joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4df720
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x621810]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.004a6444
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x4df785
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x4df785
lea edx, [esp]
push edx
call dword [0x6228a8]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0048b951
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.0048b951
add esp, 0x108
ret
jmp 0x4df720

Function at 0x4df7a0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x621810]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.004a6444
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x4df785
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x4df785
lea edx, [esp]
push edx
call dword [0x6228a8]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0048b951
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.0048b951
add esp, 0x108
ret
jmp 0x4df720
Function at 0x4e0d40
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
push esi
push 0x5c0830
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x4e0d5a
pop esi
pop ebp
pop ecx
ret
push ebx
push edi
push str.LoadLibraryExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [esp + 0x18]
mov edi, eax
push 0x5c081c
push ebx
mov dword [esp + 0x18], edi
call fcn.004e744a
add esp, 8
test eax, eax
je 0x4e0da6
test edi, edi
je 0x4e0d97
push 8
push 0
push ebx
call edi
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
test edi, edi
je 0x4e0dcc
push str.AddDllDirectory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4e0dcc
push 0x800
push 0
push ebx
call edi
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, eax
test edi, edi
je 0x4e0e84
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4e0de5
sub eax, edx
lea eax, [eax + edi + 1]
push eax
call dword [0x62289c]
mov esi, eax
add esp, 4
test esi, esi
je 0x4e0e7a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4e0e7a
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4e0e15
sub eax, edx
mov word [eax + esi], 0x5c
mov eax, esi
lea edx, [eax + 1]
jmp 0x4e0e30
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4e0e30
sub eax, edx
lea edx, [eax + esi]
mov ecx, ebx
sub edx, ebx
mov al, byte [ecx]
mov byte [edx + ecx], al
add ecx, 1
test al, al
jne 0x4e0e42
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4e0e71
push 8
push 0
push esi
call eax
push esi
mov ebp, eax
call dword [0x6228a0]
add esp, 4
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
push esi
call dword [0x6228a0]
add esp, 4
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
pop ecx
ret
Function at 0x4e31a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [eax + 0x2c]
mov ebx, dword [ebp]
mov ecx, dword [ebx + 0x1ec]
test ecx, ecx
push esi
push edi
mov esi, ecx
jne 0x4e31bd
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.004bb050
push edx
push eax
call fcn.004bb080
mov ecx, eax
mov eax, edx
mov dword [esp + 0x24], eax
mov eax, esi
cdq
add esp, 0x10
mov edi, eax
sub edi, ecx
mov ecx, dword [esp + 0x14]
mov esi, edx
sbb esi, ecx
cmp dword [ebx + 0x1e0], 0
je 0x4e322a
mov edx, dword [ebp + 0x184]
mov eax, dword [ebp + 0x180]
push edx
push eax
call fcn.004bb050
push edx
push eax
call fcn.004bb080
mov ecx, eax
mov eax, dword [ebx + 0x1e0]
mov ebp, edx
cdq
add esp, 0x10
sub eax, ecx
sbb edx, ebp
cmp esi, edx
jl 0x4e322a
jg 0x4e322e
cmp edi, eax
jae 0x4e322e
mov eax, edi
mov edx, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4e4380
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
mov byte [esi + edi - 1], 0
jne 0x4e43b2
push 0x2e
push esi
call fcn.004952d0
add esp, 8
test eax, eax
je 0x4e43b0
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret
Function at 0x4e5e20
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x62289c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4e5e45
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x4e5e8c
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x4e5e90
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
test ebp, ebp
mov dword [esp + 0x10], 0
jbe 0x4e5ef0
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
add ebx, 1
call edx
add esp, 0x18
sub ebp, 1
jne 0x4e5eb3
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 0x10]
pop ebp
pop ebx
jae 0x4e5f33
jmp 0x4e5f00
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x5c0fb4
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x5c0fb5
push eax
call ecx
mov eax, dword [esp + 0x20]
add eax, 1
add esp, 0x18
cmp eax, dword [esi + 0x10]
mov dword [esp + 8], eax
jb 0x4e5f00
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x4e80f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.0049f020
mov eax, dword [0x621810]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
mov dword [esp + 0x3c], 0
jne 0x4e8137
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.0048b951
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call fcn.00595664
add esp, 8
test eax, eax
jl 0x4e8120
mov eax, 8
call fcn.0049f020
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.004e7f60
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x4e8120
push 0x5b0218
push esi
call fcn.0048fab6
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x40], edi
je 0x4e8231
test dword [esp + 0x4e], 0x2000
je 0x4e81b4
cmp ebx, 0xffffffff
jne 0x4e819e
mov ebx, 0x800
push 0
push 4
push 0
push edi
call fcn.0048e6e6
add esp, 0x10
jmp 0x4e81b4
mov edi, dword [esp + 0x40]
test ebx, ebx
jle 0x4e81c2
cmp ebx, 0x400
mov esi, ebx
jl 0x4e81c7
mov esi, 0x400
push edi
push esi
lea edx, [esp + 0x80]
push 1
push edx
call fcn.0048fd17
mov edi, eax
add esp, 0x10
test edi, edi
mov dword [esp + 0x44], edi
jle 0x4e8215
fild dword [esp + 0x44]
mov eax, 8
call fcn.0049f020
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.004e7f60
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x4e81b0
sub ebx, esi
test ebx, ebx
jg 0x4e81b0
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0048d609
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.004f8f50
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048b951
mov esp, ebp
pop ebp
ret
Function at 0x4f24a0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
mov edx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
add ecx, 0xffffffff
push edi
mov edi, dword [esi + 4]
shr ecx, 0x1f
xor edx, edi
sub ecx, 1
and edx, ecx
xor edi, edx
mov dword [esi + 4], edi
xor dword [eax + 4], edx
lea edx, [ebx - 1]
cmp edx, 9
ja case.default.0x4f24d6
jmp dword [edx*4 + 0x4f2600]
mov edi, 0xa
cmp ebx, edi
jle case.0x4f24d6.10
push ebp
mov edx, dword [esi]
mov ebx, dword [edx + edi*4]
lea ebp, [edx + edi*4]
mov edx, dword [eax]
mov edx, dword [edx + edi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + edi*4], edx
lea ebx, [ebx + edi*4]
add edi, 1
cmp edi, dword [esp + 0x20]
jl 0x4f24e7
pop ebp
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x24]
mov edx, dword [edx + 0x24]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x24], edi
mov edi, dword [eax]
xor dword [edi + 0x24], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x20]
mov edx, dword [edx + 0x20]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x20], edi
mov edi, dword [eax]
xor dword [edi + 0x20], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x1c]
mov edx, dword [edx + 0x1c]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x1c], edi
mov edi, dword [eax]
xor dword [edi + 0x1c], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x18]
mov edx, dword [edx + 0x18]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x18], edi
mov edi, dword [eax]
xor dword [edi + 0x18], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x14]
mov edx, dword [edx + 0x14]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x14], edi
mov edi, dword [eax]
xor dword [edi + 0x14], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x10]
mov edx, dword [edx + 0x10]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x10], edi
mov edi, dword [eax]
xor dword [edi + 0x10], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0xc]
mov edx, dword [edx + 0xc]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0xc], edi
mov edi, dword [eax]
xor dword [edi + 0xc], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 8]
mov edx, dword [edx + 8]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 8], edi
mov edi, dword [eax]
xor dword [edi + 8], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 4]
mov edx, dword [edx + 4]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 4], edi
mov edi, dword [eax]
xor dword [edi + 4], edx
mov esi, dword [esi]
mov edx, dword [eax]
mov edi, dword [esi]
mov edx, dword [edx]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [esi], edi
mov eax, dword [eax]
xor dword [eax], edx
pop edi
pop esi
pop ebx
ret
Function at 0x4f4dc0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.0048cf80
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret
Function at 0x4f59e0
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.0048cf80
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
mov eax, 1
pop esi
ret

Function at 0x4f5a40
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.0048cf80
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
pop esi
ret
Function at 0x4fb740
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.0049f020
mov eax, dword [0x621810]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x4fb7c7
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4fb7c7
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x100
push edx
call fcn.00595b67
add esp, 0x10
test eax, eax
jge 0x4fb79d
mov eax, 0x100
push 0
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0048b951
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0xff
push edx
call fcn.00595b67
add esp, 0x10
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4fb859
call fcn.004fb600
test eax, eax
jle 0x4fb859
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x4fb86d
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
lea eax, [esp + 0x28]
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0048b951
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0048b951
add esp, 0x108
ret

Function at 0x4fb8c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x4fb8ea
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
sub esi, eax
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
or cl, dl
add eax, 1
sub edi, 1
jne 0x4fb8d7
pop esi
pop ebx
movzx eax, cl
pop edi
ret

Function at 0x4ff0b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x4ff0f9
mov al, byte [edx]
test al, al
je 0x4ff0f9
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
add edx, 1
xor esi, ecx
test al, al
jne 0x4ff0c7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x5014d0
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
call fcn.00500e40
mov edi, eax
add esp, 4
test edi, edi
jne 0x501576
push 0xaf
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.004ea090
push 0x5d49c8
push esi
push 0x5d49c4
push ebx
push str.fopen_
push 5
call fcn.004ea3b0
add esp, 0x2c
call fcn.0048f811
cmp dword [eax], 2
je 0x501555
call fcn.0048f811
cmp dword [eax], 6
je 0x501555
push 0xb8
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.004ea090
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0xb6
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.004ea090
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x622db4
call fcn.004eac50
mov esi, eax
add esp, 4
test esi, esi
jne 0x501598
push edi
call fcn.0048d609
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.004ea690
push edi
push 1
push 0x6a
push esi
call fcn.004ea9f0
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x51e640
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.0048cf80
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret

Function at 0x51ff30
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
lea eax, [ecx + 1]
ret

Function at 0x51ffd0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x534830
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x534920
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
jl 0x5348b2
movzx eax, byte [esi + 2]
xor edx, edx
mov dh, byte [esi]
add ecx, 1
add ecx, 1
add ecx, 1
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x5e1778]
mov byte [ecx - 3], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x5e1778]
mov byte [ecx - 2], al
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x5e1778]
mov byte [ecx - 1], al
and edx, 0x3f
movzx edx, byte [edx + 0x5e1778]
mov byte [ecx], dl
jmp 0x53490b
movzx edx, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x5348c4
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x5e1778]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x5e1778]
add ecx, 1
mov byte [ecx], al
add ecx, 1
cmp edi, 1
jne 0x5348f6
lea edx, [edi + 0x3c]
jmp 0x534903
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x5e1778]
mov byte [ecx], dl
add ecx, 1
mov byte [ecx], 0x3d
sub edi, 3
add ecx, 1
add ebp, 4
add esi, 3
test edi, edi
jg 0x534850
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x536ac0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5c
call fcn.0049f020
mov eax, dword [0x621810]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x70]
push ebx
mov ebx, dword [esp + 0x64]
push ebp
mov ebp, dword [esp + 0x74]
push esi
mov esi, dword [esp + 0x88]
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x88]
add edi, 0xffffffff
test eax, eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], edi
jne 0x536b1f
call fcn.004fcd00
mov dword [esp + 0x10], eax
test esi, esi
jne 0x536b27
mov dword [esp + 0x14], eax
push eax
call fcn.004fce40
mov esi, eax
lea eax, [esi + esi]
sub edi, eax
lea edx, [edi - 1]
add esp, 4
cmp ebp, edx
jle 0x536b6b
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0xa0
push 4
call fcn.004ea090
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.0048b951
add esp, 0x5c
ret
add eax, 1
cmp dword [esp + 0x1c], eax
jge 0x536b7f
push 0x40
push str..crypto_rsa_rsa_oaep.c
push 0x78
jmp 0x536b47
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x84]
push 0
push ecx
lea eax, [ebx + 1]
mov byte [ebx], 0
push 0
lea ebx, [ebx + esi + 1]
push ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push edx
push eax
call fcn.004fbec0
add esp, 0x18
test eax, eax
je 0x536b56
sub edi, ebp
sub edi, 1
push edi
lea ecx, [ebx + esi]
push 0
push ecx
call fcn.0048cf80
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
mov edx, ebx
sub edx, ebp
sub edx, esi
push ebp
lea eax, [edx + edi]
push ecx
push eax
mov byte [eax - 1], 1
call fcn.0048b960
mov ebp, dword [esp + 0x30]
push esi
push ebp
call fcn.004e7fd0
add esp, 0x20
test eax, eax
jle 0x536b56
push 0x55
sub edi, esi
push str..crypto_rsa_rsa_oaep.c
push edi
call fcn.004ec5e0
add esp, 0xc
test eax, eax
mov dword [esp + 0x10], eax
jne 0x536c1c
push 0x57
push str..crypto_rsa_rsa_oaep.c
push 0x41
jmp 0x536b47
mov edx, dword [esp + 0x14]
push edx
push esi
push ebp
push edi
push eax
call fcn.00536940
add esp, 0x14
test eax, eax
jl 0x536c6a
test edi, edi
jle 0x536c51
mov ebp, dword [esp + 0x10]
mov eax, ebx
sub ebp, ebx
mov ecx, edi
nop
mov dl, byte [eax + ebp]
xor byte [eax], dl
add eax, 1
sub ecx, 1
jne 0x536c40
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push eax
push edi
push ebx
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.00536940
add esp, 0x14
test eax, eax
jge 0x536c8c
mov edx, dword [esp + 0x10]
push edx
call fcn.004ec7e0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.0048b951
add esp, 0x5c
ret
test esi, esi
jle 0x536ca5
lea ecx, [esp + 0x28]
mov eax, ebp
sub ecx, ebp
mov dl, byte [ecx + eax]
xor byte [eax], dl
add eax, 1
sub esi, 1
jne 0x536c98
mov eax, dword [esp + 0x10]
push eax
call fcn.004ec7e0
mov ecx, dword [esp + 0x6c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0048b951
add esp, 0x5c
ret