joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424480
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5b66c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x424610
cmp dword [esi], 0
je 0x424610
movzx eax, word [0x56dc58]
mov ecx, dword [ebp + 8]
cmp ecx, eax
je 0x4244e3
movzx eax, word [0x56dc50]
cmp ecx, eax
je 0x4244e3
mov dword [esi], 0
mov eax, 0x11185
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050101b
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [edx + 4]
cmp edi, 0xfe
jl 0x424505
pop edi
pop esi
mov eax, 0x11175
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050101b
mov esp, ebp
pop ebp
ret
push edi
push dword [edx]
lea eax, [ebp - 0x104]
push eax
call fcn.00502d50
add esp, 0xc
cmp edi, 0xfe
jae 0x424625
lea eax, [ebp - 0x104]
mov byte [ebp + edi - 0x104], 0
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x424552
pop edi
pop esi
mov eax, 0x11182
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050101b
mov esp, ebp
pop ebp
ret
mov ecx, dword [eax]
mov edi, dword [eax + 0xc]
mov dword [ebp - 0x10c], ecx
movsx ecx, word [eax + 0xa]
mov eax, dword [esi]
mov dword [ebp - 0x108], eax
imul eax, eax, 0x11c
mov dword [ebp - 0x110], ecx
mov dword [esi], 0
push eax
push 0
push ebx
call fcn.00502bf0
add esp, 0xc
cmp dword [edi], 0
je 0x4245ef
nop dword [eax]
mov eax, dword [esi]
cmp eax, dword [ebp - 0x108]
jae 0x4245ef
imul eax, eax, 0x11c
push 0xfe
push dword [ebp - 0x10c]
add eax, ebx
push eax
call fcn.0041cb60
imul ecx, dword [esi], 0x11c
mov ax, word [0x56dc58]
push dword [ebp - 0x110]
mov word [ecx + ebx + 0x100], ax
imul eax, dword [esi], 0x11c
push dword [edi]
add eax, 0x104
add eax, ebx
push eax
call fcn.00502d50
inc dword [esi]
add edi, 4
add esp, 0x18
cmp dword [edi], 0
jne 0x424590
xor eax, eax
cmp eax, dword [esi]
pop edi
sbb eax, eax
and eax, 0xfffeee7e
pop esi
add eax, 0x11182
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050101b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x11174
pop esi
xor ecx, ebp
pop ebx
call fcn.0050101b
mov esp, ebp
pop ebp
ret
call fcn.0050117d
int3

Function at 0x424a40
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push 0x60
push 0x56ed1c
call fcn.00417190
mov ecx, dword [ebp + 0x18]
add esp, 8
test ecx, ecx
je 0x424a7c
mov eax, dword [ecx]
mov dword [ebp - 8], eax
imul eax, dword [ecx + 4], 0x3e8
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
jmp 0x424a7e
xor eax, eax
push eax
lea eax, [ebx + 4]
neg ebx
sbb ebx, ebx
and ebx, eax
lea eax, [edi + 4]
neg edi
push ebx
sbb edi, edi
and edi, eax
lea eax, [esi + 4]
neg esi
push edi
sbb esi, esi
and esi, eax
push esi
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_select]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4288a0
Capabilities:
Get thread local storage value

Disassembly:
cmp dword [0x5b8c20], 0
jne 0x428922
call fcn.00415be0
cmp dword [0x5b8c20], 0
jne fcn.00416300
push 0x5b8c28
call fcn.00413610
push 0x5b9034
push 0x5b8c28
call fcn.00413730
push 0x5b9034
call fcn.004134f0
push 0x5b9034
call fcn.00413580
push str.____.__
push 0x5b9034
call fcn.004135e0
push 0x5b902c
push 0x5b8c28
call fcn.00413730
push 0x5b902c
call fcn.00413580
add esp, 0x28
mov dword [0x5b8c20], 1
jmp fcn.00416300
ret

Function at 0x43f690
Capabilities:
Get thread local storage value

Disassembly:
call fcn.00415be0
sub dword [0x5bbd24], 1
jne 0x43f6fe
push 0x1680
push 0
push 0x5ba6a0
call fcn.00502bf0
push 0x30
push 0
push 0x5bbd28
mov dword [0x5bbd20], 0
call fcn.00502bf0
push dword [0x5b3870]
mov dword [0x5bbd58], 0
call fcn.0041ea70
push dword [0x5b3874]
mov dword [0x5b3870], 0xffffffff
call fcn.0041ea70
add esp, 0x20
mov dword [0x5b3874], 0xfffffffe
jmp fcn.00416300

Function at 0x43ff50
Capabilities:
Get thread local storage value

Disassembly:
call fcn.00415be0
mov eax, dword [0x5bbd24]
inc eax
mov dword [0x5bbd24], eax
cmp eax, 1
jne 0x43ff6a
call fcn.0043f920
jmp fcn.00416300
Function at 0x476470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5b66c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x118], eax
push edi
movzx eax, word [ebx + 2]
lea esi, [ebx + 4]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
lea edi, [esi + eax*4]
movzx eax, word [ebx]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, 0xbede
cmp ax, cx
jne 0x47658f
cmp esi, edi
jae 0x476565
mov al, byte [esi]
movzx ebx, al
mov cl, al
and ebx, 0xf
shr cl, 4
inc ebx
mov byte [ebp - 0x109], cl
inc esi
lea eax, [ebx + 1]
mov dword [ebp - 0x110], eax
lea eax, [ebx + esi]
mov dword [ebp - 0x114], eax
cmp eax, edi
ja 0x476689
cmp cl, 0xf
je 0x476565
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x118]
push dword [eax + 4]
call fcn.0047acd0
add esp, 0xc
test eax, eax
jne 0x476673
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
mov ecx, dword [ecx + 0x50]
test eax, eax
je 0x47654c
test ecx, ecx
jle 0x47654c
movzx edx, byte [ebp - 0x109]
nop dword [eax]
cmp dword [eax], edx
je 0x476578
dec ecx
add eax, 4
test ecx, ecx
jg 0x476540
mov esi, dword [ebp - 0x114]
cmp esi, edi
jae 0x476565
mov al, byte [esi]
test al, al
jne 0x4764c8
inc esi
cmp esi, edi
jb 0x476556
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050101b
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x107]
nop
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor byte [esi], al
inc esi
sub ebx, 1
jne 0x476580
jmp 0x476552
movzx eax, word [ebx]
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
mov ecx, 0xfff0
and ax, cx
mov ecx, 0x1000
cmp ax, cx
jne 0x476689
lea eax, [esi + 1]
cmp eax, edi
jae 0x476565
movzx ebx, byte [esi + 1]
mov al, byte [esi]
add esi, 2
mov byte [ebp - 0x109], al
lea eax, [ebx + 2]
mov dword [ebp - 0x114], eax
lea eax, [ebx + esi]
mov dword [ebp - 0x110], eax
cmp eax, edi
ja 0x476689
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 0x118]
push dword [eax + 4]
call fcn.0047acd0
add esp, 0xc
test eax, eax
jne 0x476673
test ebx, ebx
je 0x47662c
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
mov ecx, dword [ecx + 0x50]
test eax, eax
je 0x47662c
test ecx, ecx
jle 0x47662c
movzx edx, byte [ebp - 0x109]
nop
cmp dword [eax], edx
je 0x47665e
dec ecx
add eax, 4
test ecx, ecx
jg 0x476620
mov esi, dword [ebp - 0x110]
cmp esi, edi
jae 0x476640
cmp byte [esi], 0
jne 0x476640
inc esi
cmp esi, edi
jb 0x476636
lea eax, [esi + 1]
cmp eax, edi
jb 0x4765b6
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050101b
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x106]
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor byte [esi], al
inc esi
sub ebx, 1
jne 0x476664
jmp 0x476632
pop edi
pop esi
mov eax, 8
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050101b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x15
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0050101b
mov esp, ebp
pop ebp
ret
Function at 0x47a010
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
mov ecx, eax
mov edx, eax
sar ecx, 5
and edx, 0x1f
mov dword [ebp - 8], ecx
mov dword [ebp + 0xc], edx
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [edx]
mov ebx, esi
shr ebx, 5
mov dword [ebp - 0x10], ebx
cmp eax, esi
jl 0x47a053
shr esi, 3
push esi
push 0
push dword [edx + 4]
call fcn.00502bf0
add esp, 0xc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
push edi
mov edi, ebx
sub edi, ecx
mov dword [ebp - 0x1c], edi
test eax, eax
jne 0x47a09c
xor edx, edx
test edi, edi
jle 0x47a087
mov ebx, dword [ebp + 8]
lea esi, [ecx*4]
mov ecx, dword [ebx + 4]
lea esi, [esi + 4]
mov eax, dword [esi + ecx - 4]
mov dword [ecx + edx*4], eax
inc edx
cmp edx, edi
jl 0x47a072
mov ebx, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
lea eax, [edi*4]
mov dword [ebp - 0x10], eax
add ecx, 4
jmp 0x47a11d
lea esi, [edi - 1]
mov dword [ebp - 0x18], esi
test esi, esi
jle 0x47a0f7
mov ebx, 0x20
sub ebx, eax
lea eax, [ecx*4]
mov dword [ebp - 0x14], ebx
xor edi, edi
lea ebx, [edx + 4]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ebx
mov esi, dword [ebx]
mov ecx, dword [ebp - 0x14]
mov edx, dword [eax + esi + 4]
mov eax, dword [eax + esi]
shl edx, cl
mov ecx, dword [ebp + 0xc]
shr eax, cl
xor edx, eax
mov eax, dword [ebp - 0xc]
mov dword [esi + edi*4], edx
add eax, 4
inc edi
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0x18]
jl 0x47a0c2
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
jmp 0x47a0fd
add edx, 4
mov dword [ebp - 4], edx
mov edx, dword [edx]
mov eax, ebx
sub eax, ecx
mov ecx, dword [ebp + 0xc]
lea esi, [eax*4]
mov eax, dword [edx + ebx*4 - 4]
shr eax, cl
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], esi
mov dword [esi + edx - 4], eax
mov esi, edi
mov edx, ecx
cmp edi, ebx
jge 0x47a189
cmp dword [ebp - 8], 4
jb 0x47a189
mov eax, dword [ecx]
mov edx, dword [ebp - 0x10]
add edx, eax
mov dword [ebp + 0xc], edx
lea eax, [eax + ebx*4]
add eax, 0xfffffffc
cmp edx, ecx
ja 0x47a145
mov edx, ecx
cmp eax, ecx
jae 0x47a189
mov ecx, dword [ebp - 8]
and ecx, reloc.WS2_32.dll_closesocket
jns 0x47a155
dec ecx
or ecx, 0xfffffffc
inc ecx
mov eax, ebx
sub eax, ecx
nop dword [eax]
add esi, 4
cmp esi, eax
jl 0x47a160
sub eax, edi
mov edi, dword [ebp + 0xc]
add eax, 3
cdq
and edx, 3
lea ecx, [edx + eax]
mov edx, dword [ebp + 8]
sar ecx, 2
xor eax, eax
shl ecx, 4
shr ecx, 2
add edx, 4
rep stosd dword es:[edi], eax
pop edi
cmp esi, ebx
jge 0x47a19e
nop
mov eax, dword [edx]
mov dword [eax + esi*4], 0
inc esi
cmp esi, ebx
jl 0x47a190
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47a290
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
lea edi, [eax + ecx]
xor bl, bl
xor esi, esi
cmp eax, edi
cmova ecx, edx
test ecx, ecx
je 0x47a31c
cmp ecx, 0x20
jb 0x47a31c
mov edx, dword [ebp + 8]
and ecx, 0xffffffe0
xorps xmm3, xmm3
xorps xmm2, xmm2
nop
movups xmm0, xmmword [eax]
add esi, 0x20
movups xmm1, xmmword [edx]
xorps xmm1, xmm0
movups xmm0, xmmword [eax + 0x10]
add eax, 0x20
orps xmm3, xmm1
movups xmm1, xmmword [edx + 0x10]
add edx, 0x20
xorps xmm1, xmm0
orps xmm2, xmm1
cmp esi, ecx
jb 0x47a2c0
orps xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
orps xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
orps xmm2, xmm0
movd ebx, xmm2
jmp 0x47a31f
mov edx, dword [ebp + 8]
cmp eax, edi
jae 0x47a331
sub edx, eax
mov cl, byte [edx + eax]
xor cl, byte [eax]
inc eax
or bl, cl
cmp eax, edi
jb 0x47a325
xor eax, eax
test bl, bl
pop edi
pop esi
setne al
pop ebx
pop ebp
ret

Function at 0x47a460
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov ecx, eax
push ebx
mov ebx, eax
and ecx, 0x1f
sar ebx, 5
mov dword [ebp - 0x14], ebx
push edi
mov edi, dword [ebp + 8]
cmp eax, 0x7f
jle 0x47a4a1
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
test ecx, ecx
jne 0x47a4c3
mov edx, 4
sub edx, ebx
test edx, edx
jle 0x47a523
lea esi, [edi + ebx*4]
mov eax, dword [esi]
lea esi, [esi + 4]
mov dword [edi + ecx*4], eax
inc ecx
cmp ecx, edx
jl 0x47a4b4
jmp 0x47a523
mov eax, 3
mov dword [ebp + 0xc], 0
sub eax, ebx
mov dword [ebp - 8], eax
test eax, eax
jle 0x47a511
mov eax, 0x20
sub eax, ecx
mov dword [ebp - 0xc], eax
lea eax, [edi + ebx*4]
mov ebx, ecx
mov edx, dword [eax + 4]
lea esi, [eax + 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
shl edx, cl
mov ecx, ebx
shr eax, cl
xor edx, eax
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
mov dword [edi + eax*4], edx
inc eax
cmp eax, dword [ebp - 8]
mov dword [ebp + 0xc], eax
mov eax, esi
jl 0x47a4e7
mov ebx, dword [ebp - 0x14]
mov eax, dword [edi + 0xc]
mov edx, 4
shr eax, cl
sub edx, ebx
mov ecx, dword [ebp - 8]
mov dword [edi + ecx*4], eax
pop esi
cmp edx, 4
jge 0x47a532
mov ecx, ebx
lea edi, [edi + edx*4]
xor eax, eax
rep stosd dword es:[edi], eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47d920
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
movzx eax, byte [eax + str.cw]
mov byte [edx], al
movzx eax, byte [edx + 4]
movzx eax, byte [eax + str.cw]
mov byte [edx + 4], al
movzx eax, byte [edx + 8]
movzx eax, byte [eax + str.cw]
mov byte [edx + 8], al
movzx eax, byte [edx + 0xc]
movzx eax, byte [eax + str.cw]
mov byte [edx + 0xc], al
movzx eax, byte [edx + 1]
mov cl, byte [eax + str.cw]
movzx eax, byte [edx + 5]
movzx eax, byte [eax + str.cw]
mov byte [edx + 1], al
movzx eax, byte [edx + 9]
movzx eax, byte [eax + str.cw]
mov byte [edx + 5], al
movzx eax, byte [edx + 0xd]
mov byte [edx + 0xd], cl
movzx eax, byte [eax + str.cw]
mov byte [edx + 9], al
movzx eax, byte [edx + 0xa]
mov cl, byte [eax + str.cw]
movzx eax, byte [edx + 2]
mov byte [edx + 2], cl
movzx eax, byte [eax + str.cw]
mov byte [edx + 0xa], al
movzx eax, byte [edx + 0xe]
mov cl, byte [eax + str.cw]
movzx eax, byte [edx + 6]
mov byte [edx + 6], cl
movzx eax, byte [eax + str.cw]
mov byte [edx + 0xe], al
movzx eax, byte [edx + 0xf]
mov cl, byte [eax + str.cw]
movzx eax, byte [edx + 0xb]
movzx eax, byte [eax + str.cw]
mov byte [edx + 0xf], al
movzx eax, byte [edx + 7]
movzx eax, byte [eax + str.cw]
mov byte [edx + 0xb], al
movzx eax, byte [edx + 3]
mov byte [edx + 3], cl
mov ecx, dword [ebp + 0xc]
movzx eax, byte [eax + str.cw]
mov byte [edx + 7], al
mov eax, dword [ecx]
xor dword [edx], eax
mov eax, dword [ecx + 4]
xor dword [edx + 4], eax
mov eax, dword [ecx + 8]
xor dword [edx + 8], eax
mov eax, dword [ecx + 0xc]
xor dword [edx + 0xc], eax
pop ebp
ret
Function at 0x47da20
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
movzx eax, byte [eax + 0x587df0]
mov byte [edx], al
movzx eax, byte [edx + 4]
movzx eax, byte [eax + 0x587df0]
mov byte [edx + 4], al
movzx eax, byte [edx + 8]
movzx eax, byte [eax + 0x587df0]
mov byte [edx + 8], al
movzx eax, byte [edx + 0xc]
movzx eax, byte [eax + 0x587df0]
mov byte [edx + 0xc], al
movzx eax, byte [edx + 0xd]
mov cl, byte [eax + 0x587df0]
movzx eax, byte [edx + 9]
movzx eax, byte [eax + 0x587df0]
mov byte [edx + 0xd], al
movzx eax, byte [edx + 5]
movzx eax, byte [eax + 0x587df0]
mov byte [edx + 9], al
movzx eax, byte [edx + 1]
mov byte [edx + 1], cl
movzx eax, byte [eax + 0x587df0]
mov byte [edx + 5], al
movzx eax, byte [edx + 2]
mov cl, byte [eax + 0x587df0]
movzx eax, byte [edx + 0xa]
mov byte [edx + 0xa], cl
movzx eax, byte [eax + 0x587df0]
mov byte [edx + 2], al
movzx eax, byte [edx + 6]
mov cl, byte [eax + 0x587df0]
movzx eax, byte [edx + 0xe]
mov byte [edx + 0xe], cl
movzx eax, byte [eax + 0x587df0]
mov byte [edx + 6], al
movzx eax, byte [edx + 3]
mov cl, byte [eax + 0x587df0]
movzx eax, byte [edx + 7]
movzx eax, byte [eax + 0x587df0]
mov byte [edx + 3], al
movzx eax, byte [edx + 0xb]
movzx eax, byte [eax + 0x587df0]
mov byte [edx + 7], al
movzx eax, byte [edx + 0xf]
mov byte [edx + 0xf], cl
mov ecx, dword [ebp + 0xc]
movzx eax, byte [eax + 0x587df0]
mov byte [edx + 0xb], al
mov eax, dword [ecx]
xor dword [edx], eax
mov eax, dword [ecx + 4]
xor dword [edx + 4], eax
mov eax, dword [ecx + 8]
xor dword [edx + 8], eax
mov eax, dword [ecx + 0xc]
xor dword [edx + 0xc], eax
pop ebp
ret
Function at 0x47e280
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 8
cmp eax, 0x10
jne 0x47e2a2
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.0047d4b0
add esp, 8
xor eax, eax
mov esp, ebp
pop ebp
ret
cmp eax, 0x18
je 0x47e3ba
cmp eax, 0x20
jne 0x47e3ba
push ebx
push esi
mov esi, dword [ebp + 8]
mov edx, 1
push edi
mov edi, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 8], edx
mov dword [edi + 0xf0], 0xe
call fcn.0047a380
lea eax, [esi + 0x10]
push eax
lea eax, [edi + 0x10]
push eax
call fcn.0047a380
add esp, 0x10
lea eax, [edi + 0x22]
mov ebx, 2
nop
mov ch, byte [eax - 4]
mov esi, eax
mov cl, byte [eax - 5]
mov edx, dword [ebp - 8]
mov byte [ebp - 1], ch
mov ch, byte [eax - 3]
mov byte [ebp - 2], dl
mov byte [ebp - 3], cl
mov byte [ebp + 0xf], ch
test bl, 1
jne 0x47e350
movzx ecx, cl
mov cl, byte [ecx + str.cw]
xor cl, dl
add dl, dl
mov byte [eax - 2], cl
movzx ecx, byte [ebp - 1]
mov cl, byte [ecx + str.cw]
mov byte [eax - 1], cl
mov cl, dl
xor cl, 0x1b
cmp byte [ebp - 2], 0
movzx ecx, cl
mov dword [ebp - 8], ecx
movzx ecx, dl
mov edx, dword [ebp - 8]
cmovge edx, ecx
movzx ecx, byte [ebp + 0xf]
mov dword [ebp - 8], edx
mov dl, byte [eax - 6]
jmp 0x47e371
movzx ecx, byte [eax - 6]
mov dl, byte [ebp + 0xf]
mov cl, byte [ecx + str.cw]
mov byte [eax - 2], cl
movzx ecx, byte [ebp - 3]
mov cl, byte [ecx + str.cw]
mov byte [eax - 1], cl
movzx ecx, byte [ebp - 1]
mov cl, byte [ecx + str.cw]
inc ebx
mov byte [esi], cl
movzx ecx, dl
mov cl, byte [ecx + str.cw]
mov byte [eax + 1], cl
mov ecx, dword [eax - 0x22]
xor dword [eax - 2], ecx
mov ecx, dword [eax - 0x1e]
xor ecx, dword [eax - 2]
mov edx, dword [eax - 0x1a]
xor edx, ecx
mov dword [eax + 2], ecx
mov ecx, dword [eax - 0x16]
xor ecx, edx
mov dword [eax + 6], edx
mov dword [eax + 0xa], ecx
add eax, 0x10
cmp ebx, 0xf
jl 0x47e2f0
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, 2
mov esp, ebp
pop ebp
ret
Function at 0x47ef90
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
pop ebp
ret

Function at 0x47f190
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x47f1c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x47f1c5
mov ecx, dword [ebp + 0xc]
add eax, 0x1d4c0
mov dword [ecx], esi
mov dword [ecx + 4], esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
pop esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x47f720
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], eax
test edi, edi
je 0x47f87f
test eax, eax
je 0x47f87f
cmp dword [ebp + 0x14], ebx
je 0x47f87f
push esi
mov esi, dword [ebp + 0xc]
mov eax, 0x55555556
lea ecx, [esi*4]
imul ecx
mov ecx, dword [ebp + 0x14]
mov eax, edx
shr eax, 0x1f
add eax, 3
add eax, edx
cmp dword [ecx], eax
jge 0x47f77b
pop esi
pop edi
mov eax, 0x11183
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
test esi, esi
jle 0x47f86e
movzx ecx, byte [edi]
lea esi, [edx + 1]
mov eax, ecx
inc ebx
shr eax, 2
and ecx, 3
add eax, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_Probing
mov dword [ebp + 8], eax
lea eax, [edx + 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
cmp ebx, dword [ebp + 0xc]
je 0x47f856
movzx eax, byte [edi + 1]
inc ebx
mov edx, eax
shl ecx, 4
and edx, 0xf
shr eax, 4
mov dword [ebp - 0xc], edx
or eax, ecx
mov edx, dword [ebp + 8]
mov ah, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_Probing]
mov dl, byte [edx]
mov byte [ebp + 0xb], dl
mov edx, dword [ebp - 4]
mov cl, byte [ebp + 0xb]
cmp ebx, dword [ebp + 0xc]
je 0x47f82d
mov al, byte [edi + 2]
inc ebx
mov byte [edx], cl
add edi, 3
movzx edx, al
mov byte [esi], ah
mov ecx, edx
mov eax, dword [ebp - 0xc]
and edx, 0x3f
shl eax, 2
shr ecx, 6
or ecx, eax
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_Probing]
mov byte [esi + 1], al
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_Probing]
mov edx, dword [ebp - 8]
mov byte [esi + 2], al
mov dword [ebp - 4], edx
cmp ebx, dword [ebp + 0xc]
jl 0x47f786
mov eax, dword [ebp + 0x14]
sub edx, dword [ebp + 0x10]
pop esi
pop edi
mov dword [eax], edx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [edx], cl
mov edx, dword [ebp - 8]
sub edx, dword [ebp + 0x10]
mov byte [esi], ah
mov eax, dword [ebp - 0xc]
mov al, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_Probing]
mov byte [esi + 1], al
mov eax, dword [ebp + 0x14]
mov byte [esi + 2], 0x3d
pop esi
pop edi
mov dword [eax], edx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [eax]
shl ecx, 4
mov byte [edx], al
mov edx, dword [ebp - 8]
mov al, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_Probing]
mov byte [esi], al
mov word [esi + 1], 0x3d3d
mov eax, dword [ebp + 0x14]
sub edx, dword [ebp + 0x10]
pop esi
pop edi
mov dword [eax], edx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x11174
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4847e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
pop ebp
ret

Function at 0x498b40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
or eax, 0xffffffff
push esi
mov esi, dword [ebp + 0xc]
test bl, 3
je 0x498b70
test esi, esi
je 0x498b70
movzx ecx, byte [ebx]
dec esi
movzx edx, al
inc ebx
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x58b830]
test bl, 3
jne 0x498b53
cmp esi, 4
jb 0x498bc1
mov edx, esi
shr edx, 2
nop word [eax + eax]
xor eax, dword [ebx]
sub esi, 4
movzx ecx, al
add ebx, 4
shr eax, 8
xor eax, dword [ecx*4 + 0x58b830]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x58b830]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x58b830]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x58b830]
sub edx, 1
jne 0x498b80
test esi, esi
je 0x498bdf
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x58b830]
sub esi, 1
jne 0x498bc5
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x498c10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
not eax
test bl, 3
je 0x498c45
test esi, esi
je 0x498c45
movzx ecx, byte [ebx]
dec esi
movzx edx, al
inc ebx
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x58b830]
test bl, 3
jne 0x498c28
cmp esi, 4
jb 0x498c91
mov edx, esi
shr edx, 2
nop
xor eax, dword [ebx]
sub esi, 4
movzx ecx, al
add ebx, 4
shr eax, 8
xor eax, dword [ecx*4 + 0x58b830]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x58b830]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x58b830]
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0x58b830]
sub edx, 1
jne 0x498c50
test esi, esi
je 0x498caf
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x58b830]
sub esi, 1
jne 0x498c95
not eax
mov dword [edi], eax
pop edi
pop esi
pop ebx
pop ebp
ret