joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426b30
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx + 4]
push esi
push edi
add eax, 0x18
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [esp + 0x24], 0
push 0
je 0x426b5f
mov ecx, dword [ebx + 4]
push 0
call fcn.00427400
pop edi
pop esi
pop ebx
ret 0x18
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
cmp eax, 0xffffffff
jne 0x426b7d
mov ecx, dword [ebx + 4]
push 0x2719
call fcn.00427400
pop edi
pop esi
pop ebx
ret 0x18
mov edx, dword [esp + 0x24]
push esi
push edx
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x28]
push edx
push ecx
push eax
mov dword [esp + 0x40], 0
call dword [sym.imp.WS2_32.dll_WSASend]
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
jne 0x426bb5
mov eax, 0x274d
test edi, edi
je 0x426bd4
cmp eax, 0x3e5
je 0x426bd4
mov edx, dword [esp + 0x24]
mov ecx, dword [ebx + 4]
push edx
push eax
call fcn.00427400
pop edi
pop esi
pop ebx
ret 0x18
mov ecx, dword [ebx + 4]
mov edi, esi
call fcn.004274c0
pop edi
pop esi
pop ebx
ret 0x18

Function at 0x427570
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx + 4]
push esi
push edi
add eax, 0x18
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp byte [esp + 0x24], 0
push 0
je 0x42759f
mov ecx, dword [ebx + 4]
push 0
call fcn.00427400
pop edi
pop esi
pop ebx
ret 0x18
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
cmp eax, 0xffffffff
jne 0x4275bd
mov ecx, dword [ebx + 4]
push 0x2719
call fcn.00427400
pop edi
pop esi
pop ebx
ret 0x18
mov edx, dword [esp + 0x24]
push esi
mov dword [esp + 0x18], edx
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x30]
push edx
mov edx, dword [esp + 0x28]
push ecx
push edx
push eax
mov dword [esp + 0x40], 0
call dword [sym.imp.WS2_32.dll_WSARecv]
mov edi, eax
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x4275fd
mov eax, 0x2746
jmp 0x427609
cmp eax, 0x4d2
jne 0x427609
mov eax, 0x274d
test edi, edi
je 0x427628
cmp eax, 0x3e5
je 0x427628
mov ecx, dword [esp + 0x24]
push ecx
mov ecx, dword [ebx + 4]
push eax
call fcn.00427400
pop edi
pop esi
pop ebx
ret 0x18
mov ecx, dword [ebx + 4]
mov edi, esi
call fcn.004274c0
pop edi
pop esi
pop ebx
ret 0x18
Function at 0x42b990
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55200e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x70
call fcn.00525ec0
mov eax, dword [ebp + 0xc]
movq xmm0, qword [eax]
push esi
push edi
movq qword [esp + 0x18], xmm0
movq xmm0, qword [eax + 8]
mov eax, dword [ebp + 8]
push eax
push ecx
push edx
lea eax, [esp + 0x38]
push eax
lea edi, [esp + 0x28]
movq qword [esp + 0x30], xmm0
call fcn.0042c280
mov edi, eax
xor eax, eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x10], eax
call fcn.0050cbc0
mov dword [esp + 0x14], eax
mov esi, dword [edi]
mov dword [edi + 0x34], 1
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
and eax, 0xffff0000
lea ecx, [edi + 4]
add eax, 0x10000
push ecx
mov dword [edi + 0x30], eax
call fcn.0042cb10
or eax, 0xffffffff
mov dword [esp + 0x84], eax
lea edx, [esp + 0x30]
mov dword [esp + 0xc], edx
mov dword [esp + 0x84], eax
mov eax, edx
push eax
call fcn.00401930
mov ecx, dword [esp + 0x7c]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42ba60
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x55200e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x6c
call fcn.00525ec0
mov eax, dword [ebp + 0xc]
movq xmm0, qword [eax]
push edi
movq qword [esp + 0x10], xmm0
movq xmm0, qword [eax + 8]
mov eax, dword [ebp + 8]
push eax
push ecx
push edx
lea eax, [esp + 0x30]
push eax
lea edi, [esp + 0x20]
movq qword [esp + 0x28], xmm0
call fcn.0042c280
mov edi, eax
xor eax, eax
mov dword [esp + 0x7c], eax
mov dword [esp + 8], eax
call fcn.0050cbc0
mov dword [esp + 0xc], eax
mov dword [edi + 0x34], 1
mov eax, dword [esp + 8]
neg eax
sbb eax, eax
and eax, 0xffff0000
add eax, 0x10000
mov dword [edi + 0x30], eax
mov eax, dword [edi]
mov ecx, dword [eax]
lea edx, [edi + 4]
push edx
add eax, 4
push eax
push ecx
call fcn.0042cf20
or eax, 0xffffffff
mov dword [esp + 0x7c], eax
lea ecx, [esp + 0x28]
mov dword [esp + 4], ecx
mov dword [esp + 0x7c], eax
mov edx, ecx
push edx
call fcn.00401930
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x42e470
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x54f765
mov eax, dword fs:[0]
push eax
mov eax, 0x28
mov dword fs:[0], esp
call fcn.00525ec0
push ebx
push ebp
mov ebp, dword [esp + 0x4c]
push esi
push edi
lea eax, [ebp + 0x1c]
push eax
push 0x64
mov esi, ecx
mov dword [esp + 0x20], ebp
call fcn.0040b630
mov edi, eax
xor ebx, ebx
mov dword [esp + 0x24], edi
add esp, 8
mov dword [esp + 0x20], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x10], edi
mov byte [esp + 0x40], 1
cmp edi, ebx
je 0x42e500
push ebp
push esi
lea eax, [ebx + 8]
mov byte [esp + 0x5c], bl
call fcn.00525ec0
mov ecx, dword [esp + 0x64]
mov ebp, dword [esp + 0x5c]
mov eax, esp
mov dword [esp + 0x24], esp
push ecx
lea ecx, [ebp + 8]
push eax
call fcn.00427340
mov byte [esp + 0x50], 2
push edi
mov byte [esp + 0x54], 1
call fcn.0042eeb0
jmp 0x42e506
mov ebp, dword [esp + 0x4c]
xor eax, eax
mov byte [esp + 0x40], bl
mov ecx, dword [esi]
mov edx, dword [esi + 4]
mov dword [esp + 0x28], ecx
mov ecx, dword [esi + 8]
mov dword [esp + 0x24], edx
mov edx, dword [esi + 0xc]
mov dword [esp + 0x30], ecx
mov ecx, dword [esi + 4]
mov esi, edx
add ecx, esi
test byte [ebp + 4], 0x10
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x34], ecx
je 0x42e542
cmp ecx, ebx
jne 0x42e542
mov cl, 1
jmp 0x42e544
xor cl, cl
mov edx, dword [esp + 0x50]
push ecx
push edx
mov edx, dword [esp + 0x50]
push 2
lea ecx, [esp + 0x30]
push ecx
push ebp
push edx
mov ecx, eax
call fcn.00426b30
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x40], 0xffffffff
lea eax, [esp + 0x18]
push eax
call fcn.0042f840
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret 0x10
Function at 0x442270
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esi + 0x34], 0x1060
mov eax, dword [esi + 0x3c]
push ebx
push ebp
push edi
mov edi, dword [eax + 4]
jne 0x442346
mov ecx, dword [esi + 0x44]
mov eax, 1
sub eax, ecx
push 0
add ecx, edi
push eax
push ecx
mov ecx, esi
call fcn.004574b0
mov ecx, dword [esi + 0x44]
mov edx, 1
sub edx, ecx
add esp, 0xc
cmp eax, edx
jl 0x44232d
add ecx, eax
mov dword [esi + 0x44], ecx
mov dword [esi + 0x34], 0x1061
mov al, byte [edi]
cmp al, 5
je 0x442346
test al, al
je 0x4422f8
push esi
xor ecx, ecx
call fcn.00451c90
add esp, 4
push 0x37b
push str.._ssl_s2_clnt.c
push 0xd4
push 0x14
mov ecx, 0x6e
call fcn.00460970
add esp, 0x10
or eax, 0xffffffff
pop edi
pop ebp
pop ebx
ret
push 0x37d
push str.._ssl_s2_clnt.c
push 0xc8
push 0x14
mov ecx, 0x6e
call fcn.00460970
mov ecx, dword [esi + 0x44]
mov eax, 3
sub eax, ecx
push 0
add ecx, edi
push eax
push ecx
mov ecx, esi
call fcn.004574b0
add esp, 0x1c
test eax, eax
jl 0x4423eb
push eax
push 0x6e
mov ecx, esi
call fcn.00457ee0
add esp, 8
pop edi
pop ebp
pop ebx
ret
mov ecx, dword [esi + 0x54]
mov ebx, dword [ecx + 0x64]
mov eax, dword [esi + 0x3c]
mov ebp, dword [eax + 4]
mov eax, dword [esi + 0x44]
inc ebx
mov edi, ebx
sub edi, eax
push 0
add eax, ebp
push edi
push eax
mov ecx, esi
call fcn.004574b0
add esp, 0xc
cmp eax, edi
jl 0x44232d
mov eax, dword [esi + 0x64]
test eax, eax
je 0x442388
mov edx, dword [esi + 0x68]
mov ecx, dword [esi]
push edx
push esi
push ebx
push ebp
push 0
push ecx
push 0
call eax
add esp, 0x1c
mov ecx, dword [esi + 0x54]
inc ebp
xor dl, dl
cmp dword [ecx + 0x64], 0
lea edi, [ecx + 0x68]
jbe 0x4423e6
mov eax, ebp
sub edi, ebp
mov ebp, dword [ecx + 0x64]
mov edi, edi
mov cl, byte [edi + eax]
xor cl, byte [eax]
inc eax
or dl, cl
sub ebp, 1
jne 0x4423a0
test dl, dl
je 0x4423e6
cmp dword [esi + 0xd4], ebp
jne 0x4423d2
push esi
mov dword [esi + 0xd4], 3
mov dword [esi + 0xd8], ebp
call fcn.00451cc0
add esp, 4
push 0x394
push str.._ssl_s2_clnt.c
push 0x88
jmp 0x4422e2
mov eax, 1
pop edi
pop ebp
pop ebx
ret
Function at 0x4586c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0xc
call fcn.00525ec0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x3c]
xor esi, esi
xor ecx, ecx
mov eax, 0x5b9670
nop
cmp ecx, 5
ja 0x4586f8
mov edx, dword [eax]
mov ebx, dword [ebp + 8]
shl edx, 0xa
test ebx, edx
je 0x4586f2
inc esi
inc ecx
add eax, 4
jmp 0x4586e0
test esi, esi
jne 0x458720
push 0x109
push str.._ssl_t1_enc.c
push 0x44
push 0x14
mov ecx, 0x11c
call fcn.00460970
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x30]
cdq
idiv esi
mov dword [esp + 0x14], eax
cmp esi, 1
jne 0x458736
mov dword [ebp + 0x30], 0
mov eax, dword [ebp + 0x34]
mov ebx, dword [ebp + 0x2c]
push edi
push 0
push eax
call fcn.00516180
add esp, 0xc
mov dword [esp + 0xc], 0
xor ecx, ecx
cmp dword [esp + 0xc], 5
mov dword [esp + 0x10], ecx
ja 0x458806
mov eax, dword [ecx + 0x5b9670]
test eax, eax
je 0x458773
mov edx, dword [ecx + 0x5bdf88]
jmp 0x458775
xor edx, edx
mov ecx, dword [ebp + 8]
shl eax, 0xa
test ecx, eax
je 0x4587e2
test edx, edx
je 0x4587f2
mov eax, dword [ebp + 0x38]
mov ecx, dword [ebp + 0x28]
mov esi, dword [esp + 0x14]
push edi
push eax
mov eax, dword [ebp + 0x24]
push ecx
mov ecx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push ecx
mov ecx, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x30]
and ecx, 1
add ecx, esi
push eax
push ecx
mov ecx, ebx
call fcn.00458300
add esp, 0x2c
test eax, eax
je 0x458717
add ebx, esi
test edi, edi
jle 0x4587e2
mov eax, dword [ebp + 0x34]
mov ecx, dword [ebp + 0x38]
sub ecx, eax
mov esi, edi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub esi, 1
jne 0x4587d7
mov ecx, dword [esp + 0x10]
inc dword [esp + 0xc]
add ecx, 4
jmp 0x458752
push 0x114
push str.._ssl_t1_enc.c
push 0x146
jmp 0x458708
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45a9d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00525ec0
push ebx
mov ebx, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [edi + 8]
mov eax, dword [eax + 0x64]
inc edx
test byte [eax + 0x38], 1
mov dword [esp + 0x10], edx
je 0x45aa11
mov eax, dword [ebx + 4]
add edx, ecx
cmp edx, eax
jbe 0x45aa04
pop edi
xor eax, eax
pop ebx
pop ecx
ret
add dword [ebx + 0xc], ecx
add dword [ebx + 0x10], ecx
sub eax, ecx
mov dword [ebx + 4], eax
jmp 0x45aa16
cmp edx, dword [ebx + 4]
ja 0x45a9fe
test dword [edi + 0x100], 0x200
mov ecx, dword [ebx + 0xc]
mov edx, dword [ebx + 4]
movzx edx, byte [ecx + edx - 1]
push ebp
push esi
je 0x45aa7a
cmp dword [edi + 0x88], 0
jne 0x45aa7a
mov esi, dword [edi + 0x58]
mov ecx, 8
mov eax, 0x58b4e4
add esi, ecx
sub esi, eax
lea esp, [esp]
mov ebp, dword [esi + eax]
cmp ebp, dword [eax]
jne 0x45aa6d
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x45aa50
test dl, 1
jne 0x45aa6d
mov eax, dword [edi + 0x58]
or dword [eax], 8
mov eax, dword [edi + 0x58]
test byte [eax], 8
je 0x45aa7a
test edx, edx
jbe 0x45aa7a
dec edx
mov ecx, dword [edi + 0x80]
mov eax, dword [ecx]
test dword [eax + 0x10], 0x200000
je 0x45aa9e
pop esi
or ecx, 0xffffffff
pop ebp
sub ecx, edx
add dword [ebx + 4], ecx
pop edi
mov eax, 1
pop ebx
pop ecx
ret
mov edi, dword [ebx + 4]
mov eax, dword [esp + 0x18]
add eax, edx
mov esi, edi
sub esi, eax
xor esi, eax
mov ecx, edi
xor ecx, eax
or esi, ecx
xor esi, edi
shr esi, 0x1f
mov ecx, 0xff
lea eax, [edi - 1]
dec esi
mov dword [esp + 0x10], ecx
cmp eax, ecx
jae 0x45aacf
mov ecx, eax
mov dword [esp + 0x10], eax
xor ebp, ebp
test ecx, ecx
jbe 0x45ab1c
mov eax, dword [ebx + 0xc]
mov ecx, edx
lea eax, [edi + eax - 1]
shr ecx, 0x1f
mov dword [esp + 0x18], eax
mov ebx, edx
sub ebx, ebp
shr ebx, 0x1f
mov eax, ebp
shr eax, 0x1f
xor bl, al
xor al, cl
or bl, al
xor bl, cl
dec bl
movzx eax, bl
mov ebx, dword [esp + 0x18]
movzx ebx, byte [ebx]
dec dword [esp + 0x18]
xor ebx, edx
and eax, ebx
not eax
inc ebp
and esi, eax
cmp ebp, dword [esp + 0x10]
jb 0x45aae5
mov ebx, dword [esp + 0x1c]
not esi
and esi, 0xff
lea ecx, [esi - 1]
shr ecx, 0x1f
not esi
shr esi, 0x1f
and ecx, esi
neg ecx
lea eax, [edx + 1]
and eax, ecx
sub edi, eax
shl eax, 8
or dword [ebx], eax
pop esi
mov eax, ecx
pop ebp
mov dword [ebx + 4], edi
and eax, 1
not ecx
pop edi
or eax, ecx
pop ebx
pop ecx
ret
Function at 0x45ab60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa4
call fcn.00525ec0
mov eax, dword [0x5af1b4]
xor eax, esp
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xac]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xb0]
push ebp
sub ecx, edi
xor ebp, ebp
mov dword [esp + 8], ecx
mov dword [esp + 4], ebp
cmp eax, edi
jb 0x45ad22
cmp edi, 0x40
ja 0x45ad0e
push esi
lea esi, [esp + 0x28]
neg esi
and esi, 0x3f
lea edx, [edi + 0x100]
lea esi, [esp + esi + 0x28]
mov dword [esp + 0x10], esi
cmp eax, edx
jbe 0x45abdb
sub eax, edi
sub eax, 0x100
mov dword [esp + 8], eax
mov ebp, eax
mov eax, edi
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, ecx
xor edx, edx
div edi
push ebx
push edi
push 0
push esi
mov ebx, edx
mov dword [esp + 0x28], ebx
call fcn.00516180
mov edx, dword [esp + 0x18]
add esp, 0xc
xor esi, esi
cmp edx, dword [esp + 0xbc]
jae 0x45acbf
mov ecx, dword [esp + 0xb8]
mov ecx, dword [ecx + 4]
mov eax, dword [esp + 0x10]
sub edx, ecx
mov ebx, ecx
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xb8]
mov edx, dword [edx + 0xc]
shr eax, 0x1f
shr ebx, 0x1f
sub ecx, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x28], edx
jmp 0x45ac58
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
add ecx, ebx
shr ecx, 0x1f
xor cl, al
mov edx, ebp
shr edx, 0x1f
xor al, dl
or cl, al
mov eax, ebx
mov bl, byte [esp + 0x18]
shr eax, 0x1f
xor al, bl
xor bl, dl
or al, bl
xor al, dl
dec al
xor cl, dl
mov edx, dword [esp + 0x28]
mov dl, byte [edx + ebp]
not al
inc dword [esp + 0xc]
and al, dl
dec cl
and al, cl
mov ecx, dword [esp + 0x14]
or byte [esi + ecx], al
inc esi
mov eax, esi
sub eax, edi
xor eax, edi
mov ecx, esi
xor ecx, edi
or eax, ecx
xor eax, esi
shr eax, 0x1f
neg eax
inc ebp
and esi, eax
cmp ebp, dword [esp + 0xbc]
jb 0x45ac50
mov ebx, dword [esp + 0x1c]
xor eax, eax
test edi, edi
jbe 0x45acf6
mov esi, dword [esp + 0x14]
mov edx, ebx
xor edx, 0x20
mov cl, byte [edx + esi]
mov dl, byte [ebx + esi]
mov ecx, dword [esp + 0x24]
mov byte [ecx + eax], dl
inc ebx
mov edx, ebx
sub edx, edi
xor edx, edi
mov ecx, ebx
xor ecx, edi
or edx, ecx
xor edx, ebx
shr edx, 0x1f
neg edx
inc eax
and ebx, edx
cmp eax, edi
jb 0x45acc5
mov ecx, dword [esp + 0xac]
pop ebx
pop esi
pop ebp
xor ecx, esp
call fcn.00511c1b
add esp, 0xa4
ret
push str.md_size___EVP_MAX_MD_SIZE
mov ecx, 0xf9
mov edx, str.._ssl_s3_cbc.c
call fcn.00461970
push str.orig_len___md_size
mov ecx, 0xf8
mov edx, str.._ssl_s3_cbc.c
call fcn.00461970
int3
Function at 0x45fe40
Capabilities:
Hash data with md5

Disassembly:
push 0x5c
push 0
push esi
call fcn.00516180
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
ret

Function at 0x461830
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.00525ec0
mov eax, dword [0x5af1b4]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x4618b7
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4618b7
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x100
push edx
call fcn.00511fb4
add esp, 0x10
test eax, eax
jge 0x46188d
mov eax, 0x100
push 0
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00511c1b
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0xff
push edx
call fcn.00511fb4
add esp, 0x10
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x461945
call fcn.004616f0
test eax, eax
jle 0x461945
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 1
push 0
push 0
push 0
mov esi, eax
push 1
lea eax, [esp + 0x28]
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00511c1b
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.00511c1b
add esp, 0x108
ret

Function at 0x4619a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push edi
mov edi, ecx
xor cl, cl
test edi, edi
jbe 0x4619c0
push esi
mov esi, edx
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
sub edi, 1
jne 0x4619b2
pop esi
movzx eax, cl
pop edi
ret
Function at 0x465980
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, edx
mov edx, dword [eax + 4]
dec ecx
push edi
mov edi, dword [esi + 4]
shr ecx, 0x1f
xor edx, edi
dec ecx
and edx, ecx
xor edi, edx
mov dword [esi + 4], edi
xor dword [eax + 4], edx
lea edx, [ebx - 1]
cmp edx, 9
ja case.default.0x4659ac
jmp dword [edx*4 + 0x465ad8]
mov edi, 0xa
cmp ebx, edi
jle case.0x4659ac.10
push ebp
lea ecx, [ecx]
mov edx, dword [esi]
mov ebx, dword [edx + edi*4]
lea ebp, [edx + edi*4]
mov edx, dword [eax]
mov edx, dword [edx + edi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + edi*4], edx
lea ebx, [ebx + edi*4]
inc edi
cmp edi, dword [esp + 0x18]
jl 0x4659c0
pop ebp
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x24]
mov edx, dword [edx + 0x24]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x24], edi
mov edi, dword [eax]
xor dword [edi + 0x24], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x20]
mov edx, dword [edx + 0x20]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x20], edi
mov edi, dword [eax]
xor dword [edi + 0x20], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x1c]
mov edx, dword [edx + 0x1c]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x1c], edi
mov edi, dword [eax]
xor dword [edi + 0x1c], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x18]
mov edx, dword [edx + 0x18]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x18], edi
mov edi, dword [eax]
xor dword [edi + 0x18], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x14]
mov edx, dword [edx + 0x14]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x14], edi
mov edi, dword [eax]
xor dword [edi + 0x14], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x10]
mov edx, dword [edx + 0x10]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x10], edi
mov edi, dword [eax]
xor dword [edi + 0x10], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0xc]
mov edx, dword [edx + 0xc]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0xc], edi
mov edi, dword [eax]
xor dword [edi + 0xc], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 8]
mov edx, dword [edx + 8]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 8], edi
mov edi, dword [eax]
xor dword [edi + 8], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 4]
mov edx, dword [edx + 4]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 4], edi
mov edi, dword [eax]
xor dword [edi + 4], edx
mov esi, dword [esi]
mov edx, dword [eax]
mov edi, dword [esi]
mov edx, dword [edx]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [esi], edi
mov eax, dword [eax]
xor dword [eax], edx
pop edi
pop esi
pop ebx
ret
Function at 0x46c360
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x90
call fcn.00525ec0
mov eax, dword [0x5af1b4]
xor eax, esp
mov dword [esp + 0x8c], eax
push ebx
mov ebx, dword [esp + 0x98]
push ebp
mov ebp, dword [esp + 0xa4]
push esi
xor eax, eax
push edi
mov edi, ecx
mov dword [esp + 0x14], edx
test ebp, ebp
je 0x46c39f
mov eax, 1
mov dword [ebx], ebp
jmp 0x46c3a1
mov ebp, dword [ebx]
test edi, edi
je 0x46c475
mov eax, dword [ebp + 0x40]
cmp eax, 0x80
jg 0x46c461
mov ecx, dword [esp + 0xa8]
cmp eax, ecx
jge 0x46c408
lea esi, [ebx + 4]
push ebp
push esi
mov ecx, edx
call fcn.00473e30
add esp, 8
test eax, eax
je 0x46c512
mov eax, dword [esp + 0xa8]
mov ecx, dword [esi + 0x14]
push eax
push edi
push esi
call ecx
add esp, 0xc
test eax, eax
je 0x46c512
lea edi, [ebx + 0x4c]
lea ecx, [ebx + 0x50]
call fcn.00473fd0
test eax, eax
je 0x46c512
jmp 0x46c42a
cmp ecx, 0x80
ja 0x46c44d
push ecx
lea edx, [ebx + 0x50]
push edi
push edx
call fcn.005165f0
mov eax, dword [esp + 0xb4]
lea edi, [ebx + 0x4c]
add esp, 0xc
mov dword [edi], eax
mov edi, dword [edi]
cmp edi, 0x80
je 0x46c47d
mov ecx, 0x80
sub ecx, edi
push ecx
lea edx, [edi + ebx + 0x50]
push 0
push edx
call fcn.00516180
add esp, 0xc
jmp 0x46c47d
push str.len___0__len____int_sizeof_ctx__key_
mov ecx, 0x78
mov edx, str..cryptohmachmac.c
call fcn.00461970
push str.j____int_sizeof_ctx__key_
mov ecx, 0x6e
mov edx, str..cryptohmachmac.c
call fcn.00461970
test eax, eax
je 0x46c4fe
xor eax, eax
nop
mov cl, byte [ebx + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x46c480
mov ecx, dword [esp + 0x14]
lea esi, [ebx + 0x1c]
push ebp
push esi
call fcn.00473e30
add esp, 8
test eax, eax
je 0x46c512
mov eax, dword [ebp + 0x40]
push eax
mov eax, dword [esi + 0x14]
lea edx, [esp + 0x1c]
push edx
push esi
call eax
add esp, 0xc
test eax, eax
je 0x46c512
xor eax, eax
mov cl, byte [ebx + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x46c4c0
mov ecx, dword [esp + 0x14]
lea esi, [ebx + 0x34]
push ebp
push esi
call fcn.00473e30
add esp, 8
test eax, eax
je 0x46c512
mov ebp, dword [ebp + 0x40]
mov eax, dword [esi + 0x14]
push ebp
lea edx, [esp + 0x1c]
push edx
push esi
call eax
add esp, 0xc
test eax, eax
je 0x46c512
lea ecx, [ebx + 0x1c]
push ecx
add ebx, 4
push ebx
call fcn.00474030
add esp, 8
test eax, eax
jne 0x46c516
xor eax, eax
jmp 0x46c51b
mov eax, 1
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00511c1b
add esp, 0x90
ret

Function at 0x46df00
Capabilities:
Hash data using sha1

Disassembly:
push 0x60
push 0
push esi
call fcn.00516180
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
ret