joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x84], 0xffffffff
jne 0x47f7a5
xor eax, eax
pop edi
pop ebp
ret
push ebx
push esi
push dword [edi]
call fcn.0044de10
mov ecx, dword [ebp + 0x10]
add esp, 4
mov ebx, dword [ebp + 0xc]
mov esi, eax
mov dword [ecx], esi
test ebx, ebx
je 0x47f859
mov ecx, dword [edi + 0x84]
cmp ecx, esi
jne 0x47f7f6
test esi, esi
jle 0x47f837
mov edx, ebx
lea ecx, [edi + 4]
mov ebx, esi
nop dword [eax + eax]
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x47f7e0
jmp 0x47f834
sub eax, ecx
mov byte [ecx + edi + 0x64], 0x80
cmp eax, 1
jle 0x47f814
dec eax
push eax
lea eax, [edi + 0x65]
add eax, ecx
push 0
push eax
call fcn.0053f280
add esp, 0xc
test esi, esi
jle 0x47f837
mov edx, ebx
lea ecx, [edi + 0x24]
mov ebx, esi
nop
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x47f820
mov ebx, dword [ebp + 0xc]
push esi
push ebx
push ebx
push dword [edi]
call fcn.0044e430
add esp, 0x10
test eax, eax
jne 0x47f859
push esi
push ebx
call fcn.00457920
add esp, 8
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret
pop esi
pop ebx
mov eax, 1
pop edi
pop ebp
ret
Function at 0x48bed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
mov ecx, ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
sub ecx, 4
jb 0x48bef7
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x48befe
add edx, 4
add esi, 4
sub ecx, 4
jae 0x48bee6
xor edi, edi
cmp ecx, 0xfffffffc
je 0x48bf39
movzx edi, byte [edx]
movzx eax, byte [esi]
sub edi, eax
jne 0x48bf39
cmp ecx, 0xfffffffd
je 0x48bf39
movzx edi, byte [edx + 1]
movzx eax, byte [esi + 1]
sub edi, eax
jne 0x48bf39
cmp ecx, 0xfffffffe
je 0x48bf39
movzx edi, byte [edx + 2]
movzx eax, byte [esi + 2]
sub edi, eax
jne 0x48bf39
cmp ecx, 0xffffffff
je 0x48bf39
movzx edi, byte [edx + 3]
movzx eax, byte [esi + 3]
sub edi, eax
test edi, edi
jle case.0x48bfad.2
mov edi, dword [ebp + 0xc]
xor ecx, ecx
test ebx, ebx
jle 0x48bf5e
mov esi, dword [ebp + 8]
mov edx, edi
sub esi, edi
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x48bf5e
inc ecx
inc edx
cmp ecx, ebx
jl 0x48bf51
lea edx, [ebx - 1]
mov ebx, dword [ebp + 8]
test edx, edx
js 0x48bf81
mov esi, ebx
lea eax, [edx + edi]
sub esi, edi
nop
cmp byte [eax + esi], 0
jne 0x48bf81
cmp byte [eax], 0xff
jne 0x48bf81
dec eax
sub edx, 1
jns 0x48bf70
cmp ecx, edx
jl case.0x48bfad.2
jle 0x48bf93
pop edi
pop esi
lea eax, [ecx*8]
pop ebx
pop ebp
ret
mov dh, byte [ecx + ebx]
mov bl, byte [ecx + edi]
mov dl, bl
xor dl, dh
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x48bfad.2
movzx eax, byte [eax + 0x48c020]
jmp dword [eax*4 + 0x48c000]
mov eax, 7
jmp 0x48bfe3
mov eax, 6
jmp 0x48bfe3
mov eax, 5
jmp 0x48bfe3
mov eax, 4
jmp 0x48bfe3
mov eax, 3
jmp 0x48bfe3
mov eax, 2
jmp 0x48bfe3
mov eax, 1
test dl, dh
jne case.0x48bfad.2
and bl, dl
cmp bl, dl
jne case.0x48bfad.2
pop edi
pop esi
lea eax, [eax + ecx*8]
pop ebx
pop ebp
ret
pop edi
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
Function at 0x48df60
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push dword [ebp + 8]
call fcn.004cfd80
push 0x62
push esi
mov edi, eax
mov ebx, 1
call fcn.0053f150
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x48e006
push 0x48
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.00457620
push 0x5907e8
push esi
push 0x5947d0
push dword [ebp + 8]
