joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bded8
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
dec ecx
shr ecx, 0x1f
dec ecx
mov edi, dword [edx + 4]
mov eax, dword [ebx + 4]
xor eax, edi
and eax, ecx
xor edi, eax
mov dword [edx + 4], edi
xor dword [ebx + 4], eax
mov edx, dword [edx]
mov eax, dword [ebx]
cmp esi, 0xa
jbe switch.0x004bdfc0
mov ebx, 0xa
cmp esi, 0xa
jle case.0x4bdfc0.10
lea esi, [esi]
lea edi, [edi]
mov edi, dword [edx + ebx*4]
xor edi, dword [eax + ebx*4]
and edi, ecx
mov ebp, dword [edx + ebx*4]
xor ebp, edi
mov dword [edx + ebx*4], ebp
xor dword [eax + ebx*4], edi
inc ebx
cmp ebx, esi
jne 0x4bdef0
mov esi, dword [edx + 0x24]
mov ebx, dword [eax + 0x24]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx + 0x24], esi
xor dword [eax + 0x24], ebx
mov esi, dword [edx + 0x20]
mov ebx, dword [eax + 0x20]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx + 0x20], esi
xor dword [eax + 0x20], ebx
mov esi, dword [edx + 0x1c]
mov ebx, dword [eax + 0x1c]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx + 0x1c], esi
xor dword [eax + 0x1c], ebx
mov esi, dword [edx + 0x18]
mov ebx, dword [eax + 0x18]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx + 0x18], esi
xor dword [eax + 0x18], ebx
mov esi, dword [edx + 0x14]
mov ebx, dword [eax + 0x14]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx + 0x14], esi
xor dword [eax + 0x14], ebx
mov esi, dword [edx + 0x10]
mov ebx, dword [eax + 0x10]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx + 0x10], esi
xor dword [eax + 0x10], ebx
mov esi, dword [edx + 0xc]
mov ebx, dword [eax + 0xc]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx + 0xc], esi
xor dword [eax + 0xc], ebx
mov esi, dword [edx + 8]
mov ebx, dword [eax + 8]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx + 8], esi
xor dword [eax + 8], ebx
mov esi, dword [edx + 4]
mov ebx, dword [eax + 4]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx + 4], esi
xor dword [eax + 4], ebx
mov esi, dword [edx]
mov ebx, dword [eax]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx], esi
xor dword [eax], ebx
pop ebx
pop esi
pop edi
pop ebp
ret
jmp dword [esi*4 + 0x5e5c14]
Function at 0x4bed60
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov esi, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
test esi, esi
je 0x4bedab
lea edi, [esp + 0x2c]
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.msvcrt.dll__stat
test eax, eax
js 0x4bedab
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x24
mov dword [esp], edi
call fcn.004bf370
test ebx, ebx
jne 0x4bedc0
xor edi, edi
mov eax, edi
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x5e66a4
mov dword [esp], esi
call sub.msvcrt.dll_fopen
mov ebp, eax
test eax, eax
je 0x4bedab
test word [esp + 0x32], 0x3000
je 0x4bee08
cmp ebx, 0xffffffff
je 0x4beec0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], ebp
call sub.msvcrt.dll_setvbuf
xor edi, edi
test ebx, ebx
jle 0x4beeb0
lea esi, [esi]
lea edi, [edi]
mov esi, ebx
cmp ebx, 0x400
jle 0x4bee2f
mov esi, 0x400
mov eax, esi
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], 0x65ea20
call sub.msvcrt.dll_fread
test eax, eax
jle 0x4bee81
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fstp qword [esp + 8]
mov dword [esp + 4], esi
mov dword [esp], 0x65ea20
mov dword [esp + 0x18], eax
call fcn.004bf370
mov eax, dword [esp + 0x18]
add edi, eax
test ebx, ebx
jle 0x4beeb0
sub ebx, esi
test ebx, ebx
jg 0x4bee20
mov dword [esp], ebp
call sub.msvcrt.dll_fclose
mov dword [esp + 4], 0x400
mov dword [esp], 0x65ea20
call fcn.004dee90
mov eax, edi
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x400
mov esi, 0x400
jmp 0x4bee31
mov ebx, 0x800
jmp 0x4bede8

