joyce8/EMBER2024-capa huggingface dataset:
Function at 0x500f30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f2390
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [0x6707bc]
push ebx
mov dword [esp + 0x10], eax
xor ebx, ebx
mov dword [esp + 0xc], eax
mov dword [esp + 0x28], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], eax
push ebx
lea eax, [esp + 0x1c]
push ebx
lea ecx, [esp + 0x24]
push eax
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x20]
push edx
push eax
push ecx
mov byte [esp + 0x44], 3
call fcn.005033a0
add esp, 0x1c
test eax, eax
je 0x50105b
push ebx
lea edx, [esp + 0x34]
push ebx
lea eax, [esp + 0x1c]
push edx
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x44]
lea edx, [esp + 0x18]
push ecx
push edx
push eax
call fcn.005033a0
add esp, 0x1c
test eax, eax
je 0x50105b
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ecx
push edx
call fcn.0052d867
add esp, 8
test eax, eax
jne 0x50105b
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call fcn.0052d867
add esp, 8
test eax, eax
jne 0x50105b
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push esi
push edx
mov edx, dword [esp + 0x24]
push eax
push ecx
push edx
call fcn.005035e0
add esp, 0x10
lea ecx, [esp + 8]
mov esi, eax
mov byte [esp + 0x2c], 2
call fcn.005bc421
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 1
call fcn.005bc421
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], bl
call fcn.005bc421
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.005bc421
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret
lea ecx, [esp + 4]
mov byte [esp + 0x28], 2
call fcn.005bc421
lea ecx, [esp + 8]
mov byte [esp + 0x28], 1
call fcn.005bc421
lea ecx, [esp + 0xc]
mov byte [esp + 0x28], bl
call fcn.005bc421
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], 0xffffffff
call fcn.005bc421
mov ecx, dword [esp + 0x20]
xor eax, eax
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x5010b0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, 1
cmp esi, eax
jl 0x5010d9
mov ecx, dword [esp + 8]
push ebx
mov bl, byte [ecx]
mov edx, eax
and edx, 3
mov dl, byte [esp + edx + 0x14]
xor bl, dl
inc eax
mov byte [ecx], bl
inc ecx
cmp eax, esi
jle 0x5010c3
pop ebx
pop esi
ret

Function at 0x5010e0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push edi
lea eax, [esp + 4]
push 4
push eax
call fcn.004927e0
mov edi, dword [esp + 0x18]
add esp, 8
xor eax, eax
test edi, edi
jbe 0x501123
push ebx
push esi
mov esi, dword [esp + 0x14]
mov ecx, eax
mov dl, byte [esi]
and ecx, 3
mov bl, byte [esp + ecx + 0xc]
lea ecx, [esp + ecx + 0xc]
xor bl, dl
inc eax
inc esi
cmp eax, edi
mov byte [ecx], bl
jb 0x501101
mov eax, dword [esp + 0xc]
pop esi
pop ebx
pop edi
pop ecx
ret
mov eax, dword [esp + 4]
pop edi
pop ecx
ret
Function at 0x501210
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
xor edx, edx
test esi, esi
jle 0x50123e
mov eax, dword [esp + 0x10]
push ebx
push edi
mov edi, dword [esp + 0x10]
xor ecx, ecx
mov cl, byte [edx + edi]
mov ebx, ecx
mov ecx, edx
and ecx, 0xf
shl ebx, cl
xor eax, ebx
inc edx
cmp edx, esi
jl 0x501225
pop edi
pop ebx
pop esi
ret
mov eax, dword [esp + 0x10]
pop esi
ret
Function at 0x501820
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebx
call fcn.00492700
add esp, 4
test eax, eax
jne 0x50188a
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, 1
jne 0x50188a
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebx
call fcn.00492830
add esp, 4
mov edi, eax