push str.fopen_
push 5
call fcn.00456c60
add esp, 0x2c
call fcn.005414b2
cmp dword [eax], 2
je 0x48dfe2
call fcn.005414b2
cmp dword [eax], 6
je 0x48dfe2
lea eax, [edi + 2]
lea ecx, [edi + 0x51]
jmp 0x48dfec
mov eax, 0x80
mov ecx, 0x4f
push ecx
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_bio_bss_file.c
push eax
push 0x6d
push 0x20
call fcn.00457620
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x594748
call fcn.0044fcf0
mov esi, eax
add esp, 4
test esi, esi
jne 0x48e029
push edi
call fcn.005484a6
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 0
push esi
call fcn.0044f660
push edi
push ebx
push 0x6a
push esi
call fcn.0044f690
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x49aa20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], 0x10
lea eax, [edx + 0xf]
lea ecx, [esi + 0xf]
cmp esi, eax
ja 0x49aa61
cmp ecx, edx
jb 0x49aa61
push edi
mov ecx, esi
sub edx, esi
mov edi, 0x10
nop word [eax + eax]
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edi, 1
jne 0x49aa50
pop edi
jmp 0x49aa6e
movups xmm1, xmmword [esi]
movups xmm0, xmmword [edx]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
push 0x10
push esi
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push esi
push dword [eax + 4]
call fcn.0044ecb0
add esp, 0x14
pop esi
test eax, eax
je 0x49aa98
cmp dword [ebp - 4], 0x10
jne 0x49aa98
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x49abe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x49ac43
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x49ac43
push ebx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0xc]
cmp edx, eax
mov ebx, eax
cmovb ebx, edx
xor ecx, ecx
test ebx, ebx
je 0x49ac16
mov al, byte [ecx + esi]
xor byte [edi + ecx + 0x10], al
inc ecx
cmp ecx, ebx
jb 0x49ac07
mov eax, dword [edi + 0xc]
cmp edx, eax
jbe 0x49ac41
sub edx, eax
mov eax, 0x10
cmp edx, eax
cmova edx, eax
xor ecx, ecx
test edx, edx
je 0x49ac41
nop dword [eax]
mov eax, dword [edi + 0xc]
add eax, ecx
mov al, byte [eax + esi]
xor byte [edi + ecx + 0x30], al
inc ecx
cmp ecx, edx
jb 0x49ac30
pop edi
pop ebx
pop esi
pop ebp
ret
Function at 0x4ab340
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push esi
call fcn.0044e650
add esp, 4
cmp eax, 0x72
jne 0x4ab4e5
mov esi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x10]
push edi
push esi
push dword [ebp + 0x1c]
mov edi, eax
and eax, 1
push dword [ebp + 0x18]
shr edi, 1
push dword [ebp + 0x14]
add eax, edi
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
call fcn.004939f0
push eax
call fcn.004ab120
add esp, 0x1c
test eax, eax
jne 0x4ab393
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push 0x104
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_kdf_tls1_prf.c
push esi
call fcn.00457b40
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x4ab3ce
push 0x105
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_kdf_tls1_prf.c
push 0x41
push 0x6f
push 0x34
call fcn.00457620
add esp, 0x14
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push esi
push ebx
push dword [ebp + 0x18]
add eax, edi
push dword [ebp + 0x14]
push dword [ebp - 4]
push eax
call fcn.00493f60
push eax
call fcn.004ab120
add esp, 0x1c
test eax, eax
jne 0x4ab40e
push 0x10a
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_kdf_tls1_prf.c
push esi
push ebx
