joyce8/EMBER2024-capa huggingface dataset:
Function at 0x480150
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b937c
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x4e2018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], 2
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov byte [ebp - 4], 1
call fcn.00404840
mov ecx, eax
test ecx, ecx
je 0x480243
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi + 0x14], eax
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov byte [ebp - 4], 4
lea esi, [edi + 0x30]
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
push 8
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
call fcn.004865a5
add esp, 4
mov dword [eax + 4], 0
mov dword [esi], eax
mov dword [eax], esi
mov eax, edi
mov dword [edi + 0x44], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00404610
int3
Function at 0x481070
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x40], 0
je 0x48110e
lea eax, [edi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [edi + 0x30]
mov ecx, edi
push 0
call fcn.00481390
mov esi, dword [edi + 0xc]
sub esi, 1
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
js 0x4810ec
nop word [eax + eax]
test esi, esi
js 0x481117
cmp esi, dword [edi + 0xc]
jge 0x481117
mov eax, dword [edi + 8]
mov ebx, dword [eax + esi*4]
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [esp + 0xc], 0x103
jne 0x4810de
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
sub esi, 1
jns 0x4810b0
push dword [edi + 0x40]
call ebx
lea esi, [edi + 0x14]
mov dword [edi + 0x40], 0
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push dword [edi + 0x3c]
call ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 1
push 0xc000008c
call fcn.00403e70
int3
Function at 0x481a30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x83c
mov eax, dword [0x4e2018]
xor eax, esp
mov dword [esp + 0x838], eax
push esi
mov esi, ecx
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x481b1e
push 0x800
push eax
mov dword [esp + 0x14], eax
xorps xmm0, xmm0
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x40]
push eax
movlpd qword [esp + 0x20], xmm0
movlpd qword [esp + 0x2c], xmm0
movlpd qword [esp + 0x34], xmm0
mov dword [esp + 0x14], 0x30
mov dword [esp + 0x28], 0x400000
call fcn.00488c10
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x4cf934
lea eax, [esp + 0x40]
push 0x400
push eax
call fcn.004778a0
add esp, 0x10
mov dword [esp + 0x10], 0x481b50
lea eax, [esp + 0x38]
mov dword [esp + 0x30], eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExW]
push 0
push dword [esp + 0x20]
push 0
push 0xfffffffffffffffd
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x58]
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
mov dword [esi + 0x10], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x481b36
push esi
push 0xffffffffffffffeb
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, 1
pop esi
mov ecx, dword [esp + 0x838]
xor ecx, esp
call fcn.00486589
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x83c]
xor eax, eax
pop esi
xor ecx, esp
call fcn.00486589
mov esp, ebp
pop ebp
ret

Function at 0x481ed0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4e2018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor edx, edx
push edi
mov edi, dword [ebp + 8]
lea eax, [esi + 0x16]
nop dword [eax]
movzx ecx, byte [eax - 2]
lea eax, [eax + 4]
mov byte [ebp + edx - 0xc], cl
movzx ecx, byte [eax - 5]
mov byte [ebp + edx - 0xb], cl
movzx ecx, byte [eax - 4]
mov byte [ebp + edx - 0xa], cl
movzx ecx, byte [eax - 3]
mov byte [ebp + edx - 9], cl
add edx, 4
cmp edx, 8
jb 0x481ef0
mov edx, dword [esi + 0x14]
lea ebx, [esi + 0x5c]
shr edx, 3
mov ecx, 0x78
and edx, 0x3f
mov eax, 0x38
sub ecx, edx
sub eax, edx
cmp edx, 0x38
cmovae eax, ecx
mov ecx, esi
push eax
push ebx
call fcn.00481de0
push 8
lea eax, [ebp - 0xc]
mov ecx, esi
push eax
call fcn.00481de0
lea ecx, [edi + 2]
mov edi, 4
