joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441a60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
xor edi, edi
mov eax, dword [esi + 0x6af90]
mov dword [esi + 0x6af80], 2
test eax, eax
je 0x441c81
cmp eax, 3
jb 0x441ad6
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
test ebx, ebx
je 0x441b13
mov eax, dword [esi + 0x6af84]
sub eax, ebx
cmp eax, 0x7efa
ja 0x441b13
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x441afd
mov dword [esi + 0x6afa0], eax
mov edx, ebx
mov ecx, esi
call fcn.00441740
mov ecx, dword [esi + 0x6af90]
mov edi, eax
cmp edi, ecx
cmova edi, ecx
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x441c03
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
mov edx, ecx
mov ecx, esi
push eax
call fcn.00441260
mov ecx, dword [esi + 0x6af90]
add esp, 4
sub ecx, edi
mov dword [ebp - 4], eax
mov dword [esi + 0x6af90], ecx
cmp edi, dword [esi + 0x6af98]
ja 0x441bc8
cmp ecx, 3
jb 0x441bc8
dec edi
nop word [eax + eax]
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], ebx
mov ecx, dword [esi + 0x6af7c]
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
sub edi, 1
jne 0x441b60
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [ebp - 4]
jmp 0x441c2a
mov edx, dword [esi + 0x6af84]
add edx, edi
xor edi, edi
mov dword [esi + 0x6af84], edx
movzx ecx, byte [esi + edx + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [edx + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp - 4]
jmp 0x441c2a
movzx eax, byte [esi + ecx + 0x1af70]
xor edx, edx
push eax
mov ecx, esi
call fcn.00441260
dec dword [esi + 0x6af90]
add esp, 4
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
lea ecx, [esi + 0x1af70]
test eax, eax
je 0x441c5f
mov eax, dword [esi + 0x6af74]
sub edx, eax
push 0
push edx
lea edx, [eax + ecx]
xor ecx, ecx
test eax, eax
cmovs edx, ecx
mov ecx, esi
call fcn.00440db0
mov eax, dword [esi + 0x6af84]
add esp, 8
mov dword [esi + 0x6af74], eax
mov eax, dword [esi + 0x6af90]
cmp eax, 0x106
jae 0x441c79
mov ecx, esi
call fcn.00441900
mov eax, dword [esi + 0x6af90]
test eax, eax
jne 0x441a85
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x441c95
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x441c97
xor edx, edx
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push 1
push eax
call fcn.00440db0
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4428b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x4428bb
xor eax, eax
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
not ecx
cmp esi, 8
jb 0x442977
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46d510]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46d510]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46d510]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46d510]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46d510]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46d510]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46d510]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46d510]
sub edi, 1
jne 0x4428d0
pop edi
test esi, esi
je 0x44299a
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x46d510]
sub esi, 1
jne 0x442980
not ecx
mov eax, ecx
pop esi
pop ebp
ret
Function at 0x442cc0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
je 0x442d97
mov ecx, dword [esi + 0x3c]
mov eax, ecx
mov ebx, dword [ebp + 0xc]
test ecx, ecx
je 0x442cf8
cmp dword [esi + 0x40], ebx
jae 0x442cf8
push ecx
call fcn.004617b6
add esp, 4
mov dword [esi + 0x3c], 0
xor eax, eax
test eax, eax
jne 0x442d0e
lea eax, [ebx + ebx]
push eax
call fcn.004612a3
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
push ebx
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
xor edx, edx
add esp, 0xc
mov dword [ebp + 8], edx
test ebx, ebx
je 0x442d94
mov eax, dword [esi + 0x3c]
mov ecx, dword [esi + 0x30]
mov bl, byte [edx + eax]
mov edx, dword [esi + 0x38]
mov edi, edx
movsx eax, bl
and edi, 0xfffd
xor eax, ecx
or edi, 2
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x46d510]
xor eax, ecx
mov ecx, edi
mov dword [esi + 0x30], eax
xor ecx, 1
movzx eax, al
add eax, dword [esi + 0x34]
imul eax, eax, 0x8088405
imul ecx, edi
inc eax
mov dword [esi + 0x34], eax
shr eax, 0x18
xor eax, edx
shr ecx, 8
movzx eax, al
xor cl, bl
shr edx, 8
xor edx, dword [eax*4 + 0x46d510]
mov dword [esi + 0x38], edx
mov edx, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov byte [edx + eax], cl
inc edx
mov dword [ebp + 8], edx
cmp edx, dword [ebp + 0xc]
jb 0x442d22
mov edi, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x442dd5
mov edx, dword [esi + 0x24]
mov ebx, dword [ebp + 0xc]
lea eax, [edx + ebx]
cmp eax, dword [esi + 0x28]
jb 0x442dbc
pop edi
mov dword [esi + 0x14], 0x30000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
push ebx
add ecx, edx
push edi
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, ebx
add dword [esi + 0x24], ebx
pop edi
pop esi
pop ebx
pop ebp
ret 8
mov eax, dword [esi + 4]
test eax, eax
je 0x442df7
push 0
lea ecx, [ebp + 8]
push ecx
push dword [ebp + 0xc]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop esi
pop ebx
pop ebp
ret 8
Function at 0x443010
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov edx, dword [edi + 0x84]
test edx, edx
je 0x443073
mov ecx, dword [edi + 0x8c]
mov ebx, dword [edi + 0x88]
cmp ecx, ebx
jae 0x4430bb
mov esi, dword [ebp + 8]
lea eax, [ecx + edx]
sub ebx, ecx
cmp ebx, dword [ebp + 0xc]
cmova ebx, dword [ebp + 0xc]
push ebx
push eax
push esi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [edi + 0x78]
mov edx, esi
add dword [edi + 0x8c], ebx
add dword [edi + 0x74], ebx
push ebx
call fcn.004428b0
add esp, 0x10
mov dword [edi + 0x78], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [edi + 0x7c]
test eax, eax
je 0x4430b4
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 4]
push 0
push ecx
push dword [ebp + 0xc]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4430bb
mov esi, dword [ebp - 4]
mov edx, ebx
mov ecx, dword [edi + 0x78]
add dword [edi + 0x74], esi
push esi
call fcn.004428b0
add esp, 4
mov dword [edi + 0x78], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [edi + 0x14], 0x1000000
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4442d0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14c
mov eax, dword [0x48700c]
xor eax, esp
mov dword [esp + 0x148], eax
push ebx
push esi
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4443ba
push 0x104
call fcn.004612a3
add esp, 4
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4760e0
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x4443aa
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
nop dword [eax]
push 0x4730ac
lea eax, [esp + 0x40]
push eax
call ebx
test eax, eax
je 0x44438d
push 0x4739ac
lea eax, [esp + 0x40]
push eax
call ebx
test eax, eax
je 0x44438d
push edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x3c]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
test byte [esp + 0x10], 0x10
je 0x444386
mov dl, 1
mov ecx, esi
call fcn.004442d0
jmp 0x44438d
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x444340
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call fcn.004617b6
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [esp + 0x154]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00461231
mov esp, ebp
pop ebp
ret
Function at 0x4443d0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46904b
mov eax, dword fs:[0]
push eax
sub esp, 0x478
mov eax, dword [0x48700c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
push ecx
lea ecx, [ebp - 0x464]
call fcn.00406f60
push esi
lea ecx, [ebp - 0x44c]
mov dword [ebp - 4], 0
call fcn.00406f60
cmp dword [ebp - 0x454], 0x104
mov esi, dword [ebp - 0x464]
mov edi, dword [ebp - 0x44c]
jae 0x444531
cmp dword [ebp - 0x43c], 0x104
jae 0x444531
push 0x20a
lea eax, [ebp - 0x224]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x20a
lea eax, [ebp - 0x434]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
lea ecx, [ebp - 0x464]
cmp dword [ebp - 0x450], 8
lea edx, [ebp - 0x224]
cmovae ecx, esi
sub edx, ecx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x444490
cmp dword [ebp - 0x438], 8
lea ecx, [ebp - 0x44c]
lea edx, [ebp - 0x434]
cmovae ecx, edi
sub edx, ecx
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4444c0
lea eax, [ebp - 0x224]
mov dword [ebp - 0x484], 0
mov dword [ebp - 0x47c], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x434]
movlpd qword [ebp - 0x472], xmm0
mov dword [ebp - 0x478], eax
mov eax, 0x1694
mov word [ebp - 0x474], ax
lea eax, [ebp - 0x484]
push eax
mov dword [ebp - 0x46a], 0
mov dword [ebp - 0x480], 2
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete bl
jmp 0x444533
xor bl, bl
mov eax, dword [ebp - 0x438]
cmp eax, 8
jb 0x44456f
lea ecx, [eax*2 + 2]
mov eax, edi
cmp ecx, 0x1000
jb 0x444565
mov edi, dword [edi - 4]
add ecx, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x444565
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edi
call fcn.00461242
add esp, 8
mov eax, dword [ebp - 0x450]
cmp eax, 8
jb 0x4445ab
lea ecx, [eax*2 + 2]
mov eax, esi
cmp ecx, 0x1000
jb 0x4445a1
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4445a1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push esi
call fcn.00461242
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00461231
mov esp, ebp
pop ebp
ret
Function at 0x4445d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x48700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x20a
lea eax, [ebp - 0x210]
mov esi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x444604
mov esi, dword [esi]
lea ecx, [ebp - 0x210]
sub ecx, esi
nop dword [eax]
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x444610
lea eax, [ebp - 0x210]
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x228], eax
xorps xmm0, xmm0
mov eax, 0x414
mov dword [ebp - 0x224], 0
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x230]
push eax
movlpd qword [ebp - 0x21e], xmm0
mov dword [ebp - 0x216], 0
mov dword [ebp - 0x22c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp dword [ebp - 0x21e], 0
pop esi
je 0x444692
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461231
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x4446a2
cmp eax, 2
je 0x4446a2
cmp eax, 0x402
jne 0x444682
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
call fcn.00461231
mov esp, ebp
pop ebp
ret
Function at 0x447240
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00462800
mov eax, dword [0x48700c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ecx + 0x10], 0
push ebx
push esi
mov ebx, edx
je 0x447371
cmp dword [ecx + 0x14], 0x10
jb 0x44726d
mov ecx, dword [ecx]
push 0x4760d4
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov esi, eax
add esp, 8
mov dword [ebp - 0x1008], esi
test esi, esi
je 0x447371
push edi
push 0x1000
lea eax, [ebp - 0x1004]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push esi
push 0x1000
lea eax, [ebp - 0x1004]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edi, eax
add esp, 0x1c
test edi, edi
je 0x447351
mov edx, dword [ebx + 0x14]
mov eax, edx
mov ecx, dword [ebx + 0x10]
sub eax, ecx
cmp edi, eax
ja 0x4472ff
lea eax, [ecx + edi]
mov dword [ebx + 0x10], eax
mov eax, ebx
cmp edx, 0x10
jb 0x4472df
mov eax, dword [ebx]
lea esi, [eax + ecx]
push edi
lea eax, [ebp - 0x1004]
push eax
push esi
call sub.VCRUNTIME140.dll_memmove
mov byte [esi + edi], 0
add esp, 0xc
mov esi, dword [ebp - 0x1008]
jmp 0x44731c
push edi
lea eax, [ebp - 0x1004]
mov byte [ebp - 0x100c], 0
push eax
push dword [ebp - 0x100c]
mov ecx, ebx
push edi
call fcn.00409d40
push 0x1000
lea eax, [ebp - 0x1004]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push esi
push 0x1000
lea eax, [ebp - 0x1004]
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov edi, eax
add esp, 0x1c
test edi, edi
jne 0x4472c2
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00461231
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.00461231
mov esp, ebp
pop ebp
ret
Function at 0x447390
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4693ca
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x48700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, edx
mov edi, ecx
mov dword [ebp - 0x94], edi
mov dword [ebp - 0x9c], edi
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0xf
mov byte [ebp - 0x38], 0
lea edx, [ebp - 0x38]
mov dword [ebp - 4], 0
mov ecx, eax
call fcn.00447240
test eax, eax
je 0x447503
mov byte [ebp - 4], 1
lea edx, [ebp - 0x38]
cmp dword [ebp - 0x24], 0x10
lea ecx, [ebp - 0x90]
push dword [ebp - 0x28]
cmovae edx, dword [ebp - 0x38]
xorps xmm0, xmm0
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x90], 0x67452301
mov dword [ebp - 0x8c], 0xefcdab89
mov dword [ebp - 0x88], 0x98badcfe
mov dword [ebp - 0x84], 0x10325476
call fcn.0044dc20
add esp, 4
lea edx, [ebp - 0x90]
lea ecx, [ebp - 0x20]
call fcn.0044dd00
xor eax, eax
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
mov dword [ebp - 0x98], 2
mov dword [ebp - 0x94], eax
movzx esi, byte [ebp + eax - 0x20]
mov ecx, edi
mov eax, esi
shr eax, 4
movzx eax, byte [eax + str.0123456789abcdef]
push eax
call fcn.00414c80
and esi, 0xf
mov ecx, edi
movzx eax, byte [esi + str.0123456789abcdef]
push eax
call fcn.00414c80
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp eax, 0x10
jl 0x447490
mov eax, dword [ebp - 0x24]
cmp eax, 0x10
jb 0x447558
mov edx, dword [ebp - 0x38]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x4474ff
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4474ff
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
jmp 0x447550
push 0
mov dword [edi + 0x10], 0
mov ecx, edi
mov dword [edi + 0x14], 0xf
push 0x46ce34
mov byte [edi], 0
call fcn.00403560
mov edx, dword [ebp - 0x24]
cmp edx, 0x10
jb 0x447558
mov ecx, dword [ebp - 0x38]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x44754e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x44754e
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00461242
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00461231
mov esp, ebp
pop ebp
ret
Function at 0x44d5e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x469c1c
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x48700c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x84], edi
xorps xmm0, xmm0
mov dword [ebp - 0x80], 0
cmp dword [edx + 0x14], 0x10
mov eax, dword [edx + 0x10]
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x78], 0x67452301
mov dword [ebp - 0x74], 0xefcdab89
mov dword [ebp - 0x70], 0x98badcfe
mov dword [ebp - 0x6c], 0x10325476
jb 0x44d658
mov edx, dword [edx]
push eax
lea ecx, [ebp - 0x78]
call fcn.0044dc20
add esp, 4
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x20]
call fcn.0044dd00
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
xor eax, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x7c], eax
movzx esi, byte [ebp + eax - 0x20]
mov ecx, edi
mov eax, esi
shr eax, 4
movzx eax, byte [eax + str.0123456789abcdef]
push eax
call fcn.00414c80
and esi, 0xf
movzx ecx, byte [esi + str.0123456789abcdef]
push ecx
mov ecx, edi
call fcn.00414c80
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp eax, 0x10
jl 0x44d693
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00461231
mov esp, ebp
pop ebp
ret
Function at 0x45f620
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x45f62b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.0045f640
Function at 0x62cfb3
Capabilities:
Encode data using xor

Disassembly:
push dword [esp]
push dword [esp]
mov edx, dword [esp]
push ecx
mov ecx, esp
add ecx, 4
add ecx, 4
xchg dword [esp], ecx
pop esp
push ebp
mov ebp, esp
add ebp, 4
jmp 0x62d183
add edx, 0x7ffda000
push ecx
push 0x4feb9e00
mov ecx, dword [esp]
add esp, 4
push 0
jmp 0x62d168
mov ecx, dword [esp]
jmp 0x62d8b7
mov ebp, dword [esp]
add esp, 4
jmp 0x62d13a
sub edx, edi
jmp 0x62d73e
mov esp, dword [esp]
mov dword [esp], edi
jmp 0x62d55d
or ecx, 0x33e1a221
sub ecx, 1
push edx
mov edx, 0xa1fbaf29
sub ecx, edx
pop edx
sub edx, 0x5ef98541
sub edx, ecx
add edx, 0x5ef98541
jmp 0x62d015
not ecx
jmp 0x62d4f0
push edi
mov edi, 0x59ff6607
add edx, edi
push dword [esp]
pop edi
add esp, 4
push eax
mov dword [esp], ebx
jmp 0x62d291
sub dword [esp], ecx
pop ecx
jmp 0x62d100
sub ebp, 4
xchg dword [esp], ebp
jmp 0x62d0b0
xchg ebx, edi
jmp 0x62d39c
push esp
pop ebx
push esi
mov esi, 4
push eax
mov eax, 0x62b62400
not eax
sub eax, 0x3df98eba
add ebx, eax
pop eax
add ebx, 0x6ffe9e96
add ebx, esi
sub ebx, 0x6ffe9e96
sub ebx, 0x5f504d45
jmp 0x62d3fc
pop dword [esp]
pop esp
sub edx, 0x59ff6607
jmp 0x62cfc1
xor ecx, ebp
jmp 0x62d046
or ebx, 0x7fdf45f9
sub ebx, 0x775d932e
sub ecx, ebx
pop ebx
push ecx
xor dword [esp], 0x5fed1f1a
pop ebp
xor ebp, 0x5fed1f1a
mov ecx, dword [esp]
jmp 0x62d428
pop esi
sub esp, 4
mov dword [esp], ebp
push ecx
push ebp
mov ebp, 0x2e6e10a0
mov ecx, 0x11d09bbf
jmp 0x62d37e
push edi
mov edi, esp
add edi, 4
push edx
mov edx, 4
add edi, edx
pop edx
xchg dword [esp], edi
jmp 0x62d5a0
sub ecx, 0x77bf554e
jmp 0x62d62f
mov ecx, 4
add esi, ecx
pop ecx
xchg dword [esp], esi
pop esp
push 0x482c3f94
mov dword [esp], esi
push esp
mov esi, dword [esp]
add esp, 4
add esi, 4
add esi, 4
sub esp, 4
mov dword [esp], edi
mov dword [esp], esi
push dword [esp + 4]
pop esi
jmp 0x62d2e8
mov dword [esp], esi
push esp
pop esi
add esi, 4
jmp 0x62d8b1
pop esp
add ebx, ebp
jmp 0x62d785
add ecx, 0x3fffc33f
push ebx
mov ebx, 0x77ff8a0c
xchg ebx, edi
push edi
not dword [esp]
pop edi
jmp 0x62d191
mov edi, dword [esp]
add esp, 4
jmp 0x62d141
pop ebp
xchg dword [esp], ebx
mov esp, dword [esp]
sti
jmp fcn.0062d1e1
push ecx
jmp 0x62d4fb
add esp, 4
jmp 0x62d8c2
add edx, dword [esp]
push ecx
mov ecx, 0x743b5434
not ecx
push ebp
mov ebp, 1
add ecx, ebp
jmp 0x62d8da
pop ebp
inc ecx
or ecx, 0x5eb5dd81
sub ecx, 0xcdfbccd6
add edx, ecx
pop ecx
sub esp, 4
mov dword [esp], edi
jmp 0x62d8f9
mov edi, 0x7ffda000
jmp 0x62d0a9