joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f24f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
push str.kernel32
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x4f2510
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0x608fb4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, dword [ebp + 8]
mov ebx, eax
push 0x608fc4
push esi
mov dword [ebp - 8], ebx
call fcn.005db462
add esp, 8
test eax, eax
je 0x4f255c
test ebx, ebx
je 0x4f254c
push 8
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x4f2585
push str.AddDllDirectory
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4f2585
push 0x800
push 0
push esi
call ebx
pop esi
mov edi, eax
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
mov dword [ebp - 4], edx
test edx, edx
je 0x4f2663
mov ecx, esi
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f25a1
sub ecx, ebx
sar ecx, 1
lea eax, [ecx + edx]
lea eax, [eax*2 + 2]
push eax
call dword [section..data]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4f2659
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4f2659
mov edx, ebx
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4f25e5
sub edx, ecx
mov ecx, 0x65960c
sar edx, 1
lea edx, [ebx + edx*2]
sub edx, ecx
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4f2600
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f2615
sub ecx, edx
sar ecx, 1
lea ecx, [ebx + ecx*2]
sub ecx, esi
nop dword [eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x4f2630
mov eax, dword [ebp - 8]
test eax, eax
je 0x4f2650
push 8
push 0
push ebx
call eax
jmp 0x4f2657
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
push ebx
call dword [0x685004]
add esp, 4
pop esi
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x4f2e10
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x4f2e37
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x4f2e26
pop edi
movzx eax, dl
pop esi
ret
Function at 0x4f2f80
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.005a9580
mov eax, dword [0x68da90]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x4f301f
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4f301f
lea eax, [esp + 0x114]
push eax
push 0
push dword [esp + 0x118]
lea eax, [esp + 0x14]
push 0x100
push eax
call fcn.0040b480
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.005cb573
add esp, 0x1c
or ecx, 0xffffffff
test eax, eax
cmovs eax, ecx
lea ecx, [esp + 4]
push 0
push ecx
test eax, eax
mov ecx, 0x100
cmovs eax, ecx
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.005a8a55
add esp, 0x108
ret
lea eax, [esp + 0x114]
push eax
push 0
push dword [esp + 0x118]
lea eax, [esp + 0x14]
push 0xff
push eax
call fcn.0040b480
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.005cb573
add esp, 0x1c
mov byte [esp + 0x107], 0
call fcn.004f2e40
test eax, eax
jle 0x4f30b3
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x4f30c7
push 0
lea eax, [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.005a8a55
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.005a8a55
add esp, 0x108
ret
Function at 0x5104b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.005a9580
mov eax, dword [0x68da90]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x44], ebx
test edi, edi
jne 0x5104f5
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.005a8a55
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push edi
call fcn.005da865
add esp, 8
test eax, eax
js 0x5104de
mov eax, 8
call fcn.005a9580
xorps xmm0, xmm0
lea eax, [esp + 0x50]
movsd qword [esp], xmm0
push 0x30
push eax
call fcn.005101f0
mov esi, dword [ebp + 0xc]
add esp, 0x10
test esi, esi
je 0x5104de
push 0x661f84
push edi
call fcn.005d499f
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
je 0x5105d1
nop dword [eax]
mov edi, 0x400
test esi, esi
jle 0x51055e
cmp esi, edi
cmovl edi, esi
push eax
push edi
lea eax, [esp + 0x80]
push 1
push eax
call fcn.005d545b
mov ebx, eax
add esp, 0x10
test ebx, ebx
jle 0x5105b2
movd xmm0, ebx
mov eax, 8
cvtdq2pd xmm0, xmm0
call fcn.005a9580
lea eax, [esp + 0x80]
movsd qword [esp], xmm0
push edi
push eax
call fcn.005101f0
add dword [esp + 0x54], ebx
add esp, 0x10
mov eax, dword [esp + 0x40]
test esi, esi
jle 0x510550
sub esi, edi
test esi, esi
jg 0x510550
push dword [esp + 0x40]
call fcn.005d5581
lea eax, [esp + 0x7c]
push 0x400
push eax
call fcn.004f2ae0
mov ebx, dword [esp + 0x50]
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005a8a55
mov esp, ebp
pop ebp
ret

Function at 0x514220
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x514253
push 0x2e
push edi
call fcn.005c1920
add esp, 8
test eax, eax
je 0x514251
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x51afc0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.005a9580
mov eax, dword [0x68da90]
xor eax, esp
mov dword [esp + 0x88], eax
mov edx, dword [esp + 0xa0]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [esp + 0xac]
mov dword [esp + 0x10], edx
test edi, edi
je 0x51b026
cmp edi, dword [esi]
je 0x51b01d
test ebp, ebp
je 0x51b0a0
test ebx, ebx
js 0x51b0a0
mov eax, 1
mov dword [esi], edi
jmp 0x51b02c
mov edi, dword [esi]
test edi, edi
je 0x51b0a0
test ebp, ebp
je 0x51b1bb
push edi
call fcn.00527290
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x51b060
push str.j____int_sizeof_ctx__key_
push 0x74
push str..cryptohmachmac.c
call fcn.004f30e0
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
jge 0x51b0bb
push dword [esp + 0x10]
lea eax, [esi + 4]
push edi
push eax
call fcn.004cfc60
add esp, 0xc
test eax, eax
je 0x51b0a0
push ebx
push ebp
lea ebx, [esi + 4]
push ebx
call fcn.004cfe10
add esp, 0xc
test eax, eax
je 0x51b0a0
lea ebp, [esi + 0x4c]
push ebp
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.004cfbc0
add esp, 0xc
test eax, eax
jne 0x51b0d7
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005a8a55
add esp, 0x8c
ret
cmp ebx, 0x80
ja 0x51b0a0
push ebx
lea eax, [esi + 0x50]
push ebp
push eax
call fcn.005c20e0
lea ebp, [esi + 0x4c]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x80
je 0x51b0fa
mov eax, 0x80
sub eax, ecx
push eax
lea eax, [esi + 0x50]
add eax, ecx
push 0
push eax
call fcn.005c1b40
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x50]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x51b100
push edx
lea ebx, [esi + 0x1c]
push edi
push ebx
call fcn.004cfc60
add esp, 0xc
test eax, eax
je 0x51b0a0
push edi
call fcn.00527290
push eax
lea eax, [esp + 0x20]
push eax
push ebx
call fcn.004cfe10
add esp, 0x10
test eax, eax
je 0x51b0a0
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [esi + ecx + 0x50]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x51b150
push dword [esp + 0x10]
lea ebx, [esi + 0x34]
push edi
push ebx
call fcn.004cfc60
add esp, 0xc
test eax, eax
je 0x51b0a0
push edi
call fcn.00527290
push eax
lea eax, [esp + 0x20]
push eax
push ebx
call fcn.004cfe10
add esp, 0x10
test eax, eax
je 0x51b0a0
lea eax, [esi + 0x1c]
push eax
lea eax, [esi + 4]
push eax
call fcn.004cfee0
add esp, 8
test eax, eax
je 0x51b0a0
mov eax, 1
jmp 0x51b0a2
test eax, eax
je 0x51b199
jmp 0x51b0fe
Function at 0x51c860
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
push dword [esp + 0x10]
call fcn.0051c950
mov edi, eax
add esp, 8
test edi, edi
jne 0x51c8f8
push 0xaf
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.004f4160
push 0x61e4a0
push esi
push 0x61e4a4
push dword [esp + 0x2c]
push str.fopen_
push 5
call fcn.004f37a0
add esp, 0x2c
call fcn.005c52da
cmp dword [eax], 2
jne 0x51c8db
push 0xb2
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.004f4160
add esp, 0x14
xor eax, eax
pop edi
pop esi
ret
push 0xb4
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.004f4160
add esp, 0x14
xor eax, eax
pop edi
pop esi
ret
push 0x6856a0
call fcn.004fa520
mov esi, eax
add esp, 4
test esi, esi
jne 0x51c919
push edi
call fcn.005d5581
add esp, 4
xor eax, eax
pop edi
pop esi
ret
push 0
push esi
call fcn.004fa160
push edi
push 1
push 0x6a
push esi
call fcn.004fa190
add esp, 0x18
mov eax, esi
pop edi
pop esi
ret

Function at 0x529eb0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edi, dword [esp + 0xc]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [edi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.004fa160
add esp, 8
test esi, esi
jg 0x529f07
je 0x529ee9
cmp esi, 0xffffffff
jne 0x529f07
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.0052a140
add esp, 4
test eax, eax
je 0x529f07
push 0xa
push edi
call fcn.004fa850
add esp, 8
pop edi
mov eax, esi
pop esi
ret

Function at 0x534660
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
cmp dword [eax], 6
je 0x53467b
push eax
push esi
call fcn.00534d10
add esp, 8
test eax, eax
jle 0x5346c3
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push esi
mov edi, eax
call fcn.004fa160
add esp, 8
test edi, edi
jg 0x5346c0
push edi
call fcn.0052a200
add esp, 4
test eax, eax
je 0x5346c0
push 0xa
push esi
call fcn.004fa850
add esp, 8
mov eax, edi
pop edi
pop esi
ret
Function at 0x53c210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x6c
call fcn.005a9580
mov eax, dword [0x68da90]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push ebx
mov dword [esp + 0xc], eax
xor ebx, ebx
mov eax, dword [esp + 0x7c]
push ebp
mov ebp, dword [esp + 0x78]
push esi
mov dword [esp + 0x10], eax
xor esi, esi
mov dword [eax], ebx
lea eax, [esp + 0x1c]
push edi
mov edi, dword [esp + 0x8c]
push eax
call fcn.004d0080
lea eax, [esp + 0x24]
push ebp
push eax
call fcn.004cfee0
add esp, 0xc
test eax, eax
je 0x53c312
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.004cfbc0
add esp, 0xc
test eax, eax
je 0x53c312
lea eax, [esp + 0x20]
push eax
call fcn.004cfe20
mov esi, dword [ebp]
add esp, 4
test byte [esi + 0xc], 4
je 0x53c330
push edi
call fcn.004ff570
push ebx
push edi
mov dword [esp + 0x1c], eax
call fcn.004f47b0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x53c312
push esi
call fcn.0053cb70
add esp, 4
test eax, eax
jle 0x53c312
push dword [ebp]
push ebx
push 1
push 0xf8
push 0xffffffffffffffff
push esi
call fcn.004f4560
add esp, 0x18
test eax, eax
jle 0x53c312
push dword [esp + 0x1c]
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x24]
push esi
call fcn.0053ca90
add esp, 0x14
test eax, eax
jle 0x53c312
mov ecx, dword [esp + 0x14]
mov ebx, 1
mov eax, dword [esp + 0x10]
mov dword [ecx], eax
push esi
call fcn.004f4750
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.005a8a55
add esp, 0x6c
ret
xor eax, eax
lea ecx, [esi + 0x2c]
mov edx, dword [ecx]
test edx, edx
je 0x53c348
cmp dword [edi], edx
je 0x53c372
inc eax
add ecx, 4
cmp eax, 4
jl 0x53c335
push 0x7b
push str..cryptoevpp_sign.c
push 0x6e
push 0x6b
push 6
call fcn.004f4160
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.005a8a55
add esp, 0x6c
ret
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x53c3a6
push 0x80
push str..cryptoevpp_sign.c
push 0x68
push 0x6b
push 6
call fcn.004f4160
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.005a8a55
add esp, 0x6c
ret
push dword [edi + 0x14]
mov ecx, dword [esp + 0x18]
push ecx
push dword [esp + 0x20]
lea ecx, [esp + 0x44]
push dword [esp + 0x28]
push ecx
push dword [esi]
call eax
mov ecx, dword [esp + 0x90]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005a8a55
add esp, 0x6c
ret
Function at 0x54bd90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x54bdbd
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x54be04
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x54be0a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
mov eax, dword [esi]
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x54be6b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop word [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x54be30
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x54be97
mov eax, dword [esi + 4]
push 1
push 0x62c4cf
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x62c4d0
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x54be70
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x54dd90
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x54de59
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x54ddb1
cmp al, 0x6b
jne 0x54de59
inc ecx
cmp al, 0x6b
jne 0x54de1b
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x54ddd2
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x54ddd2
cmp dl, 0xbb
jne 0x54ddfb
inc eax
cmp eax, esi
jl 0x54ddc0
sub esi, eax
test eax, eax
jne 0x54de1e
push 0x83
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.004f4160
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x7b
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.004f4160
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x54de47
push 0x8b
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.004f4160
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call fcn.005c20e0
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x70
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.004f4160
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x550330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x70
call fcn.005a9580
mov eax, dword [0x68da90]
xor eax, esp
mov dword [esp + 0x6c], eax
cmp dword [esp + 0x88], 0x40000000
mov eax, dword [esp + 0x7c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x84]
push ebp
mov ebp, dword [esp + 0x78]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x90]
push esi
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], 0
ja 0x550507
mov esi, dword [esp + 0x80]
cmp esi, 0x40000000
ja 0x550507
cmp dword [esp + 0x88], 0x40000000
ja 0x550507
push ebx
push edi
push eax
call fcn.004d04f0
mov edi, eax
lea eax, [esp + 0x28]
push eax
call fcn.004d0080
push 0
push dword [esp + 0x20]
lea eax, [esp + 0x34]
mov ebx, 1
push eax
call fcn.004cfc60
push dword [esp + 0xa4]
lea eax, [esp + 0x3c]
mov dword [esp + 0x28], 0x1000000
push dword [esp + 0x30]
push eax
call fcn.004cfe10
add esp, 0x20
test eax, eax
je 0x5504e3
push 4
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004cfe10
add esp, 0xc
test eax, eax
je 0x5504e3
push dword [esp + 0x98]
lea eax, [esp + 0x28]
push dword [esp + 0x24]
push eax
call fcn.004cfe10
add esp, 0xc
test eax, eax
je 0x5504e3
push 0
cmp esi, edi
jb 0x5504ab
lea eax, [esp + 0x28]
push ebp
push eax
call fcn.004cfb90
add esp, 0xc
test eax, eax
je 0x5504e3
sub esi, edi
je 0x5504db
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x2c]
add ebp, edi
push eax
inc ebx
call fcn.004cfc60
push dword [esp + 0x9c]
mov eax, ebx
mov byte [esp + 0x23], bl
push dword [esp + 0x28]
shr eax, 8
mov byte [esp + 0x26], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x25], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x24], al
lea eax, [esp + 0x38]
push eax
call fcn.004cfe10
add esp, 0x18
test eax, eax
jne 0x5503f7
jmp 0x5504e3
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.004cfb90
add esp, 0xc
test eax, eax
je 0x5504e3
push esi
lea eax, [esp + 0x40]
push eax
push ebp
call fcn.005c20e0
lea eax, [esp + 0x48]
push edi
push eax
call fcn.004f2ae0
add esp, 0x14
mov dword [esp + 0x1c], 1
lea eax, [esp + 0x24]
push eax
call fcn.004cfe20
mov eax, dword [esp + 0x20]
add esp, 4
pop edi
pop ebx
pop esi
pop ebp
mov ecx, dword [esp + 0x6c]
xor ecx, esp
call fcn.005a8a55
add esp, 0x70
ret
mov ecx, dword [esp + 0x74]
xor eax, eax
pop esi
pop ebp
xor ecx, esp
call fcn.005a8a55
add esp, 0x70
ret
Function at 0x550680
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x10c], 0xffffffff
jne 0x550692
xor eax, eax
pop edi
ret
push ebp
push esi
push edi
call fcn.004d0090
mov ecx, dword [esp + 0x1c]
add esp, 4
mov ebp, dword [esp + 0x14]
mov esi, eax
mov dword [ecx], esi
test ebp, ebp
je 0x550755
mov ecx, dword [edi + 0x10c]
push ebx
cmp ecx, esi
jne 0x5506e6
test esi, esi
jle 0x550734
mov edx, ebp
lea ecx, [edi + 0x8c]
mov ebx, esi
nop word [eax + eax]
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x5506d0
jmp 0x550734
sub eax, ecx
mov byte [ecx + edi + 0xec], 0x80
cmp eax, 1
jle 0x55070a
dec eax
push eax
lea eax, [edi + 0xed]
add eax, ecx
push 0
push eax
call fcn.005c1b40
add esp, 0xc
test esi, esi
jle 0x550734
mov edx, ebp
lea ecx, [edi + 0xac]
mov ebx, esi
nop dword [eax + eax]
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x550720
push esi
push ebp
push ebp
push edi
call fcn.004d04b0
add esp, 0x10
pop ebx
test eax, eax
jne 0x550755
push esi
push ebp
call fcn.004f2ae0
add esp, 8
xor eax, eax
pop esi
pop ebp
pop edi
ret
pop esi
pop ebp
mov eax, 1
pop edi
ret
Function at 0x566e80
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.005a9580
mov eax, dword [0x68da90]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xb4]
push ebp
push esi
mov esi, dword [esp + 0xc4]
xor ebp, ebp
mov eax, dword [eax + 4]
push edi
mov edi, dword [esp + 0xc4]
mov dword [esp + 0x14], eax
sub eax, edi
mov dword [esp + 0x10], eax
cmp esi, edi
jae 0x566ee6
push str.orig_len___md_size
push 0xf8
push str.._ssl_s3_cbc.c
call fcn.004f30e0
add esp, 0xc
cmp edi, 0x40
jbe 0x566f02
push str.md_size___EVP_MAX_MD_SIZE
push 0xf9
push str.._ssl_s3_cbc.c
call fcn.004f30e0
add esp, 0xc
lea eax, [esp + 0x34]
neg eax
lea ebx, [esp + 0x34]
and eax, 0x3f
add ebx, eax
lea eax, [edi + 0x100]
mov dword [esp + 0x1c], ebx
cmp esi, eax
jbe 0x566f29
mov ebp, esi
sub ebp, edi
sub ebp, 0x100
mov eax, edi
xor edx, edx
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, dword [esp + 0x10]
div edi
push edi
mov esi, edx
push 0
push ebx
mov dword [esp + 0x38], esi
call fcn.005c1b40
add esp, 0xc
mov dword [esp + 0x18], 0
cmp ebp, dword [esp + 0xc8]
jae 0x56701f
mov ecx, dword [esp + 0x10]
mov edx, ecx
mov ebx, dword [esp + 0x14]
mov esi, ebx
mov eax, dword [esp + 0xc0]
sub esi, ecx
shr edx, 0x1f
mov dword [esp + 0x24], edx
mov edx, ebx
shr edx, 0x1f
mov eax, dword [eax + 0xc]
mov dword [esp + 0x14], edx
mov edx, ebp
sub edx, ebx
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x1c]
add eax, ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], eax
mov ebx, dword [esp + 0x20]
mov ecx, ebp
mov eax, dword [esp + 0x24]
inc ebp
shr ecx, 0x1f
lea ebx, [ebx + edx]
shr edx, 0x1f
xor dl, byte [esp + 0x14]
shr ebx, 0x1f
xor bl, al
xor al, cl
or bl, al
mov al, cl
xor al, byte [esp + 0x14]
xor bl, cl
or dl, al
dec bl
mov eax, dword [esp + 0x10]
xor dl, cl
mov ecx, dword [esp + 0x28]
dec dl
not dl
mov al, byte [ecx + eax]
mov ecx, dword [esp + 0x18]
and dl, al
and dl, bl
or byte [ecx + esi], dl
mov edx, ecx
inc edx
mov ecx, edx
mov eax, edx
sub ecx, edi
xor eax, edi
xor ecx, edi
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x10]
inc edx
mov dword [esp + 0x10], edx
cmp ebp, dword [esp + 0xc8]
jb 0x566fa0
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x1c]
xor edx, edx
test edi, edi
je 0x56705a
mov ebp, dword [esp + 0x30]
nop dword [eax]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + ebx]
movzx eax, byte [esi + ebx]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, edi
mov eax, esi
xor ecx, edi
xor eax, edi
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, edi
jb 0x567030
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.005a8a55
add esp, 0xa8
ret