Function at 0x4bf020
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.005099a0
test eax, eax
je 0x4bf0c0
xor ebx, ebx
call fcn.005099a0
test eax, eax
je 0x4bf120
test ebx, ebx
je 0x4bf136
cmp byte [ebx], 0
jne 0x4bf060
mov byte [esi], 0
mov eax, esi
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
add eax, 6
cmp dword [esp + 0x24], eax
jbe 0x4bf052
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.004cf260
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5e66bb
mov dword [esp], esi
call fcn.004cf2d0
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], str..rnd
mov dword [esp], esi
call fcn.004cf2d0
mov eax, esi
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp], str.RANDFILE
call sub.msvcrt.dll_getenv
mov ebx, eax
test eax, eax
je 0x4bf038
cmp byte [eax], 0
je 0x4bf038
mov dword [esp], eax
call sub.msvcrt.dll_strlen
inc eax
cmp eax, dword [esp + 0x24]
jae 0x4bf038
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.004cf260
cmp dword [esp + 0x24], eax
ja 0x4bf055
xor esi, esi
jmp 0x4bf055
mov dword [esp], str.HOME
call sub.msvcrt.dll_getenv
mov ebx, eax
test ebx, ebx
jne 0x4bf04d
mov ebx, 0x5e66aa
jmp 0x4bf04d
Function at 0x4c3d30
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov dword [esp], 0
call fcn.00510650
mov ebx, eax
test eax, eax
je 0x4c3de0
test esi, esi
je 0x4c3df0
mov ebp, esi
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], ebx
call fcn.005106f0
test eax, eax
jle 0x4c3db0
mov eax, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004c37b0
test esi, esi
je 0x4c3e20
mov dword [esp], ebx
mov dword [esp + 0x1c], eax
call fcn.005106b0
mov eax, dword [esp + 0x1c]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [esp + 0x48], 0x10
jne 0x4c3dc0
xor eax, eax
jmp 0x4c3d8b
call fcn.004b29d0
and eax, 0xfff
cmp eax, 0x72
jne 0x4c3db7
call fcn.004b2040
mov eax, 1
jmp 0x4c3d8b
xor eax, eax
xor ebp, ebp
jmp 0x4c3d8b
mov dword [esp], str.OPENSSL_CONF
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4c3e40
mov dword [esp], eax
call fcn.004cefc0
mov ebp, eax
test eax, eax
jne 0x4c3d5b
xor eax, eax
xor ebp, ebp
lea esi, [esi]
lea edi, [edi]
mov dword [esp], ebp
mov dword [esp + 0x1c], eax
call fcn.004b8a80
mov eax, dword [esp + 0x1c]
jmp 0x4c3d93
call fcn.0050f4d0
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea edi, [eax + 0xd]
mov dword [esp + 8], 0x231
mov dword [esp + 4], str.conf_mod.c
mov dword [esp], edi
call fcn.004b8590
mov ebp, eax
test eax, eax
je 0x4c3e12
call fcn.0050f4d0
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebp
call fcn.004cf260
mov dword [esp + 8], edi
mov dword [esp + 4], 0x5e6c37
mov dword [esp], ebp
call fcn.004cf2d0
mov dword [esp + 8], edi
mov dword [esp + 4], str.openssl.cnf
mov dword [esp], ebp
call fcn.004cf2d0
jmp 0x4c3d5b
Function at 0x4c7cc0
Capabilities:
Hash data with md5

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov edi, edx
mov ebx, 0x5c
test dl, 1
jne 0x4c7d20
test edi, 2
jne 0x4c7d30
mov ecx, ebx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
test bl, 2
je 0x4c7cf0
mov word [edi], 0
add edi, 2
and ebx, 1
je 0x4c7cf8
mov byte [edi], 0
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov eax, 1
pop ebx
pop edi
ret
mov byte [edx], 0
lea edi, [edx + 1]
mov bl, 0x5b
test edi, 2
je 0x4c7cda
mov word [edi], 0
add edi, 2
sub ebx, 2
jmp 0x4c7cda

Function at 0x4c7f00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
xor eax, eax
xor ebx, ebx
cmp edx, 0
je 0x4c8063
mov al, byte [edi]
mov bl, byte [edi + 4]
add edi, 8
lea ecx, [esi + edx]
sub ebp, esi
mov dword [esp + 0x18], ecx
inc al
cmp dword [edi + 0x100], 0xffffffff
je 0x4c8030
mov ecx, dword [edi + eax*4]
and edx, 0xfffffffc
je 0x4c8000
lea edx, [esi + edx - 4]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebp
lea esi, [esi]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
mov ecx, dword [edi + eax*4]
mov ebp, dword [edi + edx*4]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
ror ebp, 8
mov ecx, dword [edi + eax*4]
or ebp, dword [edi + edx*4]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
ror ebp, 8
mov ecx, dword [edi + eax*4]
or ebp, dword [edi + edx*4]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
ror ebp, 8
mov ecx, dword [esp + 0x20]
or ebp, dword [edi + edx*4]
ror ebp, 8
xor ebp, dword [esi]
cmp esi, dword [esp + 0x1c]
mov dword [ecx + esi], ebp
lea esi, [esi + 4]
mov ecx, dword [edi + eax*4]
jb 0x4c7f60
cmp esi, dword [esp + 0x18]
je 0x4c805b
mov ebp, dword [esp + 0x20]
nop
lea esi, [esi]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
mov edx, dword [edi + edx*4]
xor dl, byte [esi]
lea esi, [esi + 1]
mov ecx, dword [edi + eax*4]
cmp esi, dword [esp + 0x18]
mov byte [ebp + esi - 1], dl
jb 0x4c8000
jmp 0x4c805b
movzx ecx, byte [edi + eax]
add bl, cl
movzx edx, byte [edi + ebx]
mov byte [edi + ebx], cl
mov byte [edi + eax], dl
add dl, cl
movzx edx, byte [edi + edx]
add al, 1
xor dl, byte [esi]
lea esi, [esi + 1]
movzx ecx, byte [edi + eax]
cmp esi, dword [esp + 0x18]
mov byte [ebp + esi - 1], dl
jb 0x4c8034
dec al
mov byte [edi - 4], bl
mov byte [edi - 8], al
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4ca3c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x20]
test esi, esi
je 0x4ca580
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x1c]
test edx, edx
jne 0x4ca570
lea edi, [esi + 4]
mov ebx, dword [esi]
test ebx, ebx
je 0x4ca560
lea esi, [esi]
mov eax, dword [ebx]
test eax, eax
je 0x4ca3fe
mov dword [esp], ebx
call fcn.004bcf60
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4ca410
lea eax, [ebx + 0x14]
mov dword [esp], eax
call fcn.004bcf60
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x4ca422
lea eax, [ebx + 0x28]
mov dword [esp], eax
call fcn.004bcf60
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x4ca434
lea eax, [ebx + 0x3c]
mov dword [esp], eax
call fcn.004bcf60
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x4ca446
lea eax, [ebx + 0x50]
mov dword [esp], eax
call fcn.004bcf60
mov ecx, dword [ebx + 0x64]
test ecx, ecx
je 0x4ca458
lea eax, [ebx + 0x64]
mov dword [esp], eax
call fcn.004bcf60
mov edx, dword [ebx + 0x78]
test edx, edx
je 0x4ca46a
lea eax, [ebx + 0x78]
mov dword [esp], eax
call fcn.004bcf60
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0x4ca482
lea eax, [ebx + 0x8c]
mov dword [esp], eax
call fcn.004bcf60
mov eax, dword [ebx + 0xa0]
test eax, eax
je 0x4ca49a
lea eax, [ebx + 0xa0]
mov dword [esp], eax
call fcn.004bcf60
mov eax, dword [ebx + 0xb4]
test eax, eax
je 0x4ca4b2
lea eax, [ebx + 0xb4]
mov dword [esp], eax
call fcn.004bcf60
mov eax, dword [ebx + 0xc8]
test eax, eax
je 0x4ca4ca
lea eax, [ebx + 0xc8]
mov dword [esp], eax
call fcn.004bcf60
mov eax, dword [ebx + 0xdc]
test eax, eax
je 0x4ca4e2
lea eax, [ebx + 0xdc]
mov dword [esp], eax
call fcn.004bcf60
mov eax, dword [ebx + 0xf0]
test eax, eax
je 0x4ca4fa
lea eax, [ebx + 0xf0]
mov dword [esp], eax
call fcn.004bcf60
mov ecx, dword [ebx + 0x104]
test ecx, ecx
je 0x4ca512
lea eax, [ebx + 0x104]
mov dword [esp], eax
call fcn.004bcf60
mov edx, dword [ebx + 0x118]
test edx, edx
je 0x4ca52a
lea eax, [ebx + 0x118]
mov dword [esp], eax
call fcn.004bcf60
mov eax, dword [ebx + 0x12c]
test eax, eax
je 0x4ca542
add ebx, 0x12c
mov dword [esp], ebx
call fcn.004bcf60
mov eax, dword [esi]
mov edx, dword [eax + 0x144]
mov dword [edi], edx
mov dword [esp], eax
call fcn.004b8a80
mov ebx, dword [edi]
mov dword [esi], ebx
test ebx, ebx
jne 0x4ca3f0
mov dword [esp + 0x20], esi
add esp, 0x10
pop ebx
pop esi
pop edi
jmp fcn.004b8a80
mov dword [esp], eax
call fcn.004b8a80
jmp 0x4ca3e0
add esp, 0x10
pop ebx
pop esi
pop edi
ret

Function at 0x4ce3c0
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x4ce410
movsx eax, byte [ebx]
test al, al
je 0x4ce410
xor edx, edx
mov esi, 0x100
nop
lea esi, [esi]
or eax, esi
add esi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
rol edx, cl
imul eax, eax
xor edx, eax
inc ebx
movsx eax, byte [ebx]
test al, al
jne 0x4ce3e0
mov eax, edx
shr eax, 0x10
xor eax, edx
pop ebx
pop esi
ret
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4d0d60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
mov dword [esp + 0x2c], eax
mov edx, dword [esp + 0x68]
mov dword [esp + 0x28], edx
mov edi, dword [ebx + 8]
test edi, edi
jne 0x4d0da0
mov dword [esp + 0x68], edx
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], ebx
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004d0860
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
cmp eax, 0x20
ja 0x4d0f30
cmp dword [esp + 0x24], 1
je 0x4d0f10
mov edi, dword [ebx + 0xc]
test byte [ebx + 0x5d], 1
jne 0x4d0ef0
mov edx, dword [esp + 0x24]
sub edx, edi
mov dword [esp + 0x30], edx
cmp dword [esp + 0x24], edi
jbe 0x4d0eb9
mov cl, byte [esp + 0x30]
mov eax, edi
not eax
mov edx, dword [esp + 0x24]
lea ebp, [edx + eax + 1]
lea esi, [edi + 0x30]
mov dword [esp + 0x34], esi
mov edx, esi
add edx, ebx
neg edx
and edx, 3
cmp edx, ebp
jbe 0x4d0e04
mov edx, ebp
mov esi, dword [esp + 0x24]
lea eax, [esi + eax + 1]
cmp eax, 6
ja 0x4d0e13
mov edx, eax
mov dword [esp + 0x20], edi
test edx, edx
je 0x4d0e39
mov eax, edi
lea esi, [esi]
mov byte [ebx + eax + 0x30], cl
inc eax
mov esi, eax
sub esi, edi
cmp edx, esi
ja 0x4d0e20
mov dword [esp + 0x20], eax
cmp ebp, edx
je 0x4d0eb9
sub ebp, edx
mov dword [esp + 0x38], ebp
mov edi, ebp
shr edi, 2
mov eax, edi
shl eax, 2
mov dword [esp + 0x3c], eax
je 0x4d0f8e
xor esi, esi
mov eax, esi
mov al, cl
mov ah, byte [esp + 0x30]
mov esi, eax
mov al, cl
and eax, 0xff
mov ebp, eax
shl eax, 0x10
and esi, 0xffff
shl ebp, 0x18
or esi, eax
or esi, ebp
add edx, dword [esp + 0x34]
lea ebp, [ebx + edx]
xor edx, edx
mov eax, dword [esp + 0x20]
lea esi, [esi]
lea edi, [edi]
mov dword [ebp + edx*4], esi
inc edx
cmp edi, edx
ja 0x4d0e90
mov edx, dword [esp + 0x3c]
add eax, edx
mov dword [esp + 0x20], eax
cmp dword [esp + 0x38], edx
je 0x4d0eb9
mov edx, dword [esp + 0x24]
lea esi, [esi]
mov byte [ebx + eax + 0x30], cl
inc eax
cmp edx, eax
ja 0x4d0eb0
mov eax, dword [ebx]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
lea edx, [ebx + 0x30]
mov dword [esp + 8], edx
mov esi, dword [esp + 0x2c]
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x18]
test eax, eax
je 0x4d0f03
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [ecx], esi
jmp 0x4d0f03
test edi, edi
jne 0x4d0f5b
mov esi, dword [esp + 0x28]
mov dword [esi], 0
mov eax, 1
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [esp + 0x28]
mov dword [ecx], 0
mov eax, 1
jmp 0x4d0f03
mov dword [esp + 8], str.b___sizeof_ctx__buf
mov dword [esp + 4], 0x163
mov dword [esp], str.evp_enc.c
call fcn.004d2d10
mov edi, dword [ebx + 0xc]
test byte [ebx + 0x5d], 1
je 0x4d0dca
jmp 0x4d0ef0
mov dword [esp + 0x10], 0x16e
mov dword [esp + 0xc], str.evp_enc.c
mov dword [esp + 8], 0x8a
mov dword [esp + 4], 0x7f
mov dword [esp], 6
call fcn.004b26a0
xor eax, eax
jmp 0x4d0f03
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
jmp 0x4d0eb0
Function at 0x4d2920
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x65f07c]
test eax, eax
je 0x4d2930
ret
sub esp, 0x1c
mov dword [0x65f07c], 1
mov dword [esp], str.OPENSSL_ia32cap
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4d2980
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
or ah, 4
mov dword [0x65f04c], eax
add esp, 0x1c
ret
call fcn.004dec20
or ah, 4
mov dword [0x65f04c], eax
jmp 0x4d296d

Function at 0x4d2bb0
Capabilities:
Access the windows event log

Disassembly:
push esi
push ebx
sub esp, 0x144
mov dword [esp], 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
push edx
test eax, eax
je 0x4d2bda
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileType
push esi
test eax, eax
jne 0x4d2cd0
lea eax, [esp + 0x154]
mov dword [esp + 0x38], eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x150]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xff
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call sub.msvcrt.dll__vsnprintf
mov byte [esp + 0x13f], 0
call sub.KERNEL32.dll_GetVersion
test eax, eax
js 0x4d2ca0
call fcn.004d2a50
test eax, eax
jle 0x4d2ca0
mov dword [esp + 4], str.OPENSSL
mov dword [esp], 0
call sub.ADVAPI32.DLL_RegisterEventSourceA
sub esp, 8
mov esi, eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x20], 0
lea eax, [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.ADVAPI32.DLL_ReportEventA
sub esp, 0x24
mov dword [esp], esi
call sub.ADVAPI32.DLL_DeregisterEventSource
push ebx
add esp, 0x144
pop ebx
pop esi
ret
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.OpenSSL:_FATAL
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
add esp, 0x144
pop ebx
pop esi
ret
lea eax, [esp + 0x154]
mov dword [esp + 0x38], eax
mov dword [esp + 8], eax
mov eax, dword [esp + 0x150]
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
add esp, 0x144
pop ebx
pop esi
ret

Function at 0x4d33c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4d3447
mov edi, dword [esp + 0x1c]
shr edi, 2
lea edx, [edi*4]
mov eax, esi
or eax, ecx
test al, 3
sete bl
cmp dword [esp + 0x1c], 8
seta al
test bl, al
je 0x4d344b
test edx, edx
je 0x4d344b
xor eax, eax
xor ebp, ebp
nop
mov ebx, dword [esi + eax*4]
xor ebx, dword [ecx + eax*4]
or ebp, ebx
inc eax
cmp edi, eax
ja 0x4d3400
mov ebx, ebp
movzx eax, bh
shr ebx, 0x10
or eax, ebp
or eax, ebx
shr ebp, 0x18
or eax, ebp
cmp dword [esp + 0x1c], edx
je 0x4d343d
mov edi, dword [esp + 0x1c]
nop
lea esi, [esi]
mov bl, byte [esi + edx]
xor bl, byte [ecx + edx]
or eax, ebx
inc edx
cmp edi, edx
ja 0x4d3430
and eax, 0xff
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x4d3442
xor eax, eax
xor edx, edx
mov edi, dword [esp + 0x1c]
jmp 0x4d3430
Function at 0x4f2490
Capabilities:
Hash data using sha1

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov edi, edx
mov ebx, 0x60
test dl, 1
jne 0x4f2500
test edi, 2
jne 0x4f2510
mov ecx, ebx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
test bl, 2
je 0x4f24c0
mov word [edi], 0
add edi, 2
and ebx, 1
je 0x4f24c8
mov byte [edi], 0
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
mov eax, 1
pop ebx
pop edi
ret
mov byte [edx], 0
lea edi, [edx + 1]
mov bl, 0x5f
test edi, 2
je 0x4f24aa
mov word [edi], 0
add edi, 2
sub ebx, 2
jmp 0x4f24aa

Function at 0x4f2850
Capabilities:
Hash data using sha224

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov edi, edx
mov ebx, 0x70
test dl, 1
jne 0x4f28d0
test edi, 2
jne 0x4f28e0
mov ecx, ebx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
test bl, 2
je 0x4f2880
mov word [edi], 0
add edi, 2
and ebx, 1
je 0x4f2888
mov byte [edi], 0
mov dword [edx], 0xc1059ed8
mov dword [edx + 4], 0x367cd507
mov dword [edx + 8], 0x3070dd17
mov dword [edx + 0xc], 0xf70e5939
mov dword [edx + 0x10], 0xffc00b31
mov dword [edx + 0x14], 0x68581511
mov dword [edx + 0x18], 0x64f98fa7
mov dword [edx + 0x1c], 0xbefa4fa4
mov dword [edx + 0x6c], 0x1c
mov eax, 1
pop ebx
pop edi
ret
mov byte [edx], 0
lea edi, [edx + 1]
mov bl, 0x6f
test edi, 2
je 0x4f286a
mov word [edi], 0
add edi, 2
sub ebx, 2
jmp 0x4f286a

Function at 0x4f28f0
Capabilities:
Hash data using sha256

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov edi, edx
mov ebx, 0x70
test dl, 1
jne 0x4f2970
test edi, 2
jne 0x4f2980
mov ecx, ebx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
test bl, 2
je 0x4f2920
mov word [edi], 0
add edi, 2
and ebx, 1
je 0x4f2928
mov byte [edi], 0
mov dword [edx], 0x6a09e667
mov dword [edx + 4], 0xbb67ae85
mov dword [edx + 8], 0x3c6ef372
mov dword [edx + 0xc], 0xa54ff53a
mov dword [edx + 0x10], 0x510e527f
mov dword [edx + 0x14], 0x9b05688c
mov dword [edx + 0x18], 0x1f83d9ab
mov dword [edx + 0x1c], 0x5be0cd19
mov dword [edx + 0x6c], 0x20
mov eax, 1
pop ebx
pop edi
ret
mov byte [edx], 0
lea edi, [edx + 1]
mov bl, 0x6f
test edi, 2
je 0x4f290a
mov word [edi], 0
add edi, 2
sub ebx, 2
jmp 0x4f290a
Function at 0x523460
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
push ebx
push ecx
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
test ebx, ebx
jle 0x52357c
lea edx, [ebp + 4]
mov dword [esp], 0
jmp 0x5234fc
mov al, byte [esi + 1]
and eax, 0xff
mov edi, eax
shl edi, 8
or ecx, edi
mov al, byte [esi + 2]
and eax, 0xff
or ecx, eax
mov ebp, edx
mov edi, ecx
shr edi, 0x12
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 4], al
mov edi, ecx
shr edi, 0xc
and edi, 0x3f
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 3], al
mov edi, ecx
shr edi, 6
and edi, 0x3f
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 2], al
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 1], cl
add dword [esp], 4
add esi, 3
sub ebx, 3
add edx, 4
test ebx, ebx
jle 0x523590
xor ecx, ecx
mov cl, byte [esi]
shl ecx, 0x10
cmp ebx, 2
jg 0x523490
cmp ebx, 2
je 0x523540
mov edi, ecx
shr edi, 0x12
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 4], al
shr ecx, 0xc
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 3], cl
mov cl, 0x3d
mov ebp, edx
mov byte [edx - 2], cl
mov byte [edx - 1], 0x3d
jmp 0x5234e7
mov al, byte [esi + 1]
and eax, 0xff
mov edi, eax
shl edi, 8
or edi, ecx
mov ecx, edi
shr ecx, 0x12
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 4], cl
mov ecx, edi
shr ecx, 0xc
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 3], cl
shr edi, 6
and edi, 0x3f
mov cl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x52352c
mov dword [esp], 0
lea esi, [esi]
lea edi, [edi]
mov byte [ebp], 0
mov eax, dword [esp]
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret