joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45f3c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60ebe9
mov eax, dword fs:[0]
push eax
sub esp, 0xf4
mov eax, dword [0x6a0f4c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x28], esp
lea eax, [ebp + 8]
push eax
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov dword [ebp - 0xf4], eax
mov ecx, 0x6a32e8
call fcn.0045afb0
mov dword [ebp - 0xf8], eax
mov ecx, dword [ebp - 0xf8]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0
je 0x45f48e
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2c], esp
lea edx, [ebp + 8]
push edx
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov dword [ebp - 0xfc], eax
mov ecx, 0x6a32ac
call fcn.0045ae70
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x45f48e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp - 0x24]
sub eax, dword [ecx]
xor edx, edx
mov ecx, dword [ebp - 0x20]
add eax, dword [ecx]
mov ecx, dword [ecx + 4]
adc ecx, edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x1c]
or edx, dword [ebp - 0x18]
jne 0x45f4a4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x45fd70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x60ece3
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x6a0f4c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x14]
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x10], eax
mov ecx, dword [ebp + 8]
add ecx, 0x14
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x14
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x30]
mov dword [edx + 0x30], ecx
mov eax, dword [eax + 0x34]
mov dword [edx + 0x34], eax
mov ecx, dword [ebp + 8]
add ecx, 0x38
push ecx
mov ecx, dword [ebp - 0x14]
add ecx, 0x38
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
add edx, 0x54
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
add eax, 0x54
push eax
mov ecx, dword [ebp - 0x10]
call fcn.00462a30
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov al, byte [edx + 0x74]
mov byte [ecx + 0x74], al
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x78]
mov dword [ecx + 0x78], eax
mov edx, dword [edx + 0x7c]
mov dword [ecx + 0x7c], edx
mov eax, dword [ebp + 8]
add eax, 0x80
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x80
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x48c380
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
movzx edi, byte [esp + 0x10]
mov eax, edi
and eax, 1
add esi, ecx
add edx, ecx
test ecx, ecx
je 0x48c3b5
push ebx
lea esp, [esp]
movzx ebx, byte [edx - 1]
dec edx
xor ebx, edi
add eax, ebx
dec esi
dec ecx
mov byte [esi], al
shr eax, 8
test ecx, ecx
jne 0x48c3a0
pop ebx
pop edi
pop esi
ret

Function at 0x48e0d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x48e117
mov al, byte [edx]
test al, al
je 0x48e117
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x48e0e7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x48e120
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
test esi, esi
je 0x48e17a
mov al, byte [esi]
test al, al
je 0x48e17a
push ebx
mov ebx, 0x100
jmp 0x48e140
movsx eax, al
push eax
call fcn.0048f4e0
or eax, ebx
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add esp, 4
rol edi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [esi + 1]
inc esi
xor edi, ecx
add ebx, 0x100
test al, al
jne 0x48e140
mov eax, edi
shr eax, 0x10
pop ebx
xor eax, edi
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x48e4f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
ret
Function at 0x490fe0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.005fffa0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
xor edi, edi
call fcn.0047f3e0
mov ebx, eax
push ebx
push esi
call fcn.0047f550
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x49106c
push 0xf0000040
push 1
push edi
push edi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x491046
mov ecx, dword [esp + 0x10]
push ebp
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x491039
mov edi, ebx
mov edx, dword [esp + 0x10]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.0047f5c0
push esi
call fcn.0047f280
mov edi, eax
add esp, 0x10
test edi, edi
jbe 0x49106c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 1
push esi
call fcn.0047f3e0
mov ebx, eax
push ebx
push esi
call fcn.0047f550
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x4910de
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
push edi
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4910c4
mov edx, dword [esp + 0x10]
push ebp
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x4910b7
mov edi, ebx
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea ecx, [edi*8]
push ecx
push edi
push esi
call fcn.0047f5c0
push esi
call fcn.0047f280
add esp, 0x10
mov edi, eax
test edi, edi
ja 0x491064
push esi
call fcn.0047f280
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4920f0
Capabilities:
Allocate thread local storage

Disassembly:
push 0
push 0
push 0
call fcn.0048efb0
add esp, 0xc
test eax, eax
jne 0x492105
xor eax, eax
ret
push 0
push 0x6a59e4
call fcn.0048e4d0
add esp, 8
test eax, eax
je 0x492102
push ebx
push 0
push 0x6a59e8
call fcn.0048e4d0
add esp, 8
test eax, eax
je 0x492195
mov eax, dword [0x6a59f4]
mov ecx, dword [0x69d4e0]
push esi
push eax
push ecx
xor ecx, ecx
lea ebx, [ecx + 1]
call fcn.00491ef0
mov esi, eax
add esp, 8
test esi, esi
je 0x49217d
push esi
call fcn.00491d60
add esp, 4
test eax, eax
jne 0x492167
push esi
call fcn.00491390
add esp, 4
xor esi, esi
jmp 0x49217d
push 0x1c
push str.OpenSSL_NIST_SP_800_90A_DRBG
mov dword [esi + 0x58], ebx
push esi
mov dword [esi + 0x5c], ebx
call fcn.00491410
add esp, 0xc
mov dword [0x6a59ec], esi
test esi, esi
pop esi
jne 0x4921a6
push 0x6a59e8
call fcn.0048e540
add esp, 4
push 0x6a59e4
call fcn.0048e540
add esp, 4
xor eax, eax
pop ebx
ret
mov eax, ebx
pop ebx
ret
Function at 0x49a200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, edi
mov ecx, ebp
cmp edi, 4
jb 0x49a228
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x49a230
sub esi, 4
add ecx, 4
add edx, 4
cmp esi, 4
jae 0x49a214
test esi, esi
je case.0x49a2f0.2
movzx eax, byte [edx]
movzx ebx, byte [ecx]
sub eax, ebx
jne 0x49a277
cmp esi, 1
jbe case.0x49a2f0.2
movzx eax, byte [edx + 1]
movzx ebx, byte [ecx + 1]
sub eax, ebx
jne 0x49a277
cmp esi, 2
jbe case.0x49a2f0.2
movzx eax, byte [edx + 2]
movzx ebx, byte [ecx + 2]
sub eax, ebx
jne 0x49a277
cmp esi, 3
jbe case.0x49a2f0.2
movzx eax, byte [edx + 3]
movzx ecx, byte [ecx + 3]
sub eax, ecx
sar eax, 0x1f
or eax, 1
jle case.0x49a2f0.2
mov ebx, dword [esp + 0x10]
xor edx, edx
test edi, edi
jle 0x49a2a0
mov esi, ebx
mov eax, ebp
sub esi, ebp
mov cl, byte [esi + eax]
cmp cl, byte [eax]
jne 0x49a2a0
inc edx
inc eax
cmp edx, edi
jl 0x49a293
lea eax, [edi - 1]
test eax, eax
jl 0x49a2c1
mov esi, ebx
lea ecx, [eax + ebp]
sub esi, ebp
mov edi, edi
cmp byte [ecx + esi], 0
jne 0x49a2c1
cmp byte [ecx], 0xff
jne 0x49a2c1
dec eax
dec ecx
test eax, eax
jge 0x49a2b0
cmp edx, eax
jl case.0x49a2f0.2
jle 0x49a2d2
pop esi
pop ebp
lea eax, [edx*8]
pop ebx
ret
mov cl, byte [edx + ebx]
mov bl, byte [edx + ebp]
mov al, bl
xor al, cl
mov byte [esp + 0x10], cl
movzx ecx, al
dec ecx
cmp ecx, 0x7e
ja case.0x49a2f0.2
movzx ecx, byte [ecx + 0x49a360]
jmp dword [ecx*4 + 0x49a340]
mov esi, 7
jmp 0x49a326
mov esi, 6
jmp 0x49a326
mov esi, 5
jmp 0x49a326
mov esi, 4
jmp 0x49a326
mov esi, 3
jmp 0x49a326
mov esi, 2
jmp 0x49a326
mov esi, 1
test byte [esp + 0x10], al
jne case.0x49a2f0.2
and bl, al
cmp bl, al
jne case.0x49a2f0.2
lea eax, [esi + edx*8]
pop esi
pop ebp
pop ebx
ret
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret

Function at 0x4aa950
Capabilities:
Set socket configuration

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
push esi
lea ecx, [esp + 0xc]
push ecx
push 0x8004667e
push edx
mov dword [esp + 0x18], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jge 0x4aa991
push 0xc3
push str.crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call fcn.0047de20
add esp, 0x14
xor eax, eax
test esi, esi
sete al
pop esi
ret
Function at 0x4b50d0
Capabilities:
Check if file exists

