joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403160
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, 0x43
not edi
ror edx, 0xef
sbb edi, 0xd6
imul eax
mov ebx, 0xc1
imul ebx
bswap esi
or edx, 0x44
dec edi
bswap eax
ror esi, 0xeb
inc edx
mov esi, 0xe6
inc esi
add esi, 0x73
sub edx, 0x57
neg edi
rcl edi, 0x9c
neg ebx
and edx, 0xf9
imul eax
rcr edi, 0x5b
and esi, 0xcd
imul edi
add eax, 0xe0
dec ebx
add edi, 0xf6
sbb esi, 0xc4
imul ebx
rol edx, 0x2e
not edi
mov eax, 0x7d
sub edi, 0x49
bswap edi
mov edx, pe_nt_image_headers32
dec edx
inc edx
dec ebx
bswap edi
mov edx, 0x3f
rol eax, 0x19
dec ebx
inc esi
ror edx, 0x3f
rcr esi, 0x2a
rcr edx, 0x80
rcl edi, 0xfb
rcr eax, 0xec
dec esi
xor ecx, ecx
xor edi, edi
mov ebx, 0xbb
not ebx
or ebx, 0xc8
add ebx, 0x74
bswap edi
rcr edx, 0xf7
imul esi
neg ebx
not edx
inc edx
not edi
inc edx
ror ebx, 0x8c
and edx, 0x98
rcl ebx, 0xb9
sub edi, 0xde
imul ebx
sub eax, 0x1e
bswap eax
and eax, 0x12
not esi
dec edi
add esi, 0x83
neg edx
neg ebx
bswap ebx
ror ebx, 0xc0
and ebx, 0x85
not edx
add eax, 0x4c
imul edx
mov eax, 0x75
neg edx
sbb ebx, 0x7e
imul edx
add esi, 0x19
bswap esi
rol esi, 0x39
mov eax, 0xc7
sbb edi, 0xdf
rol esi, 0x96
rcr esi, 0xd1
imul edi
or edx, 0x87
and eax, 0x49
neg ebx
sbb ebx, 0x27
rol edx, 0x2a
bswap ebx
bswap esi
mov ecx, dword [ebp + 0xc]
or edx, 0x6a
rol ebx, 0x94
and edi, 0x8a
add ebx, 0x77
bswap edx
imul esi
rcl edi, 0xd0
sbb ebx, 0xb3
dec eax
rcl eax, 0xbd
sbb edi, 0x5b
and ebx, 0x7b
bswap ebx
neg edi
imul edi
bswap ebx
rcl eax, 0x78
dec edx
inc ebx
mov ebx, 0x96
imul edi
sub ebx, 0x77
neg edx
inc ebx
bswap ebx
bswap esi
add ebx, 0x54
ror edx, 0xe4
not edi
and ebx, 0x53
add edx, 0xa
rcr ebx, 0xae
or edx, 0x85
dec edi
neg eax
bswap edi
not edx
dec ebx
add edx, 0x14
dec ebx
sbb edi, 0x42
bswap esi
and edi, 0x9a
neg edi
rol edx, 0x86
dec ebx
rcl edi, 0x32
dec ebx
rcr eax, 0xcf
imul eax
mov edi, dword [ebp + 8]
mov ebx, eax
xor eax, esi
xor eax, eax
not byte [edi]
mov eax, ebx
xor ebx, ebx
mov esi, esi
xor eax, esi
xor ebx, esi
mov eax, esi
mov esi, esi
xor esi, esi
xor eax, esi
add byte [edi], 0x36
xor ebx, ebx
mov ebx, eax
mov ebx, ebx
mov ebx, esi
mov eax, esi
mov ebx, esi
xor esi, eax
xor eax, esi
mov esi, eax
sub byte [edi], 0x75
mov esi, ebx
xor esi, ebx
xor esi, eax
mov esi, esi
xor eax, esi
xor eax, eax
mov esi, ebx
mov esi, esi
xor ebx, eax
imul byte [edi]
inc edi
loop 0x40331f
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x415a40
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, dword [edi]
inc edx
cmp eax, 0x302
mov dword [esp + 0x18], edx
jge 0x415a6d
cmp eax, 0x100
je 0x415a6d
mov esi, dword [esp + 0x10]
cmp edx, dword [esi + 4]
jbe 0x415a89
pop edi
xor eax, eax
pop esi
ret
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov eax, dword [esi + 4]
add edx, ecx
cmp edx, eax
ja 0x415a68
add dword [esi + 0xc], ecx
add dword [esi + 0x10], ecx
sub eax, ecx
mov dword [esi + 4], eax
test dword [edi + 0x100], 0x200
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 4]
push ebx
movzx ebx, byte [eax + ecx - 1]
push ebp
je 0x415aea
cmp dword [edi + 0x88], 0
jne 0x415aea
mov edx, dword [edi + 0x58]
mov ecx, 8
mov eax, 0x583d88
add edx, ecx
sub edx, eax
lea esp, [esp]
mov ebp, dword [edx + eax]
cmp ebp, dword [eax]
jne 0x415add
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x415ac0
test bl, 1
jne 0x415add
mov eax, dword [edi + 0x58]
or dword [eax], 8
mov edx, dword [edi + 0x58]
test byte [edx], 8
je 0x415aea
test ebx, ebx
jbe 0x415aea
dec ebx
mov eax, dword [edi + 0x80]
mov ecx, dword [eax]
push ecx
call fcn.0042af50
add esp, 4
test eax, 0x200000
je 0x415b14
or edx, 0xffffffff
pop ebp
sub edx, ebx
add dword [esi + 4], edx
pop ebx
pop edi
mov eax, 1
pop esi
ret
mov edx, dword [esi + 4]
mov eax, edx
sub eax, ebx
sub eax, dword [esp + 0x20]
mov ecx, 0xff
not eax
lea edi, [edx - 1]
sar eax, 0x1f
cmp edi, ecx
jae 0x415b32
mov ecx, edi
test ecx, ecx
jbe 0x415b6d
mov edi, dword [esi + 0xc]
mov dword [esp + 0x20], ebx
lea edi, [edi + edx - 1]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x20]
movzx ebp, byte [edi]
not ecx
sar ecx, 0x1f
movzx ecx, cl
xor ebp, ebx
and ecx, ebp
not ecx
and eax, ecx
mov ecx, 1
sub dword [esp + 0x20], ecx
sub edi, ecx
sub dword [esp + 0x14], ecx
jne 0x415b45
mov ecx, eax
shr ecx, 4
and eax, ecx
mov ecx, eax
shr ecx, 2
and eax, ecx
lea ecx, [eax + eax]
and ecx, eax
shl ecx, 0x1e
sar ecx, 0x1f
lea eax, [ebx + 1]
and eax, ecx
sub edx, eax
shl eax, 8
or dword [esi], eax
pop ebp
mov eax, ecx
pop ebx
and eax, 1
not ecx
pop edi
mov dword [esi + 4], edx
or eax, ecx
pop esi
ret
Function at 0x415bb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x98
call fcn.004bcc80
mov eax, dword [0x5c30d8]
xor eax, esp
mov dword [esp + 0x94], eax
mov ecx, dword [esp + 0xa0]
mov eax, dword [esp + 0x9c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0xb0]
push edi
mov edi, dword [ecx + 4]
mov dword [esp + 0x10], edi
sub edi, esi
xor ebx, ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], edi
cmp dword [esp + 0xb8], esi
jae 0x415c14
push str.orig_len___md_size
push 0x113
push str.._ssl_s3_cbc.c
call fcn.00426230
add esp, 0xc
cmp esi, 0x40
jbe 0x415c30
push str.md_size___EVP_MAX_MD_SIZE
push 0x114
push str.._ssl_s3_cbc.c
call fcn.00426230
add esp, 0xc
mov eax, dword [esp + 0xb8]
lea ebp, [esp + 0x24]
neg ebp
and ebp, 0x3f
lea edx, [esi + 0x100]
lea ebp, [esp + ebp + 0x24]
cmp eax, edx
jbe 0x415c58
mov ebx, eax
sub ebx, esi
sub ebx, 0x100
mov eax, esi
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebx
add eax, edi
xor edx, edx
div esi
push esi
push 0
push ebp
mov edi, edx
mov dword [esp + 0x28], edi
call fcn.00507800
add esp, 0xc
xor ecx, ecx
cmp ebx, dword [esp + 0xb8]
jae 0x415cf5
mov eax, dword [esp + 0xb0]
mov eax, dword [eax + 0xc]
mov edx, dword [esp + 0x10]
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xb8]
mov edi, ebx
sub edi, edx
sub edx, dword [esp + 0x14]
sub eax, ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
jmp 0x415cb8
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov bl, byte [ebx]
mov eax, edi
not eax
sar eax, 0x1f
add edx, edi
not al
and al, bl
not edx
sar edx, 0x1f
and al, dl
or byte [ecx + ebp], al
mov edx, 1
add dword [esp + 0x18], edx
add ecx, edx
mov eax, ecx
sub eax, esi
sar eax, 0x1f
and ecx, eax
add edi, edx
sub dword [esp + 0x10], edx
jne 0x415cb4
mov edi, dword [esp + 0x1c]
xor eax, eax
test esi, esi
jbe 0x415d21
jmp 0x415d00
mov ecx, edi
xor ecx, 0x20
mov dl, byte [ecx + ebp]
mov cl, byte [edi + ebp]
mov edx, dword [esp + 0x20]
mov byte [edx + eax], cl
inc edi
mov ecx, edi
sub ecx, esi
sar ecx, 0x1f
inc eax
and edi, ecx
cmp eax, esi
jb 0x415d00
mov ecx, dword [esp + 0xa4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004bcc20
add esp, 0x98
ret
Function at 0x416f10
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.004bcc80
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x58]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
xor ebp, ebp
push ebp
xor esi, esi
call fcn.00403810
add esp, 0xc
test eax, eax
je 0x416f68
lea ecx, [ecx]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
shl edx, 0xa
test eax, edx
je 0x416f50
inc esi
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
inc ebp
push ebp
call fcn.00403810
add esp, 0xc
test eax, eax
jne 0x416f40
mov eax, dword [esp + 0x4c]
cdq
idiv esi
mov ebx, eax
cmp esi, 1
jne 0x416f7e
mov dword [esp + 0x4c], 0
mov eax, dword [esp + 0x50]
mov ebp, dword [esp + 0x48]
push edi
push 0
push eax
call fcn.00507800
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
mov dword [esp + 0x60], 0
call fcn.00403810
add esp, 0x18
test eax, eax
je 0x41705f
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
shl eax, 0xa
test ecx, eax
je 0x41703b
mov esi, dword [esp + 0x14]
test esi, esi
je 0x41706c
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
push edi
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x3c]
push edx
mov edx, dword [esp + 0x6c]
push eax
and edx, 1
push ecx
mov ecx, dword [esp + 0x58]
add edx, ebx
push edx
mov edx, dword [esp + 0x64]
push ebp
call fcn.00416b10
add esp, 0x30
test eax, eax
je 0x41708a
add ebp, ebx
test edi, edi
jle 0x41703b
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
sub ecx, eax
mov esi, edi
lea ecx, [ecx]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub esi, 1
jne 0x417030
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
inc eax
push edx
push eax
mov dword [esp + 0x54], eax
call fcn.00403810
add esp, 0xc
test eax, eax
jne 0x416fb3
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
push 0x114
push str.._ssl_t1_enc.c
push 0x146
push 0x11c
push 0x14
call fcn.004230c0
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
Function at 0x4235a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.004bcc80
mov eax, dword [0x5c30d8]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x3c], 0
test esi, esi
jne 0x4235e7
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.004bcc20
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call fcn.00558c76
add esp, 8
test eax, eax
jl 0x4235d0
mov eax, 8
call fcn.004bcc80
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.00423800
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x4235d0
push 0x560930
push esi
call fcn.0050b7be
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
je 0x4236c1
jmp 0x423644
mov eax, dword [esp + 0x40]
test ebx, ebx
jle 0x423652
cmp ebx, 0x400
mov esi, ebx
jl 0x423657
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x80]
push 1
push edx
call fcn.0050b9a1
mov edi, eax
add esp, 0x10
mov dword [esp + 0x44], edi
test edi, edi
jle 0x4236a5
fild dword [esp + 0x44]
mov eax, 8
call fcn.004bcc80
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.00423800
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x423640
sub ebx, esi
test ebx, ebx
jg 0x423640
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0050b54f
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.00481d90
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004bcc20
mov esp, ebp
pop ebp
ret

Function at 0x4253f0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.00507800
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret
Function at 0x426110
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.004bcc80
mov eax, dword [0x5c30d8]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x426175
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x426175
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.004baf20
add eax, 0x40
push eax
call fcn.0055a50a
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004bcc20
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.0055a522
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x426204
call fcn.00425fd0
test eax, eax
jle 0x426204
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004bcc20
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.004bcc20
add esp, 0x108
ret

Function at 0x426260
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x426284
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
sub edi, 1
jne 0x426276
pop esi
movzx eax, cl
pop edi
ret

Function at 0x426670
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x4266b7
mov al, byte [edx]
test al, al
je 0x4266b7
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x426687
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x426e30
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov edx, dword [edi + 0x1c]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.0041a010
add esp, 8
test esi, esi
jg 0x426e8e
je 0x426e6c
cmp esi, 0xffffffff
jne 0x426e8e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 4
je 0x426e83
cmp eax, 0xb
je 0x426e83
cmp eax, 0x2733
jne 0x426e8e
push 0xa
push edi
call fcn.0041a030
add esp, 8
pop edi
mov eax, esi
pop esi
ret
Function at 0x42d160
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24
call fcn.004bcc80
mov eax, dword [0x5c30d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, esi
push edi
mov dword [ebp - 0x18], esi
lea ecx, [eax + 1]
jmp 0x42d190
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x42d190
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
sub eax, ecx
lea edi, [eax + 1]
push edi
push esi
push 8
push 0xfde9
mov dword [ebp - 0x20], 8
call ebx
mov esi, eax
test esi, esi
jg 0x42d208
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ec
jne 0x42d1ea
mov ecx, dword [ebp - 0x18]
push 0
push 0
push edi
push ecx
push 0
push 0xfde9
mov dword [ebp - 0x20], 0
call ebx
mov esi, eax
test esi, esi
jg 0x42d208
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x42d29a
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push edx
push eax
jmp 0x42d288
lea eax, [esi + esi]
call fcn.0052ab60
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov eax, esp
push esi
push eax
push edi
push ecx
push edx
push 0xfde9
mov dword [ebp - 0x24], eax
call ebx
test eax, eax
je 0x42d29a
mov esi, dword [ebp - 0x1c]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42d233
push 8
sub eax, edx
lea ecx, [ebp - 0x14]
push ecx
inc eax
push eax
push esi
push 0
push 0xfde9
call ebx
test eax, eax
je 0x42d29a
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.0050b7a7
mov esi, eax
add esp, 8
test esi, esi
jne 0x42d33e
call fcn.0050b36a
cmp dword [eax], 2
je 0x42d280
call fcn.0050b36a
cmp dword [eax], 9
jne 0x42d292
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push ecx
push edx
call fcn.0050b7be
mov esi, eax
add esp, 8
test esi, esi
jne 0x42d33e
push 0xa9
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.004230c0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0x57fb54
push eax
push 0x5960e8
push ecx
push str.fopen_
push 5
call fcn.004233c0
add esp, 0x2c
call fcn.0050b36a
cmp dword [eax], 2
jne 0x42d310
push 0xac
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.004230c0
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcc20
mov esp, ebp
pop ebp
ret
push 0xae
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.004230c0
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcc20
mov esp, ebp
pop ebp
ret
push 0x5c70d8
call fcn.0041a5e0
mov edi, eax
add esp, 4
test edi, edi
jne 0x42d370
push esi
call fcn.0050b54f
add esp, 4
