joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466770
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.004668c0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x466790
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x466771
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.004668c0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x466790
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x4667c0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x466817
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x46682d
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.00466850
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WS2_32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x466850
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x4668e0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x466929
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x466f70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a9ad0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00466950
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.004669d0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.004669d0
lea ecx, [esi + 0xc]
call fcn.004984b8
lea ecx, [esi + 0x10]
call fcn.004984b8
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00469550
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00469550
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00469550
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0049852d
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0049852d
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x467d98
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4a9cf8
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x467da8
call fcn.004682c0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x467e8b
cmp byte [edi], 0
je 0x467e8b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x467dcd
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00466770
test eax, eax
jne 0x467ded
push 0x5b7a30
lea ecx, [esi + 0x38]
call fcn.004986b6
jmp 0x467e8b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.004667c0
test eax, eax
jne 0x467e1c
mov ecx, esi
call fcn.004668c0
push edi
add esi, 0x38
push 0x5b7a0c
push esi
call fcn.00495c37
add esp, 0xc
jmp 0x467e8b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.00468b40
test eax, eax
je 0x467e84
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.00467f60
test eax, eax
jne 0x467ea0
push edi
lea eax, [esi + 0x38]
push 0x5b79e8
push eax
call fcn.00495c37
add esp, 0xc
mov ecx, esi
call fcn.004682c0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x467f48
mov ecx, dword [0x5b8938]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.00495c37
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.00466870
test eax, eax
jne 0x467f0a
push 0x5b79cc
lea ecx, [esi + 0x38]
call fcn.004986b6
jmp 0x467f1a
push 0xfa
mov ecx, esi
call fcn.00468b40
test eax, eax
jne 0x467f37
mov ecx, esi
call fcn.004682c0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0049852d
jmp 0x467e8b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0049852d
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x48e400
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4ab660
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.00483085
mov eax, dword [0x59d980]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.00482fb7
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.0048eeb0
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x48e4a7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x48e49e
cmp al, 0xff
je 0x48e49e
dec al
mov byte [ecx], al
jmp 0x48e4a7
push ecx
call fcn.00498297
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x48e4d8
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x48e4cf
cmp al, 0xff
je 0x48e4cf
dec al
mov byte [ecx], al
jmp 0x48e4d8
push ecx
call fcn.00498297
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x49a91d
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x49a955
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004989d4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004989ac
jmp 0x49a961
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x49c00e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x49c050
call fcn.004a1e66
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x49c050
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x49c047
xor eax, eax
jmp 0x49c058
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0049c05e
pop edi
pop esi
pop ebx
ret 4

Function at 0x4a2396
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4a23c4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4a23e2
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004a22fc
jmp 0x4a23e2
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4a23e2
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004a22fc
test edi, edi
mov eax, edi
jne 0x4a23cc
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
test eax, eax
push edi
mov edi, ecx
je 0x4016cf
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov edx, eax
mov ecx, dword [edx]
mov edx, dword [edx + 4]
push esi
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], esi
mov esi, dword [ebp + 8]
sub eax, esi
mov dword [ebp + 0x10], 0
mov dword [ebp + 0x14], eax
mov eax, ecx
and eax, 0x3f
lea ebx, [edi + 0x1104]
mov dword [ebp - 0x14], edx
shl eax, 1
mov dword [ebp - 0x18], ecx
xor ecx, dword [ebx + eax*4]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebx + eax*4 + 4]
mov ebx, dword [ebp - 4]
xor edx, ecx
cmp ebx, 0x200
mov dword [ebp - 0x14], edx
jbe 0x401692
mov ecx, dword [ebp + 0x14]
push 0x200
push esi
add ecx, esi
push ecx
lea edx, [edi + 0x54]
push edx
lea eax, [ebp - 0x18]
sub ebx, 0x200
push eax
mov dword [ebp - 4], ebx
call dword [edi + 8]
add esp, 0x14
lea ecx, [edi + 0x1108]
lea eax, [esi + 8]
mov edx, 0x20
mov ebx, dword [ecx - 4]
xor dword [eax - 8], ebx
mov ebx, dword [ecx]
xor dword [eax - 4], ebx
mov ebx, dword [ecx + 4]
xor dword [eax], ebx
mov ebx, dword [ecx + 8]
xor dword [eax + 4], ebx
add ecx, 0x10
add eax, 0x10
dec edx
jne 0x401615
mov cx, word [ebp - 0xe]
cmp word [ebp - 0x10], cx
jne 0x401663
mov ax, word [ebp - 0xc]
cmp cx, ax
jne 0x401663
cmp ax, word [ebp - 0xa]
jne 0x401663
inc word [ebp - 0x10]
inc cx
inc ax
inc word [ebp - 0xa]
mov word [ebp - 0xe], cx
mov word [ebp - 0xc], ax
jmp 0x401675
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
add ecx, 1
adc eax, 0
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
add ebx, 0x200
mov dword [ebp + 0x10], ebx
add esi, 0x200
jmp 0x4015b0
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
lea esi, [eax + ecx]
push ebx
push esi
add eax, edx
push eax
lea eax, [edi + 0x54]
push eax
lea ecx, [ebp - 0x18]
push ecx
call dword [edi + 8]
shr ebx, 2
add esp, 0x14
test ebx, ebx
jbe 0x4016cd
mov ecx, dword [ebp - 8]
mov eax, esi
lea ecx, [ecx]
mov edx, dword [ecx]
xor dword [eax], edx
add ecx, 4
add eax, 4
dec ebx
jne 0x4016c0
pop esi
pop ebx
mov al, 1
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40e950
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0x20
lea esp, [esp]
mov esi, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
add eax, esi
mov ecx, eax
shr ecx, 0x10
movzx edx, ch
xor ebx, ebx
mov bh, byte [edx + 0x43c6f0]
movzx ecx, cl
movzx edx, ah
mov bl, byte [ecx + 0x43c5f0]
xor ecx, ecx
mov ch, byte [edx + 0x43c4f0]
movzx eax, al
shl ebx, 0x10
movzx edx, cx
movzx ecx, byte [eax + 0x43c3f0]
or ebx, edx
mov edx, dword [ebp - 8]
or ecx, ebx
mov ebx, dword [edi]
mov eax, ecx
shr eax, 0x15
shl ecx, 0xb
mov dword [edi], esi
mov esi, dword [ebp - 4]
or eax, ecx
mov ecx, dword [ebp + 8]
xor eax, ebx
add esi, 4
dec edx
mov dword [ecx], eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], edx
