joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a120
Capabilities:
Get socket status

Disassembly:
push ebp
mov edx, 0x10624dd3
mov ebp, esp
push edi
xor edi, edi
push esi
xor esi, esi
push ebx
sub esp, 0x36c
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x348], edi
mov dword [ebp - 0x128], esi
mov eax, ebx
mov ecx, ebx
imul edx
sar ecx, 0x1f
sar edx, 6
sub edx, ecx
mov ecx, 0xffffffff
mov dword [ebp - 0x350], edx
imul edx, edx, 0x3e8
sub ebx, edx
imul eax, ebx, 0x3e8
cmp dword [ebp + 8], 0xffffffff
mov dword [ebp - 0x34c], eax
je 0x43a199
mov edx, dword [ebp + 8]
mov ebx, 1
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x124], edx
xor edx, edx
cmp edx, 0x3f
jbe 0x43a25b
mov ecx, dword [ebp + 8]
xor edx, edx
cmp dword [ebp + 0xc], 0xffffffff
mov dword [ebp - 0x238], edx
je 0x43a1ed
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x348]
mov dword [ebp - 0x234], eax
mov eax, 1
mov dword [ebp - 0x238], eax
xor eax, eax
cmp edx, 0
jbe 0x43a1e1
nop
lea esi, [esi]
mov ebx, dword [ebp + 0xc]
cmp dword [ebp + eax*4 - 0x344], ebx
je 0x43a1e1
inc eax
cmp edx, eax
ja 0x43a1d0
cmp edx, eax
je 0x43a243
cmp dword [ebp + 0xc], ecx
jbe 0x43a1ed
mov ecx, dword [ebp + 0xc]
lea edi, [ebp - 0x348]
lea esi, [ebp - 0x128]
lea ebx, [ecx + 1]
lea esi, [esi]
mov dword [esp + 0xc], edi
lea eax, [ebp - 0x350]
lea edx, [ebp - 0x238]
mov dword [esp + 0x10], eax
mov dword [esp + 8], edx
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.WS2_32.DLL_select
sub esp, 0x14
cmp eax, 0xffffffff
jne 0x43a274
call fcn.00438d40
cmp eax, 4
je 0x43a200
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0x3f
ja 0x43a1e5
mov edx, dword [ebp + 0xc]
mov dword [ebp + eax*4 - 0x344], edx
inc eax
mov dword [ebp - 0x348], eax
jmp 0x43a1e5
mov ebx, dword [ebp + 8]
mov ecx, 1
mov dword [ebp - 0x348], ecx
mov dword [ebp - 0x344], ebx
jmp 0x43a196
test eax, eax
jl 0x43a236
jne 0x43a284
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebx, ebx
cmp dword [ebp + 8], 0xffffffff
je 0x43a2bb
mov dword [esp + 4], esi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.WS2_32.DLL___WSAFDIsSet
sub esp, 8
test eax, eax
jne 0x43a305
mov dword [esp + 4], edi
mov edx, dword [ebp + 8]
mov dword [esp], edx
call sub.WS2_32.DLL___WSAFDIsSet
sub esp, 8
test eax, eax
je 0x43a2bb
or ebx, 4
cmp dword [ebp + 0xc], 0xffffffff
je 0x43a2f6
lea eax, [ebp - 0x238]
mov dword [esp + 4], eax
mov edx, dword [ebp + 0xc]
mov dword [esp], edx
call sub.WS2_32.DLL___WSAFDIsSet
sub esp, 8
test eax, eax
jne 0x43a300
mov dword [esp + 4], edi
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.WS2_32.DLL___WSAFDIsSet
sub esp, 8
test eax, eax
je 0x43a2f6
or ebx, 4
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
or ebx, 2
jmp 0x43a2dd
mov ebx, 1
jmp 0x43a2a2
Function at 0x440210
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
xor edx, edx
push esi
mov esi, eax
push ebx
xor ebx, ebx
mov esi, esi
movzx ecx, byte [ebx + edi]
mov al, cl
sub al, 0x41
cmp al, 0x19
ja 0x440250
shl edx, 6
movsx eax, cl
lea edx, [edx + eax - 0x41]