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x501882
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
call fcn.00492720
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebx
ret

Function at 0x501b50
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x64
mov edx, dword [esp + 0x68]
mov ecx, 0x19
xor eax, eax
push esi
push edi
lea edi, [esp + 8]
push eax
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x78]
lea eax, [esp + 0xc]
push eax
push ecx
push edx
mov ecx, 0x6756e0
call fcn.004ba7e0
mov al, byte [esp + 8]
lea esi, [esp + 8]
test al, al
je 0x501ba0
and eax, 0xff
push eax
call fcn.00530122
add esp, 4
mov byte [esi], al
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x501b88
mov eax, 0x98543643
lea ecx, [esp + 8]
mov edx, 8
mov esi, dword [ecx]
add ecx, 4
xor eax, esi
dec edx
jne 0x501bae
pop edi
pop esi
add esp, 0x64
ret

Function at 0x502830
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x50289e
cmp si, 0x69
ja 0x50289e
add esi, 0xffd0
cmp si, 0x11
je 0x50286e
push 0x11
call edi
test ax, ax
jge 0x50286e
or esi, 0x2000
cmp si, 0x10
je 0x502883
push 0x10
call edi
test ax, ax
jge 0x502883
or esi, 0x4000
cmp si, 0x12
je 0x502898
push 0x12
call edi
test ax, ax
jge 0x502898
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x5028ab
mov esi, 0xbd
jmp 0x50285f
cmp si, 0x6e
jne 0x5028b8
mov esi, 0xbe
jmp 0x50285f
cmp si, 0x6f
jne 0x502859
mov esi, 0xbf
jmp 0x50285f
Function at 0x511a80
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f3028
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push esi
lea ecx, [esp + 4]
call fcn.004918b0
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 4]
mov dword [esp + 0x20], 0
push eax
push esi
push ecx
call fcn.00511640
add esp, 0xc
test eax, eax
je 0x511afe
push eax
push 0x6761a0
call fcn.00486c20
add esp, 8
lea ecx, [esp + 4]
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 4], 0x5f7940
call fcn.00491ab0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
mov eax, ecx
push esi
neg eax
sbb eax, eax
push ecx
and eax, edx
mov edx, dword [esp + 0x30]
push eax
push edx
call fcn.0050c900
add esp, 0x10
lea ecx, [esp + 4]
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 4], 0x5f7940
call fcn.00491ab0
mov ecx, dword [esp + 0x18]
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x20
ret

Function at 0x512320
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f3130
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
push esi
push edi
push 0x400
lea ecx, [esp + 0xc]
call fcn.005c7a55
push 0
push 0x1000
lea eax, [esp + 0x10]
push 0
push eax
lea ecx, [esp + 0x40]
mov dword [esp + 0x8c], 0
call fcn.005c4459
mov esi, dword [esp + 0x84]
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
mov byte [esp + 0x80], 1
call fcn.004618e0
lea edx, [esp + 0x30]
mov ecx, esi
push edx
call fcn.00461ad0
lea ecx, [esp + 0x30]
call fcn.005c45bd
lea ecx, [esp + 8]
call fcn.005c1d29
lea ecx, [esp + 8]
mov esi, eax
call fcn.005c7b08
lea ecx, [esp + 0x84]
mov edi, eax
mov eax, dword [esp + 0x8c]
push 2
push ecx
mov ecx, 0x676278
mov dword [esp + 0x8c], eax
call fcn.00492170
lea eax, [esp + 0x84]
lea edx, [esi + 4]
push 4
push eax
mov ecx, 0x676278
mov dword [esp + 0x8c], edx
call fcn.00492170
mov ecx, dword [esp + 0x88]
lea edx, [esp + 0x84]
mov dword [esp + 0x84], ecx
push 4
push edx
mov ecx, 0x676278
call fcn.00492170
push esi
push edi
mov ecx, 0x676278
call fcn.00492170
push edi
call fcn.0052daf7
add esp, 4
lea ecx, [esp + 0x30]