jne 0x40e970
mov edx, dword [edi]
mov dword [ecx], edx
mov dword [edi], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x414160
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
xor eax, eax
pop ebp
ret
Function at 0x4141a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
lea esi, [eax + ecx]
cmp esi, eax
push edi
mov dword [edx + 0x14], esi
jae 0x4141bf
inc dword [edx + 0x18]
and eax, 0x3f
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], esi
mov dword [ebp - 4], ecx
je 0x41425a
mov ebx, 0x40
sub ebx, eax
cmp ecx, ebx
lea edi, [eax + edx + 0x1c]
jae 0x4141f7
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [edx + 0x1c]
xor esi, esi
lea esp, [esp]
mov edx, dword [eax + esi*4]
mov ecx, edx
shl edx, 0x10
shr ecx, 0x10
or ecx, edx
mov edx, ecx
shr edx, 8
mov edi, ecx
shl edi, 8
xor edx, edi
and edx, 0xff00ff
shl ecx, 8
xor edx, ecx
mov dword [eax + esi*4], edx
inc esi
cmp esi, 0x10
jl 0x414210
mov esi, dword [ebp + 8]
call fcn.00412980
mov eax, dword [ebp + 0xc]
lea ecx, [ebx + eax]
mov eax, dword [ebp + 0x10]
sub eax, ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov ecx, eax
mov edx, esi
cmp ecx, 0x40
jb 0x4142d7
shr ecx, 6
lea ebx, [edx + 0x1c]
mov dword [ebp + 0xc], ecx
jmp 0x414270
mov esi, dword [ebp - 8]
mov ecx, 0x10
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
xor edx, edx
mov edi, edi
mov ecx, dword [ebx + edx*4]
mov eax, ecx
shl ecx, 0x10
shr eax, 0x10
or eax, ecx
mov ecx, eax
shr ecx, 8
mov esi, eax
shl esi, 8
xor ecx, esi
and ecx, 0xff00ff
shl eax, 8
xor ecx, eax
mov dword [ebx + edx*4], ecx
inc edx
cmp edx, 0x10
jl 0x414280
mov esi, dword [ebp + 8]
mov eax, ebx
call fcn.00412980
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov eax, 0x40
add edx, eax
sub ecx, eax
mov eax, dword [ebp + 0xc]
dec eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
mov dword [ebp + 0xc], eax
jne 0x414270
mov edx, esi
test ecx, ecx
jbe 0x4142ef
mov esi, dword [ebp - 8]
lea edi, [edx + 0x1c]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414300
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x14]
and eax, 0x3f
push edi
lea edi, [eax + esi + 0x1c]
mov ecx, 0x3f
mov byte [edi], 0x80
sub ecx, eax
inc edi
cmp ecx, 8
jae 0x414377
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea edi, [esi + 0x1c]
xor edx, edx
mov ecx, dword [edi + edx*4]
mov eax, ecx
shl ecx, 0x10
shr eax, 0x10
or eax, ecx
mov ecx, eax
shr ecx, 8
mov ebx, eax
shl ebx, 8
xor ecx, ebx
and ecx, 0xff00ff
shl eax, 8
xor ecx, eax
mov dword [edi + edx*4], ecx
inc edx
cmp edx, 0x10
jl 0x414338
mov eax, edi
call fcn.00412980
mov ecx, 0xe
xor eax, eax
rep stosd dword es:[edi], eax
jmp 0x41438c
jbe 0x41438c
add ecx, 0xfffffff8
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0x18]
mov edx, eax
shl ecx, 3
shr edx, 0x1d
shl eax, 3
or ecx, edx
mov dword [esi + 0x58], eax
mov dword [esi + 0x54], ecx
lea eax, [esi + 0x1c]
xor edi, edi
lea ebx, [ebx]
mov edx, dword [eax + edi*4]
mov ecx, edx
shl edx, 0x10
shr ecx, 0x10
or ecx, edx
mov edx, ecx
shr edx, 8
mov ebx, ecx
shl ebx, 8
xor edx, ebx
and edx, 0xff00ff
shl ecx, 8
xor edx, ecx
mov dword [eax + edi*4], edx
inc edi
cmp edi, 0xe
jl 0x4143b0
call fcn.00412980
mov ecx, dword [ebp + 0xc]
mov eax, esi
call fcn.00414120
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x414420
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x5c
call dword [sym.imp.MSVCR71.dll_malloc]
mov esi, eax
xor eax, eax
add esp, 4
cmp esi, eax
mov dword [ebp - 4], esi
je 0x4144a9
mov ecx, dword [ebp + 8]
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0xc]
push eax
push ecx
push esi
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
call fcn.004141a0
add esp, 0xc
test eax, eax
je 0x41448c
push esi
call dword [sym.imp.MSVCR71.dll_free]
add esp, 4
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x10]
push edx
push esi
call fcn.00414300
add esp, 8
test eax, eax
je 0x4144b3
lea eax, [ebp - 4]
push eax
call fcn.00414fe0
add esp, 4
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
push ecx
call fcn.00414fe0
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x414d20
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push edi
xor eax, eax
mov ecx, 0x10
lea edi, [edx + 0x28]
mov dword [edx], 0x6a09e667
mov dword [edx + 4], 0xbb67ae85
mov dword [edx + 8], 0x3c6ef372
mov dword [edx + 0xc], 0xa54ff53a
mov dword [edx + 0x10], 0x510e527f
mov dword [edx + 0x14], 0x9b05688c
mov dword [edx + 0x18], 0x1f83d9ab
mov dword [edx + 0x1c], 0x5be0cd19
mov dword [edx + 0x24], eax
mov dword [edx + 0x20], eax
rep stosd dword es:[edi], eax
pop edi
pop ebp
ret

Function at 0x414d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x20]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
lea esi, [eax + ecx]
cmp esi, eax
push edi
mov dword [edx + 0x20], esi
jae 0x414d9f
inc dword [edx + 0x24]
and eax, 0x3f
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], esi
mov dword [ebp - 4], ecx
je 0x414e25
mov ebx, 0x40
sub ebx, eax
cmp ecx, ebx
lea edi, [eax + edx + 0x28]
jb 0x414ea6
mov ecx, ebx
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [edx + 0x28]
xor edx, edx
mov ecx, dword [esi + edx*4]
mov eax, ecx
shl ecx, 0x10
shr eax, 0x10
or eax, ecx
mov ecx, eax
shr ecx, 8
mov edi, eax
shl edi, 8
xor ecx, edi
and ecx, 0xff00ff
shl eax, 8
xor ecx, eax
mov dword [esi + edx*4], ecx
inc edx
cmp edx, 0x10
jl 0x414dd5
mov edx, dword [ebp + 8]
push esi
push edx
call fcn.004147c0
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea ecx, [ebx + eax]
mov eax, dword [ebp + 0x10]
add esp, 8
sub eax, ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov ecx, eax
cmp ecx, 0x40
jb 0x414e9c
shr ecx, 6
lea ebx, [edx + 0x28]
mov dword [ebp + 0xc], ecx
mov esi, dword [ebp - 8]
mov ecx, 0x10
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
xor edx, edx
mov ecx, dword [ebx + edx*4]
mov eax, ecx
shl ecx, 0x10
shr eax, 0x10
or eax, ecx
mov ecx, eax
shr ecx, 8
mov esi, eax
shl esi, 8
xor ecx, esi
and ecx, 0xff00ff
shl eax, 8
xor ecx, eax
mov dword [ebx + edx*4], ecx
inc edx
cmp edx, 0x10
jl 0x414e41
mov edx, dword [ebp + 8]
push ebx
push edx
call fcn.004147c0
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov eax, 0x40
add edx, eax
sub ecx, eax
mov eax, dword [ebp + 0xc]
add esp, 8
dec eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
mov dword [ebp + 0xc], eax
jne 0x414e33
mov edx, dword [ebp + 8]
test ecx, ecx
jbe 0x414eb4
mov esi, dword [ebp - 8]
lea edi, [edx + 0x28]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x20]
and eax, 0x3f
push edi
lea edi, [eax + esi + 0x28]
mov ecx, 0x3f
mov byte [edi], 0x80
sub ecx, eax
inc edi
cmp ecx, 8
jae 0x414f3a
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea edi, [esi + 0x28]
xor edx, edx
mov ecx, dword [edi + edx*4]
mov eax, ecx
shl ecx, 0x10
shr eax, 0x10
or eax, ecx
mov ecx, eax
shr ecx, 8
mov ebx, eax
shl ebx, 8
xor ecx, ebx
and ecx, 0xff00ff
shl eax, 8
xor ecx, eax
mov dword [edi + edx*4], ecx
inc edx
cmp edx, 0x10
jl 0x414ef8
push edi
push esi
call fcn.004147c0
add esp, 8
mov ecx, 0xe
xor eax, eax
rep stosd dword es:[edi], eax
jmp 0x414f4f
jbe 0x414f4f
add ecx, 0xfffffff8
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x24]
mov edx, eax
shl ecx, 3
shr edx, 0x1d
or ecx, edx
shl eax, 3
mov dword [esi + 0x60], ecx
mov dword [esi + 0x64], eax
lea edi, [esi + 0x28]
xor edx, edx
lea ecx, [ecx]
mov ecx, dword [edi + edx*4]
mov eax, ecx
shl ecx, 0x10
shr eax, 0x10
or eax, ecx
mov ecx, eax
shr ecx, 8
mov ebx, eax
shl ebx, 8
xor ecx, ebx
and ecx, 0xff00ff
shl eax, 8
xor ecx, eax
mov dword [edi + edx*4], ecx
inc edx
cmp edx, 0xe
jl 0x414f70
push edi
push esi
call fcn.004147c0
mov ecx, dword [ebp + 0xc]
add esp, 8
mov eax, esi
call fcn.00414ce0
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret