joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bdab8
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
dec ecx
shr ecx, 0x1f
dec ecx
mov edi, dword [edx + 4]
mov eax, dword [ebx + 4]
xor eax, edi
and eax, ecx
xor edi, eax
mov dword [edx + 4], edi
xor dword [ebx + 4], eax
mov edx, dword [edx]
mov eax, dword [ebx]
cmp esi, 0xa
jbe switch.0x004bdba0
mov ebx, 0xa
cmp esi, 0xa
jle case.0x4bdba0.10
lea esi, [esi]
lea edi, [edi]
mov edi, dword [edx + ebx*4]
xor edi, dword [eax + ebx*4]
and edi, ecx
mov ebp, dword [edx + ebx*4]
xor ebp, edi
mov dword [edx + ebx*4], ebp
xor dword [eax + ebx*4], edi
inc ebx
cmp ebx, esi
jne 0x4bdad0
mov esi, dword [edx + 0x24]
mov ebx, dword [eax + 0x24]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx + 0x24], esi
xor dword [eax + 0x24], ebx
mov esi, dword [edx + 0x20]
mov ebx, dword [eax + 0x20]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx + 0x20], esi
xor dword [eax + 0x20], ebx
mov esi, dword [edx + 0x1c]
mov ebx, dword [eax + 0x1c]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx + 0x1c], esi
xor dword [eax + 0x1c], ebx
mov esi, dword [edx + 0x18]
mov ebx, dword [eax + 0x18]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx + 0x18], esi
xor dword [eax + 0x18], ebx
mov esi, dword [edx + 0x14]
mov ebx, dword [eax + 0x14]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx + 0x14], esi
xor dword [eax + 0x14], ebx
mov esi, dword [edx + 0x10]
mov ebx, dword [eax + 0x10]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx + 0x10], esi
xor dword [eax + 0x10], ebx
mov esi, dword [edx + 0xc]
mov ebx, dword [eax + 0xc]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx + 0xc], esi
xor dword [eax + 0xc], ebx
mov esi, dword [edx + 8]
mov ebx, dword [eax + 8]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx + 8], esi
xor dword [eax + 8], ebx
mov esi, dword [edx + 4]
mov ebx, dword [eax + 4]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx + 4], esi
xor dword [eax + 4], ebx
mov esi, dword [edx]
mov ebx, dword [eax]
xor ebx, esi
and ebx, ecx
xor esi, ebx
mov dword [edx], esi
xor dword [eax], ebx
pop ebx
pop esi
pop edi
pop ebp
ret
jmp dword [esi*4 + 0x5e5b34]
Function at 0x4be940
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov esi, dword [esp + 0x70]
mov ebx, dword [esp + 0x74]
test esi, esi
je 0x4be98b
lea edi, [esp + 0x2c]
mov dword [esp + 4], edi
mov dword [esp], esi
call sub.msvcrt.dll__stat
test eax, eax
js 0x4be98b
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], 0x24
mov dword [esp], edi
call fcn.004bef50
test ebx, ebx
jne 0x4be9a0
xor edi, edi
mov eax, edi
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x5e65c4
mov dword [esp], esi
call sub.msvcrt.dll_fopen
mov ebp, eax
test eax, eax
je 0x4be98b
test word [esp + 0x32], 0x3000
je 0x4be9e8
cmp ebx, 0xffffffff
je 0x4beaa0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp], ebp
call sub.msvcrt.dll_setvbuf
xor edi, edi
test ebx, ebx
jle 0x4bea90
lea esi, [esi]
lea edi, [edi]
mov esi, ebx
cmp ebx, 0x400
jle 0x4bea0f
mov esi, 0x400
mov eax, esi
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], 0x65da20
call sub.msvcrt.dll_fread
test eax, eax
jle 0x4bea61
mov dword [esp + 0x1c], eax
fild dword [esp + 0x1c]
fstp qword [esp + 8]
mov dword [esp + 4], esi
mov dword [esp], 0x65da20
mov dword [esp + 0x18], eax
call fcn.004bef50
mov eax, dword [esp + 0x18]
add edi, eax
test ebx, ebx
jle 0x4bea90
sub ebx, esi
test ebx, ebx
jg 0x4bea00
mov dword [esp], ebp
call sub.msvcrt.dll_fclose
mov dword [esp + 4], 0x400
mov dword [esp], 0x65da20
call fcn.004dea90
mov eax, edi
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0x400
mov esi, 0x400
jmp 0x4bea11
mov ebx, 0x800
jmp 0x4be9c8

Function at 0x4bec00
Capabilities:
Query environment variable

Disassembly:
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x20]
call fcn.005095a0
test eax, eax
je 0x4beca0
xor ebx, ebx
call fcn.005095a0
test eax, eax
je 0x4bed00
test ebx, ebx
je 0x4bed16
cmp byte [ebx], 0
jne 0x4bec40
mov byte [esi], 0
mov eax, esi
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
add eax, 6
cmp dword [esp + 0x24], eax
jbe 0x4bec32
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.004cee60
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x5e65db
mov dword [esp], esi
call fcn.004ceed0
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], str..rnd
mov dword [esp], esi
call fcn.004ceed0
mov eax, esi
add esp, 0x14
pop ebx
pop esi
ret
mov dword [esp], str.RANDFILE
call sub.msvcrt.dll_getenv
mov ebx, eax
test eax, eax
je 0x4bec18
cmp byte [eax], 0
je 0x4bec18
mov dword [esp], eax
call sub.msvcrt.dll_strlen
inc eax
cmp eax, dword [esp + 0x24]
jae 0x4bec18
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.004cee60
cmp dword [esp + 0x24], eax
ja 0x4bec35
xor esi, esi
jmp 0x4bec35
mov dword [esp], str.HOME
call sub.msvcrt.dll_getenv
mov ebx, eax
test ebx, ebx
jne 0x4bec2d
mov ebx, 0x5e65ca
jmp 0x4bec2d
Function at 0x4c3910
Capabilities:
Query environment variable

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [esp + 0x40]
mov dword [esp], 0
call fcn.00510250
mov ebx, eax
test eax, eax
je 0x4c39c0
test esi, esi
je 0x4c39d0
mov ebp, esi
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], ebx
call fcn.005102f0
test eax, eax
jle 0x4c3990
mov eax, dword [esp + 0x48]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.004c3390
test esi, esi
je 0x4c3a00
mov dword [esp], ebx
mov dword [esp + 0x1c], eax
call fcn.005102b0
mov eax, dword [esp + 0x1c]
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [esp + 0x48], 0x10
jne 0x4c39a0
xor eax, eax
jmp 0x4c396b
call fcn.004b25b0
and eax, 0xfff
cmp eax, 0x72
jne 0x4c3997
call fcn.004b1c20
mov eax, 1
jmp 0x4c396b
xor eax, eax
xor ebp, ebp
jmp 0x4c396b
mov dword [esp], str.OPENSSL_CONF
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4c3a20
mov dword [esp], eax
call fcn.004cebc0
mov ebp, eax
test eax, eax
jne 0x4c393b
xor eax, eax
xor ebp, ebp
lea esi, [esi]
lea edi, [edi]
mov dword [esp], ebp
mov dword [esp + 0x1c], eax
call fcn.004b8660
mov eax, dword [esp + 0x1c]
jmp 0x4c3973
call fcn.0050f0d0
mov dword [esp], eax
call sub.msvcrt.dll_strlen
lea edi, [eax + 0xd]
mov dword [esp + 8], 0x231
mov dword [esp + 4], str.conf_mod.c
mov dword [esp], edi
call fcn.004b8170
mov ebp, eax
test eax, eax
je 0x4c39f2
call fcn.0050f0d0
mov dword [esp + 8], edi
mov dword [esp + 4], eax
mov dword [esp], ebp
call fcn.004cee60
mov dword [esp + 8], edi
mov dword [esp + 4], 0x5e6b57
mov dword [esp], ebp
call fcn.004ceed0
mov dword [esp + 8], edi
mov dword [esp + 4], str.openssl.cnf
mov dword [esp], ebp
call fcn.004ceed0
jmp 0x4c393b
Function at 0x4c78a0
Capabilities:
Hash data with md5

