joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442ea0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], esi
mov ebx, edx
test esi, esi
je 0x443011
test ebx, ebx
jne 0x442ed3
cmp dword [ebp + 8], edx
ja 0x443011
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi], 0x40
jb 0x442ee3
pop esi
mov eax, 0xffffff7c
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [esi + 4]
mov edx, dword [ebp + 8]
mov dword [ebp - 4], edx
lea eax, [ecx + edx]
mov dword [esi + 4], eax
cmp eax, ecx
jae 0x442ef9
inc dword [esi + 8]
mov eax, dword [esi]
push edi
lea edi, [esi + 0xc]
test eax, eax
je 0x442f7d
mov esi, 0x40
sub esi, eax
cmp edx, esi
cmovb esi, edx
add eax, edi
push esi
push ebx
push eax
call fcn.0046ae20
mov eax, dword [ebp - 8]
add ebx, esi
mov edx, dword [ebp + 8]
add esp, 0xc
sub edx, esi
mov dword [ebp - 4], edx
add dword [eax], esi
mov esi, eax
cmp dword [esi], 0x40
jne 0x442f7d
mov edx, edi
mov esi, 0x10
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [edx - 4], ecx
sub esi, 1
jne 0x442f40
mov esi, dword [ebp - 8]
mov edx, edi
mov ecx, esi
call fcn.00441eb0
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x44300a
mov edx, dword [ebp - 4]
mov dword [esi], eax
jmp 0x442f7f
xor eax, eax
cmp edx, 0x40
jb 0x442ff3
mov eax, edx
shr eax, 6
mov dword [ebp - 8], eax
nop dword [eax]
movups xmm0, xmmword [ebx]
sub edx, 0x40
mov dword [ebp - 4], edx
movups xmmword [edi], xmm0
movups xmm0, xmmword [ebx + 0x10]
movups xmmword [edi + 0x10], xmm0
movups xmm0, xmmword [ebx + 0x20]
movups xmmword [edi + 0x20], xmm0
movups xmm0, xmmword [ebx + 0x30]
add ebx, 0x40
xor edx, edx
movups xmmword [edi + 0x30], xmm0
nop dword [eax]
mov ecx, dword [edi + edx*4]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [edi + edx*4], ecx
inc edx
cmp edx, 0x10
jb 0x442fc0
mov edx, edi
mov ecx, esi
call fcn.00441eb0
sub dword [ebp - 8], 1
mov edx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
jne 0x442f90
test edx, edx
je 0x44300a
push edx
push ebx
push edi
call fcn.0046ae20
mov eax, dword [ebp - 4]
add esp, 0xc
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 0xffffff53
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x443020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
mov eax, edx
mov dword [ebp - 4], eax
test edi, edi
je 0x4431bb
test eax, eax
je 0x4431bb
mov eax, dword [edi]
push ebx
lea ebx, [edi + 0xc]
cmp eax, 0x3f
jbe 0x443052
pop ebx
mov eax, 0xffffff40
pop edi
mov esp, ebp
pop ebp
ret
mov byte [eax + ebx], 0x80
mov ecx, dword [edi]
inc ecx
mov dword [edi], ecx
push esi
cmp ecx, 0x38
jbe 0x4430b8
mov eax, 0x40
sub eax, ecx
push eax
lea eax, [ecx + ebx]
push 0
push eax
call fcn.00469c30
add esp, 0xc
mov dword [edi], 0x40
mov edx, ebx
mov esi, 0x10
mov ecx, dword [edx]
lea edx, [edx + 4]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [edx - 4], ecx
sub esi, 1
jne 0x443084
mov edx, ebx
mov ecx, edi
call fcn.00441eb0
test eax, eax
jne 0x4431b4
mov dword [edi], eax
xor ecx, ecx
mov eax, 0x38
sub eax, ecx
push eax
lea eax, [ecx + ebx]
push 0
push eax
call fcn.00469c30
add esp, 0xc
mov eax, ebx
mov esi, 0x10
mov edx, dword [eax]
lea eax, [eax + 4]
mov ecx, edx
rol edx, 8
ror ecx, 8
xor edx, ecx
and edx, 0xff00ff
xor edx, ecx
mov dword [eax - 4], edx
sub esi, 1
jne 0x4430d5
mov esi, dword [edi + 4]
mov edx, ebx
mov ecx, dword [edi + 8]
mov eax, esi
shr eax, 0x1d
lea ecx, [eax + ecx*8]
mov dword [edi + 8], ecx
lea eax, [esi*8]
mov dword [edi + 4], eax
mov dword [ebx + 0x38], ecx
mov ecx, edi
mov eax, dword [edi + 4]
mov dword [ebx + 0x3c], eax
call fcn.00441eb0
mov edx, dword [edi + 0x4c]
mov esi, eax
mov ecx, edx
rol edx, 8
ror ecx, 8
xor edx, ecx
and edx, 0xff00ff
xor edx, ecx
mov ecx, dword [edi + 0x50]
mov eax, ecx
mov dword [edi + 0x4c], edx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [edi + 0x50], ecx
mov ecx, dword [edi + 0x54]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [edi + 0x54], ecx
mov ecx, dword [edi + 0x58]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [edi + 0x58], ecx
mov ecx, dword [edi + 0x5c]
mov eax, ecx
rol ecx, 8
ror eax, 8
xor ecx, eax
and ecx, 0xff00ff
xor ecx, eax
mov dword [edi + 0x5c], ecx
mov ecx, dword [ebp - 4]
movups xmm0, xmmword [edi + 0x4c]
movups xmmword [ecx], xmm0
mov eax, dword [edi + 0x5c]
mov dword [ecx + 0x10], eax
mov ecx, edi
call fcn.00441e70
mov eax, esi
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0xffffff53
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x444860
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
xor ebx, ebx
xor edx, edx
test byte [esi + 0x30e], 0x80
lea eax, [edi + 4]
jne 0x4448c6
cmp dword [ebp + 0xc], 1
jne 0x4448a4
mov edx, dword [esi + 0x2f0]
mov ebx, dword [esi + 0x2ec]
lea ecx, [edx + 1]
mov dword [esi + 0x2f0], ecx
cmp edx, ecx
jbe 0x4448c6
lea ecx, [ebx + 1]
mov dword [esi + 0x2ec], ecx
jmp 0x4448c6
mov edx, dword [esi + 0x2f8]
mov ebx, dword [esi + 0x2f4]
lea ecx, [edx + 1]
mov dword [esi + 0x2f8], ecx
cmp edx, ecx
jbe 0x4448c6
lea ecx, [ebx + 1]
mov dword [esi + 0x2f4], ecx
mov esi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
mov byte [eax], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [eax + 1], cl
mov ecx, ebx
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, edx
shr ecx, 0x18
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 5], cl
mov ecx, edx
mov byte [eax + 7], dl
mov edx, 8
mov byte [eax + 3], bl
shr ecx, 8
mov byte [eax + 6], cl
movzx ecx, byte [esi]
mov byte [edi], cl
movzx ecx, byte [esi + 1]
mov byte [edi + 1], cl
movzx ecx, byte [esi + 2]
mov byte [edi + 2], cl
movzx ecx, byte [esi + 3]
sub esi, edi
mov byte [edi + 3], cl
nop
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x444920
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x446430
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe0
mov eax, 0xffffff53
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x10]
push edi
mov edi, edx
sub ecx, 4
je 0x446595
sub ecx, 1
je 0x446505
sub ecx, 1
jne 0x44663d
lea eax, [esp + 8]
mov dword [esp + 0xe0], ecx
push eax
call fcn.00428550
add esp, 4
test eax, eax
jne 0x4464fb
mov eax, dword [ebp + 8]
test edi, edi
jne 0x446488
test eax, eax
jne 0x4464de
push eax
mov edx, edi
lea ecx, [esp + 0xc]
call fcn.0042afc0
add esp, 4
test eax, eax
jne 0x4464e3
test esi, esi
je 0x4464de
lea ecx, [esp + 8]
call fcn.0042b190
test eax, eax
jne 0x4464e3
movups xmm0, xmmword [esp + 8]
lea eax, [esp + 8]
push eax
movups xmmword [esi], xmm0
movups xmm0, xmmword [esp + 0x1c]
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [esp + 0x2c]
movups xmmword [esi + 0x20], xmm0
movups xmm0, xmmword [esp + 0x3c]
movups xmmword [esi + 0x30], xmm0
call fcn.00428550
add esp, 4
jmp 0x4464e3
mov eax, 0xffffff53
mov ecx, 0xe0
lea edx, [esp + 8]
nop dword [eax]
mov byte [edx], 0
lea edx, [edx + 1]
sub ecx, 1
jne 0x4464f0
mov ecx, 0x40
jmp 0x446637
lea ecx, [esp + 8]
mov dword [esp + 0xe0], 0
call fcn.0042b2f0
test eax, eax
jne 0x44658b
mov eax, dword [ebp + 8]
test edi, edi
jne 0x446528
test eax, eax
jne 0x44656f
push eax
lea ecx, [esp + 0xc]
call fcn.0042afc0
add esp, 4
test eax, eax
jne 0x446574
test esi, esi
je 0x44656f
lea ecx, [esp + 8]
call fcn.0042b190
test eax, eax
jne 0x446574
movups xmm0, xmmword [esp + 8]
lea ecx, [esp + 8]
movups xmmword [esi], xmm0
movups xmm0, xmmword [esp + 0x18]
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [esp + 0x28]
movups xmmword [esi + 0x20], xmm0
call fcn.0042b2f0
jmp 0x446574
mov eax, 0xffffff53
mov ecx, 0xe0
lea edx, [esp + 8]
nop dword [eax]
mov byte [edx], 0
lea edx, [edx + 1]
sub ecx, 1
jne 0x446580
mov ecx, 0x30
jmp 0x446637
mov dword [esp + 8], 0x6a09e667
mov dword [esp + 0xc], 0xbb67ae85
mov dword [esp + 0x10], 0x3c6ef372
mov dword [esp + 0x14], 0xa54ff53a
mov dword [esp + 0x18], 0x510e527f
mov dword [esp + 0x1c], 0x9b05688c
mov dword [esp + 0x20], 0x1f83d9ab
mov dword [esp + 0x24], 0x5be0cd19
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
test edi, edi
jne 0x446600
cmp dword [ebp + 8], edi
jbe 0x446613
jmp 0x44661e
push dword [ebp + 8]
lea ecx, [esp + 0xc]
call fcn.00433a00
add esp, 4
test eax, eax
jne 0x44661e
mov edx, esi
lea ecx, [esp + 8]
call fcn.00433c70
mov ecx, 0x70
lea edx, [esp + 8]
mov byte [edx], 0
lea edx, [edx + 1]
sub ecx, 1
jne 0x446627
mov ecx, 0x20
test eax, eax
jne 0x44663d
mov eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x446650
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe0
mov eax, 0xffffff53
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
push edi
mov edi, edx
sub ecx, 4
je 0x4467b5
sub ecx, 1
je 0x446725
sub ecx, 1
jne 0x44685c
lea eax, [esp + 8]
mov dword [esp + 0xe0], ecx
push eax
call fcn.00428550
add esp, 4
test eax, eax
jne 0x44671b
test esi, esi
jne 0x4466a5
test edi, edi
jne 0x4466fb
push edi
mov edx, esi
lea ecx, [esp + 0xc]
call fcn.0042afc0
add esp, 4
test eax, eax
jne 0x446700
test esi, esi
je 0x4466fb
lea ecx, [esp + 8]
call fcn.0042b190
test eax, eax
jne 0x446700
movups xmm0, xmmword [esp + 8]
lea eax, [esp + 8]
push eax
movups xmmword [esi], xmm0
movups xmm0, xmmword [esp + 0x1c]
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [esp + 0x2c]
movups xmmword [esi + 0x20], xmm0
movups xmm0, xmmword [esp + 0x3c]
movups xmmword [esi + 0x30], xmm0
call fcn.00428550
add esp, 4
jmp 0x446700
mov eax, 0xffffff53
mov ecx, 0xe0
lea edx, [esp + 8]
nop dword [eax]
mov byte [edx], 0
lea edx, [edx + 1]
sub ecx, 1
jne 0x446710
mov ecx, 0x40
jmp 0x446856
lea ecx, [esp + 8]
mov dword [esp + 0xe0], 0
call fcn.0042b2f0
test eax, eax
jne 0x4467ab
test esi, esi
jne 0x446745
test edi, edi
jne 0x44678e
push edi
mov edx, esi
lea ecx, [esp + 0xc]
call fcn.0042afc0
add esp, 4
test eax, eax
jne 0x446793
test esi, esi
je 0x44678e
lea ecx, [esp + 8]
call fcn.0042b190
test eax, eax
jne 0x446793
movups xmm0, xmmword [esp + 8]
lea ecx, [esp + 8]
movups xmmword [esi], xmm0
movups xmm0, xmmword [esp + 0x18]
movups xmmword [esi + 0x10], xmm0
movups xmm0, xmmword [esp + 0x28]
movups xmmword [esi + 0x20], xmm0
call fcn.0042b2f0
jmp 0x446793
mov eax, 0xffffff53
mov ecx, 0xe0
lea edx, [esp + 8]
nop dword [eax]
mov byte [edx], 0
lea edx, [edx + 1]
sub ecx, 1
jne 0x4467a0
mov ecx, 0x30
jmp 0x446856
mov dword [esp + 8], 0x6a09e667
mov dword [esp + 0xc], 0xbb67ae85
mov dword [esp + 0x10], 0x3c6ef372
mov dword [esp + 0x14], 0xa54ff53a
mov dword [esp + 0x18], 0x510e527f
mov dword [esp + 0x1c], 0x9b05688c
mov dword [esp + 0x20], 0x1f83d9ab
mov dword [esp + 0x24], 0x5be0cd19
mov dword [esp + 0x68], 0
mov dword [esp + 0x6c], 0
mov dword [esp + 0x70], 0
mov dword [esp + 0x74], 0
test esi, esi
jne 0x44681f
test edi, edi
je 0x446832
jmp 0x44683d
push edi
mov edx, esi
lea ecx, [esp + 0xc]
call fcn.00433a00
add esp, 4
test eax, eax
jne 0x44683d
mov edx, esi
lea ecx, [esp + 8]
call fcn.00433c70
mov ecx, 0x70
lea edx, [esp + 8]
mov byte [edx], 0
lea edx, [edx + 1]
sub ecx, 1
jne 0x446846
mov ecx, 0x20
test eax, eax
jne 0x44685c
mov eax, ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44c5a0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
push ebx
push esi
mov esi, ecx
mov ebx, edx
push edi
test esi, esi
je 0x44c683
test ebx, ebx
je 0x44c683
test byte [esi + 0x60], 1
jne 0x44c5d5
mov eax, 0xffffff28
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x38]
push eax
push ecx
lea edx, [esi + 0x20]
call fcn.0044c4b0
mov edi, eax
add esp, 8
test edi, edi
jne 0x44c688
mov cl, byte [esp + 0x57]
lea edx, [esp + 0x38]
and byte [esp + 0x38], 0xf8
and cl, 0x3f
or cl, 0x40
mov byte [esp + 0x57], cl
lea ecx, [esp + 0xa0]
call fcn.00466680
lea edx, [esp + 0xf0]
lea ecx, [esp + 0x10]
call fcn.00461060
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0xa4]
lea ecx, [esp + 0x3c]
call fcn.00461320
add esp, 4
lea eax, [esp + 0x10]
lea edx, [esp + 0xc8]
lea ecx, [esp + 0x78]
push eax
call fcn.00461320
add esp, 4
lea edx, [esp + 0x78]
mov ecx, ebx
call fcn.00460900
lea edx, [esp + 0x38]
lea ecx, [esp + 0x10]
call fcn.00460900
mov al, byte [esp + 0x10]
shl al, 7
xor byte [ebx + 0x1f], al
mov eax, edi
or word [esi + 0x60], 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0xffffff53
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
push esi
mov esi, ecx
push edi
test esi, esi
je 0x44cb76
mov eax, dword [ebp + 8]
test eax, eax
je 0x44cb76
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x44cb76
mov dword [eax], 0
cmp edx, 0x40
jne 0x44cb76
cmp byte [esi + 0x3f], 0x10
ja 0x44cb76
jne 0x44ca34
lea eax, [edx - 2]
lea ecx, [esi + 0x3c]
nop
cmp byte [ecx + 2], 0
ja 0x44ca34
cmp byte [ecx + 1], 0
ja 0x44ca09
cmp byte [ecx], 0
ja 0x44ca04
cmp byte [ecx - 1], 0
ja 0x44c9ff
cmp byte [ecx - 2], 0
ja 0x44c9fa
sub eax, 5
sub ecx, 5
cmp eax, 0x2f
jg 0x44c9d0
jmp 0x44ca0a
sub eax, 4
jmp 0x44ca0a
sub eax, 3
jmp 0x44ca0a
sub eax, 2
jmp 0x44ca0a
dec eax
cmp eax, 0x2f
jne 0x44ca34
xor ecx, ecx
mov dl, byte [eax + esi]
mov dh, byte [ecx + 0x48f0f0]
cmp dl, dh
jb 0x44ca2b
ja 0x44cb76
inc ecx
dec eax
cmp ecx, 0x10
jl 0x44ca11
cmp eax, 0x1f
je 0x44cb76
mov edx, edi
lea ecx, [esp + 0xf0]
call fcn.00467bc0
test eax, eax
jne 0x44cb76
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x44cb76
mov ecx, edi
call fcn.0042b190
test eax, eax
jne 0x44cb7b
movups xmm0, xmmword [edi]
push edi
movups xmmword [esp + 0x34], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [esp + 0x44], xmm0
movups xmm0, xmmword [edi + 0x20]
movups xmmword [esp + 0x54], xmm0
movups xmm0, xmmword [edi + 0x30]
movups xmmword [esp + 0x64], xmm0
call fcn.00428550
add esp, 4
test eax, eax
jne 0x44cb7b
lea ecx, [esp + 0x30]
call fcn.00462ac0
lea eax, [esi + 0x20]
push eax
lea eax, [esp + 0xf4]
push eax
lea edx, [esp + 0x38]
lea ecx, [esp + 0x80]
call fcn.00466d30
add esp, 8
test eax, eax
jne 0x44cb7b
lea edx, [esp + 0x78]
lea ecx, [esp + 0x10]
call fcn.00467e30
lea eax, [esp + 0x10]
xorps xmm4, xmm4
lea ecx, [esp + 0x14]
sub eax, esi
xorps xmm3, xmm3
sub ecx, esi
mov edx, 4
nop dword [eax]
movd xmm2, dword [eax + esi]
xorps xmm0, xmm0
movd xmm1, dword [esi]
lea esi, [esi + 8]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [esi - 4]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [ecx + esi - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
sub edx, 1
jne 0x44caf0
orps xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
test eax, eax
je 0x44cb67
mov eax, 0xffffff1b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
mov dword [ecx], 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0xffffff53
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x44d1f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, edx
push edi
mov edi, ecx
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebp + 0xc]
neg ecx
mov dword [ebp + 0xc], ecx
mov eax, dword [edi]
xor eax, dword [ebx]
and eax, ecx
mov dword [esi], eax
mov eax, dword [ebx + 8]
xor eax, dword [edi + 8]
and eax, ecx
cmp dword [ebp + 8], 0
mov dword [esi + 8], eax
je 0x44d2a7
mov edx, dword [ebp + 8]
lea ecx, [ebx + 0xc]
mov eax, edi
sub eax, ebx
mov dword [ebp - 8], eax
mov eax, esi
mov esi, dword [ebp - 8]
sub eax, ebx
mov ebx, eax
nop
mov eax, dword [esi + ecx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
and eax, dword [ebp + 0xc]
mov dword [ebx + ecx - 4], eax
sub edx, 1
jne 0x44d240
mov esi, dword [ebp + 0x10]
lea ecx, [edi + 0xc]
mov ebx, dword [ebp - 0x10]
mov eax, dword [esi]
xor dword [edi], eax
mov eax, dword [esi + 8]
xor dword [edi + 8], eax
mov eax, esi
sub eax, edi
mov edi, dword [ebp + 8]
mov edx, eax
mov eax, dword [edx + ecx]
lea ecx, [ecx + 4]
xor dword [ecx - 4], eax
sub edi, 1
jne 0x44d271
mov ecx, dword [esi]
lea eax, [ebx + 0xc]
xor dword [ebx], ecx
sub esi, ebx
mov edx, dword [ebp + 8]
mov dword [ebx + 8], edi
nop
mov ecx, dword [eax + esi]
lea eax, [eax + 4]
xor dword [eax - 4], ecx
sub edx, 1
jne 0x44d290
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
xor dword [edi], eax
mov eax, dword [esi + 8]
xor dword [edi + 8], eax
mov eax, dword [esi]
xor dword [ebx], eax
xor eax, eax
pop edi
pop esi
mov dword [ebx + 8], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455230
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov eax, edx
and esi, 3
and eax, 3
cmp esi, eax
mov eax, dword [ebp + 8]
push edi
jne 0x4552f5
test esi, esi
je 0x455262
test eax, eax
je 0x455262
mov bl, byte [edx]
inc edx
xor byte [ecx], bl
inc ecx
dec eax
jmp 0x455255
mov edi, eax
xor ebx, ebx
shr edi, 2
test edi, edi
je 0x4552ef
cmp edi, 0x10
jb 0x4552da
lea esi, [edi - 1]
lea esi, [edx + esi*4]
cmp ecx, esi
ja 0x45528a
lea esi, [edi - 1]
lea esi, [ecx + esi*4]
cmp esi, edx
jae 0x4552da
mov esi, edi
and esi, 0xfffffff0
nop
movups xmm0, xmmword [ecx]
add ebx, 0x10
movups xmm1, xmmword [edx]
xorps xmm1, xmm0
movups xmmword [ecx], xmm1
movups xmm0, xmmword [ecx + 0x10]
movups xmm1, xmmword [edx + 0x10]
xorps xmm1, xmm0
movups xmmword [ecx + 0x10], xmm1
movups xmm0, xmmword [ecx + 0x20]
movups xmm1, xmmword [edx + 0x20]
xorps xmm1, xmm0
movups xmmword [ecx + 0x20], xmm1
movups xmm1, xmmword [edx + 0x30]
add edx, 0x40
movups xmm0, xmmword [ecx + 0x30]
xorps xmm1, xmm0
movups xmmword [ecx + 0x30], xmm1
add ecx, 0x40
cmp ebx, esi
jb 0x455290
cmp ebx, edi
jae 0x4552ef
sub edi, ebx
nop dword [eax]
mov esi, dword [edx]
add edx, 4
xor dword [ecx], esi
add ecx, 4
sub edi, 1
jne 0x4552e0
mov dword [ebp - 4], edx
and eax, 3
xor edi, edi
test eax, eax
je 0x4553fe
cmp eax, 8
jb 0x4553e3
lea esi, [edx - 1]
lea ebx, [ecx - 1]
add esi, eax
add ebx, eax
cmp ecx, esi
ja 0x45531e
cmp ebx, edx
jae 0x4553e3
cmp eax, 0x40
jb 0x4553a4
mov ebx, eax
mov esi, eax
and ebx, 0x3f
sub esi, ebx
mov dword [ebp - 0x10], ebx
lea ebx, [edx + 0x30]
mov dword [ebp - 0xc], esi
mov dword [ebp + 8], ebx
lea esi, [ecx + 0x10]
mov ebx, edx
sub ebx, ecx
mov dword [ebp - 8], ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebp - 8]
nop dword [eax]
movups xmm0, xmmword [esi - 0x10]
add edi, 0x40
lea ebx, [ebx + 0x40]
lea esi, [esi + 0x40]
movups xmm1, xmmword [ebx - 0x70]
xorps xmm1, xmm0
movups xmmword [esi - 0x50], xmm1
movups xmm0, xmmword [esi - 0x40]
movups xmm1, xmmword [edx + esi - 0x40]
xorps xmm1, xmm0
movups xmmword [esi - 0x40], xmm1
movups xmm0, xmmword [esi - 0x30]
movups xmm1, xmmword [ebx - 0x50]
xorps xmm1, xmm0
movups xmmword [esi - 0x30], xmm1
movups xmm1, xmmword [ebx - 0x40]
movups xmm0, xmmword [esi - 0x20]
xorps xmm1, xmm0
movups xmmword [esi - 0x20], xmm1
cmp edi, dword [ebp - 0xc]
jb 0x455350
cmp dword [ebp - 0x10], 8
mov edx, dword [ebp - 4]
jb 0x4553df
mov ebx, eax
lea esi, [edi + ecx]
and ebx, 0xfffffff8
sub edx, ecx
mov dword [ebp + 8], ebx
mov dword [ebp - 0x10], edx
nop dword [eax]
nop dword [eax + eax]
movq xmm1, qword [esi + edx]
lea esi, [esi + 8]
movq xmm0, qword [esi - 8]
add edi, 8
xorps xmm1, xmm0
movq qword [esi - 8], xmm1
cmp edi, ebx
jb 0x4553c0
mov edx, dword [ebp - 4]
cmp edi, eax
jae 0x4553fe
sub edx, ecx
lea esi, [edi + ecx]
sub eax, edi
nop word [eax + eax]
mov cl, byte [esi + edx]
lea esi, [esi + 1]
xor byte [esi - 1], cl
sub eax, 1
jne 0x4553f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x459030
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
shr esi, 2
push edi
mov edi, edx
test esi, esi
je 0x459063
sub edi, ecx
mov edx, dword [edi + ecx]
lea ecx, [ecx + 4]
mov eax, edx
rol edx, 8
ror eax, 8
xor edx, eax
and edx, 0xff00ff
xor edx, eax
mov dword [ecx - 4], edx
sub esi, 1
jne 0x459043
pop edi
pop esi
pop ebp
ret
Function at 0x45bae0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, ecx
mov dword [ebp - 0x20], edx
xorps xmm0, xmm0
mov dword [ebp - 0x24], eax
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
movups xmm0, xmmword [eax]
push ebx
movups xmm2, xmmword [ebp - 0x38]
push esi
movups xmmword [ebp - 0x48], xmm0
mov ecx, dword [ebp - 0x3c]
xor eax, eax
mov esi, dword [ebp - 0x40]
push edi
mov edi, dword [ebp - 0x44]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 8], ecx
mov ecx, dword [edx + eax*8 + 4]
mov ebx, dword [edx + eax*8]
mov eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], 0x40
nop dword [eax]
movups xmm0, xmmword [ebp - 0x48]
mov edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x10]
shr edx, 0x1f
neg edx
mov dword [ebp - 0x30], edx
mov edx, dword [ebp - 8]
adc ecx, ecx
shrd dword [ebp - 4], eax, 1
neg ecx
shl edx, 0x1f
shr eax, 1
xor edi, edi
or edx, eax
mov dword [ebp - 0x2c], ecx
movq xmm1, qword [ebp - 0x30]
xor ecx, ecx
or ecx, dword [ebp - 4]
and esi, 1
mov eax, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
neg esi
mov esi, dword [ebp - 4]
adc edi, edi
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
neg edi
mov dword [ebp - 0x3c], edx
and edi, 0xe1000000
mov edx, dword [ebp - 8]
xor ecx, ecx
shrd edx, eax, 1
punpcklqdq xmm1, xmm1
shr eax, 1
xor edx, ecx
xor edi, eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
andps xmm1, xmm0
shld eax, ebx, 1
xorps xmm2, xmm1
mov dword [ebp - 0x48], edx
add ebx, ebx
mov dword [ebp - 0x14], edi
sub dword [ebp - 0x18], 1
mov dword [ebp - 0x44], edi
mov dword [ebp - 0xc], eax
jne 0x45bb40
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 2
jl 0x45bb26
mov eax, dword [ebp - 0x24]
pop edi
pop esi
pop ebx
movups xmmword [eax], xmm2
mov esp, ebp
pop ebp
ret
Function at 0x45cc60
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
mov eax, edx
mov dword [ebp - 4], eax
test edi, edi
je 0x45cd54
test eax, eax
je 0x45cd54
mov eax, dword [edi]
push ebx
lea ebx, [edi + 0xc]
cmp eax, 0x3f
jbe 0x45cc92
pop ebx
mov eax, 0xffffff7c
pop edi
mov esp, ebp
pop ebp
ret
mov byte [eax + ebx], 0x80
mov ecx, dword [edi]
inc ecx
mov dword [edi], ecx
cmp ecx, 0x38
jbe 0x45cccd
mov eax, 0x40
sub eax, ecx
push eax
lea eax, [ecx + ebx]
push 0
push eax
call fcn.00469c30
add esp, 0xc
mov dword [edi], 0x40
mov edx, ebx
mov ecx, edi
call fcn.0045c460
mov dword [edi], 0
xor ecx, ecx
push esi
mov eax, 0x38
sub eax, ecx
push eax
lea eax, [ecx + ebx]
push 0
push eax
call fcn.00469c30
mov esi, dword [edi + 4]
add esp, 0xc
mov ecx, dword [edi + 8]
mov eax, esi
shr eax, 0x1d
mov edx, ebx
lea eax, [eax + ecx*8]
mov ecx, edi
mov dword [edi + 8], eax
lea eax, [esi*8]
mov dword [edi + 4], eax
mov dword [ebx + 0x38], eax
mov eax, dword [edi + 8]
mov dword [ebx + 0x3c], eax
call fcn.0045c460
movups xmm0, xmmword [edi + 0x4c]
mov eax, dword [ebp - 4]
pop esi
pop ebx
movups xmmword [eax], xmm0
mov dword [edi + 0x4c], 0x67452301
xor eax, eax
mov dword [edi + 0x50], 0xefcdab89
mov dword [edi + 0x54], 0x98badcfe
mov dword [edi + 0x58], 0x10325476
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
pop edi
mov esp, ebp
pop ebp
ret
mov eax, 0xffffff53
pop edi
mov esp, ebp
pop ebp
ret