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
push esi
push edi
call fcn.004f19a0
push 0x62
push esi
mov ebx, eax
mov ebp, 1
call dword [sym.imp.MSVCR90.dll_strchr]
add esp, 0x10
test eax, eax
jne 0x4b50fd
lea ebp, [eax + 0x11]
test ebx, ebx
jne 0x4b5186
push 0x45
push str.crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.0047de20
push 0x6373d8
push esi
push 0x6373d4
push edi
push str.fopen_
push 5
call fcn.0047e3d0
mov esi, dword [sym.imp.MSVCR90.dll__errno]
add esp, 0x2c
call esi
cmp dword [eax], 2
je 0x4b5167
call esi
cmp dword [eax], 6
je 0x4b5167
push 0x4e
push str.crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.0047de20
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x4c
push str.crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.0047de20
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x637378
call fcn.00483e30
mov esi, eax
add esp, 4
test esi, esi
jne 0x4b51aa
push ebx
call dword [sym.imp.MSVCR90.dll_fclose]
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x8000
push esi
call fcn.00484050
push ebx
push ebp
push 0x6a
push esi
call fcn.004846e0
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x4b5da0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret

Function at 0x4b8e90
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x4c1520
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
cmp edi, eax
je 0x4c15ab
mov edx, dword [esp + 8]
lea ecx, [edx - 1]
not edx
shr edx, 0x1f
push esi
mov esi, dword [edi + 4]
shr ecx, 0x1f
and ecx, edx
mov edx, dword [eax + 4]
xor edx, esi
dec ecx
and edx, ecx
xor esi, edx
mov dword [edi + 4], esi
xor dword [eax + 4], edx
mov esi, dword [edi + 0xc]
mov edx, dword [eax + 0xc]
xor edx, esi
and edx, ecx
xor esi, edx
mov dword [edi + 0xc], esi
xor dword [eax + 0xc], edx
mov esi, dword [edi + 0x10]
mov edx, dword [eax + 0x10]
xor edx, esi
and edx, ecx
and edx, 4
xor esi, edx
mov dword [edi + 0x10], esi
xor dword [eax + 0x10], edx
xor esi, esi
cmp dword [esp + 0x18], esi
jle 0x4c15aa
push ebx
push ebp
mov edx, dword [edi]
mov ebx, dword [edx + esi*4]
lea ebp, [edx + esi*4]
mov edx, dword [eax]
mov edx, dword [edx + esi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + esi*4], edx
lea ebx, [ebx + esi*4]
inc esi
cmp esi, dword [esp + 0x20]
jl 0x4c1583
pop ebp
pop ebx
pop esi
pop edi
ret

Function at 0x4c1870
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
test byte [eax + 0x10], 4
mov ecx, dword [eax + 4]
push esi
lea esi, [ecx - 1]
je 0x4c188b
pop esi
mov dword [esp + 4], eax
jmp fcn.004c10e0
test ecx, ecx
jne 0x4c1893
xor eax, eax
pop esi
ret
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
push ecx
call fcn.004c1050
shl esi, 5
add esp, 4
add eax, esi
pop esi
ret
Function at 0x4cb1b0
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x208
call fcn.005fffa0
mov eax, dword [0x6a0f4c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x4cb226
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4cb226
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x204]
push 0x200
push edx
call dword [sym.imp.MSVCR90.dll__vsnprintf]
add esp, 0x10
test eax, eax
jge 0x4cb209
mov eax, 0x200
push 0
lea ecx, [ebp - 0x208]
push ecx
push eax
lea edx, [ebp - 0x204]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4cb36f
mov ebx, dword [ebp + 8]
mov eax, ebx
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4cb230
sub eax, edx
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.00600250
mov esi, esp
test esi, esi
jne 0x4cb254
mov esi, str.no_stack_
jmp 0x4cb2df
push edi
push esi
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x4cb281
test edi, edi
jbe 0x4cb281
lea ebx, [ebx]
mov ecx, dword [ebp + 8]
movsx dx, byte [eax + ecx]
mov word [esi + eax*2], dx
inc eax
cmp eax, edi
jb 0x4cb270
xor eax, eax
test edi, edi
jbe 0x4cb2df
cmp word [esi + eax*2], 0x25
jne case.0x4cb2a4.43
lea ecx, [esi + eax*2 + 2]
movzx edx, word [ecx]
add edx, 0xffffffd6
cmp edx, 0x49
ja case.0x4cb2a4.43
movzx edx, byte [edx + 0x4cb3a0]
jmp dword [edx*4 + 0x4cb388]
inc eax
add ecx, 2
jmp 0x4cb292
mov ecx, 0x53
mov word [esi + eax*2 + 2], cx
jmp case.0x4cb2a4.43
mov edx, 0x73
jmp 0x4cb2d5
mov ecx, 0x43
mov word [esi + eax*2 + 2], cx
jmp case.0x4cb2a4.43
mov edx, 0x63
mov word [esi + eax*2 + 2], dx
inc eax
cmp eax, edi
jb 0x4cb287
lea eax, [ebp + 0xc]
push eax
push esi
lea ecx, [ebp - 0x204]
push 0xff
push ecx
call dword [sym.imp.MSVCR90.dll__vsnwprintf]
xor edx, edx
add esp, 0x10
mov word [ebp - 6], dx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4cb359
call fcn.004cb070
test eax, eax
jle 0x4cb359
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x4cb36f
push 0
lea ecx, [ebp - 0x208]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x204]
push esi
mov dword [ebp - 0x208], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x4cb36f
push 0x10
push str.OpenSSL:_FATAL
lea edx, [ebp - 0x204]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005fff12
mov esp, ebp
pop ebp
ret

Function at 0x4cb420
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x4cb448
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
sub esi, eax
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
or cl, dl
inc eax
sub edi, 1
jne 0x4cb437
pop esi
pop ebx
movzx eax, cl
pop edi
ret
Function at 0x4d81b9
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
cmp ebp, 2
je 0x4d822f
test eax, eax
je 0x4d81fb
push eax
push 0
lea eax, [esp + 0x20]
push eax
push 0
call fcn.004946f0
add esp, 0x10
cmp dword [esp + 0x18], 0xffffffff
je 0x4d81fb
push 0x3b
push str.cryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call fcn.0047de20
add esp, 0x14
pop esi
xor eax, eax
pop ebp
ret
cmp dword [esp + 0x14], 0
je 0x4d822b
cmp edi, 0x40a
je 0x4d8222
cmp edi, 0x43f
je 0x4d8222
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x4d8227
mov eax, 0x20
cmp esi, eax
je 0x4d822f
push 0x41
jmp 0x4d81e0
push ebx
push 0x46
push str.cryptoececx_meth.c
push 0x40
call fcn.0048e6a0
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x4d8265
push 0x48
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.0047de20
add esp, 0x14
pop ebx
pop esi
xor eax, eax
pop ebp
ret
test ebp, ebp
jne 0x4d827d
mov ecx, dword [esp + 0x18]
push esi
push ecx
push ebx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
jmp case.0x4d83ae.1036
cmp edi, 0x40a
je 0x4d829d
cmp edi, 0x43f
je 0x4d829d
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x4d82a2
mov eax, 0x20
push 0x50
push str.cryptoececx_meth.c
push eax
call fcn.00490f50
mov esi, eax
add esp, 0xc
mov dword [ebx + 0x3c], esi
test esi, esi
jne 0x4d82d5
push 0x52
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.0047de20
add esp, 0x14
jmp 0x4d8328
cmp ebp, 2
jne 0x4d8368
cmp edi, 0x40a
je 0x4d82fe
cmp edi, 0x43f
je 0x4d82fe
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x4d8303
mov eax, 0x20
push eax
push esi
call fcn.0047fc90
add esp, 8
test eax, eax
jg 0x4d833e
push 0x57
push str.cryptoececx_meth.c
push esi
call fcn.00490f70
add esp, 0xc
mov dword [ebx + 0x3c], 0
push 0x79
push str.cryptoececx_meth.c
push ebx
call fcn.0048e710
add esp, 0xc
pop ebx
pop esi
xor eax, eax
pop ebp
ret
cmp edi, 0x40a
jne 0x4d8357
mov dl, byte [esi + 0x1f]
and byte [esi], 0xf8
and dl, 0x3f
or dl, 0x40
mov byte [esi + 0x1f], dl
jmp 0x4d839c
cmp edi, 0x40b
jne 0x4d839c
and byte [esi], 0xfc
or byte [esi + 0x37], 0x80
jmp 0x4d839c
cmp edi, 0x40a
je 0x4d8388
cmp edi, 0x43f
je 0x4d8388
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x4d838d
mov eax, 0x20
push eax
mov eax, dword [esp + 0x1c]
push eax
push esi
call sub.MSVCR90.dll_memcpy
add esp, 0xc
lea eax, [edi - 0x40a]
cmp eax, 0x36
ja case.0x4d83ae.1036
movzx ecx, byte [eax + 0x4d8408]
jmp dword [ecx*4 + 0x4d83f4]
push esi
push ebx
call fcn.00527130
jmp 0x4d83d7
push esi
push ebx
call fcn.00527060
jmp 0x4d83d7
push esi
push ebx
call fcn.00519ac0
jmp 0x4d83d7
push esi
push ebx
call fcn.005178c0
add esp, 8
mov edx, dword [esp + 0x10]
push ebx
push edi
push edx
call fcn.00480de0
add esp, 0xc
pop ebx
pop esi
mov eax, 1
pop ebp
ret