joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dd960
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x61e810]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.004a4674
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x4dd9c5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x4dd9c5
lea edx, [esp]
push edx
call dword [0x61f8a8]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00489dc1
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.00489dc1
add esp, 0x108
ret
jmp 0x4dd960

Function at 0x4dd9e0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x61e810]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.004a4674
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x4dd9c5
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x4dd9c5
lea edx, [esp]
push edx
call dword [0x61f8a8]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00489dc1
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.00489dc1
add esp, 0x108
ret
jmp 0x4dd960
Function at 0x4def70
Capabilities:
Get common file path

Disassembly:
push ecx
push ebp
push esi
push 0x5be810
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
test esi, esi
jne 0x4def8a
pop esi
pop ebp
pop ecx
ret
push ebx
push edi
push str.LoadLibraryExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, dword [esp + 0x18]
mov edi, eax
push 0x5be7fc
push ebx
mov dword [esp + 0x18], edi
call fcn.004e5694
add esp, 8
test eax, eax
je 0x4defd6
test edi, edi
je 0x4defc7
push 8
push 0
push ebx
call edi
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
test edi, edi
je 0x4deffc
push str.AddDllDirectory
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4deffc
push 0x800
push 0
push ebx
call edi
pop edi
pop ebx
pop esi
mov ebp, eax
pop ebp
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, eax
test edi, edi
je 0x4df0b4
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4df015
sub eax, edx
lea eax, [eax + edi + 1]
push eax
call dword [0x61f89c]
mov esi, eax
add esp, 4
test esi, esi
je 0x4df0aa
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x4df0aa
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4df045
sub eax, edx
mov word [eax + esi], 0x5c
mov eax, esi
lea edx, [eax + 1]
jmp 0x4df060
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4df060
sub eax, edx
lea edx, [eax + esi]
mov ecx, ebx
sub edx, ebx
mov al, byte [ecx]
mov byte [edx + ecx], al
add ecx, 1
test al, al
jne 0x4df072
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4df0a1
push 8
push 0
push esi
call eax
push esi
mov ebp, eax
call dword [0x61f8a0]
add esp, 4
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
pop ecx
ret
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
push esi
call dword [0x61f8a0]
add esp, 4
pop edi
pop ebx
pop esi
mov eax, ebp
pop ebp
pop ecx
ret
Function at 0x4e13a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [eax + 0x2c]
mov ebx, dword [ebp]
mov ecx, dword [ebx + 0x1ec]
test ecx, ecx
push esi
push edi
mov esi, ecx
jne 0x4e13bd
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.004b9280
push edx
push eax
call fcn.004b92b0
mov ecx, eax
mov eax, edx
mov dword [esp + 0x24], eax
mov eax, esi
cdq
add esp, 0x10
mov edi, eax
sub edi, ecx
mov ecx, dword [esp + 0x14]
mov esi, edx
sbb esi, ecx
cmp dword [ebx + 0x1e0], 0
je 0x4e142a
mov edx, dword [ebp + 0x184]
mov eax, dword [ebp + 0x180]
push edx
push eax
call fcn.004b9280
push edx
push eax
call fcn.004b92b0
mov ecx, eax
mov eax, dword [ebx + 0x1e0]
mov ebp, edx
cdq
add esp, 0x10
sub eax, ecx
sbb edx, ebp
cmp esi, edx
jl 0x4e142a
jg 0x4e142e
cmp edi, eax
jae 0x4e142e
mov eax, edi
mov edx, esi
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4e2580
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
mov byte [esi + edi - 1], 0
jne 0x4e25b2
push 0x2e
push esi
call fcn.004935b0
add esp, 8
test eax, eax
je 0x4e25b0
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret
Function at 0x4e4030
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x61f89c]
mov edi, eax
add esp, 4
test edi, edi
jne 0x4e4055
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x4e409c
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x4e40a0
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
test ebp, ebp
mov dword [esp + 0x10], 0
jbe 0x4e4100
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
add ebx, 1
call edx
add esp, 0x18
sub ebp, 1
jne 0x4e40c3
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 0x10]
pop ebp
pop ebx
jae 0x4e4143
jmp 0x4e4110
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x5bef94
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x5bef95
push eax
call ecx
mov eax, dword [esp + 0x20]
add eax, 1
add esp, 0x18
cmp eax, dword [esi + 0x10]
mov dword [esp + 8], eax
jb 0x4e4110
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x4e6330
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.0049d300
mov eax, dword [0x61e810]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
test esi, esi
push edi
mov dword [esp + 0x3c], 0
jne 0x4e6377
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.00489dc1
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call fcn.0059391e
add esp, 8
test eax, eax
jl 0x4e6360
mov eax, 8
call fcn.0049d300
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.004e61a0
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x4e6360
push 0x5ae1f8
push esi
call fcn.0048df35
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x40], edi
je 0x4e6471
test dword [esp + 0x4e], 0x2000
je 0x4e63f4
cmp ebx, 0xffffffff
jne 0x4e63de
mov ebx, 0x800
push 0
push 4
push 0
push edi
call fcn.0048cb65
add esp, 0x10
jmp 0x4e63f4
mov edi, dword [esp + 0x40]
test ebx, ebx
jle 0x4e6402
cmp ebx, 0x400
mov esi, ebx
jl 0x4e6407
mov esi, 0x400
push edi
push esi
lea edx, [esp + 0x80]
push 1
push edx
call fcn.0048e196
mov edi, eax
add esp, 0x10
test edi, edi
mov dword [esp + 0x44], edi
jle 0x4e6455
fild dword [esp + 0x44]
mov eax, 8
call fcn.0049d300
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.004e61a0
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x4e63f0
sub ebx, esi
test ebx, ebx
jg 0x4e63f0
mov ecx, dword [esp + 0x40]
push ecx
call fcn.0048ba88
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.004f71a0
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00489dc1
mov esp, ebp
pop ebp
ret
Function at 0x4f06e0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
mov edx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
add ecx, 0xffffffff
push edi
mov edi, dword [esi + 4]
shr ecx, 0x1f
xor edx, edi
sub ecx, 1
and edx, ecx
xor edi, edx
mov dword [esi + 4], edi
xor dword [eax + 4], edx
lea edx, [ebx - 1]
cmp edx, 9
ja case.default.0x4f0716
jmp dword [edx*4 + 0x4f0840]
mov edi, 0xa
cmp ebx, edi
jle case.0x4f0716.10
push ebp
mov edx, dword [esi]
mov ebx, dword [edx + edi*4]
lea ebp, [edx + edi*4]
mov edx, dword [eax]
mov edx, dword [edx + edi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + edi*4], edx
lea ebx, [ebx + edi*4]
add edi, 1
cmp edi, dword [esp + 0x20]
jl 0x4f0727
pop ebp
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x24]
mov edx, dword [edx + 0x24]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x24], edi
mov edi, dword [eax]
xor dword [edi + 0x24], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x20]
mov edx, dword [edx + 0x20]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x20], edi
mov edi, dword [eax]
xor dword [edi + 0x20], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x1c]
mov edx, dword [edx + 0x1c]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x1c], edi
mov edi, dword [eax]
xor dword [edi + 0x1c], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x18]
mov edx, dword [edx + 0x18]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x18], edi
mov edi, dword [eax]
xor dword [edi + 0x18], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x14]
mov edx, dword [edx + 0x14]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x14], edi
mov edi, dword [eax]
xor dword [edi + 0x14], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x10]
mov edx, dword [edx + 0x10]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x10], edi
mov edi, dword [eax]
xor dword [edi + 0x10], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0xc]
mov edx, dword [edx + 0xc]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0xc], edi
mov edi, dword [eax]
xor dword [edi + 0xc], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 8]
mov edx, dword [edx + 8]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 8], edi
mov edi, dword [eax]
xor dword [edi + 8], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 4]
mov edx, dword [edx + 4]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 4], edi
mov edi, dword [eax]
xor dword [edi + 4], edx
mov esi, dword [esi]
mov edx, dword [eax]
mov edi, dword [esi]
mov edx, dword [edx]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [esi], edi
mov eax, dword [eax]
xor dword [eax], edx
pop edi
pop esi
pop ebx
ret
Function at 0x4f3be0
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.0048b3f0
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
mov eax, 1
pop esi
ret

Function at 0x4f3c40
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.0048b3f0
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
pop esi
ret
Function at 0x4f5a90
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.0048b3f0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret
Function at 0x4f9980
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.0049d300
mov eax, dword [0x61e810]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x4f9a07
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4f9a07
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push pe_nt_image_headers32
push edx
call fcn.00593e21
add esp, 0x10
test eax, eax
jge 0x4f99dd
mov eax, pe_nt_image_headers32
push 0
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00489dc1
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0xff
push edx
call fcn.00593e21
add esp, 0x10
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x4f9a99
call fcn.004f9840
test eax, eax
jle 0x4f9a99
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x4f9aad
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
lea eax, [esp + 0x28]
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00489dc1
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.00489dc1
add esp, 0x108
ret

Function at 0x4f9b00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x4f9b2a
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
sub esi, eax
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
or cl, dl
add eax, 1
sub edi, 1
jne 0x4f9b17
pop esi
pop ebx
movzx eax, cl
pop edi
ret

Function at 0x4fd2d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x4fd319
mov al, byte [edx]
test al, al
je 0x4fd319
push edi
mov edi, pe_nt_image_headers32
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
add edx, 1
xor esi, ecx
test al, al
jne 0x4fd2e7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x4ff6f0
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
call fcn.004ff060
mov edi, eax
add esp, 4
test edi, edi
jne 0x4ff796
push 0xaf
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.004e82c0
push 0x5d29b8
push esi
push 0x5d29b4
push ebx
push str.fopen_
push 5
call fcn.004e85e0
add esp, 0x2c
call fcn.0048dc90
cmp dword [eax], 2
je 0x4ff775
call fcn.0048dc90
cmp dword [eax], 6
je 0x4ff775
push 0xb8
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.004e82c0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0xb6
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.004e82c0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x61fdb4
call fcn.004e8e80
mov esi, eax
add esp, 4
test esi, esi
jne 0x4ff7b8
push edi
call fcn.0048ba88
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.004e88c0
push edi
push 1
push 0x6a
push esi
call fcn.004e8c20
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x51c830
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.0048b3f0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret

Function at 0x51e120
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
lea eax, [ecx + 1]
ret

Function at 0x51e1c0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x532a70
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x532b60
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
jl 0x532af2
movzx eax, byte [esi + 2]
xor edx, edx
mov dh, byte [esi]
add ecx, 1
add ecx, 1
add ecx, 1
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x5df768]
mov byte [ecx - 3], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x5df768]
mov byte [ecx - 2], al
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x5df768]
mov byte [ecx - 1], al
and edx, 0x3f
movzx edx, byte [edx + 0x5df768]
mov byte [ecx], dl
jmp 0x532b4b
movzx edx, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x532b04
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x5df768]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x5df768]
add ecx, 1
mov byte [ecx], al
add ecx, 1
cmp edi, 1
jne 0x532b36
lea edx, [edi + 0x3c]
jmp 0x532b43
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x5df768]
mov byte [ecx], dl
add ecx, 1
mov byte [ecx], 0x3d
sub edi, 3
add ecx, 1
add ebp, 4
add esi, 3
test edi, edi
jg 0x532a90
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x534d00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5c
call fcn.0049d300
mov eax, dword [0x61e810]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x70]
push ebx
mov ebx, dword [esp + 0x64]
push ebp
mov ebp, dword [esp + 0x74]
push esi
mov esi, dword [esp + 0x88]
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x88]
add edi, 0xffffffff
test eax, eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], edi
jne 0x534d5f
call fcn.004faf30
mov dword [esp + 0x10], eax
test esi, esi
jne 0x534d67
mov dword [esp + 0x14], eax
push eax
call fcn.004fb090
mov esi, eax
lea eax, [esi + esi]
sub edi, eax
lea edx, [edi - 1]
add esp, 4
cmp ebp, edx
jle 0x534dab
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0xa0
push 4
call fcn.004e82c0
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00489dc1
add esp, 0x5c
ret
add eax, 1
cmp dword [esp + 0x1c], eax
jge 0x534dbf
push 0x40
push str..crypto_rsa_rsa_oaep.c
push 0x78
jmp 0x534d87
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x84]
push 0
push ecx
lea eax, [ebx + 1]
mov byte [ebx], 0
push 0
lea ebx, [ebx + esi + 1]
push ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push edx
push eax
call fcn.004fa100
add esp, 0x18
test eax, eax
je 0x534d96
sub edi, ebp
sub edi, 1
push edi
lea ecx, [ebx + esi]
push 0
push ecx
call fcn.0048b3f0
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
mov edx, ebx
sub edx, ebp
sub edx, esi
push ebp
lea eax, [edx + edi]
push ecx
push eax
mov byte [eax - 1], 1
call fcn.00489dd0
mov ebp, dword [esp + 0x30]
push esi
push ebp
call fcn.004e6210
add esp, 0x20
test eax, eax
jle 0x534d96
push 0x55
sub edi, esi
push str..crypto_rsa_rsa_oaep.c
push edi
call fcn.004ea800
add esp, 0xc
test eax, eax
mov dword [esp + 0x10], eax
jne 0x534e5c
push 0x57
push str..crypto_rsa_rsa_oaep.c
push 0x41
jmp 0x534d87
mov edx, dword [esp + 0x14]
push edx
push esi
push ebp
push edi
push eax
call fcn.00534b80
add esp, 0x14
test eax, eax
jl 0x534eaa
test edi, edi
jle 0x534e91
mov ebp, dword [esp + 0x10]
mov eax, ebx
sub ebp, ebx
mov ecx, edi
nop
mov dl, byte [eax + ebp]
xor byte [eax], dl
add eax, 1
sub ecx, 1
jne 0x534e80
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push eax
push edi
push ebx
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.00534b80
add esp, 0x14
test eax, eax
jge 0x534ecc
mov edx, dword [esp + 0x10]
push edx
call fcn.004eaa00
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.00489dc1
add esp, 0x5c
ret
test esi, esi
jle 0x534ee5
lea ecx, [esp + 0x28]
mov eax, ebp
sub ecx, ebp
mov dl, byte [ecx + eax]
xor byte [eax], dl
add eax, 1
sub esi, 1
jne 0x534ed8
mov eax, dword [esp + 0x10]
push eax
call fcn.004eaa00
mov ecx, dword [esp + 0x6c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00489dc1
add esp, 0x5c
ret