call fcn.00457c50
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
xor edi, edi
test esi, esi
je 0x4ab4c5
mov edx, dword [ebp + 0x1c]
cmp esi, 0x40
jb 0x4ab4a0
lea eax, [esi - 1]
lea ecx, [edx - 1]
add eax, ebx
add ecx, esi
cmp edx, eax
ja 0x4ab436
cmp ecx, ebx
jae 0x4ab4a0
mov ecx, esi
mov eax, edx
mov esi, ebx
and ecx, 0xffffffc0
sub esi, edx
mov dword [ebp - 4], esi
mov esi, dword [ebp + 0x20]
mov edx, dword [ebp - 4]
nop word [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x40]
movups xmm1, xmmword [edx + eax - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ebx + edi + 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm0, xmmword [eax - 0x20]
movups xmm1, xmmword [ebx + edi + 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm0, xmmword [eax - 0x10]
movups xmm1, xmmword [ebx + edi + 0x30]
add edi, 0x40
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edi, ecx
jb 0x4ab450
mov edx, dword [ebp + 0x1c]
cmp edi, esi
jae 0x4ab4c5
mov eax, ebx
lea ecx, [edi + edx]
sub eax, edx
mov edx, esi
mov dword [ebp - 4], eax
sub edx, edi
mov esi, eax
mov al, byte [ecx + esi]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x4ab4b4
mov esi, dword [ebp + 0x20]
push 0x10f
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_kdf_tls1_prf.c
push esi
push ebx
call fcn.00457c50
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.004ab120
add esp, 0x1c
neg eax
sbb eax, eax
neg eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4b0fa0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov cl, byte [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
add ebx, esi
push edi
mov edi, dword [ebp + 8]
movzx eax, cl
add edi, esi
and eax, 1
test esi, esi
je 0x4b0fde
movzx edx, byte [ebx - 1]
lea ebx, [ebx - 1]
movzx ecx, cl
lea edi, [edi - 1]
xor edx, ecx
mov cl, byte [ebp + 0x14]
add eax, edx
mov byte [edi], al
shr eax, 8
sub esi, 1
jne 0x4b0fc0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4bcf40
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x4bd044
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4bd044
call fcn.005414b2
mov dword [eax], 0
mov eax, dword [ebx]
test eax, eax
jne 0x4bd06e
mov edi, esi
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4bcf76
sub edi, ecx
je 0x4bd059
cmp edi, 0x7ffffffc
ja 0x4bd059
push 0x244
call fcn.005414d5
add esp, 4
mov dword [ebx], eax
test eax, eax
jne 0x4bcfb9
call fcn.005414b2
mov dword [eax], 0xc
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x244
push 0
push eax
call fcn.0053f280
add esp, 0xc
cmp byte [edi + esi - 1], 0x2a
je 0x4bd019
lea eax, [edi + 3]
call fcn.0053e940
mov edx, esp
mov ecx, edx
sub ecx, esi
nop
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x4bcfe0
mov al, byte [edx + edi - 1]
cmp al, 0x2f
je 0x4bd00e
cmp al, 0x5c
je 0x4bd00e
mov ax, word [0x5b1250]
mov word [edx + edi], ax
mov al, byte [0x5b1252]
mov byte [edx + edi + 2], al
jmp 0x4bd017
mov eax, 0x2a
mov word [edx + edi], ax
mov esi, edx
push dword [ebx]
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ecx, dword [ebx]
mov dword [ecx + 0x140], eax
mov eax, dword [ebx]
cmp dword [eax + 0x140], 0xffffffff
jne 0x4bd07f
push eax
call fcn.005414d0
add esp, 4
mov dword [ebx], 0
call fcn.005414b2
mov dword [eax], 0x16
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.005414b2