lea edx, [esi + 6]
nop dword [eax]
movzx eax, byte [edx - 2]
lea edx, [edx + 4]
mov byte [ecx - 2], al
lea ecx, [ecx + 4]
movzx eax, byte [edx - 5]
mov byte [ecx - 5], al
movzx eax, byte [edx - 4]
mov byte [ecx - 4], al
movzx eax, byte [edx - 3]
mov byte [ecx - 3], al
sub edi, 1
jne 0x481f60
push 0x9c
push edi
push esi
call fcn.00488c10
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [esi + 4], 0x67452301
xor ecx, ebp
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
pop edi
mov dword [esi + 0x10], 0x10325476
pop esi
mov byte [ebx], 0x80
pop ebx
call fcn.00486589
mov esp, ebp
pop ebp
ret 4
Function at 0x4a1a78
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a18ee

Function at 0x4a845d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004a80da
Function at 0xefac1c
Capabilities:
Encode data using xor

Disassembly:
jmp 0xefac26
pushal
call 0xefac2c
pop ebp
sub ebp, 0x10
sub ebp, 0xafac1c
jmp 0xefac42
mov eax, 0xafac1c
add eax, ebp
add eax, 0x4c
mov ecx, 0x5da
mov edx, 0xa3677a35
xor byte [eax], dl
inc eax
dec ecx
jne 0xefac59
jmp 0xefac6c
mov esi, 0x9bcbef8
xor eax, 0xf4b43535
int 0x35
xor eax, 0x8df83635
xor esi, dword [0x1d8f3535]
xor eax, 0xd7c23535
std
mov esi, 0x353539b4
xor eax, 0x51b8f036
adc ecx, ecx
mov esp, 0x51b81131
adc ecx, ecx
mov esp, 0x695d1131
pop ss
xor eax, 0xb86c8b5d
xor eax, 0x5d111934
rcl byte [ebx + 0x30dd135e]
xor eax, 0x1dc3535
xor eax, 0x51b83535
adc ecx, ecx
mov esp, 0x68611119
mov esi, 0x35353db0
xor eax, 0x3539a0be
xor eax, 0x25b8be35
xor eax, 0xdcf43535
aaa
add al, 0x37
mov dh, 0xf7
xor dword [edx + edi - 0x50], edi
ror edx, 0xca
retf 0x19be
Function at 0x650f9a
Capabilities:
Encode data using xor

Disassembly:
and al, 0xa4
sub dl, byte [ecx]
sub ah, byte [edx + ebp]
int1
popfd
pop ds
pop ds
fdivr qword [ebp - 0xf0fb423]
mov ah, 0xc3
pop es
xchg dword [edi], esi
mov dword [ecx - 0x36], eax
je 0x650fbf
cdq
cli
jb 0x650f90
test byte ds:[eax], al
out 0x7f, al
push eax
mov byte [0xf69f187a], al
imul edx, dword [0x15a15e7b], 0xffffffd9
mov bl, cl
pop esi
mov eax, dword [0xcb88d915]
push ss
xor edx, dword [eax]
stosb byte es:[edi], al
mov ebp, 0x7a2b0af8
cmc
adc dword [ebp + 0x13], eax
sti
mov dl, byte [edi - 0x1e04f1e4]
sbb byte [0xe98d548e], bh
loope 0x650faa
cmp eax, 0xe98d548e
daa
cmp edi, edx
scasb al, byte es:[edi]
imul ebp, dword [edx - 6], 0x4c
call 0x80c72656
popal
inc esp
adc eax, 0x32283bda
sbb dword [edx], edx
inc edi
loop 0x65102d
xor bl, byte [ecx]
adc al, byte [edi - 0x1e]
jge 0x650fd1
and byte [edx - 0x6e], ch
push 0xffffffffffffff92
jp 0x650f76
rcl byte [esp + esi + 0x4b], 0xf2
nop
js 0x650f49
dec ebp
cwde
ljmp 0x5881:0x9882ad0a
les esi, [eax]
fimul dword [0x8eaa32b8]
sbb esi, dword [esp + edi*2 - 0x68]
sete byte [esi + 2]
ljmp 0x3e19
push 0x5d8c41c8
ror esp, cl
sahf
fstp dword [ecx]
into
mov dl, 0xf6
mov byte [eax], dl
mov ah, 0x1a
and ecx, dword [edx + 0x34]
cmp esp, dword [edi + 0x40]
adc byte [edx + ebx + 0x3b344a23], dh
inc eax
add dword [esi + 0x7de42ed4], ecx
loop 0x651087
jge 0x651011
push edi
or dl, 0x12
in al, dx
in al, dx
mov al, byte [0x4a4171ce]
sar byte [ebx + 0x40], 1
sti
xor edi, dword [edx - 0x13e7a53f]
jge 0x65101f
adc ch, byte [edx]
inc edi
stosb byte es:[edi], al
insb byte es:[edi], dx
sbb dword [ecx + edi*8 - 0x402e0e70], edx
retf
dec edi
pop es
test al, 0x60
stc
add ebp, dword [edx]
dec ecx
push 0x619a3ce5
in al, 1
mov dh, 0x8c
cli
sbb al, 0xb0
mov esp, 0xec0d161a
nop
pop edx
wait
fadd st(0), st(0)
test eax, 0xb11d381a
xchg edx, eax
inc ecx
out dx, eax
dec eax
pop esi
or cl, byte [ecx - 0xd]
arpl word [edi - 0x27462f9e], di
insb byte es:[edi], dx
push edx
dec edx
invalid
Function at 0x4068c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4068e9
xor eax, eax
test eax, eax
je 0x4068fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4068fc
xor ecx, ecx
jmp 0x4068ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406a22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4275ac], 0
push esi
jne 0x406a59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406a33
mov dword [ecx*4 + 0x4275a8], eax
inc ecx
cmp ecx, 0x100
jl 0x406a2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406a8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4275a8]
xor eax, esi
inc ecx
dec edx
jne 0x406a6c
pop edi
not eax
pop esi
ret 0xc

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x40de38
mov ecx, 0x64e71691
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x2f4f53b5
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401b3f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401b7e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401b7e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401b7e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401b7e
cmp dword [ecx + 0x74], 0xe
jbe 0x401b7e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x4079b3
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x407a50
push ebx
push esi
call fcn.0040797c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00407910
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4079fd
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x407a4f
push edi
push eax
call fcn.004062fd
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x407a1d
call fcn.00406458
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x407a4e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00407910
add esp, 0x20
test eax, eax
jne 0x407a3c
push edi
call fcn.00406458
jmp 0x407a44
push ebx
call fcn.00406458
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x40885e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40ffe8
push 0x40ffe0
push str.FlsAlloc
push 0x1f
call fcn.0040877a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408892
push dword [ebp + 8]
mov ecx, esi
call dword [0x40e12c]
call esi
jmp 0x408898
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4088dc
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x40fff8
push 0x40fff0
push str.FlsGetValue
push 0x21
call fcn.0040877a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408913
push dword [ebp + 8]
mov ecx, esi
call dword [0x40e12c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x40891b
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410000
push 0x40fff8
push str.FlsSetValue
push 0x22
call fcn.0040877a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x408955
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40e12c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x40d780
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40d7ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40d7ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x40dbc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x54
call fcn.00481180
mov eax, dword [0x4b8014]
xor eax, esp
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x58]
push ebx
push ebp
mov ebp, dword [esp + 0x64]
push edi
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x14], 0x41
xor edi, edi
call fcn.0041eb10
lea edx, [esp + 0x18]
push 8
push edx
call fcn.0041f480
lea eax, [esp + 0x30]
push eax
call fcn.0041eb10
add esp, 0x10
xor ebx, ebx
test ebp, ebp
jg 0x40dc54
lea eax, [esp + 0x38]
push 0x14
push eax
call fcn.0041e830
lea ecx, [esp + 0x1c]
push ecx
call fcn.0041ed10
lea edx, [esp + 0x30]
push edx
call fcn.0041ed10
add esp, 0x10
pop edi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.00475a12
add esp, 0x54
ret
mov edi, dword [esp + 0x34]
add edi, 1
cmp edi, 0x10
mov dword [esp + 0x34], edi
ja 0x40dd8e
test edi, edi
jbe 0x40dc7b
mov ecx, dword [esp + 0x10]
push edi
push ecx
lea edx, [esp + 0x54]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
add byte [esp + 0x10], 1
push 0
call fcn.004194f0
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.0041ebf0
push edi
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x38]
push edx
call fcn.0041ec80
mov eax, dword [esi + 0xbc]
mov ecx, dword [eax + 0x10]
push ecx
add eax, 0x14
push eax
lea edx, [esp + 0x44]
push edx
call fcn.0041ec80
mov eax, dword [esi + 0x58]
push 0x20
add eax, 0x98
push eax
lea ecx, [esp + 0x50]
push ecx
call fcn.0041ec80
mov edx, dword [esi + 0x58]
push 0x20
add edx, 0xb8
push edx
lea eax, [esp + 0x5c]
push eax
call fcn.0041ec80
push 0
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x68]
push edx
call fcn.0041ec90
add esp, 0x48
push 0
call fcn.004199f0
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0041ebf0
mov eax, dword [esi + 0xbc]
mov ecx, dword [eax + 0x10]
push ecx
add eax, 0x14
push eax
lea edx, [esp + 0x28]
push edx
call fcn.0041ec80
push 0x14
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.0041ec80
add esp, 0x24
lea edi, [ebx + 0x10]
cmp edi, ebp
push 0
jle 0x40dd68
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.0041ec90
mov eax, dword [esp + 0x18]
mov ecx, ebp
sub ecx, ebx
push ecx
lea edx, [esp + 0x48]
push edx
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0x18
jmp 0x40dd7a
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0041ec90
add esp, 0xc
add dword [esp + 0xc], 0x10
mov ebx, edi
cmp ebx, ebp
jl 0x40dc50
jmp 0x40dc14
push 0x9d
push str.._ssl_s3_enc.c
push 0x44
push 0xee
push 0x14
call fcn.00412a20
mov ecx, dword [esp + 0x70]
add esp, 0x14
pop edi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00475a12
add esp, 0x54
ret
Function at 0x40f350
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00481180
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov edi, edx
mov eax, ecx
cdq
sub eax, edx
mov esi, eax
and ecx, 1
sar esi, 1
lea eax, [esi + edi]
add esi, ecx
mov ecx, dword [esp + 0x20]
push ebx
push ecx
mov ecx, dword [esp + 0x1c]
push esi
push edi
mov edi, dword [esp + 0x2c]
mov edx, ebp
mov dword [esp + 0x1c], eax
call fcn.0040f0f0
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push ebx
push edx
push esi
mov esi, dword [esp + 0x44]
push eax
mov edx, esi
call fcn.0040f0f0
add esp, 0x20
test ebx, ebx
jle 0x40f3cd
mov ecx, esi
mov eax, ebp
sub ecx, ebp
mov esi, ebx
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
add eax, 1
sub esi, 1
jne 0x40f3c0
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x4134b0
Capabilities:
Access the windows event log

Disassembly:
mov eax, pe_nt_image_headers32
call fcn.00481180
mov eax, dword [0x4b8014]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x413515
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x413515
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.00467150
add eax, 0x40
push eax
call fcn.00480d2b
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00475a12
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.00480d5c
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4135a4
call fcn.004133d0
test eax, eax
je 0x4135a4
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00475a12
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00475a12
add esp, 0x108
ret

Function at 0x413910
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x413959
mov al, byte [edx]
test al, al
je 0x413959
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
add edx, 1
xor esi, ecx
test al, al
jne 0x413927
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x414780
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call sub.WS2_32.dll_WSASetLastError
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov edx, dword [edi + 0x1c]
push 0
push eax
push ecx
push edx
call sub.WS2_32.dll_send
push 0xf
push edi
mov esi, eax
call fcn.00413f90
add esp, 8
test esi, esi
jg 0x4147db
je 0x4147ba
cmp esi, 0xffffffff
jne 0x4147db
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 4
je 0x4147d0
cmp eax, 0xb
je 0x4147d0
cmp eax, 0x2733
jne 0x4147db
push 0xa
push edi
call fcn.00413fb0
add esp, 8
pop edi
mov eax, esi
pop esi
ret
Function at 0x41ba60
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10
call fcn.00481180
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0x14]
push ebx
mov ebx, dword [esi + 0x20]
push ebp
shr eax, 6
push edi
xor ebp, ebp
and eax, 1
push str.OPENSSL_ALLOW_PROXY_CERTS
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], 0xffffffff
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x41baab
mov dword [esp + 0x18], 1
cmp dword [esi + 0x48], ebp
jle 0x41bc67
mov ecx, dword [esi + 0x4c]
push ebp
push ecx
call fcn.00413080
mov edx, dword [esi + 0x14]
add esp, 8
test byte [edx + 0x14], 0x10
mov edi, eax
jne 0x41baf2
test dword [edi + 0x28], 0x200
je 0x41baf2
push esi
push 0
mov dword [esi + 0x5c], 0x22
mov dword [esi + 0x58], ebp
mov dword [esi + 0x60], edi
call ebx
add esp, 8
test eax, eax
je 0x41bc6c
cmp dword [esp + 0x18], 0
jne 0x41bb1f
test dword [edi + 0x28], 0x400
je 0x41bb1f
push esi
push 0
mov dword [esi + 0x5c], 0x28
mov dword [esi + 0x58], ebp
mov dword [esi + 0x60], edi
call ebx
add esp, 8
test eax, eax
je 0x41bc6c
push edi
call fcn.00417760
mov ecx, dword [esp + 0x10]
add esp, 4
cmp ecx, 0xffffffff
je 0x41bb54
test ecx, ecx
je 0x41bb47
test eax, eax
je 0x41bb66
mov edx, dword [esi + 0x14]
test byte [edx + 0x14], 0x20
je 0x41bb87
cmp eax, 1
jmp 0x41bb64
test eax, eax
je 0x41bb87
mov dword [esi + 0x5c], 0x25
jmp 0x41bb6d
mov edx, dword [esi + 0x14]
test byte [edx + 0x14], 0x20
je 0x41bb87
cmp eax, 1
je 0x41bb87
test eax, eax
je 0x41bb87
mov dword [esi + 0x5c], 0x18
push esi
push 0
mov dword [esi + 0x58], ebp
mov dword [esi + 0x60], edi
call ebx
add esp, 8
test eax, eax
je 0x41bc6c
mov ecx, dword [esp + 0xc]
mov eax, dword [esi + 0x14]
mov eax, dword [eax + 0x18]
test eax, eax
jle 0x41bbd2
xor edx, edx
test ecx, ecx
setg dl
push edx
push eax
push edi
call fcn.00417b70
add esp, 0xc
test eax, eax
je 0x41bbb5
mov ecx, dword [esi + 0x14]
test byte [ecx + 0x14], 0x20
je 0x41bbd2
cmp eax, 1
je 0x41bbd2
push esi
push 0
mov dword [esi + 0x5c], 0x1a
mov dword [esi + 0x58], ebp
mov dword [esi + 0x60], edi
call ebx
add esp, 8
test eax, eax
je 0x41bc6c
cmp ebp, 1
jle 0x41bc0c
test byte [edi + 0x28], 0x20
jne 0x41bc0c
mov eax, dword [edi + 0x20]
cmp eax, 0xffffffff
je 0x41bc0c
mov edx, dword [esp + 0x14]
lea eax, [eax + edx + 1]
cmp dword [esp + 0x10], eax
jle 0x41bc0c
push esi
push 0
mov dword [esi + 0x5c], 0x19
mov dword [esi + 0x58], ebp
mov dword [esi + 0x60], edi
call ebx
add esp, 8
test eax, eax
je 0x41bc6c
mov eax, dword [edi + 0x28]
test al, 0x20
jne 0x41bc18
add dword [esp + 0x10], 1
test eax, 0x400
je 0x41bc53
mov eax, dword [edi + 0x24]
cmp eax, 0xffffffff
je 0x41bc44
cmp ebp, eax
jle 0x41bc44
push esi
push 0
mov dword [esi + 0x5c], 0x26
mov dword [esi + 0x58], ebp
mov dword [esi + 0x60], edi
call ebx
add esp, 8
test eax, eax
je 0x41bc6c
add dword [esp + 0x14], 1
mov dword [esp + 0xc], 0
jmp 0x41bc5b
mov dword [esp + 0xc], 1
add ebp, 1
cmp ebp, dword [esi + 0x48]
jl 0x41bab4
mov eax, 1
pop edi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x41e750
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push ebx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov edi, eax
add esp, 8
test edi, edi
jne 0x41e7e6
push 0x7e
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.00412a20
push 0x488a30
push esi
push 0x492a24
push ebx
push str.fopen_
push 5
call fcn.00412c30
add esp, 0x2c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
cmp dword [eax], 2
jne 0x41e7c8
push 0x81
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.00412a20
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x83
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.00412a20
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x4c2e50
call fcn.004144c0
mov esi, eax
add esp, 4
test esi, esi
jne 0x41e808
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.00413f90
push edi
push 1
push 0x6a
push esi
call fcn.004142a0
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
ret