joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42c2f0
Capabilities:
Check http status code

Disassembly:
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebx
mov ebx, dword [edi]
mov eax, edx
push ebp
mov ebp, dword [esp + 0xc]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x42c326
push str.Couldnt_set_desired_mode
push ebx
call fcn.0040cc30
add esp, 8
lea eax, [esi + 0x11]
pop esi
pop ebp
pop ebx
ret
cmp ecx, 0xc8
je 0x42c33d
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.0040cba0
add esp, 0xc
cmp ebp, 0x13
jne 0x42c351
push edi
call fcn.0042c270
add esp, 4
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x14
jne 0x42c365
push edi
call fcn.004292c0
add esp, 4
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x15
jne 0x42c37d
push 0xd
push 1
push edi
call fcn.0042b630
add esp, 0xc
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x16
jne 0x42c391
push 0xe
push 1
push edi
call fcn.0042b630
add esp, 0xc
mov esi, eax
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x42ec70
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x5b46a4]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.0054cf48
add esp, 4
mov byte [esp], 0
test eax, eax
je 0x42ecd5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x42ecd5
lea edx, [esp]
push edx
call dword [0x5b44cc]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0053a230
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.0053a230
add esp, 0x108
ret

Function at 0x4309f0
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x430a12
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x430a06
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x430a42
cmp dword [esi + 8], 0
jne 0x430a35
mov ecx, dword [eax + 8]
push 0x5ad124
push ecx
call fcn.0054400d
add esp, 8
mov dword [esi + 8], eax
test eax, eax
jne 0x430a35
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.005468fe
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x430a64
mov eax, dword [esi + 8]
test eax, eax
je 0x430a5e
push eax
call fcn.005464cc
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x431370
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1ec]
test esi, esi
jne 0x431389
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.0040c740
push edx
push eax
call fcn.0040c770
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x1e0], 0
je 0x4313d6
mov eax, dword [ebx + 0x148]
mov ecx, dword [ebx + 0x144]
push eax
push ecx
call fcn.0040c740
push edx
push eax
call fcn.0040c770
mov ecx, dword [edi + 0x1e0]
sub ecx, eax
add esp, 0x10
mov eax, ecx
cmp esi, ecx
jge 0x4313d8
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x433760
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [esi + edi - 1], 0
test eax, eax
jne 0x433792
push 0x2e
push esi
call fcn.0053d970
add esp, 8
test eax, eax
je 0x433790
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret
Function at 0x4357a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x5b44c0]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4357c5
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x43580c
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x435810
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x43586c
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
inc ebx
call edx
add esp, 0x18
dec ebp
jne 0x435833
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
cmp eax, dword [esi + 0x10]
jae 0x4358a8
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x56f73f
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x56f740
push eax
call ecx
mov eax, dword [esp + 0x20]
inc eax
add esp, 0x18
mov dword [esp + 8], eax
cmp eax, dword [esi + 0x10]
jb 0x435877
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x436750
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.0053a250
mov eax, dword [0x5b46a4]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x3c], 0
test esi, esi
jne 0x436797
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.0053a230
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call fcn.0054caee
add esp, 8
test eax, eax
js 0x436780
mov eax, 8
call fcn.0053a250
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.004365c0
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x436780
push 0x5ad124
push esi
call fcn.0054400d
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
je 0x436871
jmp 0x4367f4
mov eax, dword [esp + 0x40]
test ebx, ebx
jle 0x436802
mov esi, ebx
cmp ebx, 0x400
jl 0x436807
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x80]
push 1
push edx
call fcn.005468fe
mov edi, eax
add esp, 0x10
mov dword [esp + 0x44], edi
test edi, edi
jle 0x436855
fild dword [esp + 0x44]
mov eax, 8
call fcn.0053a250
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.004365c0
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x4367f0
sub ebx, esi
test ebx, ebx
jg 0x4367f0
mov ecx, dword [esp + 0x40]
push ecx
call fcn.005464cc
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.004c7a50
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0053a230
mov esp, ebp
pop ebp
ret
Function at 0x440ea0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
mov edx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
dec ecx
push edi
mov edi, dword [esi + 4]
shr ecx, 0x1f
xor edx, edi
dec ecx
and edx, ecx
xor edi, edx
mov dword [esi + 4], edi
xor dword [eax + 4], edx
lea edx, [ebx - 1]
cmp edx, 9
ja case.default.0x440ed2
jmp dword [edx*4 + 0x440ffc]
mov edi, 0xa
cmp ebx, edi
jle case.0x440ed2.10
push ebp
mov edx, dword [esi]
mov ebx, dword [edx + edi*4]
lea ebp, [edx + edi*4]
mov edx, dword [eax]
mov edx, dword [edx + edi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + edi*4], edx
lea ebx, [ebx + edi*4]
inc edi
cmp edi, dword [esp + 0x20]
jl 0x440ee3
pop ebp
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x24]
mov edx, dword [edx + 0x24]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x24], edi
mov edi, dword [eax]
xor dword [edi + 0x24], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x20]
mov edx, dword [edx + 0x20]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x20], edi
mov edi, dword [eax]
xor dword [edi + 0x20], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x1c]
mov edx, dword [edx + 0x1c]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x1c], edi
mov edi, dword [eax]
xor dword [edi + 0x1c], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x18]
mov edx, dword [edx + 0x18]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x18], edi
mov edi, dword [eax]
xor dword [edi + 0x18], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x14]
mov edx, dword [edx + 0x14]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x14], edi
mov edi, dword [eax]
xor dword [edi + 0x14], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x10]
mov edx, dword [edx + 0x10]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x10], edi
mov edi, dword [eax]
xor dword [edi + 0x10], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0xc]
mov edx, dword [edx + 0xc]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0xc], edi
mov edi, dword [eax]
xor dword [edi + 0xc], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 8]
mov edx, dword [edx + 8]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 8], edi
mov edi, dword [eax]
xor dword [edi + 8], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 4]
mov edx, dword [edx + 4]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 4], edi
mov edi, dword [eax]
xor dword [edi + 4], edx
mov esi, dword [esi]
mov edx, dword [eax]
mov edi, dword [esi]
mov edx, dword [edx]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [esi], edi
mov eax, dword [eax]
xor dword [eax], edx
pop edi
pop esi
pop ebx
ret
Function at 0x441de0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.0053bcd0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret

Function at 0x441e20
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.0053bcd0
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
mov eax, 1
pop esi
ret

Function at 0x441e80
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.0053bcd0
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
pop esi
ret
Function at 0x447620
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.0053a250
mov eax, dword [0x5b46a4]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x447685
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x447685
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.005234d5
add eax, 0x40
push eax
call fcn.0055dcfb
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0053a230
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.0055dd2c
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x447714
call fcn.004474e0
test eax, eax
jle 0x447714
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0053a230
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0053a230
add esp, 0x108
ret

Function at 0x447770
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
je 0x447792
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
dec edi
jne 0x447786
pop esi
movzx eax, cl
pop edi
ret

Function at 0x449890
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x4498d4
mov al, byte [edx]
test al, al
je 0x4498d4
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
inc edx
xor esi, eax
mov al, byte [edx]
test al, al
jne 0x4498a7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x44b060
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24
call fcn.0053a250
mov eax, dword [0x5b46a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, esi
push edi
mov dword [ebp - 0x18], esi
lea ecx, [eax + 1]
jmp 0x44b090
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x44b090
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
sub eax, ecx
lea edi, [eax + 1]
push edi
push esi
push 8
push 0xfde9
mov dword [ebp - 0x20], 8
call ebx
mov esi, eax
test esi, esi
jg 0x44b108
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ec
jne 0x44b0ea
mov ecx, dword [ebp - 0x18]
push 0
push 0
push edi
push ecx
push 0
push 0xfde9
mov dword [ebp - 0x20], 0
call ebx
mov esi, eax
test esi, esi
jg 0x44b108
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x44b19a
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push edx
push eax
jmp 0x44b188
lea eax, [esi + esi]
call fcn.0053a6c0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov eax, esp
push esi
push eax
push edi
push ecx
push edx
push 0xfde9
mov dword [ebp - 0x24], eax
call ebx
test eax, eax
je 0x44b19a
mov esi, dword [ebp - 0x1c]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x44b133
push 8
sub eax, edx
lea ecx, [ebp - 0x14]
push ecx
inc eax
push eax
push esi
push 0
push 0xfde9
call ebx
test eax, eax
je 0x44b19a
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.00543feb
mov esi, eax
add esp, 8
test esi, esi
jne 0x44b23e
call fcn.0053fcda
cmp dword [eax], 2
je 0x44b180
call fcn.0053fcda
cmp dword [eax], 9
jne 0x44b19a
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push ecx
push edx
call fcn.0054400d
mov esi, eax
add esp, 8
test esi, esi
jne 0x44b23e
push 0xa8
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.004380c0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0x589c6c
push eax
push 0x589c68
push ecx
push str.fopen_
push 5
call fcn.004383b0
add esp, 0x2c
call fcn.0053fcda
cmp dword [eax], 2
jne 0x44b210
push 0xab
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.004380c0
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053a230
mov esp, ebp
pop ebp
ret
push 0xad
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.004380c0
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053a230
mov esp, ebp
pop ebp
ret
push 0x5b54f0
call fcn.00438d40
mov edi, eax
add esp, 4
test edi, edi
jne 0x44b270
push esi
call fcn.005464cc
add esp, 4
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053a230
mov esp, ebp
pop ebp
ret
push 0
push edi
call fcn.00438690
push esi
push 1
push 0x6a
push edi
call fcn.00438a80
add esp, 0x18
mov eax, edi
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0053a230
mov esp, ebp
pop ebp
ret
Function at 0x466300
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
lea eax, [ecx + 1]
ret

Function at 0x4663a0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x476910
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x4769f3
push esi
mov esi, dword [esp + 0x14]
inc esi
lea ebx, [ebx]
movzx edx, byte [esi - 1]
cmp edi, 3
jl 0x47698d
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], dl
jmp 0x4769de
shl edx, 0x10
cmp edi, 2
jne 0x47699d
movzx eax, byte [esi]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
cmp edi, 1
jne 0x4769ca
lea edx, [edi + 0x3c]
jmp 0x4769d7
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], dl
mov byte [ecx + 3], 0x3d
sub edi, 3
add ecx, 4
add ebp, 4
add esi, 3
test edi, edi
jg 0x476930
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x478f80
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.0053a250
mov eax, dword [0x5b46a4]
xor eax, esp
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x2c]
dec ebx
push edi
mov edi, dword [esp + 0x38]
mov dword [esp + 8], ecx
lea ecx, [ebx - 0x29]
mov dword [esp + 0xc], edx
cmp edi, ecx
jle 0x478fe3
push 0x2c
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.004380c0
add esp, 0x14
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0053a230
add esp, 0x20
ret
cmp ebx, 0x29
jge 0x479010
push 0x31
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.004380c0
add esp, 0x14
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0053a230
add esp, 0x20
ret
push ebp
push esi
push 0
mov byte [eax], 0
lea esi, [eax + 1]
lea ebp, [eax + 0x15]
call fcn.00448ad0
mov edx, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x1c]
push 0
push ebp
push edx
push eax
call fcn.00447d70
add esp, 0x18
test eax, eax
je 0x4790a9
mov ecx, ebx
sub ecx, edi
sub ecx, 0x29
push ecx
lea edx, [ebp + 0x14]
push 0
push edx
call fcn.0053bcd0
mov ecx, dword [esp + 0x1c]
mov eax, ebp
sub eax, edi
add eax, ebx
push edi
mov byte [eax - 0x15], 1
push ecx
add eax, 0xffffffec
push eax
call fcn.0053b750
push 0x14
push esi
call fcn.00436630
add esp, 0x20
test eax, eax
jle 0x4790a9
push 0x47
add ebx, 0xffffffec
push str..crypto_rsa_rsa_oaep.c
push ebx
call fcn.0043b030
mov edi, eax
add esp, 0xc
mov dword [esp + 0x14], edi
test edi, edi
jne 0x4790be
push 0x49
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.004380c0
add esp, 0x14
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.0053a230
add esp, 0x20
ret
push 0x14
push esi
push ebx
push edi
call fcn.00478f50
add esp, 0x10
test eax, eax
js 0x4790a9
test ebx, ebx
jle 0x4790e9
mov eax, ebp
sub edi, ebp
mov ecx, ebx
lea esp, [esp]
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x4790e0
call fcn.00448ad0
push eax
push ebx
push ebp
lea eax, [esp + 0x24]
push 0x14
push eax
call fcn.00478dd0
add esp, 0x14
test eax, eax
js 0x4790a9
lea ecx, [esp + 0x18]
lea edi, [esp + 0x19]
lea ebp, [esp + 0x1a]
lea edx, [esp + 0x1b]
sub ecx, esi
sub edi, esi
sub ebp, esi
sub edx, esi
lea ebx, [esp + 0x1c]
sub ebx, esi
mov eax, esi
mov dword [esp + 0x10], ebx
mov esi, 4
lea ecx, [ecx]
movzx ebx, byte [ecx + eax]
xor byte [eax], bl
movzx ebx, byte [edi + eax]
xor byte [eax + 1], bl
movzx ebx, byte [eax + ebp]
xor byte [eax + 2], bl
movzx ebx, byte [edx + eax]
xor byte [eax + 3], bl
mov ebx, dword [esp + 0x10]
movzx ebx, byte [ebx + eax]
xor byte [eax + 4], bl
add eax, 5
dec esi
jne 0x479130
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0043b1e0
mov ecx, dword [esp + 0x30]
add esp, 4
lea eax, [esi + 1]
pop esi
pop ebp
pop edi
pop ebx
xor ecx, esp
call fcn.0053a230
add esp, 0x20
ret