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov edi, edx
mov ebx, 0x5c
test dl, 1
jne 0x4c7900
test edi, 2
jne 0x4c7910
mov ecx, ebx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
test bl, 2
je 0x4c78d0
mov word [edi], 0
add edi, 2
and ebx, 1
je 0x4c78d8
mov byte [edi], 0
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov eax, 1
pop ebx
pop edi
ret
mov byte [edx], 0
lea edi, [edx + 1]
mov bl, 0x5b
test edi, 2
je 0x4c78ba
mov word [edi], 0
add edi, 2
sub ebx, 2
jmp 0x4c78ba

Function at 0x4c7b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
xor eax, eax
xor ebx, ebx
cmp edx, 0
je 0x4c7c63
mov al, byte [edi]
mov bl, byte [edi + 4]
add edi, 8
lea ecx, [esi + edx]
sub ebp, esi
mov dword [esp + 0x18], ecx
inc al
cmp dword [edi + 0x100], 0xffffffff
je 0x4c7c30
mov ecx, dword [edi + eax*4]
and edx, 0xfffffffc
je 0x4c7c00
lea edx, [esi + edx - 4]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], ebp
lea esi, [esi]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
mov ecx, dword [edi + eax*4]
mov ebp, dword [edi + edx*4]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
ror ebp, 8
mov ecx, dword [edi + eax*4]
or ebp, dword [edi + edx*4]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
ror ebp, 8
mov ecx, dword [edi + eax*4]
or ebp, dword [edi + edx*4]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
ror ebp, 8
mov ecx, dword [esp + 0x20]
or ebp, dword [edi + edx*4]
ror ebp, 8
xor ebp, dword [esi]
cmp esi, dword [esp + 0x1c]
mov dword [ecx + esi], ebp
lea esi, [esi + 4]
mov ecx, dword [edi + eax*4]
jb 0x4c7b60
cmp esi, dword [esp + 0x18]
je 0x4c7c5b
mov ebp, dword [esp + 0x20]
nop
lea esi, [esi]
add bl, cl
mov edx, dword [edi + ebx*4]
mov dword [edi + ebx*4], ecx
mov dword [edi + eax*4], edx
add edx, ecx
inc al
and edx, 0xff
mov edx, dword [edi + edx*4]
xor dl, byte [esi]
lea esi, [esi + 1]
mov ecx, dword [edi + eax*4]
cmp esi, dword [esp + 0x18]
mov byte [ebp + esi - 1], dl
jb 0x4c7c00
jmp 0x4c7c5b
movzx ecx, byte [edi + eax]
add bl, cl
movzx edx, byte [edi + ebx]
mov byte [edi + ebx], cl
mov byte [edi + eax], dl
add dl, cl
movzx edx, byte [edi + edx]
add al, 1
xor dl, byte [esi]
lea esi, [esi + 1]
movzx ecx, byte [edi + eax]
cmp esi, dword [esp + 0x18]
mov byte [ebp + esi - 1], dl
jb 0x4c7c34
dec al
mov byte [edi - 4], bl
mov byte [edi - 8], al
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4c9fc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x20]
test esi, esi
je 0x4ca180
mov eax, dword [esi + 0x14]
mov edx, dword [esi + 0x1c]
test edx, edx
jne 0x4ca170
lea edi, [esi + 4]
mov ebx, dword [esi]
test ebx, ebx
je 0x4ca160
lea esi, [esi]
mov eax, dword [ebx]
test eax, eax
je 0x4c9ffe
mov dword [esp], ebx
call fcn.004bcb40
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x4ca010
lea eax, [ebx + 0x14]
mov dword [esp], eax
call fcn.004bcb40
mov eax, dword [ebx + 0x28]
test eax, eax
je 0x4ca022
lea eax, [ebx + 0x28]
mov dword [esp], eax
call fcn.004bcb40
mov eax, dword [ebx + 0x3c]
test eax, eax
je 0x4ca034
lea eax, [ebx + 0x3c]
mov dword [esp], eax
call fcn.004bcb40
mov eax, dword [ebx + 0x50]
test eax, eax
je 0x4ca046
lea eax, [ebx + 0x50]
mov dword [esp], eax
call fcn.004bcb40
mov ecx, dword [ebx + 0x64]
test ecx, ecx
je 0x4ca058
lea eax, [ebx + 0x64]
mov dword [esp], eax
call fcn.004bcb40
mov edx, dword [ebx + 0x78]
test edx, edx
je 0x4ca06a
lea eax, [ebx + 0x78]
mov dword [esp], eax
call fcn.004bcb40
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0x4ca082
lea eax, [ebx + 0x8c]
mov dword [esp], eax
call fcn.004bcb40
mov eax, dword [ebx + 0xa0]
test eax, eax
je 0x4ca09a
lea eax, [ebx + 0xa0]
mov dword [esp], eax
call fcn.004bcb40
mov eax, dword [ebx + 0xb4]
test eax, eax
je 0x4ca0b2
lea eax, [ebx + 0xb4]
mov dword [esp], eax
call fcn.004bcb40
mov eax, dword [ebx + 0xc8]
test eax, eax
je 0x4ca0ca
lea eax, [ebx + 0xc8]
mov dword [esp], eax
call fcn.004bcb40
mov eax, dword [ebx + 0xdc]
test eax, eax
je 0x4ca0e2
lea eax, [ebx + 0xdc]
mov dword [esp], eax
call fcn.004bcb40
mov eax, dword [ebx + 0xf0]
test eax, eax
je 0x4ca0fa
lea eax, [ebx + 0xf0]
mov dword [esp], eax
call fcn.004bcb40
mov ecx, dword [ebx + 0x104]
test ecx, ecx
je 0x4ca112
lea eax, [ebx + 0x104]
mov dword [esp], eax
call fcn.004bcb40
mov edx, dword [ebx + 0x118]
test edx, edx
je 0x4ca12a
lea eax, [ebx + 0x118]
mov dword [esp], eax
call fcn.004bcb40
mov eax, dword [ebx + 0x12c]
test eax, eax
je 0x4ca142
add ebx, 0x12c
mov dword [esp], ebx
call fcn.004bcb40
mov eax, dword [esi]
mov edx, dword [eax + 0x144]
mov dword [edi], edx
mov dword [esp], eax
call fcn.004b8660
mov ebx, dword [edi]
mov dword [esi], ebx
test ebx, ebx
jne 0x4c9ff0
mov dword [esp + 0x20], esi
add esp, 0x10
pop ebx
pop esi
pop edi
jmp fcn.004b8660
mov dword [esp], eax
call fcn.004b8660
jmp 0x4c9fe0
add esp, 0x10
pop ebx
pop esi
pop edi
ret

Function at 0x4cdfc0
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x4ce010
movsx eax, byte [ebx]
test al, al
je 0x4ce010
xor edx, edx
mov esi, 0x100
nop
lea esi, [esi]
or eax, esi
add esi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
rol edx, cl
imul eax, eax
xor edx, eax
inc ebx
movsx eax, byte [ebx]
test al, al
jne 0x4cdfe0
mov eax, edx
shr eax, 0x10
xor eax, edx
pop ebx
pop esi
ret
xor eax, eax
pop ebx
pop esi
ret
Function at 0x4d0960
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ebx, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
mov dword [esp + 0x2c], eax
mov edx, dword [esp + 0x68]
mov dword [esp + 0x28], edx
mov edi, dword [ebx + 8]
test edi, edi
jne 0x4d09a0
mov dword [esp + 0x68], edx
mov dword [esp + 0x64], eax
mov dword [esp + 0x60], ebx
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.004d0460
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
cmp eax, 0x20
ja 0x4d0b30
cmp dword [esp + 0x24], 1
je 0x4d0b10
mov edi, dword [ebx + 0xc]
test byte [ebx + 0x5d], 1
jne 0x4d0af0
mov edx, dword [esp + 0x24]
sub edx, edi
mov dword [esp + 0x30], edx
cmp dword [esp + 0x24], edi
jbe 0x4d0ab9
mov cl, byte [esp + 0x30]
mov eax, edi
not eax
mov edx, dword [esp + 0x24]
lea ebp, [edx + eax + 1]
lea esi, [edi + 0x30]
mov dword [esp + 0x34], esi
mov edx, esi
add edx, ebx
neg edx
and edx, 3
cmp edx, ebp
jbe 0x4d0a04
mov edx, ebp
mov esi, dword [esp + 0x24]
lea eax, [esi + eax + 1]
cmp eax, 6
ja 0x4d0a13
mov edx, eax
mov dword [esp + 0x20], edi
test edx, edx
je 0x4d0a39
mov eax, edi
lea esi, [esi]
mov byte [ebx + eax + 0x30], cl
inc eax
mov esi, eax
sub esi, edi
cmp edx, esi
ja 0x4d0a20
mov dword [esp + 0x20], eax
cmp ebp, edx
je 0x4d0ab9
sub ebp, edx
mov dword [esp + 0x38], ebp
mov edi, ebp
shr edi, 2
mov eax, edi
shl eax, 2
mov dword [esp + 0x3c], eax
je 0x4d0b8e
xor esi, esi
mov eax, esi
mov al, cl
mov ah, byte [esp + 0x30]
mov esi, eax
mov al, cl
and eax, 0xff
mov ebp, eax
shl eax, 0x10
and esi, 0xffff
shl ebp, 0x18
or esi, eax
or esi, ebp
add edx, dword [esp + 0x34]
lea ebp, [ebx + edx]
xor edx, edx
mov eax, dword [esp + 0x20]
lea esi, [esi]
lea edi, [edi]
mov dword [ebp + edx*4], esi
inc edx
cmp edi, edx
ja 0x4d0a90
mov edx, dword [esp + 0x3c]
add eax, edx
mov dword [esp + 0x20], eax
cmp dword [esp + 0x38], edx
je 0x4d0ab9
mov edx, dword [esp + 0x24]
lea esi, [esi]
mov byte [ebx + eax + 0x30], cl
inc eax
cmp edx, eax
ja 0x4d0ab0
mov eax, dword [ebx]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xc], ecx
lea edx, [ebx + 0x30]
mov dword [esp + 8], edx
mov esi, dword [esp + 0x2c]
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x18]
test eax, eax
je 0x4d0b03
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [ecx], esi
jmp 0x4d0b03
test edi, edi
jne 0x4d0b5b
mov esi, dword [esp + 0x28]
mov dword [esi], 0
mov eax, 1
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [esp + 0x28]
mov dword [ecx], 0
mov eax, 1
jmp 0x4d0b03
mov dword [esp + 8], str.b___sizeof_ctx__buf
mov dword [esp + 4], 0x163
mov dword [esp], str.evp_enc.c
call fcn.004d2910
mov edi, dword [ebx + 0xc]
test byte [ebx + 0x5d], 1
je 0x4d09ca
jmp 0x4d0af0
mov dword [esp + 0x10], 0x16e
mov dword [esp + 0xc], str.evp_enc.c
mov dword [esp + 8], 0x8a
mov dword [esp + 4], 0x7f
mov dword [esp], 6
call fcn.004b2280
xor eax, eax
jmp 0x4d0b03
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
jmp 0x4d0ab0
Function at 0x4d2520
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x65e07c]
test eax, eax
je 0x4d2530
ret
sub esp, 0x1c
mov dword [0x65e07c], 1
mov dword [esp], str.OPENSSL_ia32cap
call sub.msvcrt.dll_getenv
test eax, eax
je 0x4d2580
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.msvcrt.dll_strtoul
or ah, 4
mov dword [0x65e04c], eax
add esp, 0x1c
ret
call fcn.004de820
or ah, 4
mov dword [0x65e04c], eax
jmp 0x4d256d

Function at 0x4d27b0
Capabilities:
Access the windows event log

Disassembly:
push esi
push ebx
sub esp, 0x144
mov dword [esp], 0xfffffff4
call sub.KERNEL32.dll_GetStdHandle
push edx
test eax, eax
je 0x4d27da
mov dword [esp], eax
call sub.KERNEL32.dll_GetFileType
push esi
test eax, eax
jne 0x4d28d0
lea eax, [esp + 0x154]
mov dword [esp + 0x38], eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x150]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xff
lea ebx, [esp + 0x40]
mov dword [esp], ebx
call sub.msvcrt.dll__vsnprintf
mov byte [esp + 0x13f], 0
call sub.KERNEL32.dll_GetVersion
test eax, eax
js 0x4d28a0
call fcn.004d2650
test eax, eax
jle 0x4d28a0
mov dword [esp + 4], str.OPENSSL
mov dword [esp], 0
call sub.ADVAPI32.DLL_RegisterEventSourceA
sub esp, 8
mov esi, eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x20], 0
lea eax, [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.ADVAPI32.DLL_ReportEventA
sub esp, 0x24
mov dword [esp], esi
call sub.ADVAPI32.DLL_DeregisterEventSource
push ebx
add esp, 0x144
pop ebx
pop esi
ret
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.OpenSSL:_FATAL
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
add esp, 0x144
pop ebx
pop esi
ret
lea eax, [esp + 0x154]
mov dword [esp + 0x38], eax
mov dword [esp + 8], eax
mov eax, dword [esp + 0x150]
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sub.msvcrt.dll_vfprintf
add esp, 0x144
pop ebx
pop esi
ret

Function at 0x4d2fc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x4d3047
mov edi, dword [esp + 0x1c]
shr edi, 2
lea edx, [edi*4]
mov eax, esi
or eax, ecx
test al, 3
sete bl
cmp dword [esp + 0x1c], 8
seta al
test bl, al
je 0x4d304b
test edx, edx
je 0x4d304b
xor eax, eax
xor ebp, ebp
nop
mov ebx, dword [esi + eax*4]
xor ebx, dword [ecx + eax*4]
or ebp, ebx
inc eax
cmp edi, eax
ja 0x4d3000
mov ebx, ebp
movzx eax, bh
shr ebx, 0x10
or eax, ebp
or eax, ebx
shr ebp, 0x18
or eax, ebp
cmp dword [esp + 0x1c], edx
je 0x4d303d
mov edi, dword [esp + 0x1c]
nop
lea esi, [esi]
mov bl, byte [esi + edx]
xor bl, byte [ecx + edx]
or eax, ebx
inc edx
cmp edi, edx
ja 0x4d3030
and eax, 0xff
pop ebx
pop esi
pop edi
pop ebp
ret
xor eax, eax
jmp 0x4d3042
xor eax, eax
xor edx, edx
mov edi, dword [esp + 0x1c]
jmp 0x4d3030
Function at 0x4f2090
Capabilities:
Hash data using sha1

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov edi, edx
mov ebx, 0x60
test dl, 1
jne 0x4f2100
test edi, 2
jne 0x4f2110
mov ecx, ebx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
test bl, 2
je 0x4f20c0
mov word [edi], 0
add edi, 2
and ebx, 1
je 0x4f20c8
mov byte [edi], 0
mov dword [edx], 0x67452301
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
mov eax, 1
pop ebx
pop edi
ret
mov byte [edx], 0
lea edi, [edx + 1]
mov bl, 0x5f
test edi, 2
je 0x4f20aa
mov word [edi], 0
add edi, 2
sub ebx, 2
jmp 0x4f20aa

Function at 0x4f2450
Capabilities:
Hash data using sha224

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov edi, edx
mov ebx, 0x70
test dl, 1
jne 0x4f24d0
test edi, 2
jne 0x4f24e0
mov ecx, ebx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
test bl, 2
je 0x4f2480
mov word [edi], 0
add edi, 2
and ebx, 1
je 0x4f2488
mov byte [edi], 0
mov dword [edx], 0xc1059ed8
mov dword [edx + 4], 0x367cd507
mov dword [edx + 8], 0x3070dd17
mov dword [edx + 0xc], 0xf70e5939
mov dword [edx + 0x10], 0xffc00b31
mov dword [edx + 0x14], 0x68581511
mov dword [edx + 0x18], 0x64f98fa7
mov dword [edx + 0x1c], 0xbefa4fa4
mov dword [edx + 0x6c], 0x1c
mov eax, 1
pop ebx
pop edi
ret
mov byte [edx], 0
lea edi, [edx + 1]
mov bl, 0x6f
test edi, 2
je 0x4f246a
mov word [edi], 0
add edi, 2
sub ebx, 2
jmp 0x4f246a

Function at 0x4f24f0
Capabilities:
Hash data using sha256

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov edi, edx
mov ebx, 0x70
test dl, 1
jne 0x4f2570
test edi, 2
jne 0x4f2580
mov ecx, ebx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
test bl, 2
je 0x4f2520
mov word [edi], 0
add edi, 2
and ebx, 1
je 0x4f2528
mov byte [edi], 0
mov dword [edx], 0x6a09e667
mov dword [edx + 4], 0xbb67ae85
mov dword [edx + 8], 0x3c6ef372
mov dword [edx + 0xc], 0xa54ff53a
mov dword [edx + 0x10], 0x510e527f
mov dword [edx + 0x14], 0x9b05688c
mov dword [edx + 0x18], 0x1f83d9ab
mov dword [edx + 0x1c], 0x5be0cd19
mov dword [edx + 0x6c], 0x20
mov eax, 1
pop ebx
pop edi
ret
mov byte [edx], 0
lea edi, [edx + 1]
mov bl, 0x6f
test edi, 2
je 0x4f250a
mov word [edi], 0
add edi, 2
sub ebx, 2
jmp 0x4f250a
Function at 0x523060
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
push ebx
push ecx
mov ebp, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
test ebx, ebx
jle 0x52317c
lea edx, [ebp + 4]
mov dword [esp], 0
jmp 0x5230fc
mov al, byte [esi + 1]
and eax, 0xff
mov edi, eax
shl edi, 8
or ecx, edi
mov al, byte [esi + 2]
and eax, 0xff
or ecx, eax
mov ebp, edx
mov edi, ecx
shr edi, 0x12
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 4], al
mov edi, ecx
shr edi, 0xc
and edi, 0x3f
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 3], al
mov edi, ecx
shr edi, 6
and edi, 0x3f
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 2], al
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 1], cl
add dword [esp], 4
add esi, 3
sub ebx, 3
add edx, 4
test ebx, ebx
jle 0x523190
xor ecx, ecx
mov cl, byte [esi]
shl ecx, 0x10
cmp ebx, 2
jg 0x523090
cmp ebx, 2
je 0x523140
mov edi, ecx
shr edi, 0x12
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 4], al
shr ecx, 0xc
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 3], cl
mov cl, 0x3d
mov ebp, edx
mov byte [edx - 2], cl
mov byte [edx - 1], 0x3d
jmp 0x5230e7
mov al, byte [esi + 1]
and eax, 0xff
mov edi, eax
shl edi, 8
or edi, ecx
mov ecx, edi
shr ecx, 0x12
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 4], cl
mov ecx, edi
shr ecx, 0xc
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 3], cl
shr edi, 6
and edi, 0x3f
mov cl, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x52312c
mov dword [esp], 0
lea esi, [esi]
lea edi, [edi]
mov byte [ebp], 0
mov eax, dword [esp]
pop edx
pop ebx
pop esi
pop edi
pop ebp
ret