inc ebx
cmp ebx, 3
jle 0x440220
pop ebx
mov byte [esi + 2], dl
shr edx, 8
mov byte [esi + 1], dl
shr edx, 8
mov byte [esi], dl
pop esi
pop edi
pop ebp
ret
mov al, cl
sub al, 0x61
cmp al, 0x19
ja 0x440264
shl edx, 6
movsx eax, cl
lea edx, [edx + eax - 0x47]
jmp 0x440236
mov al, cl
sub al, 0x30
cmp al, 9
ja 0x440278
shl edx, 6
movsx eax, cl
lea edx, [edx + eax + 4]
jmp 0x440236
cmp cl, 0x2b
je 0x44028c
cmp cl, 0x2f
je 0x440296
cmp cl, 0x3d
jne 0x440236
shl edx, 6
jmp 0x440236
mov eax, edx
shl eax, 6
lea edx, [eax + 0x3e]
jmp 0x440236
mov eax, edx
shl eax, 6
lea edx, [eax + 0x3f]
jmp 0x440236
Function at 0x4572b0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x58], 0
mov eax, 1
ret
Function at 0x45eaf0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebx
mov esi, dword [esp + 0x10]
test esi, esi
je 0x45ecc0
push 0x167
push str..cryptoengineeng_list.c
push 0x1e
push 9
call fcn.0046fb20
mov ebx, dword [0x537e80]
add esp, 0x10
jmp 0x45eb36
sub esp, 8
mov eax, dword [ebx]
push eax
push esi
call sub.msvcrt.dll_strcmp
add esp, 0x10
test eax, eax
je 0x45eb60
mov ebx, dword [ebx + 0x60]
test ebx, ebx
jne 0x45eb20
push 0x181
push str..cryptoengineeng_list.c
push 0x1e
push 0xa
call fcn.0046fb20
add esp, 0x10
test ebx, ebx
mov edx, ebx
je 0x45ebf1
pop ebx
pop esi
mov eax, edx
pop edi
ret
test byte [ebx + 0x48], 4
jne 0x45eb6b
inc dword [ebx + 0x4c]
jmp 0x45eb3a
call fcn.0045e080
test eax, eax
mov edx, eax
je 0x45ece2
mov ecx, dword [ebx]
mov dword [eax], ecx
mov eax, dword [ebx + 4]
mov edi, dword [ebx + 8]
mov ecx, dword [ebx + 0xc]
mov dword [edx + 4], eax
mov eax, dword [ebx + 0x10]
mov dword [edx + 8], edi
mov dword [edx + 0xc], ecx
mov edi, dword [ebx + 0x14]
mov ecx, dword [ebx + 0x18]
mov dword [edx + 0x10], eax
mov eax, dword [ebx + 0x1c]
mov dword [edx + 0x14], edi
mov dword [edx + 0x18], ecx
mov edi, dword [ebx + 0x20]
mov ecx, dword [ebx + 0x24]
mov dword [edx + 0x1c], eax
mov eax, dword [ebx + 0x28]
mov dword [edx + 0x20], edi
mov dword [edx + 0x24], ecx
mov edi, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x30]
mov dword [edx + 0x28], eax
mov eax, dword [ebx + 0x34]
mov dword [edx + 0x2c], edi
mov dword [edx + 0x30], ecx
mov edi, dword [ebx + 0x38]
mov ecx, dword [ebx + 0x3c]
mov dword [edx + 0x34], eax
mov eax, dword [ebx + 0x40]
mov dword [edx + 0x38], edi
mov dword [edx + 0x3c], ecx
mov dword [edx + 0x40], eax
mov edi, dword [ebx + 0x44]
mov ecx, dword [ebx + 0x48]
mov ebx, edx
mov dword [edx + 0x44], edi
mov dword [edx + 0x48], ecx
jmp 0x45eb3a
sub esp, 0xc
push str.OPENSSL_ENGINES
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
mov edi, eax
je 0x45ece9
sub esp, 0xc
push 0x5141db
call fcn.0045eaf0
add esp, 0x10
test eax, eax
mov ebx, eax
je 0x45ec36
push 0
push esi
push 0x5141e3
push eax
call fcn.0048a920
add esp, 0x10
test eax, eax
jne 0x45ec68
sub esp, 0xc
push 0x19b
push str..cryptoengineeng_list.c
push 0x74
push 0x6a
push 0x26
call fcn.0045dc30
add esp, 0x1c
push esi
push 0x5141e6
push 2
call fcn.0045de40
xor edx, edx
add esp, 0x10
jmp 0x45eb5a
push 0
push 0x5141ea
push 0x5141ec
push ebx
call fcn.0048a920
add esp, 0x10
test eax, eax
je 0x45ec36
push 0
push edi
push 0x5141f5
push ebx
call fcn.0048a920
add esp, 0x10
test eax, eax
je 0x45ec36
push 0
push 0
push 0x5141fd
push ebx
call fcn.0048a920
add esp, 0x10
test eax, eax
mov edx, ebx
jne 0x45eb5a
jmp 0x45ec36
sub esp, 0xc
push 0x164
push str..cryptoengineeng_list.c
push 0x43
push 0x6a
push 0x26
call fcn.0045dc30
xor edx, edx
add esp, 0x20
jmp 0x45eb5a
xor ebx, ebx
jmp 0x45eb3a
mov edi, str._usr_local_ssl_lib_engines
jmp 0x45ec0b
Function at 0x4642c0
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [esp + 0x60]
xor eax, eax
test edi, edi
mov ebp, dword [esp + 0x64]
mov dword [esp + 0xc], 0
je 0x464306
sub esp, 8
lea ebx, [esp + 0x18]
push ebx
push edi
call sub.msvcrt.dll__stat
push 0
push 0
push 0x24
mov esi, eax
push ebx
call fcn.004653b0
add esp, 0x20
xor eax, eax
test esi, esi
js 0x464306
test ebp, ebp
jne 0x464310
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 8
push 0x514a70
push edi
call sub.msvcrt.dll_fopen
add esp, 0x10
test eax, eax
mov edi, eax
je 0x4643b9
mov ax, word [esp + 0x16]
test ah, 0x30
je 0x464351
cmp ebp, 0xffffffff
mov eax, ebp
je 0x4643c9
push 0
push 4
push 0
push edi
mov ebp, eax
call sub.msvcrt.dll_setvbuf
add esp, 0x10
test ebp, ebp
jle 0x4643c2
cmp ebp, 0x400
mov esi, ebp
jg 0x4643c2
push edi
push esi
push 1
push 0x537f70
call sub.msvcrt.dll_fread
add esp, 0x10
test eax, eax
mov ebx, eax
jle 0x46439c
push eax
fild dword [esp]
sub esp, 4
fstp qword [esp]
push esi
push 0x537f70
call fcn.004653b0
add dword [esp + 0x1c], ebx
add esp, 0x10
test ebp, ebp
jle 0x4643c2
sub ebp, esi
test ebp, ebp
jg 0x464355
sub esp, 0xc
push edi
call sub.msvcrt.dll_fclose
pop eax
pop edx
push 0x400
push 0x537f70
call fcn.004704d0
add esp, 0x10
mov eax, dword [esp + 0xc]
jmp 0x464306
mov esi, 0x400
jmp 0x46435f
mov eax, 0x800
jmp 0x464340

Function at 0x4644f0
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebx
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
call fcn.004a2410
xor ebx, ebx
test eax, eax
je 0x464540
call fcn.004a2410
test eax, eax
je 0x464580
test ebx, ebx
je 0x4645a0
cmp byte [ebx], 0
je 0x464533
sub esp, 0xc
push ebx
call sub.msvcrt.dll_strlen
add eax, 6
add esp, 0x10
cmp eax, edi
jb 0x4645b0
mov byte [esi], 0
mov edx, esi
pop ebx
pop esi
mov eax, edx
pop edi
ret
sub esp, 0xc
push str.RANDFILE
call sub.msvcrt.dll_getenv
add esp, 0x10
test eax, eax
mov ebx, eax
je 0x464506
cmp byte [eax], 0
je 0x464506
sub esp, 0xc
push eax
call sub.msvcrt.dll_strlen
inc eax
add esp, 0x10
cmp eax, edi
jae 0x464506
push eax
push edi
push ebx
push esi
call fcn.00470260
add esp, 0x10
xor edx, edx
cmp eax, edi
jb 0x464536
jmp 0x464538
sub esp, 0xc
push str.HOME
call sub.msvcrt.dll_getenv
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x464517
lea esi, [esi]
lea edi, [edi]
mov ebx, 0x514a84
jmp 0x464517
push eax
push edi
push ebx
push esi
call fcn.00470260
add esp, 0xc
push edi
push 0x514a87
push esi
call fcn.00470450
add esp, 0xc
push edi
push str..rnd
push esi
call fcn.00470450
add esp, 0x10
jmp 0x464536
Function at 0x464f90
Capabilities:
Capture screenshot

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x6c
call fcn.00464740
call sub.KERNEL32.dll_GetVersion
test eax, eax
js 0x464fb2
call fcn.0046f8d0
test eax, eax
jne 0x465114
push 0
push 0
push 0
push str.DISPLAY
call sub.GDI32.dll_CreateDCA
mov dword [esp + 0x1c], eax
sub esp, 0xc
push eax
call sub.GDI32.dll_CreateCompatibleDC
pop edx
mov dword [esp + 0x20], eax
push 8
mov eax, dword [esp + 0x28]
push eax
call sub.GDI32.dll_GetDeviceCaps
mov dword [esp + 0x18], eax
push 0xa
mov ebp, dword [esp + 0x28]
push ebp
call sub.GDI32.dll_GetDeviceCaps
pop ebp
mov dword [esp + 0x10], eax
push 0x10
mov edi, dword [esp + 0x18]
push edi
mov esi, dword [esp + 0x28]
push esi
call sub.GDI32.dll_CreateCompatibleBitmap
push ebx
push eax
mov ebx, dword [esp + 0x24]
push ebx
mov ebp, eax
call sub.GDI32.dll_SelectObject
pop edx
lea ecx, [esp + 0x44]
mov dword [esp + 0x18], eax
push ecx
push 0x18
push ebp
call sub.GDI32.dll_GetObjectA
mov edx, dword [esp + 0x4c]
mov edi, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
imul edi, edx
push 0x2da
and eax, 0xffff
imul edi, eax
push str..crypto_rand_rand_win.c
push edi
call fcn.00458b20
add esp, 0x10
test eax, eax
mov ebx, eax
je 0x4650e4
mov edx, dword [esp + 0xc]
sub edx, 0x10
xor esi, esi
cmp edx, 0
mov dword [esp + 8], edx
jmp 0x4650d6
sub esp, 0xc
push 0xcc0020
push esi
push 0
mov eax, dword [esp + 0x34]
push eax
push 0x10
mov ecx, dword [esp + 0x30]
push ecx
push 0
push 0
mov edx, dword [esp + 0x44]
push edx
call sub.GDI32.dll_BitBlt
pop eax
pop edx
push ebx
push edi
push ebp
call sub.GDI32.dll_GetBitmapBits
push eax
push 0
push eax
call fcn.0047a180
mov dword [esp], eax
push 0
lea eax, [esp + 0x34]
push eax
push edi
push ebx
call fcn.00479050
add esp, 0x20
push 0
push 0
push 0x14
lea ecx, [esp + 0x2c]
push ecx
call fcn.004653b0
add esi, 0x10
add esp, 0x10
cmp dword [esp + 8], esi
jg 0x465070
sub esp, 0xc
push ebx
call fcn.00458e30
add esp, 0x10
sub esp, 8
mov ebp, dword [esp + 0x1c]
push ebp
mov edi, dword [esp + 0x24]
push edi
call sub.GDI32.dll_SelectObject
push edi
push eax
call sub.GDI32.dll_DeleteObject
mov esi, dword [esp + 0x24]
push esi
call sub.GDI32.dll_DeleteDC
mov ebx, dword [esp + 0x28]
push ebx
call sub.GDI32.dll_DeleteDC
add esp, 0xc
add esp, 0x6c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x465a30
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov dword [eax + 0x58], 0
mov eax, 1
ret

Function at 0x46e9b0
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
xor esi, esi
test edx, edx
je 0x46e9c7
mov al, byte [edx]
test al, al
mov ebx, 0x100
jne 0x46e9d0
pop ebx
xor eax, eax
pop esi
ret
movsx eax, al
or eax, ebx
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
imul eax, eax
rol esi, cl
inc edx
xor esi, eax
mov al, byte [edx]
add ebx, 0x100
test al, al
jne 0x46e9d0
mov eax, esi
shr eax, 0x10
pop ebx
xor eax, esi
pop esi
ret
Function at 0x46f9b0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x14c
mov ebx, dword [ebp + 8]
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
add esp, 0xc
test eax, eax
je 0x46f9e0
sub esp, 0xc
push eax
call sub.KERNEL32.dll_GetFileType
add esp, 0xc
test eax, eax
jne 0x46fa90
lea edx, [ebp + 0xc]
push edx
push ebx
push 0xff
lea esi, [ebp - 0x108]
push esi
call sub.msvcrt.dll__vsnprintf
mov byte [ebp - 9], 0
call sub.KERNEL32.dll_GetVersion
add esp, 0x10
test eax, eax
js 0x46fa13
call fcn.0046f8d0
test eax, eax
jne 0x46fab0
sub esp, 0xc
lea eax, [ebp - 0x138]
mov dword [ebp - 0x138], 0x28
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x128], str.OpenSSL:_FATAL
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x120], 0x7f01
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0x409
mov dword [ebp - 0x12c], esi
push eax
call sub.USER32.dll_MessageBoxIndirectA
add esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
lea ecx, [ebp + 0xc]
push edx
push ecx
push ebx
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
push eax
call sub.msvcrt.dll_vfprintf
add esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
sub esp, 8
push str.OPENSSL
push 0
call sub.ADVAPI32.DLL_RegisterEventSourceA
mov dword [ebp - 0x13c], esi
push esi
push 0
lea esi, [ebp - 0x13c]
push esi
push 0
push 1
push 0
push 0
push 0
push 1
push eax
mov ebx, eax
call sub.ADVAPI32.DLL_ReportEventA
push ebx
call sub.ADVAPI32.DLL_DeregisterEventSource
jmp 0x46fa82
Function at 0x473e20
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x18
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x2c]
mov ebp, dword [esp + 0x38]
mov dword [esp + 0x10], 0
push esi
call fcn.0046cd30
add esp, 0x10
cmp eax, dword [esp + 0x30]
je 0x473e70
sub esp, 0xc
push 0x9a
push str..crypto_rsa_rsa_sign.c
push 0x77
push 0x77
push 4
call fcn.0045dc30
xor eax, eax
add esp, 0x20
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [esi + 0x3c], 0x40
je 0x473e84
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x30]
test eax, eax
jne 0x473fe0
push eax
push 0xa4
push str..crypto_rsa_rsa_sign.c
mov eax, dword [esp + 0x3c]
push eax
call fcn.00458b20
add esp, 0x10
test eax, eax
mov ebx, eax
je 0x47405d
cmp edi, 0x72
je 0x473f10
sub esp, 0xc
push 1
push esi
push ebx
push ebp
mov esi, dword [esp + 0x4c]
push esi
call fcn.0046cdf0
add esp, 0x20
test eax, eax
jle 0x473f35
cmp edi, 0x72
jne 0x473f60
cmp eax, 0x24
jne 0x473ef0
cld
mov esi, ebx
mov edi, dword [esp + 0x24]
mov ecx, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x473ffc
lea esi, [esi]
lea edi, [edi]
sub esp, 0xc
push 0xb5
push str..crypto_rsa_rsa_sign.c
push 0x68
jmp 0x473f29
cmp dword [esp + 0x28], 0x24
je 0x473eab
sub esp, 0xc
push 0xab
push str..crypto_rsa_rsa_sign.c
push 0x83
push 0x77
push 4
call fcn.0045dc30
add esp, 0x20
test ebx, ebx
je 0x473f52
sub esp, 8
mov ebp, dword [esp + 0x38]
push ebp
push ebx
call fcn.004704d0
mov dword [esp], ebx
call fcn.00458e30
add esp, 0x10
mov eax, dword [esp + 4]
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
push edx
push eax
lea ebp, [esp + 0x10]
push ebp
push 0
call fcn.0049e280
add esp, 0x10
test eax, eax
mov ebp, eax
je 0x473f35
mov eax, dword [eax]
sub esp, 0xc
mov edx, dword [eax]
push edx
call fcn.0046a800
add esp, 0x10
cmp eax, edi
je 0x474029
cmp edi, 4
je 0x474058
cmp edi, 3
je 0x474009
sub esp, 0xc
push 0xd3
push str..crypto_rsa_rsa_sign.c
push 0x64
push 0x77
push 4
call fcn.0045dc30
add esp, 0x20
test ebp, ebp
je 0x473f35
sub esp, 0xc
push ebp
call fcn.0049e2e0
add esp, 0x10
jmp 0x473f35
sub esp, 8
push esi
mov ebx, dword [esp + 0x3c]
push ebx
push ebp
mov ecx, dword [esp + 0x3c]
push ecx
mov edx, dword [esp + 0x3c]
push edx
push edi
call eax
jmp 0x473e64
mov dword [esp + 4], 1
jmp 0x473f35
cmp eax, 7
jne 0x473fa1
mov edi, dword [sym.imp.msvcrt.dll__iob]
add edi, 0x40
push edi
push 0x34
push 1
push str.signature_has_problems__re_make_with_post_SSLeay045_n
call sub.msvcrt.dll_fwrite
add esp, 0x10
mov eax, dword [ebp + 4]
mov edx, dword [esp + 0x28]
cmp dword [eax], edx
jne 0x474044
mov edi, dword [eax + 8]
cld
cmp edx, edx
mov esi, dword [esp + 0x24]
mov ecx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x474081
sub esp, 0xc
push 0xda
push str..crypto_rsa_rsa_sign.c
push 0x68
jmp 0x473fb0
cmp eax, 8
jmp 0x47400c
sub esp, 0xc
push 0xa7
push str..crypto_rsa_rsa_sign.c
push 0x41
push 0x77
push 4
call fcn.0045dc30
add esp, 0x20
mov eax, dword [esp + 4]
jmp 0x473f56
mov dword [esp + 4], 1
jmp 0x473fbc
Function at 0x47e700
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x9c
mov edi, dword [esp + 0xbc]
xor eax, eax
test edi, edi
mov ebx, dword [esp + 0xb0]
mov ebp, dword [esp + 0xb8]
je 0x47e8bf
mov edx, dword [esp + 0xb4]
test edx, edx
mov al, 1
mov dword [ebx], edi
je 0x47e8d0
mov esi, dword [edi + 0x40]
cmp esi, 0x80
jg 0x47e88b
cmp esi, ebp
jl 0x47e83e
cmp ebp, 0x80
ja 0x47e8a5
push edx
push ebp
mov edx, dword [esp + 0xbc]
push edx
lea eax, [ebx + 0x38]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0x10
lea ecx, [ebx + 4]
mov edx, ebp
mov dword [ebx + 0x34], ebp
mov dword [esp + 0xc], ecx
cmp edx, 0x80
je 0x47e7a1
mov esi, pe_nt_image_headers32
sub esi, edx
push ecx
push esi
push 0
lea ebp, [edx + ebx + 0x38]
push ebp
call sub.msvcrt.dll_memset
add esp, 0x10
xor edx, edx
lea esi, [esi]
lea edi, [edi]
mov al, byte [ebx + edx + 0x38]
xor eax, 0x36
mov byte [esp + edx + 0x10], al
inc edx
cmp edx, 0x7f
jle 0x47e7b0
push eax
mov ebp, dword [esp + 0xc4]
push ebp
push edi
lea esi, [ebx + 0x14]
push esi
call fcn.00478c70
add esp, 0xc
mov edx, dword [edi + 0x40]
push edx
lea ebp, [esp + 0x18]
push ebp
push esi
call fcn.00478e10
xor edx, edx
add esp, 0x10
nop
lea esi, [esi]
mov cl, byte [ebx + edx + 0x38]
xor ecx, 0x5c
mov byte [esp + edx + 0x10], cl
inc edx
cmp edx, 0x7f
jle 0x47e7f0
push eax
mov edx, dword [esp + 0xc4]
push edx
push edi
add ebx, 0x24
push ebx
call fcn.00478c70
add esp, 0xc
mov eax, dword [edi + 0x40]
push eax
push ebp
push ebx
call fcn.00478e10
add esp, 0x10
sub esp, 8
push esi
mov ebx, dword [esp + 0x18]
push ebx
call fcn.00479210
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret
push eax
mov eax, dword [esp + 0xc4]
push eax
push edi
lea esi, [ebx + 4]
mov dword [esp + 0x18], esi
push esi
call fcn.00478c70
add esp, 0xc
push ebp
mov edx, dword [esp + 0xbc]
push edx
mov ebp, dword [esp + 0x18]
push ebp
call fcn.00478e10
add esp, 0xc
lea ecx, [ebx + 0x34]
push ecx
lea eax, [ebx + 0x38]
push eax
mov esi, dword [esp + 0x18]
push esi
call fcn.00478e30
add esp, 0x10
mov edx, dword [ebx + 0x34]
jmp 0x47e781
push eax
push str.j____int_sizeof_ctx__key_
push 0x52
push str..cryptohmachmac.c
call fcn.0046faf0
add esp, 0x10
jmp 0x47e74b
push ecx
push str.len_0__len__int_sizeof_ctx__key_
push 0x5c
push str..cryptohmachmac.c
call fcn.0046faf0
add esp, 0x10
jmp 0x47e75f
mov edx, dword [esp + 0xb4]
test edx, edx
mov edi, dword [ebx]
jne 0x47e73c
lea ecx, [ebx + 4]
test eax, eax
mov dword [esp + 0xc], ecx
lea esi, [ebx + 0x14]
jne 0x47e7a1
sub esp, 8
push esi
mov ebx, dword [esp + 0x18]
push ebx
call fcn.00479210
add esp, 0xac
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4ad780
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov dword [eax + 0x5c], 0
mov eax, 1
ret
Function at 0x4f12c0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4f12f6
mov dword [0x53e030], eax
mov edx, 0x4f12a0
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004f1990
test eax, eax
sete al
movzx eax, al
mov dword [0x504e60], eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x504e60], eax
leave
ret

Function at 0x4f13e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], 0x4ef4c0
mov dword [ebp - 0x24], 0x4f4310
mov dword [ebp - 0x1c], 0x4f14a0
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call fcn.004f1f30
cmp dword [0x504e60], 0
mov dword [ebp - 0x44], 0x53e040
je 0x4f1480
jl 0x4f14c0
mov dword [ebp - 0x3c], 1
mov eax, dword [0x53e030]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x4f1563
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.004f2010
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x53e070]
mov eax, 0xffffffff
test edx, edx
je 0x4f14da
mov eax, dword [0x504e64]
test eax, eax
je 0x4f151a
xor eax, eax
test eax, eax
jne 0x4f1510
mov edi, dword [0x504e60]
test edi, edi
js 0x4f1510
mov dword [ebp - 0x44], 0x53e040
mov ebx, dword [0x504e60]
test ebx, ebx
je 0x4f1480
jmp 0x4f142e
xor esi, esi
mov dword [0x504e60], esi
jmp 0x4f14e8
mov dword [esp], 0x504e68
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.dll_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x4f15a1
mov eax, dword [0x504e64]
test eax, eax
jne 0x4f14d8
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x504e64]
test eax, eax
je 0x4f153d
jmp 0x4f14d8
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x4f1595
mov dword [esp + 4], eax
mov eax, dword [0x53e030]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x4f15ca
test edx, edx
je 0x4f15b5
mov dword [ebp - 0x3c], 1
call fcn.004f0e40
call fcn.004f12c0
mov eax, 1
mov dword [0x504e64], eax
jmp 0x4f14d8
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x4f1476
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
jmp 0x4f1591