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcc20
mov esp, ebp
pop ebp
ret
push 0
push edi
call fcn.0041a010
push esi
push 1
push 0x6a
push edi
call fcn.0041a370
add esp, 0x18
mov eax, edi
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004bcc20
mov esp, ebp
pop ebp
ret
Function at 0x437720
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.004bcc80
mov eax, dword [0x5c30d8]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebp, ebp
je 0x43776f
mov eax, 1
mov dword [esi], ebp
jmp 0x437771
mov ebp, dword [esi]
test ecx, ecx
je 0x437854
push ebp
call fcn.00430300
mov ebx, eax
add esp, 4
cmp ebx, 0x80
jle 0x4377a0
push str.j____int_sizeof_ctx__key_
push 0x68
push str..cryptohmachmac.c
call fcn.00426230
add esp, 0xc
mov edi, dword [esp + 0xa8]
cmp ebx, edi
jge 0x4377f7
mov ecx, dword [esp + 0x10]
push ecx
lea ebx, [esi + 4]
push ebp
push ebx
call fcn.0042a350
add esp, 0xc
test eax, eax
je 0x4378f6
mov edx, dword [esp + 0x14]
push edi
push edx
push ebx
call fcn.0042a500
add esp, 0xc
test eax, eax
je 0x4378f6
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.0042a510
add esp, 0xc
test eax, eax
je 0x4378f6
jmp 0x437831
cmp edi, 0x80
jbe 0x437813
push str.len_0__len__int_sizeof_ctx__key_
push 0x75
push str..cryptohmachmac.c
call fcn.00426230
add esp, 0xc
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edx, [esi + 0x50]
push edx
call fcn.00507280
mov eax, dword [esp + 0xb4]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], eax
mov edi, dword [edi]
cmp edi, 0x80
je 0x43785c
mov ecx, 0x80
sub ecx, edi
push ecx
lea edx, [edi + esi + 0x50]
push 0
push edx
call fcn.00507800
add esp, 0xc
jmp 0x43785c
test eax, eax
je 0x4378e2
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x437860
mov edi, dword [esp + 0x10]
push edi
lea ebx, [esi + 0x1c]
push ebp
push ebx
call fcn.0042a350
add esp, 0xc
test eax, eax
je 0x4378f6
push ebp
call fcn.00430300
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.0042a500
add esp, 0x10
test eax, eax
je 0x4378f6
xor eax, eax
mov cl, byte [esi + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x4378a4
push edi
lea ebx, [esi + 0x34]
push ebp
push ebx
call fcn.0042a350
add esp, 0xc
test eax, eax
je 0x4378f6
push ebp
call fcn.00430300
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.0042a500
add esp, 0x10
test eax, eax
je 0x4378f6
lea eax, [esi + 0x1c]
push eax
add esi, 4
push esi
call fcn.0042a6a0
add esp, 8
test eax, eax
jne 0x4378fa
xor eax, eax
jmp 0x4378ff
mov eax, 1
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004bcc20
add esp, 0x8c
ret
Function at 0x437af0
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
lea eax, [ecx + 1]
ret

Function at 0x437b90
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret

Function at 0x4381e0
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.00507800
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
mov eax, 1
pop esi
ret

Function at 0x438240
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.00507800
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
pop esi
ret
Function at 0x450060
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x450143
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
movzx edx, byte [esi]
jl 0x4500de
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x450130
shl edx, 0x10
cmp edi, 2
jne 0x4500ef
movzx eax, byte [esi + 1]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x45011d
lea edx, [edi + 0x3c]
jmp 0x45012a
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x450080
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret