joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c1d0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
cmp byte [0x6bf138], 0
jne 0x48c416
push esi
push edi
mov dword [0x6bf140], 0xff00ff00
mov edi, 0x6bee80
mov dword [0x6bf144], 0xff00ff00
mov esi, 0x647038
mov dword [0x6bf148], 0xff00ff
mov dword [0x6bf14c], 0xff00ff
mov dword [0x6bf150], 0xffff0000
mov dword [0x6bf154], 0xffff0000
mov dword [0x6bf158], 0xffff
mov dword [0x6bf15c], 0xffff
mov dword [0x6bee38], 0xc1059ed8
mov dword [0x6bee3c], 0xcbbb9d5d
mov dword [0x6bee40], 0x367cd507
mov dword [0x6bee44], 0x629a292a
mov dword [0x6bee48], 0x3070dd17
mov dword [0x6bee4c], 0x9159015a
mov dword [0x6bee50], 0xf70e5939
mov dword [0x6bee54], 0x152fecd8
mov dword [0x6bee58], 0xffc00b31
mov dword [0x6bee5c], 0x67332667
mov dword [0x6bee60], 0x68581511
mov dword [0x6bee64], 0x8eb44a87
mov dword [0x6bee68], 0x64f98fa7
mov dword [0x6bee6c], 0xdb0c2e0d
mov dword [0x6bee70], 0xbefa4fa4
mov dword [0x6bee74], 0x47b5481d
nop dword [eax]
mov eax, dword [esi - 8]
mov cl, 0x20
mov edx, dword [esi - 4]
call fcn.005ecbd0
or eax, dword [esi]
mov cl, 0x20
or edx, dword [esi + 4]
mov dword [edi - 8], eax
mov eax, dword [esi + 8]
mov dword [edi - 4], edx
mov edx, dword [esi + 0xc]
call fcn.005ecbd0
or eax, dword [esi + 0x10]
mov cl, 0x20
or edx, dword [esi + 0x14]
mov dword [edi], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 4], edx
mov edx, dword [esi + 0x1c]
call fcn.005ecbd0
or eax, dword [esi + 0x20]
mov cl, 0x20
or edx, dword [esi + 0x24]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0xc], edx
mov edx, dword [esi + 0x2c]
call fcn.005ecbd0
or eax, dword [esi + 0x30]
mov cl, 0x20
or edx, dword [esi + 0x34]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x14], edx
mov edx, dword [esi + 0x3c]
call fcn.005ecbd0
or eax, dword [esi + 0x40]
lea edi, [edi + 0x28]
or edx, dword [esi + 0x44]
add esi, 0x50
mov dword [edi - 0x10], eax
mov dword [edi - 0xc], edx
cmp esi, 0x647538
jl 0x48c2e0
pop edi
mov dword [0x6bf0f8], 0xf3bcc908
mov dword [0x6bf0fc], 0x6a09e667
mov dword [0x6bf100], 0x84caa73b
mov dword [0x6bf104], 0xbb67ae85
mov dword [0x6bf108], 0xfe94f82b
mov dword [0x6bf10c], 0x3c6ef372
mov dword [0x6bf110], 0x5f1d36f1
mov dword [0x6bf114], 0xa54ff53a
mov dword [0x6bf118], 0xade682d1
mov dword [0x6bf11c], 0x510e527f
mov dword [0x6bf120], 0x2b3e6c1f
mov dword [0x6bf124], 0x9b05688c
mov dword [0x6bf128], 0xfb41bd6b
mov dword [0x6bf12c], 0x1f83d9ab
mov dword [0x6bf130], 0x137e2179
mov dword [0x6bf134], 0x5be0cd19
mov byte [0x6bf138], 1
pop esi
ret
Function at 0x48c780
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x154], ebx
xor esi, esi
lea edx, [ebx + 0x88]
movzx ecx, byte [edx]
lea edx, [edx + 4]
movzx eax, byte [edx - 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx - 1]
shl ecx, 8
or ecx, eax
mov dword [ebp + esi*4 - 0x144], ecx
inc esi
cmp esi, 0x10
jl 0x48c7a6
lea eax, [ebp - 0x13c]
mov edx, 0x40
nop
mov ecx, dword [eax + 0x2c]
lea eax, [eax + 4]
xor ecx, dword [eax + 0x14]
xor ecx, dword [eax - 0xc]
xor ecx, dword [eax - 4]
rol ecx, 1
mov dword [eax + 0x34], ecx
sub edx, 1
jne 0x48c7e0
mov eax, dword [ebx + 0xc]
mov ecx, eax
mov edi, dword [ebx + 0x10]
mov esi, dword [ebx + 0x14]
mov ebx, dword [ebx + 0x18]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x148], edx
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x14c], eax
mov edx, ecx
mov eax, esi
and eax, edi
rol edx, 5
mov ecx, edi
not ecx
and ecx, ebx
or ecx, eax
mov eax, dword [ebp - 0x148]
add edx, ecx
add edx, dword [ebp + eax*4 - 0x144]
mov eax, dword [ebp - 0x14c]
add eax, 0x5a827999
mov dword [ebp - 0x14c], ebx
add edx, eax
mov ebx, esi
mov eax, dword [ebp - 0x148]
mov esi, edi
mov edi, dword [ebp - 0x150]
inc eax
ror esi, 2
mov ecx, edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x148], eax
cmp eax, 0x14
jl 0x48c828
mov dword [ebp - 0x148], 0x14
nop dword [eax]
mov eax, ebx
rol edx, 5
xor eax, esi
xor eax, edi
add edx, eax
mov eax, dword [ebp - 0x148]
add edx, dword [ebp + eax*4 - 0x144]
mov eax, dword [ebp - 0x14c]
add eax, 0x6ed9eba1
mov dword [ebp - 0x14c], ebx
add edx, eax
mov ebx, esi
mov eax, dword [ebp - 0x148]
mov esi, edi
inc eax
ror esi, 2
mov dword [ebp - 0x148], eax
mov edi, ecx
mov ecx, edx
cmp eax, 0x28
jl 0x48c890
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x148], 0x28
mov ecx, esi
rol edx, 5
or ecx, edi
mov eax, esi
and eax, edi
and ecx, ebx
or ecx, eax
add edx, 0x8f1bbcdc
mov eax, dword [ebp - 0x148]
add edx, dword [ebp - 0x14c]
mov dword [ebp - 0x14c], ebx
mov ebx, esi
mov esi, edi
mov edi, dword [ebp - 0x150]
add ecx, dword [ebp + eax*4 - 0x144]
inc eax
add edx, ecx
ror esi, 2
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x148], eax
cmp eax, 0x3c
jl 0x48c8e8
mov dword [ebp - 0x148], 0x3c
mov ecx, dword [ebp - 0x148]
mov eax, ebx
xor eax, esi
rol edx, 5
add edx, dword [ebp - 0x14c]
xor eax, edi
add eax, 0xca62c1d6
mov dword [ebp - 0x14c], ebx
add eax, dword [ebp + ecx*4 - 0x144]
mov ebx, esi
add edx, eax
mov esi, edi
mov edi, dword [ebp - 0x150]
mov eax, ecx
inc eax
ror esi, 2
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x148], eax
cmp eax, 0x50
jl 0x48c941
mov ecx, dword [ebp - 0x154]
mov eax, dword [ebp - 0x158]
add eax, edx
add dword [ecx + 0x10], edi
add dword [ecx + 0x14], esi
add dword [ecx + 0x18], ebx
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x14c]
add dword [ecx + 0x1c], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005ebe04
mov esp, ebp
pop ebp
ret
Function at 0x498690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f598b
mov eax, dword fs:[0]
push eax
sub esp, 0xa60
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xa64], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xa6c], eax
test eax, eax
jne 0x4986da
xor al, al
jmp 0x498899
mov eax, dword [ebp + 0x18]
mov esi, 0x40
cmp eax, 3
je 0x4986ec
cmp eax, 2
jne 0x4986f1
mov esi, 0x80
push eax
call fcn.00484240
mov edi, dword [ebp + 0x14]
add esp, 4
mov dword [ebp - 0xa68], eax
cmp edi, esi
jle 0x498737
lea eax, [ebp - 0x158]
push eax
push dword [ebp + 0x18]
push edi
push dword [ebp - 0xa64]
call fcn.004837f0
mov edi, dword [ebp - 0xa68]
lea eax, [ebp - 0x158]
add esp, 0x10
mov dword [ebp - 0xa64], eax
cmp edi, esi
cmovg edi, esi
push esi
lea eax, [ebp - 0x94]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [ebp - 0x118]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push edi
push dword [ebp - 0xa64]
lea eax, [ebp - 0x94]
push eax
call sub.VCRUNTIME140.dll_memcpy
push edi
push dword [ebp - 0xa64]
lea eax, [ebp - 0x118]
push eax
call sub.VCRUNTIME140.dll_memcpy
movaps xmm1, xmmword [str.6666666666666666Using_RC2.__Underlying_decryption_algorithm_for_PBES1_must_be_either_DES_or_RC2.]
add esp, 0x30
movaps xmm2, xmmword [0x6475e0]
xor eax, eax
nop
movups xmm0, xmmword [ebp + eax - 0x94]
pxor xmm0, xmm1
movups xmmword [ebp + eax - 0x94], xmm0
movups xmm0, xmmword [ebp + eax - 0x118]
pxor xmm0, xmm2
movups xmmword [ebp + eax - 0x118], xmm0
movups xmm0, xmmword [ebp + eax - 0x84]
pxor xmm0, xmm1
movups xmmword [ebp + eax - 0x84], xmm0
movups xmm0, xmmword [ebp + eax - 0x108]
pxor xmm0, xmm2
movups xmmword [ebp + eax - 0x108], xmm0
add eax, 0x20
cmp eax, esi
jl 0x498790
lea ecx, [ebp - 0xa60]
call fcn.004119c0
mov edi, dword [ebp + 0x18]
lea eax, [ebp - 0x94]
mov dword [ebp - 0xa5c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa58], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x658], eax
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0xa60]
mov dword [ebp - 4], 0
push edi
push eax
mov dword [ebp - 0x25c], 2
mov dword [ebp - 0x65c], esi
call fcn.00483a30
push esi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x258]
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0xa68]
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x258]
add eax, esi
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0xa6c]
mov eax, dword [ebp - 0xa68]
add eax, esi
push edi
push eax
lea eax, [ebp - 0x258]
push eax
call fcn.004837f0
add esp, 0x34
lea ecx, [ebp - 0xa60]
call fcn.00411c40
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ebe04
mov esp, ebp
pop ebp
ret
Function at 0x498910
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x258], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x250], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x25c], eax
test eax, eax
jne 0x498952
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ebe04
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov esi, 0x40
cmp edi, 3
je 0x498967
cmp edi, 2
jne 0x49896c
mov esi, 0x80
push edi
call fcn.00484240
mov ebx, dword [ebp + 0x10]
add esp, 4
mov dword [ebp - 0x254], eax
cmp ebx, esi
jle 0x4989b0
lea eax, [ebp - 0x14c]
push eax
push edi
push ebx
push dword [ebp - 0x250]
call fcn.004837f0
mov ebx, dword [ebp - 0x254]
lea eax, [ebp - 0x14c]
add esp, 0x10
mov dword [ebp - 0x250], eax
cmp ebx, esi
cmovg ebx, esi
push esi
lea eax, [ebp - 0x88]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push esi
lea eax, [ebp - 0x10c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push ebx
push dword [ebp - 0x250]
lea eax, [ebp - 0x88]
push eax
call sub.VCRUNTIME140.dll_memcpy
push ebx
push dword [ebp - 0x250]
lea eax, [ebp - 0x10c]
push eax
call sub.VCRUNTIME140.dll_memcpy
movaps xmm1, xmmword [str.6666666666666666Using_RC2.__Underlying_decryption_algorithm_for_PBES1_must_be_either_DES_or_RC2.]
add esp, 0x30
movaps xmm2, xmmword [0x6475e0]
xor eax, eax
nop word [eax + eax]
movups xmm0, xmmword [ebp + eax - 0x88]
pxor xmm0, xmm1
movups xmmword [ebp + eax - 0x88], xmm0
movups xmm0, xmmword [ebp + eax - 0x10c]
pxor xmm0, xmm2
movups xmmword [ebp + eax - 0x10c], xmm0
movups xmm0, xmmword [ebp + eax - 0x78]
pxor xmm0, xmm1
movups xmmword [ebp + eax - 0x78], xmm0
movups xmm0, xmmword [ebp + eax - 0xfc]
pxor xmm0, xmm2
movups xmmword [ebp + eax - 0xfc], xmm0
add eax, 0x20
cmp eax, esi
jl 0x498a10
mov eax, dword [ebp - 0x258]
lea ecx, [ebp - 0x88]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x18c]
push ecx
push edi
push eax
mov dword [eax + 0x404], esi
call fcn.00483a30
push esi
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x24c]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov ebx, dword [ebp - 0x254]
lea eax, [ebp - 0x18c]
push ebx
push eax
lea eax, [ebp - 0x24c]
add eax, esi
push eax
call sub.VCRUNTIME140.dll_memcpy
push dword [ebp - 0x25c]
lea eax, [ebx + esi]
push edi
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.004837f0
mov ecx, dword [ebp - 4]
add esp, 0x34
xor ecx, ebp
mov al, 1
pop edi
pop esi
pop ebx
call fcn.005ebe04
mov esp, ebp
pop ebp
ret
Function at 0x499a20
Capabilities:
Hash data with md5

Disassembly:
mov dword [ecx], vtable._ckMd4.0
mov eax, ecx
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
ret

Function at 0x499aa0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, ecx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], eax
test ecx, ecx
jne 0x499ae7
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ebe04
mov esp, ebp
pop ebp
ret 0x14
push esi
push 0x4e28
mov dword [edi + 0x18], 0
mov dword [edi + 0x14], 0
mov dword [edi + 4], 0x67452301
mov dword [edi + 8], 0xefcdab89
mov dword [edi + 0xc], 0x98badcfe
mov dword [edi + 0x10], 0x10325476
call fcn.0040f690
mov esi, eax
add esp, 4
test esi, esi
jne 0x499b3a
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ebe04
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], 0
mov byte [ebp - 9], 1
call fcn.004a9cf0
test al, al
jne 0x499bc2
push dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 8]
push ebx
push eax
push 0x4e20
push esi
call fcn.004a9f50
test al, al
je 0x499bc2
mov eax, dword [ebp - 8]
test eax, eax
je 0x499ba3
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x499b83
push eax
push esi
call fcn.00412010
mov eax, dword [ebp - 8]
push eax
push esi
mov ecx, edi
call fcn.0049a280
test ebx, ebx
je 0x499ba3
push dword [ebp - 0x14]
mov ecx, ebx
push 0
push dword [ebp - 8]
call fcn.00480a20
test al, al
jne 0x499bb1
mov ecx, dword [ebp - 0x10]
call fcn.004a9cf0
test al, al
je 0x499b51
jmp 0x499bc2
mov ecx, dword [ebp - 0x14]
push str.MD4_aborted_by_application
mov eax, dword [ecx]
call dword [eax + 0x14]
mov byte [ebp - 9], 0
push esi
call sub.mfc140.dll_Ordinal_266
add esp, 4
mov ecx, edi
push dword [ebp - 0x1c]
call fcn.00499bf0
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 9]
xor ecx, ebp
pop esi
pop edi
pop ebx
call fcn.005ebe04
mov esp, ebp
pop ebp
ret 0x14
Function at 0x499cc0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f5b38
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x3c]
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x40], eax
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x24], 0
movq qword [ebp - 0x2c], xmm0
call fcn.004118f0
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0
push eax
push 0
mov ecx, esi
call fcn.00409b20
lea ecx, [ebp - 0x3c]
mov dword [edi + 0x18], 0
mov dword [edi + 0x14], 0
mov dword [edi + 4], 0x67452301
mov dword [edi + 8], 0xefcdab89
mov dword [edi + 0xc], 0x98badcfe
mov dword [edi + 0x10], 0x10325476
call fcn.00401c90
push eax
lea ecx, [ebp - 0x3c]
call fcn.00414910
push eax
mov ecx, edi
call fcn.0049a280
lea eax, [ebp - 0x20]
mov ecx, edi
push eax
call fcn.00499bf0
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x20]
push 0x10
push eax
call fcn.00412010
lea ecx, [ebp - 0x3c]
call fcn.00411b10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ebe04
mov esp, ebp
pop ebp
ret 8
Function at 0x49a380
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
lea esi, [ecx + 0x24]
mov edi, 0x10
nop dword [eax + eax]
mov dl, byte [esi + 0x20]
lea esi, [esi + 1]
mov al, byte [esi - 0x11]
xor al, dl
mov byte [esi - 1], dl
mov byte [esi + 0xf], al
sub edi, 1
jne 0x49a390
xor dl, dl
lea edi, [ecx + 0x15]
xor ebx, ebx
nop dword [eax]
mov eax, edi
mov esi, 8
nop word [eax + eax]
movzx ecx, dl
lea eax, [eax + 6]
movzx edx, byte [ecx + str._.C]
movzx ecx, byte [eax - 7]
xor edx, ecx
movzx ecx, dl
mov byte [eax - 7], dl
movzx edx, byte [ecx + str._.C]
movzx ecx, byte [eax - 6]
xor edx, ecx
movzx ecx, dl
mov byte [eax - 6], dl
movzx edx, byte [ecx + str._.C]
movzx ecx, byte [eax - 5]
xor edx, ecx
movzx ecx, dl
mov byte [eax - 5], dl
movzx edx, byte [ecx + str._.C]
movzx ecx, byte [eax - 4]
xor edx, ecx
movzx ecx, dl
mov byte [eax - 4], dl
movzx edx, byte [ecx + str._.C]
movzx ecx, byte [eax - 3]
xor edx, ecx
movzx ecx, dl
mov byte [eax - 3], dl
movzx edx, byte [ecx + str._.C]
movzx ecx, byte [eax - 2]
xor edx, ecx
mov byte [eax - 2], dl
sub esi, 1
jne 0x49a3c0
add dl, bl
inc ebx
cmp ebx, 0x12
jl 0x49a3b0
pop edi
pop esi
pop ebx
ret

Function at 0x49a570
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
mov dword [ebp - 4], esi
je 0x49a60c
mov edx, dword [esi + 0x54]
mov ecx, 0x10
mov eax, ecx
push ebx
sub eax, edx
push edi
cmp edx, ecx
jae 0x49a5b7
sub ecx, edx
movzx eax, al
lea edi, [esi + 0x44]
imul eax, eax, 0x1010101
mov esi, ecx
add edi, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
mov esi, dword [ebp - 4]
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, esi
call fcn.0049a380
mov bl, byte [esi + 0x13]
lea eax, [esi + 4]
mov edi, 0x10
nop dword [eax]
movzx edx, byte [eax + 0x40]
lea eax, [eax + 1]
movzx ecx, bl
xor edx, ecx
movzx ecx, byte [eax - 1]
movzx ebx, byte [edx + str._.C]
xor ebx, ecx
mov byte [eax - 1], bl
sub edi, 1
jne 0x49a5d0
movups xmm0, xmmword [esi + 4]
mov ecx, esi
movups xmmword [esi + 0x44], xmm0
call fcn.0049a380
mov eax, dword [ebp + 8]
movups xmm0, xmmword [esi + 0x14]
pop edi
pop ebx
movups xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x49a6e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push edi
mov edi, ecx
test eax, eax
je 0x49a780
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x49a77f
push esi
nop
mov esi, 0x10
sub esi, dword [edi + 0x54]
cmp ebx, esi
cmovb esi, ebx
push esi
push eax
mov eax, dword [edi + 0x54]
add eax, 0x44
add eax, edi
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp + 8]
sub ebx, esi
add dword [edi + 0x54], esi
add eax, esi
add esp, 0xc
mov dword [ebp + 8], eax
cmp dword [edi + 0x54], 0x10
mov dword [ebp + 0xc], ebx
jne 0x49a77a
mov ecx, edi
call fcn.0049a380
mov bl, byte [edi + 0x13]
lea eax, [edi + 4]
mov esi, 0x10
nop dword [eax + eax]
movzx edx, byte [eax + 0x40]
lea eax, [eax + 1]
movzx ecx, bl
xor edx, ecx
movzx ecx, byte [eax - 1]
movzx ebx, byte [edx + str._.C]
xor ebx, ecx
mov byte [eax - 1], bl
sub esi, 1
jne 0x49a750
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [edi + 0x54], esi
test ebx, ebx
jne 0x49a700
pop esi
pop ebx
pop edi
pop ebp
ret 8
Function at 0x49ac10
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f5b68
mov eax, dword fs:[0]
push eax
sub esp, 0x84
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp + 0x18]
push 0x40
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x54]
push 0
push eax
mov dword [ebp - 0x7c], vtable._ckSha1.0
movups xmmword [ebp - 0x6c], xmm0
mov dword [ebp - 0x5c], 0
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
mov dword [ebp - 4], 0
push 0x4e28
mov dword [ebp - 0x6c], 0x67452301
mov dword [ebp - 0x68], 0xefcdab89
mov dword [ebp - 0x64], 0x98badcfe
mov dword [ebp - 0x60], 0x10325476
mov dword [ebp - 0x5c], 0xc3d2e1f0
mov dword [ebp - 0x58], 0
movlpd qword [ebp - 0x74], xmm0
call fcn.0040f690
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x49acd9
xor al, al
jmp 0x49ada0
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x7d], 1
call fcn.004a9cf0
test al, al
jne 0x49ad84
nop word [eax + eax]
push dword [ebp - 0x88]
mov ecx, dword [ebp - 0x84]
lea eax, [ebp - 0x14]
push edi
push eax
push 0x4e20
push esi
call fcn.004a9f50
test al, al
je 0x49ad84
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x49ad5f
mov ecx, dword [ebp - 0x8c]
test ecx, ecx
je 0x49ad3b
push eax
push esi
call fcn.00412010
mov eax, dword [ebp - 0x14]
push eax
push esi
lea ecx, [ebp - 0x7c]
call fcn.0049b190
test edi, edi
je 0x49ad5f
push dword [ebp - 0x88]
mov ecx, edi
push 0
push dword [ebp - 0x14]
call fcn.00480a20
test al, al
jne 0x49ad70
mov ecx, dword [ebp - 0x84]
call fcn.004a9cf0
test al, al
je 0x49ad00
jmp 0x49ad84
mov ecx, dword [ebp - 0x88]
push str.Digest_SHA1_aborted_by_application
mov eax, dword [ecx]
call dword [eax + 0x14]
mov byte [ebp - 0x7d], 0
push esi
call sub.mfc140.dll_Ordinal_266
add esp, 4
lea ecx, [ebp - 0x7c]
push 0
push dword [ebp - 0x90]
call fcn.0049af40
mov al, byte [ebp - 0x7d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ebe04
mov esp, ebp
pop ebp
ret

Function at 0x49b150
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx + 0x10], 0x67452301
mov dword [ecx + 0x14], 0xefcdab89
mov dword [ecx + 0x18], 0x98badcfe
mov dword [ecx + 0x1c], 0x10325476
mov dword [ecx + 0x20], 0xc3d2e1f0
mov dword [ecx + 0x24], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
ret
Function at 0x49b670
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0x40
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x44]
push 0
push eax
mov dword [ebp - 0x6c], vtable._ckSha1.0
movups xmmword [ebp - 0x5c], xmm0
mov dword [ebp - 0x4c], 0
call sub.VCRUNTIME140.dll_memset
xor edi, edi
mov dword [ebp - 0x5c], 0x67452301
add esp, 0xc
mov dword [ebp - 0x58], 0xefcdab89
xorps xmm0, xmm0
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
mov dword [ebp - 0x4c], 0xc3d2e1f0
mov dword [ebp - 0x48], 0
movlpd qword [ebp - 0x64], xmm0
cmp dword [ebx + 0x804], edi
jbe 0x49b70d
push esi
lea esi, [ebx + 4]
push dword [esi + 0x400]
lea ecx, [ebp - 0x6c]
push dword [esi]
call fcn.0049b190
inc edi
lea esi, [esi + 4]
cmp edi, dword [ebx + 0x804]
jb 0x49b6f0
pop esi
push 0
push dword [ebp - 0x70]
lea ecx, [ebp - 0x6c]
call fcn.0049af40
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.005ebe04
mov esp, ebp
pop ebp
ret

Function at 0x49b730
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x44]
push edi
mov edi, dword [ebp + 0x10]
xorps xmm0, xmm0
push 0x40
push 0
push eax
mov dword [ebp - 0x6c], vtable._ckSha1.0
movups xmmword [ebp - 0x5c], xmm0
mov dword [ebp - 0x4c], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x5c], 0x67452301
xorps xmm0, xmm0
mov dword [ebp - 0x58], 0xefcdab89
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
push dword [ebp + 0xc]
mov dword [ebp - 0x4c], 0xc3d2e1f0
push esi
mov dword [ebp - 0x48], 0
movlpd qword [ebp - 0x64], xmm0
call fcn.0049b190
push 0
push edi
lea ecx, [ebp - 0x6c]
call fcn.0049af40
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005ebe04
mov esp, ebp
pop ebp
ret
Function at 0x49b7d0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f5b98
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x6baac0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ecx, esi
push 0x14
mov dword [ebp - 0x7c], eax
call fcn.00414890
mov edi, eax
test edi, edi
je 0x49b8a2
push 0x40
lea eax, [ebp - 0x50]
mov dword [ebp - 0x78], vtable._ckSha1.0
xorps xmm0, xmm0
mov dword [ebp - 0x58], 0
push 0
push eax
movups xmmword [ebp - 0x68], xmm0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov ecx, dword [ebp - 0x7c]
xorps xmm0, xmm0
mov dword [ebp - 4], 0
mov dword [ebp - 0x68], 0x67452301
mov dword [ebp - 0x64], 0xefcdab89
mov dword [ebp - 0x60], 0x98badcfe
mov dword [ebp - 0x5c], 0x10325476
mov dword [ebp - 0x58], 0xc3d2e1f0
mov dword [ebp - 0x54], 0
movlpd qword [ebp - 0x70], xmm0
call fcn.00401c90
mov ecx, dword [ebp - 0x7c]
push eax
call fcn.00414910
push eax
lea ecx, [ebp - 0x78]
call fcn.0049b190
push 0
push edi
lea ecx, [ebp - 0x78]
call fcn.0049af40
push 0x14
mov ecx, esi
call fcn.00411ed0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005ebe04
mov esp, ebp
pop ebp
ret