joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50c854
Capabilities:
Write file on windows

Disassembly:
xor esi, 0xed7e38a0
not edx
add eax, esi
sub ecx, 0x9811f360
cmp ebx, esp
jo 0x50c86d
mov edx, 0x7051e156
sub ebx, edx
call fcn.0052e9fc
shl ebx, 0x1b
and eax, eax
and ebx, esp
dec edi
call fcn.004fee39
shr edx, 0x1a
dec edx
call fcn.0042ba72
mov ebx, 0xb22b07c0
neg esi
and edi, 0xc21d3575
mov edx, 0x524499fb
sub ecx, ecx
call fcn.00492a17
call fcn.00478570
xor esi, 0x3bf6b04f
dec eax
not eax
or edi, 0xe51affed
xor ebx, dword [0x5b737e]
ror ecx, 0x13
rol ebx, 0x14
not esi
mov ecx, 0x30d9c8fa
mov dword [0x5c0c9a], eax
not eax
add esi, eax
shr eax, 7
and eax, 0xbaf61cb2
shl eax, 0x1f
xchg esi, edx
dec esi
mov dword [0x5c0d09], 0xc3ca0ff6
mov edx, 0x6972585e
sub edi, 0x7b34376d
test dword [0x5b2e43], edi
jle 0x50c901
inc edi
mov edx, 0x79a7c11
invalid
invalid
invalid

Function at 0x50c903
Capabilities:
Write file on windows

Disassembly:
xor esi, 0xed7e38a0
not edx
add eax, esi
sub ecx, 0x9811f360
cmp ebx, esp
jo 0x50c86d
mov edx, 0x7051e156
sub ebx, edx
call fcn.0052e9fc
shl ebx, 0x1b
and eax, eax
and ebx, esp
dec edi
call fcn.004fee39
shr edx, 0x1a
dec edx
call fcn.0042ba72
mov ebx, 0xb22b07c0
neg esi
and edi, 0xc21d3575
mov edx, 0x524499fb
sub ecx, ecx
call fcn.00492a17
call fcn.00478570
xor esi, 0x3bf6b04f
dec eax
not eax
or edi, 0xe51affed
xor ebx, dword [0x5b737e]
ror ecx, 0x13
rol ebx, 0x14
not esi
mov ecx, 0x30d9c8fa
mov dword [0x5c0c9a], eax
not eax
add esi, eax
shr eax, 7
and eax, 0xbaf61cb2
shl eax, 0x1f
xchg esi, edx
dec esi
mov dword [0x5c0d09], 0xc3ca0ff6
mov edx, 0x6972585e
sub edi, 0x7b34376d
test dword [0x5b2e43], edi
jle 0x50c901
inc edi
mov edx, 0x79a7c11
invalid
invalid
invalid

Function at 0x50c948
Capabilities:
Write file on windows

Disassembly:
je 0x50c902
clc
invalid
adc dword [edx + ebx*4 + 7], edi
jl 0x50c89f
pop es
or esi, 0xcfad531a
mov eax, 0x5d633e2a
add esi, 0x24269eab
shr ecx, 0x1e
xor edx, ecx
shl edx, 0x11
ror ecx, 3
add dword [0x5c0c11], ecx
test dword [0x5b954f], esi
jne 0x50c93c
xchg edx, esi
mov ecx, 0x5bff60cd
or edi, ecx
sub edi, dword [0x5b1869]
add byte [ecx], cl
add eax, 0x5c0be8
ror esi, 0x12
and dword [0x5c0c97], ebx
neg edx
shr ebx, 0x1a
mov esi, dword [0x5b8878]
rol edx, 0xd
and ebx, 0xbe082b2
neg edi
sub edi, 0xed240390
dec ecx
jne 0x50c941

Function at 0x50c978
Capabilities:
Write file on windows

Disassembly:
xchg ebx, esi
call fcn.0049a430
call fcn.0045c1e0
call fcn.004912b0
shr ebx, 0x1f
add eax, 0x17536980
mov ecx, 0x3d8313c3
add dword [0x5c0d9a], edi
sub dword [0x5c0d1b], edi
inc eax
or dword [0x5c0c66], edx
xchg esi, edx
neg eax
test dword [0x5b42af], 0x48435551
pop ebx
add byte [ecx + 0x55], dl
inc ebx
dec eax
jno 0x50c9bd
shl esi, 0xb
dec edi
or ebx, 0xc8174d41
and edi, 0x11756609
inc edx
dec ecx
jne 0x50c997
shr ecx, 0x1b
dec eax
xor edi, 0xccb9ab5e
or eax, dword [0x5ae463]
Function at 0x50c9df
Capabilities:
Write file on windows

Disassembly:
inc ebx
xor ecx, 0x2ae93934
sub ecx, 0xec4463ee
rol ebx, 0x1f
neg edi
add esi, edx
