joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40541f
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
mov eax, dword [ebp + 8]
push ebx
push esi
push 0x14
pop esi
mov dword [ebp - 8], esi
call fcn.004055a4
cmp edi, esi
jae 0x40543f
mov dword [ebp - 8], edi
mov esi, 0xff
xor ebx, ebx
push esi
lea eax, [ebp - 0x20b]
push ebx
push eax
mov byte [ebp - 0x20c], bl
call fcn.004465de
add esp, 0xc
push esi
lea eax, [ebp - 0x10b]
push ebx
push eax
mov byte [ebp - 0x10c], bl
call fcn.004465de
add esp, 0xc
push esi
lea eax, [ebp - 0x30b]
push ebx
push eax
mov byte [ebp - 0x30c], bl
call fcn.004465de
add esp, 0xc
push dword [ebp - 8]
lea eax, [ebp - 0x20c]
push dword [ebp + 0xc]
push eax
call fcn.00446622
add esp, 0xc
push dword [ebp - 8]
lea eax, [ebp - 0x10c]
push dword [ebp + 0xc]
push eax
call fcn.00446622
add esp, 0xc
xor eax, eax
cmp edi, ebx
jbe 0x4054d0
xor byte [ebp + eax - 0x20c], 0x5c
xor byte [ebp + eax - 0x10c], 0x36
inc eax
cmp eax, edi
jb 0x4054bb
lea eax, [ebp - 0x30c]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x10c]
push dword [ebp + 0x10]
push edi
push eax
mov eax, dword [ebp + 8]
call fcn.0040550f
push dword [ebp + 0x18]
lea eax, [ebp - 0x30c]
push 0x14
push eax
push edi
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp + 8]
call fcn.0040550f
pop esi
pop ebx
leave
ret 0x14
Function at 0x408d18
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
push ebx
push esi
mov esi, eax
push edi
lea eax, [ecx + 0x10]
push eax
lea eax, [ecx + 8]
push eax
lea eax, [ebp - 0x308]
mov edi, edx
call fcn.00405082
push 8
push dword [ebp + 8]
lea eax, [ebp - 8]
push eax
call fcn.00446622
add esp, 0x14
test esi, esi
jbe 0x408d8f
mov ebx, dword [ebp + 0xc]
sub ebx, edi
dec esi
shr esi, 3
inc esi
lea ecx, [ebp - 0x188]
lea eax, [edi + ebx]
push ecx
call fcn.004050fe
and dword [ebp + 8], 0
pop ecx
mov eax, edi
mov ecx, dword [ebp + 8]
lea ecx, [ebp + ecx - 8]
mov dl, byte [ecx]
xor byte [eax], dl
mov dl, byte [ebx + eax]
inc dword [ebp + 8]
inc eax
cmp dword [ebp + 8], 8
mov byte [ecx], dl
jb 0x408d70
dec esi
mov edi, eax
jne 0x408d5a
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40a7be
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, ecx
xor eax, eax
shl esi, 0xd
lea esi, [esi + 0x45e398]
push edi
mov dl, 0xfd
mov edi, esi
mov bl, al
and bl, 0x3f
sub bl, 0x56
xor bl, dl
movsx dx, bl
mov word [edi], dx
mov dl, byte [eax + 0x44e4f5]
inc eax
inc edi
inc edi
test dl, dl
jne 0x40a7d2
shl ecx, 0xc
add ecx, eax
and word [ecx*2 + 0x45e398], 0
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x40b44b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
xor eax, eax
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop edi
push ebx
mov byte [ebp - 0x14], 0x47
mov byte [ebp - 0x13], 0xd1
mov byte [ebp - 0x12], 0xf2
mov byte [ebp - 0x16], 0xca
mov byte [ebp - 0x15], 0x5e
mov byte [ebp - 0x18], 0xc8
mov byte [ebp - 0x17], 0x13
mov byte [ebp - 0x11], 0x12
xor edx, edx
lea ecx, [ebp - 0x11]
push esi
mov al, dl
mov bl, 0xd
imul bl
xor al, byte [ebp + edx - 0x18]
xor al, byte [ecx]
inc edx
mov byte [ebp + edx - 0x11], al
dec ecx
cmp edx, 8
jl 0x40b487
xor ecx, ecx
lea esi, [ebp - 0x11]
mov al, cl
mov dl, 0xe
imul dl
xor al, byte [esi]
xor al, 0x47
mov byte [ebp + ecx - 8], al
inc ecx
dec esi
cmp ecx, 8
jl 0x40b4a3
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x18]
call fcn.00405082
pop ecx
pop ecx
pop esi
pop ebx
leave
ret 4
Function at 0x40b4d3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30c
push ebx
push esi
push edi
lea eax, [esp + 0x18]
push eax
call fcn.0040b44b
and dword [esp + 0xc], 0
cmp dword [ebp + 0xc], 0
mov byte [0x45a4e0], 0xde
mov byte [0x45a4e3], 0xff
mov byte [0x45a4e4], 0x42
mov byte [0x45a4e6], 0xe1
mov byte [0x45a4e7], 0x97
mov byte [0x45a4e5], 0x1f
mov byte [0x45a4e2], 0x2c
mov byte [0x45a4e1], 0x53
jbe 0x40b584
mov ebx, dword [ebp + 8]
lea eax, [esp + 0x198]
push eax
lea edi, [esp + 0x14]
mov eax, ebx
call fcn.004050fe
pop ecx
xor eax, eax
lea esi, [eax + 0x45a4e0]
mov cl, byte [esi]
xor cl, byte [esp + 0xc]
xor byte [esp + eax + 0x10], cl
mov cl, byte [ebx + eax]
inc eax
cmp eax, 8
mov byte [esi], cl
jb 0x40b548
push 8
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00446622
add dword [esp + 0x18], 8
mov eax, dword [esp + 0x18]
add esp, 0xc
add ebx, 8
cmp eax, dword [ebp + 0xc]
jb 0x40b532
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4170e3
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
jle 0x41710c
push esi
movzx edx, byte [ecx]
movzx edx, byte [edx + 0x44ec90]
mov esi, eax
shl esi, 3
xor edx, esi
xor eax, edx
inc ecx
dec dword [esp + 8]
cmp dword [esp + 8], 0
jg 0x4170ec
pop esi
ret

Function at 0x41b559
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov edx, dword [ebx + 0x3c]
push esi
push edi
xor edi, edi
cmp dword [edx], edi
mov esi, eax
mov dword [ebp - 4], edi
jne 0x41b592
mov eax, dword [ebx + 0x78]
mov ecx, dword [ebx]
or eax, 0x1e
push edi
and eax, 0x87f3f
push eax
push edx
push edi
push ecx
call dword [ecx + 0x18]
add esp, 0x14
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x41b660
mov ecx, dword [ebx + 0x18]
cmp ecx, dword [ebx + 0x24]
jbe 0x41b5cc
mov eax, dword [ebx + 0x80]
push edi
cdq
push ecx
push edx
push eax
call fcn.0044d9c0
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x10]
push edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x3c]
mov ecx, dword [eax]
push 5
push eax
call dword [ecx + 0x28]
mov eax, dword [ebx + 0x18]
add esp, 0xc
mov dword [ebx + 0x24], eax
jmp 0x41b5cc
xor edi, edi
cmp esi, edi
je 0x41b660
mov edi, dword [esi + 0xc]
cmp edi, dword [ebx + 0x18]
ja 0x41b653
test byte [esi + 0x14], 0x20
jne 0x41b653
mov eax, dword [ebx + 0x80]
cdq
push edx
push eax
lea ecx, [edi - 1]
push 0
push ecx
call fcn.0044d9c0
cmp edi, 1
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jne 0x41b606
call fcn.0041ad8d
push dword [ebp - 0xc]
mov eax, dword [esi]
push dword [ebp - 0x10]
mov dword [ebp - 8], eax
push dword [ebx + 0x80]
push eax
mov eax, dword [ebx + 0x3c]
call fcn.004151b7
add esp, 0x10
cmp edi, 1
mov dword [ebp - 4], eax
jne 0x41b640
mov eax, dword [ebp - 8]
add eax, 0x18
push 0x10
push eax
lea eax, [ebx + 0x64]
push eax
call fcn.00446622
add esp, 0xc
cmp edi, dword [ebx + 0x20]
jbe 0x41b648
mov dword [ebx + 0x20], edi
push dword [esi]
mov eax, dword [ebx + 0x58]
call fcn.00422506
pop ecx
cmp dword [ebp - 4], 0
mov esi, dword [esi + 8]
je 0x41b5ca
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x42be4c
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x42be5e
xor eax, eax
jmp 0x42bf49
push esi
mov esi, dword [ebp + 8]
push 0x50
call fcn.00415ab7
mov esi, eax
test esi, esi
pop ecx
je 0x42bf48
push ebx
push dword [ebp + 0x10]
mov ebx, dword [edi]
push dword [ebp + 8]
call fcn.0042bbd5
push dword [ebp + 0x10]
mov dword [esi], eax
push dword [edi + 8]
push dword [ebp + 8]
call fcn.0042bc98
push 0
push dword [ebp + 0x10]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
push eax
push dword [ebp + 8]
call fcn.0042b9bd
push dword [ebp + 0x10]
mov dword [esi + 0xc], eax
push dword [ebp + 8]
mov ebx, dword [edi + 0x10]
call fcn.0042bbd5
push 0
push dword [ebp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
push eax
push dword [ebp + 8]
call fcn.0042b9bd
push dword [ebp + 0x10]
mov dword [esi + 0x14], eax
push dword [ebp + 8]
mov ebx, dword [edi + 0x18]
call fcn.0042bbd5
add esp, 0x44
push dword [ebp + 0x10]
mov dword [esi + 0x18], eax
mov al, byte [edi + 4]
mov byte [esi + 4], al
push dword [edi + 0x1c]
push dword [ebp + 8]
call fcn.0042be4c
xor ebx, ebx
push ebx
push dword [ebp + 0x10]
mov dword [esi + 0x1c], eax
mov eax, dword [edi + 0x28]
push eax
push dword [ebp + 8]
call fcn.0042b9bd
push ebx
push dword [ebp + 0x10]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
push eax
push dword [ebp + 8]
call fcn.0042b9bd
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov ax, word [edi + 6]
or dword [esi + 0x38], 0xffffffff
or dword [esi + 0x3c], 0xffffffff
and ax, 0xfff7
add esp, 0x2c
or dword [esi + 0x40], 0xffffffff
mov word [esi + 6], ax
mov dword [esi + 0x24], ebx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4466f4
Capabilities:
Parse pe header

Disassembly:
push 0x70
push 0x44e4c0
call fcn.00446904
xor edi, edi
push edi
call dword [0x44e0ac]
cmp word [eax], 0x5a4d
jne 0x44672f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44672f
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x446747
cmp eax, 0x20b
je 0x446734
mov dword [ebp - 0x1c], edi
jmp 0x44675b
cmp dword [ecx + 0x84], 0xe
jbe 0x44672f
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x446755
cmp dword [ecx + 0x74], 0xe
jbe 0x44672f
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
call dword [0x44e38c]
pop ecx
or dword [0x47259c], 0xffffffff
or dword [0x4725a0], 0xffffffff
call dword [0x44e388]
mov ecx, dword [0x45a52c]
mov dword [eax], ecx
call dword [0x44e384]
mov ecx, dword [0x45a528]
mov dword [eax], ecx
mov eax, dword [0x44e37c]
mov eax, dword [eax]
mov dword [0x472598], eax
call fcn.004153f2
cmp dword [section..data], edi
jne 0x4467b8
push fcn.004153f2
call dword [0x44e378]
pop ecx
call fcn.004468f0
push 0x44e498
push 0x44e494
call fcn.004468ea
mov eax, dword [0x45a524]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x45a520]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [0x44e370]
mov dword [ebp - 0x30], eax
push 0x44e490
push 0x44e46c
call fcn.004468ea
add esp, 0x24
mov eax, dword [0x44e3a8]
mov esi, dword [eax]
cmp esi, edi
jne 0x44681e
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x4468d8
mov dword [ebp - 0x34], esi
cmp word [esi], 0x22
jne 0x44686c
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x44683a
cmp ax, 0x22
jne 0x446827
cmp word [esi], 0x22
jne 0x446845
add esi, ebx
mov dword [ebp - 0x34], esi
mov ax, word [esi]
cmp ax, di
je 0x446853
cmp ax, 0x20
jbe 0x446840
mov dword [ebp - 0x4c], edi
lea eax, [ebp - 0x78]
push eax
call dword [0x44e0b0]
test byte [ebp - 0x4c], 1
je 0x446879
movzx eax, word [ebp - 0x48]
jmp 0x44687c
cmp word [esi], 0x20
jbe 0x446845
add esi, ebx
mov dword [ebp - 0x34], esi
jmp 0x44686c
push 0xa
pop eax
push eax
push esi
push edi
push edi
call dword [0x44e0ac]
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], edi
jne 0x44689d
push esi
call dword [0x44e3d8]
call dword [0x44e3dc]
jmp 0x4468d2
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0044693d
ret
Function at 0x447310
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x24
mov eax, dword [edi + 0x144]
mov ecx, dword [edi + 0x140]
push ebx
push ebp
mov ebp, dword [esp + 0x30]
push esi
push 0
push 8
push eax
push ecx
call fcn.0044d9c0
push 0
mov esi, edx
mov edx, dword [edi + 0x14c]
push 8
mov ebx, eax
mov eax, dword [edi + 0x148]
push edx
push eax
mov dword [esp + 0x2c], esi
call fcn.0044d9c0
mov ecx, dword [edi + 0x150]
mov dword [ebp], ecx
mov ecx, dword [edi + 0x154]
mov dword [ebp + 4], ecx
mov ecx, dword [edi + 0x158]
mov dword [ebp + 8], ecx
mov ecx, dword [edi + 0x15c]
mov dword [ebp + 0xc], ecx
mov ecx, ebx
or ecx, esi
mov dword [esp + 0x14], edx
jne 0x447388
mov ecx, eax
or ecx, edx
je 0x4474c5
xor ecx, ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ecx
mov ecx, edx
shr ecx, 0x18
mov byte [esp + 0x20], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esp + 0x21], cl
mov ecx, edx
shr ecx, 8
mov byte [esp + 0x22], cl
mov cl, byte [esp + 0x14]
mov byte [esp + 0x23], cl
mov ecx, eax
mov ebp, edx
shrd ecx, ebp, 0x18
mov byte [esp + 0x24], cl
mov ecx, eax
shr ebp, 0x18
mov ebp, edx
shrd ecx, ebp, 0x10
mov byte [esp + 0x25], cl
mov ecx, eax
shrd ecx, edx, 8
mov byte [esp + 0x27], al
mov byte [esp + 0x26], cl
mov eax, esi
shr eax, 0x10
mov ecx, esi
shr ecx, 8
shr edx, 8
mov byte [esp + 0x29], al
mov byte [esp + 0x2a], cl
mov edx, esi
shr edx, 0x18
mov ecx, esi
mov eax, ebx
shrd eax, ecx, 0x18
mov byte [esp + 0x28], dl
mov dl, byte [esp + 0x1c]
mov byte [esp + 0x2c], al
mov byte [esp + 0x2b], dl
shr ecx, 0x18
mov eax, esi
mov edx, ebx
shrd edx, eax, 0x10
mov ecx, ebx
shrd ecx, esi, 8
shr esi, 8
shr ebp, 0x10
shr eax, 0x10
mov byte [esp + 0x2d], dl
mov byte [esp + 0x2e], cl
mov byte [esp + 0x2f], bl
xor eax, eax
lea esi, [edi + 0x171]
jmp 0x447450
movzx edx, byte [esp + eax + 0x20]
movzx ecx, byte [esp + eax + 0x21]
xor byte [esi + eax - 1], dl
xor byte [esi + eax], cl
movzx edx, byte [esp + eax + 0x22]
movzx ecx, byte [esp + eax + 0x23]
xor byte [esi + eax + 1], dl
xor byte [esi + eax + 2], cl
add eax, 4
cmp eax, 0x10
jb 0x447450
lea ecx, [edi + 0x170]
push ecx
mov eax, edi
call fcn.00446d30
mov eax, dword [esp + 0x38]
add esp, 4
add eax, 1
mov ecx, 4
jmp 0x4474a0
movzx edx, byte [esi - 1]
xor byte [eax - 1], dl
movzx edx, byte [esi]
xor byte [eax], dl
movzx edx, byte [esi + 1]
xor byte [eax + 1], dl
movzx edx, byte [esi + 2]
xor byte [eax + 2], dl
add esi, 4
add eax, 4
sub ecx, 1
jne 0x4474a0
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x24
ret
Function at 0x44a360
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
test ecx, ecx
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 0xe8], ecx
jne 0x44a3b0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
ret
mov dword [eax + 8], 0xc1059ed8
mov dword [eax + 0xc], 0x367cd507
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0xf70e5939
mov dword [eax + 0x18], 0xffc00b31
mov dword [eax + 0x1c], 0x68581511
mov dword [eax + 0x20], 0x64f98fa7
mov dword [eax + 0x24], 0xbefa4fa4
ret

Function at 0x44a6e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push ebp
push edi
push 0x40
lea ebp, [esi + 0x68]
push 0x36
push ebp
call fcn.004465de
push 0x40
lea edi, [esi + 0xa8]
push 0x5c
push edi
call fcn.004465de
mov ecx, dword [esp + 0x28]
mov eax, edi
add esp, 0x18
mov edi, 0x14
mov edi, edi
movzx edx, byte [ecx]
xor byte [eax - 0x40], dl
movzx edx, byte [ecx]
xor byte [eax], dl
add ecx, 1
add eax, 1
sub edi, 1
jne 0x44a710
push ebx
xor ecx, ecx
mov eax, esi
call fcn.0044a360
lea edi, [ecx + 0x40]
mov ecx, dword [esi]
mov eax, ecx
and eax, 0x3f
mov ebx, edi
add ecx, edi
sub ebx, eax
cmp ecx, edi
mov dword [esp + 0xc], eax
mov dword [esi], ecx
jae 0x44a74e
add dword [esi + 4], 1
test eax, eax
je 0x44a77f
cmp ebx, edi
ja 0x44a77f
push ebx
lea eax, [eax + esi + 0x28]
push ebp
push eax
call fcn.00446622
lea eax, [esi + 0x28]
push esi
call fcn.004479c0
sub edi, ebx
add esp, 0x10
add ebp, ebx
cmp edi, 0x40
mov dword [esp + 0xc], 0
jb 0x44a79a
mov ebx, edi
shr ebx, 6
push esi
mov eax, ebp
call fcn.004479c0
add esp, 4
add ebp, 0x40
sub edi, 0x40
sub ebx, 1
jne 0x44a784
test edi, edi
pop ebx
jbe 0x44a7b2
mov ecx, dword [esp + 8]
push edi
lea edx, [ecx + esi + 0x28]
push ebp
push edx
call fcn.00446622
add esp, 0xc
pop edi
pop ebp
pop ecx
ret
Function at 0x44b610
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
sub esp, 0x800
push ebx
push ebp
xor ecx, ecx
push esi
lea eax, [ecx + 1]
push edi
nop
mov edx, eax
and dl, 0x80
neg dl
lea esi, [eax + eax]
mov dword [esp + ecx*4 + 0x410], eax
mov dword [esp + eax*4 + 0x10], ecx
sbb edx, edx
and edx, 0x1b
xor edx, esi
xor edx, eax
and edx, 0xff
add ecx, 1
cmp ecx, 0x100
mov eax, edx
jl 0x44b620
mov eax, 1
mov ecx, 0x45b770
jmp 0x44b660
mov edx, eax
and dl, 0x80
neg dl
mov dword [ecx], eax
sbb edx, edx
and edx, 0x1b
add eax, eax
xor edx, eax
and edx, 0xff
add ecx, 4
cmp ecx, 0x45b798
mov eax, edx
jl 0x44b660
mov byte [0x45ae70], 0x63
mov byte [0x45cffb], 0
mov ebx, 1
mov ecx, dword [esp + ebx*4 + 0x10]
add ecx, ecx
add ecx, ecx
lea edx, [esp + 0x80c]
sub edx, ecx
mov eax, dword [edx]
mov ecx, eax
sar ecx, 7
lea edx, [eax + eax]
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
and edx, 0xff
xor eax, edx
mov ecx, edx
add edx, edx
sar ecx, 7
or ecx, edx
and ecx, 0xff
xor eax, ecx
mov edx, ecx
sar edx, 7
add ecx, ecx
or edx, ecx
xor edx, 0x63
and edx, 0xff
xor eax, edx
mov byte [ebx + 0x45ae70], al
mov byte [eax + 0x45cf98], bl
add ebx, 1
cmp ebx, 0x100
jl 0x44b698
xor ecx, ecx
lea esp, [esp]
movzx edx, byte [ecx + 0x45ae70]
mov eax, edx
and al, 0x80
neg al
lea esi, [edx + edx]
sbb eax, eax
and eax, 0x1b
xor eax, esi
and eax, 0xff
mov esi, eax
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, esi
mov dword [ecx*4 + 0x45cb98], eax
rol eax, 8
mov dword [ecx*4 + 0x45c798], eax
rol eax, 8
mov dword [ecx*4 + 0x45c398], eax
rol eax, 8
mov dword [ecx*4 + 0x45bf98], eax
movzx eax, byte [ecx + 0x45cf98]
test eax, eax
je 0x44b7c1
mov esi, dword [esp + eax*4 + 0x10]
mov edx, dword [esp + 0x48]
lea eax, [esi + edx]
cdq
mov edi, 0xff
idiv edi
mov eax, dword [esp + 0x34]
add eax, esi
mov ebp, dword [esp + edx*4 + 0x410]
cdq
idiv edi
mov ebx, dword [esp + edx*4 + 0x410]
mov edx, dword [esp + 0x44]
lea eax, [esi + edx]
cdq
idiv edi
mov eax, dword [esp + 0x3c]
add eax, esi
mov esi, 0xff
mov edi, dword [esp + edx*4 + 0x410]
cdq
idiv esi
mov edx, dword [esp + edx*4 + 0x410]
jmp 0x44b7c9
xor ebp, ebp
xor ebx, ebx
xor edi, edi
xor edx, edx
shl edx, 8
xor edx, edi
shl edx, 8
xor edx, ebx
shl edx, 8
xor edx, ebp
mov dword [ecx*4 + 0x45bb98], edx
rol edx, 8
mov dword [ecx*4 + 0x45b798], edx
rol edx, 8
mov dword [ecx*4 + 0x45b370], edx
rol edx, 8
mov dword [ecx*4 + 0x45af70], edx
add ecx, 1
cmp ecx, 0x100
jl 0x44b710
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x800
ret
Function at 0x44be00
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
test cl, 0xf
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
mov esi, eax
mov edi, edx
je 0x44be1f
pop edi
pop esi
mov eax, 0xffffffde
pop ebp
add esp, 0x28
ret
cmp dword [esp + 0x3c], 0
push ebx
jne 0x44bece
test ecx, ecx
jbe 0x44bfb0
lea eax, [ecx - 1]
mov ebx, ebp
shr eax, 4
sub ebx, esi
add eax, 1
mov dword [esp + 0x14], eax
mov eax, dword [edi]
mov ecx, dword [edi + 4]
mov edx, dword [edi + 8]
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x3c]
mov ecx, edi
mov dword [esp + 0x30], edx
call fcn.0044aa80
mov eax, esi
lea ecx, [ebp + 2]
mov esi, 4
movzx edx, byte [ebx + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
sub esi, 1
jne 0x44be74
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [ebp], ecx
mov ecx, dword [esp + 0x30]
mov dword [ebp + 4], edx
mov edx, dword [esp + 0x34]
add edi, 0x10
sub ebx, 0x10
sub dword [esp + 0x14], 1
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], edx
mov esi, eax
jne 0x44be44
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x28
ret
test ecx, ecx
jbe 0x44bfb0
mov eax, ebp
sub eax, esi
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, edi
mov dword [esp + 0x10], eax
lea eax, [ecx - 1]
shr eax, 4
add eax, 1
mov dword [esp + 0x20], eax
lea eax, [ebp + 3]
mov edx, esi
sub edx, edi
mov dword [esp + 0x18], eax
lea ecx, [esi + 1]
mov eax, edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], 4
jmp 0x44bf15
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x10]
movzx ebx, byte [eax + ebx]
xor bl, byte [eax]
add eax, 4
mov byte [edx + eax - 4], bl
mov edx, dword [esp + 0x14]
mov dl, byte [ecx + edx]
xor dl, byte [eax - 3]
add ecx, 4
mov byte [ecx - 4], dl
movzx ebx, byte [eax - 2]
mov edx, dword [esp + 0x18]
xor bl, byte [edx - 1]
add edx, 4
mov byte [ecx - 3], bl
movzx ebx, byte [eax - 1]
xor bl, byte [edx - 4]
mov dword [esp + 0x18], edx
mov byte [ecx - 2], bl
mov ebx, 1
sub dword [esp + 0x1c], ebx
jne 0x44bf11
cmp dword [esp + 0x40], ebx
mov eax, dword [esp + 0x3c]
jne 0x44bf77
push eax
mov eax, esi
call fcn.0044b040
add esp, 4
jmp 0x44bf7e
mov ecx, esi
call fcn.0044aa80
mov ecx, dword [esi]
mov dword [ebp], ecx
mov edx, dword [esi + 4]
mov dword [ebp + 4], edx
mov eax, dword [esi + 8]
mov dword [ebp + 8], eax
mov ecx, dword [esi + 0xc]
mov eax, 0x10
sub dword [esp + 0x10], eax
sub dword [esp + 0x14], eax
add edi, eax
add esi, eax
sub dword [esp + 0x20], ebx
mov dword [ebp + 0xc], ecx
jne 0x44bef3
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x28
ret
Function at 0x44bfc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
push ebx
push esi
push edi
push 0x118
mov edi, eax
lea eax, [esp + 0x14]
push 0
push eax
call fcn.004465de
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ecx
lea edx, [esp + 0x20]
lea esi, [edi + 8]
push edx
mov dword [edi + 4], esi
call fcn.0044b870
add esp, 0x14
test eax, eax
mov dword [esp + 0xc], eax
jne 0x44c0e8
mov ecx, dword [esp + 0x10]
mov dword [edi], ecx
shl ecx, 4
add ecx, dword [esp + 0x14]
add esi, 4
mov edx, dword [ecx]
mov dword [esi - 4], edx
mov edx, dword [ecx + 4]
add ecx, 4
mov dword [esi], edx
mov edx, dword [ecx + 4]
add ecx, 4
add esi, 4
mov dword [esi], edx
mov edx, dword [ecx + 4]
add ecx, 4
add esi, 4
mov dword [esi], edx
mov edx, dword [edi]
sub edx, 1
add esi, 4
sub ecx, 0x1c
test edx, edx
jle 0x44c0c8
mov edi, edi
mov edi, 4
jmp 0x44c060
movzx eax, byte [ecx + 3]
movzx eax, byte [eax + 0x45ae70]
movzx ebx, byte [ecx + 2]
movzx ebx, byte [ebx + 0x45ae70]
mov eax, dword [eax*4 + 0x45af70]
xor eax, dword [ebx*4 + 0x45b370]
movzx ebx, byte [ecx + 1]
movzx ebx, byte [ebx + 0x45ae70]
xor eax, dword [ebx*4 + 0x45b798]
mov ebx, dword [ecx]
and ebx, 0xff
movzx ebx, byte [ebx + 0x45ae70]
xor eax, dword [ebx*4 + 0x45bb98]
add esi, 4
mov dword [esi - 4], eax
add ecx, 4
sub edi, 1
jne 0x44c060
sub edx, 1
sub ecx, 0x20
test edx, edx
jg 0x44c050
mov eax, dword [esp + 0xc]
mov edx, dword [ecx]
mov dword [esi], edx
mov edx, dword [ecx + 4]
add ecx, 4
add esi, 4
mov dword [esi], edx
mov edx, dword [ecx + 4]
add esi, 4
add ecx, 4
mov dword [esi], edx
mov ecx, dword [ecx + 4]
mov dword [esi + 4], ecx
mov ecx, 0x118
lea edx, [esp + 0x10]
sub ecx, 1
mov byte [edx], 0
add edx, 1
test ecx, ecx
jne 0x44c0f1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x44d5d0
Capabilities:
Hash data using sha1

Disassembly:
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret