at 0x4f29a0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24
call fcn.0058a1c0
mov eax, dword [0x62c930]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, esi
push edi
mov dword [ebp - 0x18], esi
lea ecx, [eax + 1]
jmp 0x4f29d0
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4f29d0
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
sub eax, ecx
lea edi, [eax + 1]
push edi
push esi
push 8
push 0xfde9
mov dword [ebp - 0x20], 8
call ebx
mov esi, eax
test esi, esi
jg 0x4f2a48
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ec
jne 0x4f2a2a
mov ecx, dword [ebp - 0x18]
push 0
push 0
push edi
push ecx
push 0
push 0xfde9
mov dword [ebp - 0x20], 0
call ebx
mov esi, eax
test esi, esi
jg 0x4f2a48
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x4f2ada
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push edx
push eax
jmp 0x4f2ac8
lea eax, [esi + esi]
call fcn.0058b320
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov eax, esp
push esi
push eax
push edi
push ecx
push edx
push 0xfde9
mov dword [ebp - 0x24], eax
call ebx
test eax, eax
je 0x4f2ada
mov esi, dword [ebp - 0x1c]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4f2a73
push 8
sub eax, edx
lea ecx, [ebp - 0x14]
push ecx
inc eax
push eax
push esi
push 0
push 0xfde9
call ebx
test eax, eax
je 0x4f2ada
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.00583665
mov esi, eax
add esp, 8
test esi, esi
jne 0x4f2b7e
call fcn.0058810c
cmp dword [eax], 2
je 0x4f2ac0
call fcn.0058810c
cmp dword [eax], 9
jne 0x4f2ad2
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push ecx
push edx
call fcn.005867c9
mov esi, eax
add esp, 8
test esi, esi
jne 0x4f2b7e
push 0xa8
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.004c4d70
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0x5c3ae8
push eax
push 0x5d3d58
push ecx
push str.fopen_
push 5
call fcn.004c5070
add esp, 0x2c
call fcn.0058810c
cmp dword [eax], 2
jne 0x4f2b50
push 0xab
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.004c4d70
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005832f8
mov esp, ebp
pop ebp
ret
push 0xad
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.004c4d70
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005832f8
mov esp, ebp
pop ebp
ret
push 0x6237a0
call fcn.004c5910
mov edi, eax
add esp, 4
test edi, edi
jne 0x4f2bb0
push esi
call fcn.0058392a
add esp, 4
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005832f8
mov esp, ebp
pop ebp
ret
push 0
push edi
call fcn.004c5350
push esi
push 1
push 0x6a
push edi
call fcn.004c56b0
add esp, 0x18
mov eax, edi
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005832f8
mov esp, ebp
pop ebp
ret