xchg ebx, edx
inc ebx
dec esi
shl eax, 0x18
mov ecx, 0x4403230b
ror ebx, 5
cmp dword [0x5aeabf], esi
xor eax, 0x5aeabf
jns 0x50ca10
or eax, 0x5aae8a27
shr edx, 0xf
xchg esi, eax
neg esi
cmp esp, 0x5a681deb
ja 0x50ca25
or eax, 0x975ea0f8
and ebx, dword [0x5adbac]
mov edi, dword [0x5b180e]
ror edi, 0xb
not edi
and dword [0x5c0d89], esi
not esi
dec ecx
jne 0x50c9ff
mov edx, 0xcfe42de1
xor esi, dword [0x5c0efb]
sub dword [0x5c0c52], eax
xchg ebx, eax
ror edx, 0x13
adc eax, dword [ecx - 0x52e1f90e]
int1
sub edx, dword [0x5c0e05]
call fcn.0051bdb4
xor ebx, ebp
not ecx
ror esi, 0x1c
rol esi, 0x1c
not ecx
xor ebx, ebp
xor edx, 0xf1ad1e06
rol edx, 0x13
xchg ebx, eax
xor dword [0x5c0c7c], edx
xor edx, 0x6314a027
add eax, 0xa9ead7d3
inc ecx
call fcn.00493f6b
or dword [0x5c0c84], 0x24504370
xor edi, esi
call fcn.00407290
neg edx
sub ebx, 0x910d957d
add dword [0x5c0bfc], eax
add edi, esi
call fcn.0043af69
call fcn.004df367
sub edi, esi
xor dword [0x5c0da1], edx
add ebx, 0x910d957d
neg edx
xor edi, esi
dec ecx
sub eax, 0xa9ead7d3
xor edx, 0xacf08d86
not edx
sub edx, dword [0x5c0eda]
xchg esi, eax
or ebx, dword [0x5c0e19]
sub edx, eax
dec edi
neg eax
or dword [0x5c0c37], edi
not esi
sub edx, dword [0x5c0e83]
xchg ecx, esi
rol ecx, 1
inc esi
add esi, dword [0x5c0f0c]
dec esi
ror ecx, 1
xchg ecx, esi
not esi
neg eax
inc edi
add edx, eax
xchg esi, eax
not edx
push edx
rol edx, 0x10
add edi, dword [0x5c0e1d]
rol esi, 0x1f
xchg ecx, esi
xor edi, dword [0x5c0f83]
add dword [0x5c0c0a], eax
xchg edi, eax
sub edx, ebp
ror eax, 0xd
Function at 0x50ca57
Capabilities:
Write file on windows

Disassembly:
inc ebx
xor ecx, 0x2ae93934
sub ecx, 0xec4463ee
rol ebx, 0x1f
neg edi
add esi, edx
xchg ebx, edx
inc ebx
dec esi
shl eax, 0x18
mov ecx, 0x4403230b
ror ebx, 5
cmp dword [0x5aeabf], esi
xor eax, 0x5aeabf
jns 0x50ca10
or eax, 0x5aae8a27
shr edx, 0xf
xchg esi, eax
neg esi
cmp esp, 0x5a681deb
ja 0x50ca25
or eax, 0x975ea0f8
and ebx, dword [0x5adbac]
mov edi, dword [0x5b180e]
ror edi, 0xb
not edi
and dword [0x5c0d89], esi
not esi
dec ecx
jne 0x50c9ff
mov edx, 0xcfe42de1
xor esi, dword [0x5c0efb]
sub dword [0x5c0c52], eax
xchg ebx, eax
ror edx, 0x13
adc eax, dword [ecx - 0x52e1f90e]
int1
sub edx, dword [0x5c0e05]
call fcn.0051bdb4
xor ebx, ebp
not ecx
ror esi, 0x1c
rol esi, 0x1c
not ecx
xor ebx, ebp
xor edx, 0xf1ad1e06
rol edx, 0x13
xchg ebx, eax
xor dword [0x5c0c7c], edx
xor edx, 0x6314a027
add eax, 0xa9ead7d3
inc ecx
call fcn.00493f6b
or dword [0x5c0c84], 0x24504370
xor edi, esi
call fcn.00407290
neg edx
sub ebx, 0x910d957d
add dword [0x5c0bfc], eax
add edi, esi
call fcn.0043af69
call fcn.004df367
sub edi, esi
xor dword [0x5c0da1], edx
add ebx, 0x910d957d
neg edx
xor edi, esi
dec ecx
sub eax, 0xa9ead7d3
xor edx, 0xacf08d86
not edx
sub edx, dword [0x5c0eda]
xchg esi, eax
or ebx, dword [0x5c0e19]
sub edx, eax
dec edi
neg eax
or dword [0x5c0c37], edi
not esi
sub edx, dword [0x5c0e83]
xchg ecx, esi
rol ecx, 1
inc esi
add esi, dword [0x5c0f0c]
dec esi
ror ecx, 1
xchg ecx, esi
not esi
neg eax
inc edi
add edx, eax
xchg esi, eax
not edx
push edx
rol edx, 0x10
add edi, dword [0x5c0e1d]
rol esi, 0x1f
xchg ecx, esi
xor edi, dword [0x5c0f83]
add dword [0x5c0c0a], eax
xchg edi, eax
sub edx, ebp
ror eax, 0xd
Function at 0x50e173
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x5ac020]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00506da0
mov dword [ebp - 0x14], eax
cmp dword [0x5bba54], esi
jne 0x50e266
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x50e1f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x50e346
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x50e346
push 0x557d30
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x50e346
push eax
call ebx
push 0x557d3c
push edi
mov dword [0x5bba54], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x5bba58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x5bba5c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5bba64], eax
test eax, eax
je 0x50e263
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x5bba60], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x50e28b
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x50e27e
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x50e2a0
push 4
pop eax
jmp 0x50e348
cmp dword [ebp - 0x14], esi
je 0x50e2a0
push dword [0x5bba54]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x50e285
mov eax, dword [0x5bba60]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x50e2fe
cmp dword [0x5bba64], edi
je 0x50e2fe
push eax
call ebx
push dword [0x5bba64]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x50e2fe
test eax, eax
je 0x50e2fe
call ecx
test eax, eax
je 0x50e2f3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x50e2f3
test byte [ebp - 8], 1
jne 0x50e2fe
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x50e32e
mov eax, dword [0x5bba58]
cmp eax, edi
je 0x50e32b
push eax
call ebx
test eax, eax
je 0x50e32b
call eax
mov esi, eax
test esi, esi
je 0x50e32b
mov eax, dword [0x5bba5c]
cmp eax, edi
je 0x50e32b
push eax
call ebx
test eax, eax
je 0x50e32b
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x5bba54]
call ebx
test eax, eax
je 0x50e346
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x50e348
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ffcef
mov esp, ebp
pop ebp
ret
Function at 0x512ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x2c]
lea esp, [esp]
mov eax, dword [edi + 0x2c]
mov ebx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub ebx, dword [edi + 0x74]
add eax, esi
sub ebx, dword [edi + 0x6c]
cmp dword [edi + 0x6c], eax
jb 0x512f59
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.00502510
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
jmp 0x512f20
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x512f2f
sub eax, esi
jmp 0x512f31
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x512f20
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x512f4f
sub eax, esi
jmp 0x512f51
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x512f40
add ebx, esi
mov ecx, dword [edi]
cmp dword [ecx + 4], 0
je 0x512fb1
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
push ebx
push eax
push ecx
call fcn.00513230
add dword [edi + 0x74], eax
add esp, 0xc
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x512f9d
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x512fb1
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x512ee0
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x514e40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x514e4c
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.00514e60

Function at 0x5182e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
test ebx, ebx
jne 0x518300
push ebx
push ebx
push ebx
push 2
call fcn.0051acb0
pop esi
xor al, al
pop ebx
pop ebp
ret 8
push edi
call fcn.00517ae0
push 2
push 0
push ebx
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
call fcn.00535056
push ebx
call fcn.00535469
push 0
mov edi, eax
push 0
push ebx
mov dword [ebp + 8], edi
call fcn.00535056
add esp, 0x1c
test edi, edi
jg 0x518352
push 0
push 0
push 0
push 0xc
mov ecx, esi
call fcn.0051acb0
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
lea eax, [edi + 1]
push eax
call fcn.004ffbb1
push ebx
mov ebx, dword [ebp + 8]
mov edi, eax
push 1
push ebx
push edi
mov byte [edi], 0
call fcn.00534f1b
add esp, 0x14
cmp eax, 1
je 0x518396
push edi
call fcn.00500843
add esp, 4
mov ecx, esi
push 0
push 0
push 0
push 2
call fcn.0051acb0
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret 8
mov byte [edi + ebx], 0
mov eax, edi
cmp byte [edi], 0
mov ecx, edi
je 0x5183bf
mov dl, byte [eax]
cmp dl, 0xd
jne 0x5183b6
inc eax
mov byte [ecx], 0xa
inc ecx
cmp byte [eax], 0xa
jne 0x5183ba
jmp 0x5183b9
mov byte [ecx], dl
inc ecx
inc eax
cmp byte [eax], 0
jne 0x5183a3
push dword [ebp + 0xc]
mov byte [ecx], 0
mov ecx, esi
mov eax, dword [esi]
push 0
push edi
call dword [eax + 8]
push edi
call fcn.00500843
add esp, 4
xor eax, eax
cmp byte [esi + 0x2c], al
sete al
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x51d650
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
jne 0x51d674
push 0xd4
push str.srcprngs_sober128.c
push str.in___NULL
call fcn.0052cf10
add esp, 0xc
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x51d692
push 0xd5
push str.srcprngs_sober128.c
push str.prng___NULL
call fcn.0052cf10
add esp, 0xc
cmp dword [esi + 0x94], 1
jne 0x51d717
mov eax, dword [ebp + 0xc]
test al, 3
je 0x51d6ac
pop edi
pop esi
mov eax, 3
pop ebx
pop ebp
ret
xor edi, edi
test eax, eax
je 0x51d6da
lea eax, [edi + ebx]
push eax
call fcn.004db490
add dword [esi + 0x3c], eax
push esi
call fcn.0051e150
push esi
call fcn.0051e1e0
xor dword [esi + 0x10], eax
add edi, 4
mov eax, dword [ebp + 0xc]
add esp, 0xc
cmp edi, eax
jb 0x51d6b2
add dword [esi + 0x3c], eax
push esi
call fcn.0051e220
push esi
call fcn.0051e740
push esi
call fcn.0051e7f0
add esp, 0xc
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 1
xor eax, eax
mov dword [esi + 0x90], 0
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.0051e770
mov ebx, dword [ebp + 0xc]
add esp, 4
test bl, 3
jne 0x51d6a2
xor edi, edi
test ebx, ebx
je 0x51d759
mov eax, dword [ebp + 8]
add eax, edi
push eax
call fcn.004db490
add dword [esi + 0x3c], eax
push esi
call fcn.0051e150
push esi
call fcn.0051e1e0
xor dword [esi + 0x10], eax
add edi, 4
add esp, 0xc
cmp edi, ebx
jb 0x51d732
add dword [esi + 0x3c], ebx
push esi
call fcn.0051e220
add esp, 4
mov dword [esi + 0x90], 0
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x51e970
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x51e992
push 0xd0
push str.srchashes_sha2_sha256.c
push str.md___NULL
call fcn.0052cf10
add esp, 0xc
mov dword [esi + 0x28], 0
xor eax, eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0x6a09e667
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0x3c6ef372
mov dword [esi + 0x14], 0xa54ff53a
mov dword [esi + 0x18], 0x510e527f
mov dword [esi + 0x1c], 0x9b05688c
mov dword [esi + 0x20], 0x1f83d9ab
mov dword [esi + 0x24], 0x5be0cd19
pop esi
pop ebp
ret
Function at 0x51ed90
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x51edaf
push 0x2a
push str.f:pd3privacydrivelibtomcrypt_srchashes_sha2_sha224.c
push str.md___NULL
call fcn.0052cf10
add esp, 0xc
mov dword [esi + 0x28], 0
xor eax, eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0xc1059ed8
mov dword [esi + 0xc], 0x367cd507
mov dword [esi + 0x10], 0x3070dd17
mov dword [esi + 0x14], 0xf70e5939
mov dword [esi + 0x18], 0xffc00b31
mov dword [esi + 0x1c], 0x68581511
mov dword [esi + 0x20], 0x64f98fa7
mov dword [esi + 0x24], 0xbefa4fa4
pop esi
pop ebp
ret
Function at 0x521290
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x5212b2
push 0xb1
push str.srchashes_sha2_sha512.c
push str.md___NULL
call fcn.0052cf10
add esp, 0xc
mov dword [esi + 0x48], 0
xor eax, eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0xf3bcc908
mov dword [esi + 0xc], 0x6a09e667
mov dword [esi + 0x10], 0x84caa73b
mov dword [esi + 0x14], 0xbb67ae85
mov dword [esi + 0x18], 0xfe94f82b
mov dword [esi + 0x1c], 0x3c6ef372
mov dword [esi + 0x20], 0x5f1d36f1
mov dword [esi + 0x24], 0xa54ff53a
mov dword [esi + 0x28], 0xade682d1
mov dword [esi + 0x2c], 0x510e527f
mov dword [esi + 0x30], 0x2b3e6c1f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0xfb41bd6b
mov dword [esi + 0x3c], 0x1f83d9ab
mov dword [esi + 0x40], 0x137e2179
mov dword [esi + 0x44], 0x5be0cd19
pop esi
pop ebp
ret
Function at 0x5217f0
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x52180f
push 0x29
push str.f:pd3privacydrivelibtomcrypt_srchashes_sha2_sha384.c
push str.md___NULL
call fcn.0052cf10
add esp, 0xc
mov dword [esi + 0x48], 0
xor eax, eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0xc1059ed8
mov dword [esi + 0xc], 0xcbbb9d5d
mov dword [esi + 0x10], 0x367cd507
mov dword [esi + 0x14], 0x629a292a
mov dword [esi + 0x18], 0x3070dd17
mov dword [esi + 0x1c], 0x9159015a
mov dword [esi + 0x20], 0xf70e5939
mov dword [esi + 0x24], 0x152fecd8
mov dword [esi + 0x28], 0xffc00b31
mov dword [esi + 0x2c], 0x67332667
mov dword [esi + 0x30], 0x68581511
mov dword [esi + 0x34], 0x8eb44a87
mov dword [esi + 0x38], 0x64f98fa7
mov dword [esi + 0x3c], 0xdb0c2e0d
mov dword [esi + 0x40], 0xbefa4fa4
mov dword [esi + 0x44], 0x47b5481d
pop esi
pop ebp
ret
Function at 0x524c00
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x524c22
push 0xeb
push str.srchashesmd5.c
push str.md___NULL
call fcn.0052cf10
add esp, 0xc
mov dword [esi + 8], 0x67452301
xor eax, eax
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0
mov dword [esi], 0
mov dword [esi + 4], 0
pop esi
pop ebp
ret
Function at 0x529d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x529d33
push 0x22b
push 0x564470
push str.pt___NULL
call fcn.0052cf10
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x529d50
push 0x22c
push 0x564470
push str.ct___NULL
call fcn.0052cf10
add esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jne 0x529d71
push 0x22d
push 0x564470
push str.skey___NULL
call fcn.0052cf10
add esp, 0xc
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0x1018]
mov edi, dword [esi + 0x101c]
mov ebx, dword [esi + 0x1010]
xor eax, dword [ecx + 8]
mov edx, dword [esi + 0x1014]
xor edi, dword [ecx + 0xc]
xor ebx, dword [ecx]
xor edx, dword [ecx + 4]
mov dword [ebp + 8], eax
lea eax, [esi + 0x1090]
mov dword [ebp - 4], edx
mov dword [ebp + 0x10], eax
mov dword [ebp - 0xc], 8
lea ecx, [ecx]
mov eax, edx
shr eax, 0x10
movzx ecx, al
mov eax, edx
shr eax, 8
movzx eax, al
mov edx, dword [esi + ecx*4 + 0xc00]
mov ecx, dword [ebp - 4]
xor edx, dword [esi + eax*4 + 0x800]
mov eax, ecx
shr eax, 0x18
xor edx, dword [esi + eax*4]
movzx eax, cl
mov ecx, ebx
shr ecx, 0x18
xor edx, dword [esi + eax*4 + 0x400]
mov eax, ebx
mov ecx, dword [esi + ecx*4 + 0xc00]
shr eax, 0x10
movzx eax, al
xor ecx, dword [esi + eax*4 + 0x800]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [esi + eax*4 + 0x400]
movzx eax, bl
rol ebx, 1
xor ecx, dword [esi + eax*4]
mov eax, dword [ebp + 8]
add ecx, edx
rol eax, 1
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 8]
add eax, ecx
xor dword [ebp + 8], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
add eax, ecx
add edx, eax
xor edx, edi
mov edi, dword [ebp + 0x10]
ror edx, 1
mov eax, edx
mov dword [ebp - 8], edx
shr eax, 0x10
movzx ecx, al
mov eax, edx
shr eax, 8
movzx eax, al
mov edx, dword [esi + ecx*4 + 0xc00]
mov ecx, dword [ebp - 8]
xor edx, dword [esi + eax*4 + 0x800]
mov eax, ecx
shr eax, 0x18
xor edx, dword [esi + eax*4]
movzx eax, cl
xor edx, dword [esi + eax*4 + 0x400]
mov eax, dword [ebp + 8]
mov ecx, eax
shr eax, 0x10
movzx eax, al
shr ecx, 0x18
mov ecx, dword [esi + ecx*4 + 0xc00]
xor ecx, dword [esi + eax*4 + 0x800]
mov eax, dword [ebp + 8]
shr eax, 8
movzx eax, al
xor ecx, dword [esi + eax*4 + 0x400]
mov eax, dword [ebp + 8]
movzx eax, al
xor ecx, dword [esi + eax*4]
mov eax, dword [edi]
add ecx, edx
add eax, ecx
xor ebx, eax
mov eax, dword [edi + 4]
add eax, ecx
add edx, eax
xor edx, dword [ebp - 4]
ror edx, 1
sub edi, 0x10
mov dword [ebp - 4], edx
dec dword [ebp - 0xc]
mov dword [ebp + 0x10], edi
mov edi, dword [ebp - 8]
jne 0x529db0
xor edi, dword [esi + 0x1004]
mov ecx, dword [ebp + 0xc]
xor ebx, dword [esi + 0x1008]
xor edx, dword [esi + 0x100c]
mov eax, dword [esi + 0x1000]
xor eax, dword [ebp + 8]
mov dword [ecx + 4], edi
pop edi
pop esi
mov dword [ecx], eax
xor eax, eax
mov dword [ecx + 8], ebx
mov dword [ecx + 0xc], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x529f10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x529f37
push 0x1e2
push 0x564470
push str.pt___NULL
call fcn.0052cf10
add esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x529f54
push 0x1e3
push 0x564470
push str.ct___NULL
call fcn.0052cf10
add esp, 0xc
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x529f72
push 0x1e4
push 0x564470
push str.skey___NULL
call fcn.0052cf10
add esp, 0xc
mov eax, dword [esi + 0x1000]
xor eax, dword [edi]
mov ebx, dword [esi + 0x1004]
xor ebx, dword [edi + 4]
mov dword [ebp + 0x10], eax
mov eax, dword [esi + 0x1008]
xor eax, dword [edi + 8]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x100c]
xor eax, dword [edi + 0xc]
lea edi, [esi + 0x1020]
mov dword [ebp + 8], eax
mov dword [ebp - 8], 8
jmp 0x529fb0
mov eax, ebx
shr eax, 0x10
movzx ecx, al
mov eax, ebx
shr eax, 8
movzx eax, al
mov edx, dword [esi + ecx*4 + 0xc00]
xor edx, dword [esi + eax*4 + 0x800]
mov eax, ebx
shr eax, 0x18
xor edx, dword [esi + eax*4]
movzx eax, bl
rol ebx, 1
xor edx, dword [esi + eax*4 + 0x400]
mov eax, dword [ebp + 0x10]
mov ecx, eax
shr eax, 0x10
movzx eax, al
shr ecx, 0x18
mov ecx, dword [esi + ecx*4 + 0xc00]
xor ecx, dword [esi + eax*4 + 0x800]
mov eax, dword [ebp + 0x10]
shr eax, 8
movzx eax, al
xor ecx, dword [esi + eax*4 + 0x400]
mov eax, dword [ebp + 0x10]
movzx eax, al
xor ecx, dword [esi + eax*4]
mov eax, dword [edi]
add ecx, edx
add eax, ecx
xor eax, dword [ebp - 4]
ror eax, 1
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
rol eax, 1
mov dword [ebp + 8], eax
mov eax, dword [edi + 4]
add eax, ecx
add eax, edx
mov edx, dword [ebp + 8]
xor edx, eax
mov eax, edx
mov dword [ebp + 8], edx
shr eax, 0x10
movzx ecx, al
mov eax, edx
shr eax, 8
movzx eax, al
mov edx, dword [esi + ecx*4 + 0xc00]
mov ecx, dword [ebp + 8]
xor edx, dword [esi + eax*4 + 0x800]
mov eax, ecx
shr eax, 0x18
xor edx, dword [esi + eax*4]
movzx eax, cl
xor edx, dword [esi + eax*4 + 0x400]
mov eax, dword [ebp - 4]
mov ecx, eax
shr eax, 0x10
movzx eax, al
shr ecx, 0x18
mov ecx, dword [esi + ecx*4 + 0xc00]
xor ecx, dword [esi + eax*4 + 0x800]
mov eax, dword [ebp - 4]
shr eax, 8
movzx eax, al
xor ecx, dword [esi + eax*4 + 0x400]
mov eax, dword [ebp - 4]
movzx eax, al
xor ecx, dword [esi + eax*4]
mov eax, dword [edi + 8]
add ecx, edx
add eax, ecx
xor eax, dword [ebp + 0x10]
ror eax, 1
mov dword [ebp + 0x10], eax
mov eax, dword [edi + 0xc]
add eax, ecx
add eax, edx
xor ebx, eax
dec dword [ebp - 8]
lea edi, [edi + 0x10]
jne 0x529fb0
mov ecx, dword [esi + 0x101c]
mov edi, dword [esi + 0x1014]
xor ecx, ebx
mov ebx, dword [ebp + 0xc]
mov edx, dword [esi + 0x1018]
mov eax, dword [esi + 0x1010]
xor edi, dword [ebp + 8]
xor edx, dword [ebp + 0x10]
xor eax, dword [ebp - 4]
mov dword [ebx + 4], edi
pop edi
mov dword [ebx], eax
xor eax, eax
pop esi
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], ecx
pop ebx
mov esp, ebp
pop ebp
ret