mov dword [eax], 2
xor eax, eax
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
push eax
push dword [eax + 0x140]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4bd04f
mov ecx, dword [ebx]
push 0xff
lea eax, [ecx + 0x2c]
push eax
lea eax, [ecx + 0x144]
push eax
call fcn.00551270
mov eax, dword [ebx]
add esp, 0xc
mov byte [eax + 0x243], 0
mov eax, dword [ebx]
add eax, 0x144
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4be440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
sub eax, ebx
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 4], eax
cmp ecx, ebx
jb 0x4be58b
cmp ebx, 0x40
ja 0x4be58b
lea eax, [ebp - 0x98]
neg eax
push esi
push edi
and eax, 0x3f
lea edi, [ebp - 0x98]
add edi, eax
lea eax, [ebx + 0x100]
mov dword [ebp - 0x18], edi
cmp ecx, eax
jbe 0x4be49f
mov eax, ecx
sub eax, ebx
sub eax, 0x100
mov dword [ebp - 4], eax
push ebx
xor esi, esi
mov dword [ebp - 8], 0
push esi
push edi
call fcn.0053f280
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], esi
cmp ecx, dword [eax + 0xc]
jae 0x4be54c
mov edx, ecx
sub edx, dword [eax + 8]
mov dword [ebp - 0x10], edx
nop dword [eax]
mov ebx, dword [ebp + 0xc]
mov eax, ecx
xor eax, dword [ebp - 0x14]
lea edi, [eax - 1]
not eax
shr eax, 0x1f
shr edi, 0x1f
and edi, eax
mov eax, dword [ebp + 0xc]
neg edi
xor edx, dword [eax + 8]
mov eax, ecx
xor eax, dword [ebx + 8]
or edx, eax
mov eax, dword [ebx + 0x14]
xor edx, ecx
mov ebx, dword [ebp + 0x10]
shr edx, 0x1f
neg edx
mov cl, byte [eax + ecx]
mov eax, edi
or eax, dword [ebp - 8]
and eax, edx
mov edx, dword [ebp - 0xc]
and edi, edx
mov dword [ebp - 8], eax
and al, cl
or esi, edi
mov edi, dword [ebp - 0x18]
or byte [edx + edi], al
inc edx
mov ecx, edx
mov eax, edx
sub ecx, ebx
xor eax, ebx
xor ecx, ebx
or ecx, eax
mov eax, dword [ebp + 0xc]
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
inc ecx
mov edx, dword [ebp - 0x10]
inc edx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], edx
cmp ecx, dword [eax + 0xc]
jb 0x4be4d0
xor edx, edx
test ebx, ebx
je 0x4be57f
mov ecx, dword [ebp + 8]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + edi]
movzx eax, byte [esi + edi]
inc esi
mov byte [edx + ecx], al
mov ecx, esi
sub ecx, ebx
mov eax, esi
xor ecx, ebx
xor eax, ebx
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, ebx
jb 0x4be552
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push 0x612
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_ssl_record_ssl3_record.c
push str.Assertion_failed:_rec__orig_len___md_size__md_size___EVP_MAX_MD_SIZE
call fcn.004594a0
add esp, 0xc
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4bf5e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
inc ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
mov eax, dword [esi + 4]
mov ecx, dword [edi + 8]
mov eax, dword [eax + 0x64]
test byte [eax + 0x30], 1
je 0x4bf628
mov edx, dword [ebp + 0x10]
lea eax, [ebx + edx]
cmp eax, ecx
jbe 0x4bf618
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
add dword [edi + 0x14], edx
sub ecx, edx
add dword [edi + 0x18], edx
sub dword [edi + 0xc], edx
mov dword [edi + 8], ecx
jmp 0x4bf62c
cmp ebx, ecx
ja 0x4bf60f
mov eax, dword [edi + 0x14]
push dword [esi + 0x3c8]
mov al, byte [eax + ecx - 1]
movzx ebx, al
mov byte [ebp + 0x17], al
mov dword [ebp + 8], ebx
call fcn.0044de30
push eax
call fcn.0044dff0
mov esi, dword [edi + 8]
add esp, 8
mov dword [ebp - 0x10], esi
and eax, 0x200000
je 0x4bf66f
sub esi, ebx
mov eax, 1
dec esi
mov dword [edi + 8], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov ebx, esi
mov edx, dword [ebp + 8]
mov eax, esi
add ecx, edx
sub ebx, ecx
xor eax, ecx
xor ebx, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
cmovb eax, esi
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4bf6eb
mov eax, edx
dec esi
shr eax, 0x1f
mov dword [ebp - 8], eax
mov eax, dword [edi + 0x14]
add eax, esi
xor edi, edi
mov esi, eax
nop dword [eax]
movzx eax, byte [ebp - 8]
lea esi, [esi - 1]
sub edx, edi
mov ecx, edi
shr edx, 0x1f
inc edi
shr ecx, 0x1f
xor dl, cl
xor al, cl
movzx ecx, byte [ebp + 0x17]
or dl, al
movzx eax, byte [esi + 1]
dec dl
movzx edx, dl
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [ebp + 8]
cmp edi, dword [ebp - 0xc]
jb 0x4bf6b0
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
not ebx
lea eax, [edx + 1]
movzx ecx, bl
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov eax, ecx
mov dword [edi + 8], esi
and eax, 1
pop edi
not ecx
pop esi
or eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c3070
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov ecx, dword [ebp + 0xc]
xor edx, edx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 4], edx
mov eax, dword [esi]
test edi, edi
je 0x4c30b3
cmp edi, eax
je 0x4c30a7
test ecx, ecx
je 0x4c314a
test ebx, ebx
js 0x4c314a
mov edx, 1
mov dword [esi], edi
mov dword [ebp - 4], edx
jmp 0x4c30bd
test eax, eax
je 0x4c314a
mov edi, eax
test ecx, ecx
je 0x4c319a
push edi
mov dword [ebp - 4], 1
call fcn.0044e4c0
mov ecx, eax
add esp, 4
xor eax, eax
mov dword [ebp - 8], ecx
cmp ecx, 0x90
setle al
mov dword [ebp + 0x14], eax
jle 0x4c3104
push 0x29
push str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_hmac_hmac.c
push str.Assertion_failed:_j____int_sizeof_ctx__key_
call fcn.004594a0
mov eax, dword [ebp + 0x14]
add esp, 0xc
mov ecx, dword [ebp - 8]
test eax, eax
je 0x4c314a
cmp ecx, ebx
jge 0x4c3153
push dword [ebp + 0x18]
push edi
push dword [esi + 4]
call fcn.004626c0
add esp, 0xc
test eax, eax
je 0x4c314a
mov eax, dword [ebp + 0xc]
push ebx
push eax
push dword [esi + 4]
call fcn.00462860
add esp, 0xc
test eax, eax
je 0x4c314a
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.00462620
add esp, 0xc
test eax, eax
jne 0x4c3173
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 0x90
ja 0x4c314a
mov eax, dword [ebp + 0xc]
push ebx
push eax
lea eax, [esi + 0x14]
push eax
call fcn.0053f3e0
lea eax, [esi + 0x10]
add esp, 0xc
mov dword [eax], ebx
jmp 0x4c3176
lea eax, [esi + 0x10]
mov ecx, dword [eax]
cmp ecx, 0x90
je 0x4c31a2
mov eax, 0x90
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call fcn.0053f280
add esp, 0xc
jmp 0x4c31a2
test edx, edx
je 0x4c3244
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [ebp + ecx - 0x98], al
inc ecx
cmp ecx, 0x90
jl 0x4c31b0
mov ebx, dword [ebp + 0x18]
push ebx
push edi
push dword [esi + 8]
call fcn.004626c0
add esp, 0xc
test eax, eax
je 0x4c3260
push edi
call fcn.0044e4c0
push eax
lea eax, [ebp - 0x98]
push eax
push dword [esi + 8]
call fcn.00462860
add esp, 0x10
test eax, eax
je 0x4c3260
xor ecx, ecx
nop dword [eax]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [ebp + ecx - 0x98], al
inc ecx
cmp ecx, 0x90
jl 0x4c3200
push ebx
push edi
push dword [esi + 0xc]
call fcn.004626c0
add esp, 0xc
test eax, eax
je 0x4c3260
push edi
call fcn.0044e4c0
push eax
lea eax, [ebp - 0x98]
push eax
push dword [esi + 0xc]
call fcn.00462860
add esp, 0x10
test eax, eax
je 0x4c3260
push dword [esi + 8]
push dword [esi + 4]
call fcn.004629e0
xor ebx, ebx
add esp, 8
test eax, eax
mov ecx, 1
cmovne ebx, ecx
jmp 0x4c3262
xor ebx, ebx
cmp dword [ebp - 4], 0
je 0x4c327c
lea eax, [ebp - 0x98]
push 0x90
push eax
call fcn.00457920
add esp, 8
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4cfc70
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 4], ecx
push ebx
push esi
test eax, eax
je 0x4cfc8d
test byte [eax + 0x5c], 2
mov ebx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x4cfc92
mov ebx, 0x5ba2d0
mov esi, dword [ebp + 0x14]
test esi, esi
jle 0x4cfd65
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
inc edi
movzx eax, byte [edi - 1]
cmp esi, 3
jl 0x4cfcf3
movzx ecx, byte [edi]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 1]
shl eax, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
mov ecx, eax
shr ecx, 6
and ecx, 0x3f
and eax, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 2], cl
mov cl, byte [eax + ebx]
lea eax, [edx + 3]
jmp 0x4cfd3d
shl eax, 0x10
cmp esi, 2
jne 0x4cfd03
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
inc edx
and ecx, 0x3f
mov dword [ebp + 0xc], edx
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
cmp esi, 1
jne 0x4cfd29
mov al, 0x3d
jmp 0x4cfd32
shr eax, 6
and eax, 0x3f
mov al, byte [eax + ebx]
mov byte [edx + 1], al
mov cl, 0x3d
mov eax, dword [ebp + 0xc]
add eax, 2
mov byte [eax], cl
lea edx, [eax + 1]
mov ecx, dword [ebp - 4]
sub esi, 3
add ecx, 4
add edi, 3
mov dword [ebp - 4], ecx
test esi, esi
jg 0x4cfca5
pop edi
pop esi
mov byte [edx], 0
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
mov byte [eax], cl
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x4d4b00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d4cf0

Function at 0x4d4b10
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0x30
mov eax, 1
pop ebp
ret
Function at 0x4d4bd0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd8
mov eax, dword [ebp + 0x10]
xorps xmm0, xmm0
push esi
push dword [ebp + 0xc]
test eax, eax
mov dword [ebp - 0xd8], 0xf3bcc908
push dword [ebp + 8]
mov esi, 0x600828
mov dword [ebp - 0xd4], 0x6a09e667
cmovne esi, eax
mov dword [ebp - 0xd0], 0x84caa73b
lea eax, [ebp - 0xd8]
mov dword [ebp - 0xcc], 0xbb67ae85
push eax
mov dword [ebp - 0xc8], 0xfe94f82b
mov dword [ebp - 0xc4], 0x3c6ef372
mov dword [ebp - 0xc0], 0x5f1d36f1
mov dword [ebp - 0xbc], 0xa54ff53a
mov dword [ebp - 0xb8], 0xade682d1
mov dword [ebp - 0xb4], 0x510e527f
mov dword [ebp - 0xb0], 0x2b3e6c1f
mov dword [ebp - 0xac], 0x9b05688c
mov dword [ebp - 0xa8], 0xfb41bd6b
mov dword [ebp - 0xa4], 0x1f83d9ab
mov dword [ebp - 0xa0], 0x137e2179
mov dword [ebp - 0x9c], 0x5be0cd19
movlpd qword [ebp - 0x98], xmm0
movlpd qword [ebp - 0x90], xmm0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0x40
call fcn.004d55e0
lea eax, [ebp - 0xd8]
push eax
push esi
call fcn.004d4cf0
lea eax, [ebp - 0xd8]
push 0xd8
push eax
call fcn.00457920
add esp, 0x1c
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret