joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bfc60
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4bfccb
cmp byte [ebx + 0xd3], 0
jne 0x4bfccb
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406ffc
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4bfcb8
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4bfcd8
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00407254
jmp 0x4bfcd8
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00407254
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4c14a0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4c150e
mov eax, esi
call fcn.0047e5fc
test al, al
je 0x4c150e
mov eax, dword [ebx + 0x84]
call fcn.0047e250
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4c150e
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4c1502
push 0
mov eax, dword [ebx + 0x84]
call fcn.0047e250
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.004751cc
jmp 0x4c150e
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004c12d8
pop esi
pop ebx
ret

Function at 0x4c27cc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4c2852
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push edi
push esi
call sub.kernel32.dll_GetLocaleInfoW_1
mov ebx, eax
test ebx, ebx
jne 0x4c280d
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.00407254
jmp 0x4c283c
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004079c8
push ebx
mov eax, dword [ebp - 4]
call fcn.00407854
push eax
push edi
push esi
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, dword [ebp + 8]
push eax
mov ecx, ebx
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00407c10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c2859
lea eax, [ebp - 4]
call fcn.00406e94
ret
Function at 0x4db6b4
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4db7dc
push dword fs:[eax]
mov dword fs:[eax], esp
movzx eax, word [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 8]
mov eax, edi
call fcn.004db5a0
mov eax, dword [esi]
call fcn.00408814
add eax, 0x28
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x416884]
call fcn.004089dc
add esp, 4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1c]
mov ecx, 0x1c
call fcn.0040462c
mov ebx, 0x1c
mov eax, dword [ebp - 4]
lea edx, [eax + ebx]
lea eax, [ebp - 0x2c]
mov ecx, 0x1c
call fcn.0040462c
add ebx, 0x1c
mov eax, dword [esi]
call fcn.00408814
mov dword [ebp - 0xc], eax
mov eax, dword [0x551358]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x30]
lea edx, [ebp - 4]
mov ecx, ebx
call fcn.004ca568
add ebx, 4
mov eax, dword [ebp - 4]
add eax, ebx
xor ecx, ecx
mov edx, 3
call fcn.00404cf8
add ebx, 3
mov eax, dword [ebp - 4]
mov byte [eax + ebx], 0x3a
inc ebx
mov eax, dword [esi]
mov byte [eax + 2], 0
mov eax, dword [esi]
mov byte [eax + 3], 0
push ebx
mov eax, dword [esi]
call fcn.00408814
push eax
lea ecx, [ebp - 4]
mov eax, dword [esi]
xor edx, edx
call fcn.004ca458
mov edx, dword [ebp - 4]
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0x94]
mov ebx, eax
mov eax, ebx
call fcn.004ca210
mov edx, esi
mov ecx, dword [ebp + 0x10]
call fcn.004ca560
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db7e3
lea eax, [ebp - 4]
mov edx, dword [0x416884]
call fcn.004089e8
ret

Function at 0x4f49b0
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov eax, ebx
mov edx, 0x10
call fcn.004079c8
mov eax, dword [ebx]
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
test eax, eax
je 0x4f49d5
sub eax, 4
mov eax, dword [eax]
mov dword [esp], eax
push esp
mov eax, dword [ebx]
call fcn.00407854
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x4f49f4
mov eax, ebx
mov edx, dword [esp]
call fcn.004079c8
pop ecx
pop edx
pop ebx
ret
Function at 0x54b7b4
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, 0x542088
call fcn.0040aa54
xor eax, eax
push ebp
push 0x54b906
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x54b889
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.004047e8
mov eax, dword [ebp - 0x14]
call fcn.0041ce14
mov dword [0x557688], eax
push 0x557694
push 0x1388
push 2
push 0
push 0
push 0x10
mov eax, dword [0x557688]
push eax
call sub.user32.dll_SendMessageTimeoutW
mov eax, dword [0x557688]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x54b87f
push 0x55768c
mov eax, dword [0x557688]
push eax
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [0x55768c], 0
je 0x54b87f
mov eax, dword [0x55768c]
push eax
push 0
push 0x401
call sub.kernel32.dll_OpenProcess
mov dword [0x557690], eax
cmp dword [0x557690], 0
je 0x54b87f
push 0
mov eax, dword [0x557690]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [0x557690]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x54b8a4
mov eax, dword [0x5510d4]
mov eax, dword [eax]
call fcn.004c0308
mov eax, dword [0x5510d4]
mov eax, dword [eax]
mov edx, 0x54b950
call fcn.004bfd40
mov ecx, dword [0x551330]
mov eax, dword [0x5510d4]
mov eax, dword [eax]
mov edx, dword [0x540af4]
call fcn.004c0320
mov eax, dword [0x5510d4]
mov eax, dword [eax]
mov byte [eax + 0x5b], 0
mov eax, dword [0x5510d4]
mov eax, dword [eax]
call fcn.004c0470
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x54b90d
lea eax, [ebp - 0x14]
call fcn.00406e94
ret
Function at 0x4018b0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
mov edx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
dec ecx
push edi
mov edi, dword [esi + 4]
shr ecx, 0x1f
xor edx, edi
dec ecx
and edx, ecx
xor edi, edx
mov dword [esi + 4], edi
xor dword [eax + 4], edx
lea edx, [ebx - 1]
cmp edx, 9
ja case.default.0x4018e2
jmp dword [edx*4 + 0x401a0c]
mov edi, 0xa
cmp ebx, edi
jle case.0x4018e2.10
push ebp
mov edx, dword [esi]
mov ebx, dword [edx + edi*4]
lea ebp, [edx + edi*4]
mov edx, dword [eax]
mov edx, dword [edx + edi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + edi*4], edx
lea ebx, [ebx + edi*4]
inc edi
cmp edi, dword [esp + 0x20]
jl 0x4018f3
pop ebp
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x24]
mov edx, dword [edx + 0x24]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x24], edi
mov edi, dword [eax]
xor dword [edi + 0x24], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x20]
mov edx, dword [edx + 0x20]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x20], edi
mov edi, dword [eax]
xor dword [edi + 0x20], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x1c]
mov edx, dword [edx + 0x1c]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x1c], edi
mov edi, dword [eax]
xor dword [edi + 0x1c], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x18]
mov edx, dword [edx + 0x18]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x18], edi
mov edi, dword [eax]
xor dword [edi + 0x18], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x14]
mov edx, dword [edx + 0x14]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x14], edi
mov edi, dword [eax]
xor dword [edi + 0x14], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x10]
mov edx, dword [edx + 0x10]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x10], edi
mov edi, dword [eax]
xor dword [edi + 0x10], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0xc]
mov edx, dword [edx + 0xc]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0xc], edi
mov edi, dword [eax]
xor dword [edi + 0xc], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 8]
mov edx, dword [edx + 8]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 8], edi
mov edi, dword [eax]
xor dword [edi + 8], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 4]
mov edx, dword [edx + 4]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 4], edi
mov edi, dword [eax]
xor dword [edi + 4], edx
mov esi, dword [esi]
mov edx, dword [eax]
mov edi, dword [esi]
mov edx, dword [edx]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [esi], edi
mov eax, dword [eax]
xor dword [eax], edx
pop edi
pop esi
pop ebx
ret
Function at 0x40b020
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.0059fb60
mov eax, dword [0x647f70]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x40b0a7
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x40b0a7
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x100
push edx
call fcn.005a0cdc
add esp, 0x10
test eax, eax
jns 0x40b07d
mov eax, 0x100
push 0
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0059df39
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0xff
push edx
call fcn.005a0cdc
add esp, 0x10
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x40b139
call fcn.0040aee0
test eax, eax
jle 0x40b139
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x40b14d
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
lea eax, [esp + 0x28]
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0059df39
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0059df39
add esp, 0x108
ret

Function at 0x40b1a0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
je 0x40b1c6
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
sub esi, eax
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
or cl, dl
inc eax
dec edi
jne 0x40b1b7
pop esi
pop ebx
movzx eax, cl
pop edi
ret
Function at 0x40cc20
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
call fcn.0040c5f0
mov edi, eax
add esp, 4
test edi, edi
jne 0x40ccc6
push 0xaf
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.00408770
push 0x5cf934
push esi
push 0x5cf930
push ebx
push str.fopen_
push 5
call fcn.004088d0
add esp, 0x2c
call fcn.005a19e9
cmp dword [eax], 2
je 0x40cca5
call fcn.005a19e9
cmp dword [eax], 6
je 0x40cca5
push 0xb8
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.00408770
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0xb6
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.00408770
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x64632c
call fcn.00403c30
mov esi, eax
add esp, 4
test esi, esi
jne 0x40cce8
push edi
call fcn.0059f233
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.004035d0
push edi
push 1
push 0x6a
push esi
call fcn.004039c0
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x414ab0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x414af4
mov al, byte [edx]
test al, al
je 0x414af4
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
inc edx
xor esi, eax
mov al, byte [edx]
test al, al
jne 0x414ac7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4152d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5c
call fcn.0059fb60
mov eax, dword [0x647f70]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x70]
push ebx
mov ebx, dword [esp + 0x64]
push ebp
mov ebp, dword [esp + 0x74]
push esi
mov esi, dword [esp + 0x88]
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x88]
dec edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], edi
test eax, eax
jne 0x41532d
call fcn.004130c0
mov dword [esp + 0x10], eax
test esi, esi
jne 0x415335
mov dword [esp + 0x14], eax
push eax
call fcn.004235d0
mov esi, eax
lea eax, [esi + esi]
sub edi, eax
lea edx, [edi - 1]
add esp, 4
cmp ebp, edx
jle 0x415379
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0xa0
push 4
call fcn.00408770
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.0059df39
add esp, 0x5c
ret
inc eax
cmp dword [esp + 0x1c], eax
jge 0x41538b
push 0x40
push str..crypto_rsa_rsa_oaep.c
push 0x78
jmp 0x415355
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x84]
push 0
push ecx
lea eax, [ebx + 1]
mov byte [ebx], 0
push 0
lea ebx, [ebx + esi + 1]
push ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push edx
push eax
call fcn.00412f90
add esp, 0x18
test eax, eax
je 0x415364
sub edi, ebp
dec edi
push edi
lea ecx, [ebx + esi]
push 0
push ecx
call fcn.0059fb90
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
mov eax, ebx
sub eax, ebp
sub eax, esi
push ebp
add eax, edi
push ecx
push eax
mov byte [eax - 1], 1
call fcn.0059fc20
mov ebp, dword [esp + 0x30]
push esi
push ebp
call fcn.00413e50
add esp, 0x20
test eax, eax
jle 0x415364
push 0x55
sub edi, esi
push str..crypto_rsa_rsa_oaep.c
push edi
call fcn.00402890
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
jne 0x415425
push 0x57
push str..crypto_rsa_rsa_oaep.c
push 0x41
jmp 0x415355
mov edx, dword [esp + 0x14]
push edx
push esi
push ebp
push edi
push eax
call fcn.00415150
add esp, 0x14
test eax, eax
js 0x41546e
test edi, edi
jle 0x415455
mov ebp, dword [esp + 0x10]
mov eax, ebx
sub ebp, ebx
mov ecx, edi
mov dl, byte [eax + ebp]
xor byte [eax], dl
inc eax
dec ecx
jne 0x415448
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push eax
push edi
push ebx
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.00415150
add esp, 0x14
test eax, eax
jns 0x415490
mov edx, dword [esp + 0x10]
push edx
call fcn.00402a90
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.0059df39
add esp, 0x5c
ret
test esi, esi
jle 0x4154a9
lea ecx, [esp + 0x28]
mov eax, ebp
sub ecx, ebp
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x4154a0
mov eax, dword [esp + 0x10]
push eax
call fcn.00402a90
mov ecx, dword [esp + 0x6c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0059df39
add esp, 0x5c
ret
Function at 0x415fa0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x416069
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x415fc1
cmp al, 0x6b
jne 0x416069
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x41602a
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x415fe1
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x415fe1
cmp al, 0xbb
jne 0x41600a
inc ecx
cmp ecx, esi
jl 0x415fd1
sub esi, ecx
test ecx, ecx
jne 0x41602d
push 0x83
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00408770
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x7b
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00408770
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x416056
push 0x8b
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.00408770
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.0059fc20
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x70
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.00408770
add esp, 0x14
or eax, 0xffffffff
pop esi
ret

Function at 0x4242c0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.0059fb90
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret
Function at 0x4253e0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x4254c3
push esi
mov esi, dword [esp + 0x14]
inc esi
lea ebx, [ebx]
movzx edx, byte [esi - 1]
cmp edi, 3
jl 0x42545d
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], dl
jmp 0x4254ae
shl edx, 0x10
cmp edi, 2
jne 0x42546d
movzx eax, byte [esi]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
cmp edi, 1
jne 0x42549a
lea edx, [edi + 0x3c]
jmp 0x4254a7
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], dl
mov byte [ecx + 3], 0x3d
sub edi, 3
add ecx, 4
add ebp, 4
add esi, 3
test edi, edi
jg 0x425400
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x42a3d0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x10c], 0xffffffff
jne 0x42a3e2
xor eax, eax
pop edi
ret
push ebx
push esi
push edi
call fcn.00423580
mov ebx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
mov dword [eax], esi
test ebx, ebx
je 0x42a48e
mov eax, dword [edi + 0x10c]
push ebp
cmp eax, esi
jne 0x42a42e
test esi, esi
jle 0x42a46d
mov ecx, ebx
lea eax, [edi + 0x8c]
mov ebp, esi
lea ebx, [ebx]
mov dl, byte [eax + 0x60]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
dec ebp
jne 0x42a420
jmp 0x42a46d
mov ecx, esi
sub ecx, eax
mov byte [eax + edi + 0xec], 0x80
cmp ecx, 1
jle 0x42a453
dec ecx
push ecx
lea eax, [eax + edi + 0xed]
push 0
push eax
call fcn.0059fb90
add esp, 0xc
test esi, esi
jle 0x42a46d
mov ecx, ebx
lea eax, [edi + 0xac]
mov ebp, esi
mov dl, byte [eax + 0x40]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
dec ebp
jne 0x42a461
push esi
push ebx
push ebx
push edi
call fcn.00423590
add esp, 0x10
pop ebp
test eax, eax
jne 0x42a48e
push esi
push ebx
call fcn.00407be0
add esp, 8
pop esi
pop ebx
xor eax, eax
pop edi
ret
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x448e90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.0059fb60
mov eax, dword [0x647f70]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x9c]
push ebx
mov ebx, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x94]
mov dword [esp + 8], eax
xor eax, eax
push edi
mov edi, dword [esp + 0x9c]
test ebx, ebx
je 0x448f05
cmp ebx, dword [esi]
je 0x448efc
test edi, edi
je 0x448ee2
cmp dword [esp + 0xa0], eax
jge 0x448efc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.0059df39
add esp, 0x88
ret
mov eax, 1
mov dword [esi], ebx
jmp 0x448f0b
mov ebx, dword [esi]
test ebx, ebx
je 0x448ee2
push ebp
test edi, edi
je 0x448fdd
push ebx
call fcn.004235c0
mov ebp, eax
add esp, 4
cmp ebp, 0x80
jle 0x448f3b
push str.j____int_sizeof_ctx__key_
push 0x74
push str..cryptohmachmac.c
call fcn.0040b170
add esp, 0xc
mov eax, dword [esp + 0xa4]
cmp ebp, eax
jge 0x448f95
mov ecx, dword [esp + 0x10]
push ecx
lea ebp, [esi + 4]
push ebx
push ebp
call fcn.00412b10
add esp, 0xc
test eax, eax
je 0x44908a
mov edx, dword [esp + 0xa4]
push edx
push edi
push ebp
call fcn.00412cc0
add esp, 0xc
test eax, eax
je 0x44908a
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebp
call fcn.00412cd0
add esp, 0xc
test eax, eax
je 0x44908a
jmp 0x448fba
cmp eax, 0x80
ja 0x44908a
push eax
lea ecx, [esi + 0x50]
push edi
push ecx
call fcn.0059fc20
mov edx, dword [esp + 0xb0]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], edx
mov edi, dword [edi]
cmp edi, 0x80
je 0x448fe5
mov eax, 0x80
sub eax, edi
push eax
lea ecx, [edi + esi + 0x50]
push 0
push ecx
call fcn.0059fb90
add esp, 0xc
jmp 0x448fe5
test eax, eax
je 0x449076
xor eax, eax
jmp 0x448ff0
mov dl, byte [esi + eax + 0x50]
xor dl, 0x36
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x80
jl 0x448ff0
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x1c]
push ebx
push ebp
call fcn.00412b10
add esp, 0xc
test eax, eax
je 0x44908a
push ebx
call fcn.004235c0
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.00412cc0
add esp, 0x10
test eax, eax
je 0x44908a
xor eax, eax
mov dl, byte [esi + eax + 0x50]
xor dl, 0x5c
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x80
jl 0x449034
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x34]
push ebx
push ebp
call fcn.00412b10
add esp, 0xc
test eax, eax
je 0x44908a
push ebx
call fcn.004235c0
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.00412cc0
add esp, 0x10
test eax, eax
je 0x44908a
lea edx, [esi + 0x1c]
push edx
add esi, 4
push esi
call fcn.00412e30
add esp, 8
test eax, eax
jne 0x44908e
xor eax, eax
jmp 0x449093
mov eax, 1
mov ecx, dword [esp + 0x94]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0059df39
add esp, 0x88
ret