mov byte [esp + 0x7c], 0
call fcn.005c4535
lea ecx, [esp + 8]
mov dword [esp + 0x7c], 0xffffffff
call fcn.005c7b1a
mov ecx, dword [esp + 0x74]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x78
ret 0xc
Function at 0x518e60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5f3c98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
push esi
push edi
mov edi, ecx
mov eax, SysReAllocString
lea ecx, [esp + 0x2c]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.004918b0
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
lea edx, [esp + 0x30]
push ecx
push edx
mov ecx, edi
mov dword [esp + 0x54], 0
call fcn.00518d20
mov eax, dword [esp + 0x3c]
test eax, eax
je 0x518fb8
mov eax, dword [esp + 8]
push 0
test eax, eax
push 0
jne 0x518ee5
mov ecx, dword [edi + 0x4c]
add ecx, 0x14
call fcn.004f4110
jmp 0x518ef1
mov ecx, dword [edi + 0x4c]
push eax
add ecx, 0x14
call fcn.004f4200
test eax, eax
je 0x518fb8
lea esi, [eax + 0x18]
push esi
call fcn.00492830
add esi, eax
push esi
call fcn.00492830
add esi, eax
add esp, 8
mov esi, dword [esi]
test esi, esi
je 0x518fb8
mov eax, dword [esp + 8]
test eax, eax
jne 0x518f2f
lea eax, [esp + 0x1c]
mov ecx, edi
push eax
call fcn.0051d600
jmp 0x518f3e
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
sub eax, ecx
sub eax, esi
mov esi, dword [esp + 0xc]
add eax, esi
cdq
sub eax, edx
mov edx, dword [esp + 0x20]
mov ecx, eax
mov eax, dword [esp + 0x28]
sar ecx, 1
sub ecx, esi
mov esi, dword [esp + 0x18]
sub eax, edx
sub eax, esi
mov esi, dword [esp + 0x10]
add eax, esi
cdq
sub eax, edx
mov edx, dword [esp + 0x50]
sar eax, 1
sub eax, esi
cmp edx, 0x202004f
jne 0x518f8a
xor eax, eax
jmp 0x518f94
cmp edx, 0x2020050
jne 0x518f94
xor ecx, ecx
and eax, 0xffff
and ecx, 0xffff
shl eax, 0x10
or eax, ecx
mov ecx, edi
push eax
lea eax, [esp + 0x30]
push eax
push 0
push 0x202003d
call fcn.005173d0
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x2c], 0x5f7940
call fcn.00491ab0
mov ecx, dword [esp + 0x40]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x44
ret 4
Function at 0x51e020
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x44
push esi
lea eax, [esp + 4]
push 0x44
mov esi, ecx
push eax
call fcn.004927e0
add esp, 8
lea ecx, [esi + 0x64]
mov eax, dword [esi + 0x5c]
lea edx, [esp + 4]
push ecx
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
mov dword [esp + 0x2c], 0x44
mov dword [esi + 0x404], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x51e080
push 0x670348
call fcn.004ff630
add esp, 4
xor eax, eax
pop esi
add esp, 0x44
ret
push 0
push 0
push 0
push 0
push esi
push 0x51dfc0
call fcn.005c1174
mov eax, 1
pop esi
add esp, 0x44
ret

Function at 0x53a13e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x672f60
cmp edx, dword [eax]
je 0x53a160
add eax, 8
inc ecx
cmp eax, 0x672ff0
jl 0x53a151
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x672f60]
jne 0x53a28e
mov eax, dword [0x684974]
cmp eax, 1
je 0x53a268
test eax, eax
jne 0x53a191
cmp dword [0x671dc4], 1
je 0x53a268
cmp edx, 0xfc
je 0x53a28e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x53a1c8
lea eax, [ebp - 0x1a4]
push 0x605be4
push eax
call fcn.00534f10
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0052de80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x53a20b
lea eax, [ebp - 0x1a4]
push eax
call fcn.0052de80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x66f960
push edi
call fcn.0052ed40
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x605bc8
push eax
call fcn.00534f10
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00534f20
lea eax, [ebp - 0xa0]
push 0x605bc4
push eax
call fcn.00534f20
push dword [esi + 0x672f64]
lea eax, [ebp - 0xa0]
push eax
call fcn.00534f20
push 0x12010
lea eax, [ebp - 0xa0]
push 0x605b9c
push eax
call fcn.0053c58b
add esp, 0x2c
pop edi
jmp 0x53a28e
lea eax, [ebp + 8]
lea esi, [esi + 0x672f64]
push 0
push eax
push dword [esi]
call fcn.0052de80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x53f310
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x53f332
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push ebx
sub ecx, eax
mov dl, byte [ecx + eax]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec esi
jne 0x53f324
pop ebx
pop esi
ret
Function at 0x541300
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xc
xor eax, eax
xor ecx, ecx
mov cl, byte [eax + str.80_]
inc eax
cmp eax, 0x38
mov dl, byte [ecx + 0x68abe4]
mov byte [eax + 0x68abab], dl
jl 0x541305
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0x68a8ac
mov eax, dword [esp + 0x10]
mov ecx, dword [0x68abac]
and ecx, 0xff
xor edx, edx
mov al, byte [eax + 0x673794]
mov dl, byte [0x68abad]
mov ebp, eax
xor esi, esi
and ebp, 0xff
mov eax, ebp
neg eax
lea edi, [eax + 0x1c]
test edi, edi
jle 0x54138a
lea ebx, [ebp + 0x68abac]
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x14]
inc esi
mov bl, byte [ebx]
mov byte [esi + 0x68abab], bl
mov ebx, dword [esp + 0x14]
inc ebx
cmp esi, edi
mov dword [esp + 0x14], ebx
jl 0x541370
mov esi, dword [esp + 0x10]
cmp byte [esi + 0x673794], 2
jne 0x5413a5
mov byte [0x68abc6], cl
mov byte [0x68abc7], dl
jmp 0x5413ab
mov byte [0x68abc7], cl
mov edx, dword [0x68abc8]
mov ecx, 0x1c
lea esi, [eax + 0x38]
and edx, 0xff
xor ebx, ebx
cmp esi, ecx
mov bl, byte [0x68abc9]
jle 0x5413e0
lea ebp, [ebp + 0x68abc8]
mov al, byte [ebp]
mov byte [ecx + 0x68abac], al
inc ecx
inc ebp
cmp ecx, esi
jl 0x5413d1
mov ecx, dword [esp + 0x10]
cmp byte [ecx + 0x673794], 2
jne 0x5413fb
mov byte [0x68abe2], dl
mov byte [0x68abe3], bl
jmp 0x541401
mov byte [0x68abe3], dl
mov ecx, dword [esp + 0x18]
xor eax, eax
xor edx, edx
mov dl, byte [eax + 0x6737dc]
inc eax
cmp eax, 0x30
mov dl, byte [edx + 0x68abac]
mov byte [ecx + eax - 1], dl
jl 0x541407
mov esi, dword [esp + 0x10]
add ecx, 0x30
inc esi
cmp ecx, 0x68abac
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], ecx
jl 0x541333
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x542f80
Capabilities:
Hash data using sha256

Disassembly:
mov eax, 0xd8
call fcn.0052df00
push esi
mov esi, dword [esp + 0xe8]
xor eax, eax
cmp esi, eax
jne 0x542f9d
mov esi, 0x68ad7c
mov ecx, dword [esp + 0xe0]
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0xd4], eax
mov eax, dword [esp + 0xe4]
lea edx, [esp + 4]
push eax
push ecx
push edx
mov dword [esp + 0x10], 0xf3bcc908
mov dword [esp + 0x14], 0x6a09e667
mov dword [esp + 0x18], 0x84caa73b
mov dword [esp + 0x1c], 0xbb67ae85
mov dword [esp + 0x20], 0xfe94f82b
mov dword [esp + 0x24], 0x3c6ef372
mov dword [esp + 0x28], 0x5f1d36f1
mov dword [esp + 0x2c], 0xa54ff53a
mov dword [esp + 0x30], 0xade682d1
mov dword [esp + 0x34], 0x510e527f
mov dword [esp + 0x38], 0x2b3e6c1f
mov dword [esp + 0x3c], 0x9b05688c
mov dword [esp + 0x40], 0xfb41bd6b
mov dword [esp + 0x44], 0x1f83d9ab
mov dword [esp + 0x48], 0x137e2179
mov dword [esp + 0x4c], 0x5be0cd19
mov dword [esp + 0xe4], 0x40
call fcn.00542e60
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00542ba0
lea ecx, [esp + 0x18]
push 0xd8
push ecx
call fcn.00552020
add esp, 0x1c
mov eax, esi
pop esi
add esp, 0xd8
ret
Function at 0x547e70
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.0052df00
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x547edc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x547edc
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x104]
push pe_nt_image_headers32
push edx
call fcn.005b6f10
add esp, 0x10
test eax, eax
jge 0x547ebc
mov eax, pe_nt_image_headers32
lea ecx, [ebp - 4]
push 0
push ecx
lea edx, [ebp - 0x104]
push eax
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x104]
push 0xff
push edx
call fcn.005b6f10
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x547f59
call fcn.00547d60
test eax, eax
jle 0x547f59
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x547f6f
lea ecx, [ebp - 4]
push 0
push ecx
push 0
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
push 0x10
lea edx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x547f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
push ecx
push edx
push str._s__d_:_OpenSSL_internal_error__assertion_failed:__s_n
call fcn.00547e70
push 0x16
call fcn.0053c896
add esp, 0x14
push 3
call fcn.0052f3fa
nop
nop
nop
nop
nop
nop

Function at 0x547fb0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 4
call fcn.0052df00
push edi
mov edi, dword [esp + 0x14]
xor cl, cl
test edi, edi
mov byte [esp + 4], cl
jbe 0x547fe8
mov eax, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0x18]
sub esi, eax
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
or cl, dl
inc eax
dec edi
jne 0x547fd5
pop esi
mov byte [esp + 8], cl
pop ebx
mov eax, dword [esp + 4]
pop edi
and eax, 0xff
pop ecx
ret
Function at 0x59e607
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x80
call fcn.0052df00
push ebx
mov ebx, dword [esp + 0x88]
push ebp
mov ebp, dword [esp + 0x94]
mov eax, dword [ebx]
push esi
mov esi, dword [esp + 0x9c]
xor ecx, ecx
test esi, esi
push edi
je 0x59e5cf
cmp esi, eax
je 0x59e5c6
mov eax, dword [esp + 0x98]
test eax, eax
je 0x59e780
test ebp, ebp
jl 0x59e780
mov ecx, 1
mov dword [ebx], esi
jmp 0x59e5e0
test eax, eax
je 0x59e780
mov dword [esp + 0xa0], eax
mov esi, eax
mov eax, dword [esp + 0x98]
test eax, eax
je 0x59e6c6
push esi
call fcn.005677f0
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x59e616
push str.j____int_sizeof_ctx__key_
push 0x74
push str..cryptohmachmac.c
call fcn.00547f80
add esp, 0xc
cmp edi, ebp
jge 0x59e66c
mov eax, dword [esp + 0xa4]
lea edi, [ebx + 4]
push eax
push esi
push edi
call fcn.0056b520
add esp, 0xc
test eax, eax
je 0x59e780
mov ecx, dword [esp + 0x98]
push ebp
push ecx
push edi
call fcn.0056b6e0
add esp, 0xc
test eax, eax
je 0x59e780
lea esi, [ebx + 0x4c]
lea edx, [ebx + 0x50]
push esi
push edx
push edi
call fcn.0056b800
add esp, 0xc
test eax, eax
je 0x59e780
jmp 0x59e69f
test ebp, ebp
jl 0x59e780
cmp ebp, 0x80
jg 0x59e780
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov eax, ecx
lea edi, [ebx + 0x50]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x4c]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x80
je 0x59e6ce
mov ecx, 0x80
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x50]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
jmp 0x59e6ce
test ecx, ecx
je 0x59e75c
xor eax, eax
mov cl, byte [ebx + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x59e6d0
mov ebp, dword [esp + 0xa4]
mov edi, dword [esp + 0xa0]
lea esi, [ebx + 0x1c]
push ebp
push edi
push esi
call fcn.0056b520
add esp, 0xc
test eax, eax
je 0x59e780
push edi
call fcn.005677f0
lea edx, [esp + 0x14]
push eax
push edx
push esi
call fcn.0056b6e0
add esp, 0x10
test eax, eax
je 0x59e780
xor eax, eax
mov cl, byte [ebx + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x59e71e
lea esi, [ebx + 0x34]
push ebp
push edi
push esi
call fcn.0056b520
add esp, 0xc
test eax, eax
je 0x59e780
push edi
call fcn.005677f0
lea edx, [esp + 0x14]
push eax
push edx
push esi
call fcn.0056b6e0
add esp, 0x10
test eax, eax
je 0x59e780
lea eax, [ebx + 0x1c]
add ebx, 4
push eax
push ebx
call fcn.0056b8a0
add esp, 8
test eax, eax
je 0x59e780
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x80
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x80
ret
Function at 0x5a5630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.0052df00
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
xor eax, eax
mov ebx, dword [esi + 0x160]
mov dword [esi], eax
mov dword [esi + 8], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x38], eax
cmp edi, 0xc
mov dword [ebp - 4], ebx
mov dword [esi + 4], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x16c], eax
mov dword [esi + 0x168], eax
jne 0x5a56a8
mov eax, dword [ebp + 0xc]
mov ecx, esi
mov edi, 1
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov eax, dword [eax + 8]
mov byte [esi + 0xf], 1
mov dword [ecx + 8], eax
jmp 0x5a57bb
cmp edi, 0x10
mov dword [ebp - 0xc], edi
jb 0x5a56f1
mov eax, edi
shr eax, 4
mov dword [ebp + 8], eax
mov ecx, dword [ebp + 0xc]
mov eax, esi
sub ecx, esi
mov edx, 0x10
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec edx
jne 0x5a56c4
mov ebx, dword [ebp - 4]
lea ecx, [esi + 0x60]
push ecx
push esi
call ebx
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
add esp, 8
add edx, 0x10
sub edi, 0x10
dec eax
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], eax
jne 0x5a56b8
xor eax, eax
cmp edi, eax
je 0x5a5711
jbe 0x5a5707
mov ecx, dword [ebp + 0xc]
mov eax, esi
sub ecx, esi
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec edi
jne 0x5a56fe
lea eax, [esi + 0x60]
push eax
push esi
call ebx
add esp, 8
mov eax, dword [ebp - 0xc]
mov ecx, 3
xor edx, edx
call fcn.0053c3e0
mov edi, edx
mov dl, byte [esi + 8]
mov ecx, edi
mov ebx, eax
mov al, byte [esi + 9]
mov dword [ebp - 8], edi
shr ecx, 0x18
xor dl, cl
mov cl, byte [esi + 0xa]
mov byte [esi + 8], dl
mov edx, edi
shr edx, 0x10
xor al, dl
mov dl, byte [esi + 0xb]
mov byte [esi + 9], al
mov eax, edi
shr eax, 8
xor cl, al
mov eax, ebx
mov byte [esi + 0xa], cl
mov cl, byte [ebp - 8]
xor dl, cl
mov ecx, 0x18
mov byte [esi + 0xb], dl
mov edx, edi
call fcn.005b6eb0
mov cl, byte [esi + 0xc]
mov edx, edi
xor cl, al
mov eax, ebx
mov byte [esi + 0xc], cl
mov ecx, 0x10
call fcn.005b6eb0
mov dl, byte [esi + 0xd]
mov ecx, 8
xor dl, al
mov eax, ebx
mov byte [esi + 0xd], dl
mov edx, edi
call fcn.005b6eb0
mov cl, byte [esi + 0xe]
lea edx, [esi + 0x60]
xor cl, al
mov al, byte [esi + 0xf]
xor al, bl
push edx
push esi
mov byte [esi + 0xe], cl
mov byte [esi + 0xf], al
call dword [ebp - 4]
mov eax, dword [esi + 0xc]
add esp, 8
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
bswap eax
mov edi, eax
mov ecx, dword [esi + 0x174]
lea edx, [esi + 0x20]
push ecx
push edx
push esi
call dword [esi + 0x170]
add esp, 0xc
inc edi
mov dword [ebp + 0xc], edi
mov eax, dword [ebp + 0xc]
bswap eax
mov dword [esi + 0xc], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret