joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a8e40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [0x53450c]
xor eax, esp
mov dword [esp + 0xc], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
push edi
xor edx, edx
jmp 0x4a8e60
mov eax, dword [edx + esi]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
bswap eax
mov edi, dword [ecx + 0x44]
mov dword [edx + edi], eax
add edx, 4
cmp edx, 0x10
jne 0x4a8e60
xor eax, eax
lea ecx, [ecx]
mov edx, dword [ecx + 0x44]
mov edx, dword [eax + edx]
mov esi, dword [ecx + 0x24]
mov dword [eax + esi], edx
add eax, 4
cmp eax, 0x10
jne 0x4a8e80
mov edx, eax
jmp 0x4a8ea0
mov esi, dword [ecx + 0x24]
mov eax, dword [edx + esi - 0x10]
add eax, dword [edx + esi - 4]
add edx, 4
mov edi, eax
and edi, 7
shr eax, 3
xor eax, dword [edi*4 + 0x4fa298]
mov dword [edx + esi - 4], eax
cmp edx, 0x400
jne 0x4a8ea0
xor eax, eax
jmp 0x4a8ed0
mov edx, dword [ecx + 0x24]
mov esi, dword [eax + edx + 0x164]
add dword [eax + edx], esi
add eax, 4
cmp eax, 0x5c
jne 0x4a8ed0
mov eax, dword [ecx + 0x24]
mov edi, dword [eax + 0xec]
mov edx, dword [eax + 0x84]
and edi, 0xff7fffff
or edi, 0x1000001
xor eax, eax
mov esi, dword [ecx + 0x24]
mov ebx, dword [esi + eax]
and edx, 0xff7fffff
add edx, edi
and ebx, 0xffffff
xor ebx, edx
mov dword [esi + eax], ebx
add eax, 4
cmp eax, 0x400
jne 0x4a8f02
mov esi, dword [ecx + 0x24]
mov ebp, dword [esi]
mov eax, edx
and eax, 0xff
mov eax, dword [esi + eax*4]
xor eax, edx
and eax, 0xff
lea edi, [eax*4]
mov edx, dword [edi + esi]
mov dword [esi], edx
mov edx, 1
lea esp, [esp]
mov esi, dword [ecx + 0x24]
mov ebx, dword [esi + edx*4]
mov dword [edi + esi], ebx
mov esi, dword [ecx + 0x24]
mov edi, edx
xor edi, eax
mov edi, dword [esi + edi*4]
xor eax, edi
and eax, 0xff
lea edi, [eax*4]
mov ebx, dword [edi + esi]
mov dword [esi + edx*4], ebx
inc edx
cmp edx, 0x100
jne 0x4a8f50
mov edx, dword [ecx + 0x24]
mov dword [edx + eax*4], ebp
xor eax, eax
mov dword [ecx + 0x54], eax
mov byte [esp + 0x14], al
mov dword [esp + 0x15], eax
mov word [esp + 0x19], ax
mov byte [esp + 0x1b], al
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
push 8
lea edx, [esp + 0x18]
push edx
call eax
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0045f14f
add esp, 0x10
ret 8
Function at 0x4a9550
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
sub esp, 0xc
mov eax, dword [0x53450c]
xor eax, esp
mov dword [esp + 8], eax
push esi
mov esi, ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x18]
call edx
mov eax, dword [esp + 0x18]
cmp eax, 0x10
jne 0x4a95e4
mov eax, dword [esi + 0x14]
mov dword [eax], 0x61707865
mov ecx, dword [esi + 0x14]
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
mov dword [ecx + 4], edx
mov edx, dword [eax + 4]
mov ecx, dword [esi + 0x14]
mov dword [ecx + 8], edx
mov edx, dword [eax + 8]
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0xc], edx
mov edx, dword [eax + 0xc]
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x10], edx
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x14], 0x3120646e
mov edx, dword [esi + 0x14]
mov dword [edx + 0x28], 0x79622d36
mov edx, dword [eax]
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x2c], edx
mov edx, dword [eax + 4]
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x30], edx
mov edx, dword [eax + 8]
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x34], edx
mov edx, dword [eax + 0xc]
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x38], edx
mov eax, dword [esi + 0x14]
mov dword [eax + 0x3c], 0x6b206574
jmp 0x4a965b
cmp eax, 0x20
jne 0x4a965b
mov ecx, dword [esi + 0x14]
mov eax, dword [esp + 0x14]
mov dword [ecx], 0x61707865
mov ecx, dword [eax]
mov edx, dword [esi + 0x14]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 4]
mov edx, dword [esi + 0x14]
mov dword [edx + 8], ecx
mov ecx, dword [eax + 8]
mov edx, dword [esi + 0x14]
mov dword [edx + 0xc], ecx
mov ecx, dword [eax + 0xc]
mov edx, dword [esi + 0x14]
mov dword [edx + 0x10], ecx
mov edx, dword [esi + 0x14]
mov dword [edx + 0x14], 0x3320646e
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x28], 0x79622d32
mov ecx, dword [eax + 0x10]
mov edx, dword [esi + 0x14]
mov dword [edx + 0x2c], ecx
mov ecx, dword [eax + 0x14]
mov edx, dword [esi + 0x14]
mov dword [edx + 0x30], ecx
mov ecx, dword [eax + 0x18]
mov edx, dword [esi + 0x14]
mov dword [edx + 0x34], ecx
mov edx, dword [esi + 0x14]
mov eax, dword [eax + 0x1c]
mov dword [edx + 0x38], eax
mov ecx, dword [esi + 0x14]
mov dword [ecx + 0x3c], 0x6b206574
mov edx, dword [esi]
mov edx, dword [edx + 0xc]
xor eax, eax
mov byte [esp + 4], al
mov dword [esp + 5], eax
mov word [esp + 9], ax
mov byte [esp + 0xb], al
push 8
lea eax, [esp + 8]
push eax
mov ecx, esi
call edx
mov ecx, dword [esp + 0xc]
pop esi
xor ecx, esp
call fcn.0045f14f
add esp, 0xc
ret 8
Function at 0x4a9c40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov ebx, ecx
mov eax, dword [ebx]
mov edx, dword [eax + 0x18]
push esi
call edx
xor eax, eax
lea ecx, [ecx]
mov ecx, dword [ebx + 0x28]
mov dword [ecx + eax*4], eax
inc eax
cmp eax, 0x100
jne 0x4a9c50
push ebp
mov ebp, dword [esp + 0x10]
push edi
xor ecx, ecx
xor edi, edi
xor edx, edx
mov eax, ecx
div dword [esp + 0x18]
mov esi, dword [ebx + 0x28]
mov eax, dword [esi + ecx*4]
inc ecx
movzx edx, byte [edx + ebp]
add edi, edx
add edi, dword [esi + ecx*4 - 4]
and edi, 0xff
mov edx, dword [esi + edi*4]
mov dword [esi + ecx*4 - 4], edx
mov dword [esi + edi*4], eax
cmp ecx, 0x100
jne 0x4a9c68
pop edi
xor esi, esi
pop ebp
lea ecx, [ecx]
mov ecx, ebx
call fcn.004a9a90
add esi, dword [ebx + 0x1c]
cmp esi, dword [ebx + 0x14]
jbe 0x4a9ca0
mov eax, dword [ebx + 0x14]
xor edx, edx
div dword [ebx + 0x1c]
pop esi
add dword [ebx + 0x40], edx
pop ebx
ret 8

Function at 0x4a9d10
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4e60f3
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53450c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, 1
xor ebx, ebx
mov dword [esi + 4], 0x100
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ebx
mov eax, dword [esp + 0x28]
lea ecx, [esi + 0x18]
mov dword [esp + 0x20], ebx
mov dword [esi], vtable.Botan::ARC4.0
mov dword [esi + 0x14], eax
call fcn.0047fb50
lea ecx, [esi + 0x28]
mov byte [esp + 0x20], 1
call fcn.00486e80
mov eax, dword [esi + 0x30]
cmp eax, ebx
je 0x4a9d94
mov edx, dword [esi + 0x28]
lea ecx, [eax*4]
push ecx
push ebx
push edx
call fcn.0045f2d0
add esp, 0xc
mov eax, dword [esi + 0x20]
cmp eax, ebx
je 0x4a9da9
push eax
mov eax, dword [esi + 0x18]
push ebx
push eax
call fcn.0045f2d0
add esp, 0xc
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x4abde0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e615b
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x53450c]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push esi
mov eax, dword [0x53450c]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [esp + 0x68]
mov esi, ecx
mov dword [esi + 4], eax
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc], esi
mov dword [esi + 8], eax
xor ebx, ebx
push eax
lea ecx, [esi + 0xc]
mov dword [esp + 0x64], ebx
mov dword [esi], vtable.Botan::MDx_HashFunction.0
call fcn.0047acc0
mov eax, dword [esp + 0x78]
mov cl, byte [esp + 0x70]
mov dl, byte [esp + 0x74]
mov byte [esp + 0x60], 1
mov byte [esi + 0x2c], cl
mov byte [esi + 0x2d], dl
mov dword [esi + 0x30], eax
cmp eax, dword [esi + 4]
jae 0x4abe87
cmp eax, dword [esi + 8]
jae 0x4abe87
mov dword [esi + 0x28], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov eax, esi
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.0045f14f
add esp, 0x58
ret 0x14
push 0x27
push 0x4fa30c
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], ebx
mov byte [esp + 0x18], bl
call fcn.004013e0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x64], 2
call fcn.0047a400
push 0x527a40
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x34], vtable.Botan::Invalid_Argument.0
call fcn.0045ed14
int3
Function at 0x4acc80
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
call fcn.004abc50
mov eax, dword [esi + 0x38]
mov dword [eax], 0x6a09e667
mov ecx, dword [esi + 0x38]
mov dword [ecx + 4], 0xbb67ae85
mov edx, dword [esi + 0x38]
mov dword [edx + 8], 0x3c6ef372
mov eax, dword [esi + 0x38]
mov dword [eax + 0xc], 0xa54ff53a
mov ecx, dword [esi + 0x38]
mov dword [ecx + 0x10], 0x510e527f
mov edx, dword [esi + 0x38]
mov dword [edx + 0x14], 0x9b05688c
mov eax, dword [esi + 0x38]
mov dword [eax + 0x18], 0x1f83d9ab
mov ecx, dword [esi + 0x38]
mov dword [ecx + 0x1c], 0x5be0cd19
pop esi
ret
Function at 0x4ad990
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, ecx
call fcn.004abc50
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4ad9b2
mov ecx, dword [esi + 0x38]
add eax, eax
add eax, eax
push eax
push 0
push ecx
call fcn.0045f2d0
add esp, 0xc
mov edx, dword [esi + 0x48]
mov dword [edx], 0x67452301
mov eax, dword [esi + 0x48]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [esi + 0x48]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [esi + 0x48]
mov dword [edx + 0xc], 0x10325476
mov eax, dword [esi + 0x48]
mov dword [eax + 0x10], 0xc3d2e1f0
pop esi
ret
Function at 0x4af480
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
call fcn.004abc50
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4af4a2
mov ecx, dword [esi + 0x38]
add eax, eax
add eax, eax
push eax
push 0
push ecx
call fcn.0045f2d0
add esp, 0xc
mov edx, dword [esi + 0x48]
mov dword [edx], 0x67452301
mov eax, dword [esi + 0x48]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [esi + 0x48]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [esi + 0x48]
mov dword [edx + 0xc], 0x10325476
pop esi
ret
Function at 0x4b2cb0
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, ecx
call fcn.004abc50
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4b2cd2
mov ecx, dword [esi + 0x38]
add eax, eax
add eax, eax
push eax
push 0
push ecx
call fcn.0045f2d0
add esp, 0xc
mov edx, dword [esi + 0x48]
mov dword [edx], 0xc1059ed8
mov eax, dword [esi + 0x48]
mov dword [eax + 4], 0x367cd507
mov ecx, dword [esi + 0x48]
mov dword [ecx + 8], 0x3070dd17
mov edx, dword [esi + 0x48]
mov dword [edx + 0xc], 0xf70e5939
mov eax, dword [esi + 0x48]
mov dword [eax + 0x10], 0xffc00b31
mov ecx, dword [esi + 0x48]
mov dword [ecx + 0x14], 0x68581511
mov edx, dword [esi + 0x48]
mov dword [edx + 0x18], 0x64f98fa7
mov eax, dword [esi + 0x48]
mov dword [eax + 0x1c], 0xbefa4fa4
pop esi
ret

Function at 0x4b2d30
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
call fcn.004abc50
mov eax, dword [esi + 0x40]
test eax, eax
je 0x4b2d52
mov ecx, dword [esi + 0x38]
add eax, eax
add eax, eax
push eax
push 0
push ecx
call fcn.0045f2d0
add esp, 0xc
mov edx, dword [esi + 0x48]
mov dword [edx], 0x6a09e667
mov eax, dword [esi + 0x48]
mov dword [eax + 4], 0xbb67ae85
mov ecx, dword [esi + 0x48]
mov dword [ecx + 8], 0x3c6ef372
mov edx, dword [esi + 0x48]
mov dword [edx + 0xc], 0xa54ff53a
mov eax, dword [esi + 0x48]
mov dword [eax + 0x10], 0x510e527f
mov ecx, dword [esi + 0x48]
mov dword [ecx + 0x14], 0x9b05688c
mov edx, dword [esi + 0x48]
mov dword [edx + 0x18], 0x1f83d9ab
mov eax, dword [esi + 0x48]
mov dword [eax + 0x1c], 0x5be0cd19
pop esi
ret
Function at 0x4b2db0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 8]
add ecx, 0xfffffff0
push edi
cmp eax, ecx
jbe 0x4b2dc4
mov eax, ecx
mov edi, dword [esp + 0x10]
push eax
mov eax, dword [esi + 0xc]
add eax, 0x10
push edi
push eax
call fcn.0045e5f0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push ecx
lea edx, [eax + 0x10]
push edx
push eax
add eax, 0x20
push eax
call fcn.0049b100
add esp, 0x1c
xor dl, dl
xor ebx, ebx
xor eax, eax
jmp 0x4b2e00
mov ecx, dword [esi + 0xc]
movzx edx, dl
movzx edx, byte [edx + 0x4fa368]
xor byte [ecx + eax], dl
mov cl, byte [ecx + eax]
mov edx, dword [esi + 0xc]
movzx ecx, cl
movzx ecx, byte [ecx + 0x4fa368]
xor byte [edx + eax + 1], cl
mov ecx, dword [esi + 0xc]
lea edx, [edx + eax + 1]
mov dl, byte [edx]
movzx edx, dl
movzx edx, byte [edx + 0x4fa368]
xor byte [ecx + eax + 2], dl
mov edx, dword [esi + 0xc]
lea ecx, [ecx + eax + 2]
mov cl, byte [ecx]
movzx ecx, cl
movzx ecx, byte [ecx + 0x4fa368]
xor byte [edx + eax + 3], cl
mov ecx, dword [esi + 0xc]
lea edx, [edx + eax + 3]
mov dl, byte [edx]
movzx edx, dl
movzx edx, byte [edx + 0x4fa368]
xor byte [ecx + eax + 4], dl
mov edx, dword [esi + 0xc]
lea ecx, [ecx + eax + 4]
mov cl, byte [ecx]
movzx ecx, cl
movzx ecx, byte [ecx + 0x4fa368]
xor byte [edx + eax + 5], cl
mov ecx, dword [esi + 0xc]
lea edx, [edx + eax + 5]
mov dl, byte [edx]
movzx edx, dl
movzx edx, byte [edx + 0x4fa368]
xor byte [ecx + eax + 6], dl
mov edx, dword [esi + 0xc]
lea ecx, [ecx + eax + 6]
mov cl, byte [ecx]
movzx ecx, cl
movzx ecx, byte [ecx + 0x4fa368]
xor byte [edx + eax + 7], cl
lea edx, [edx + eax + 7]
mov dl, byte [edx]
add eax, 8
cmp eax, 0x30
jne 0x4b2e00
add dl, bl
inc ebx
cmp ebx, 0x12
jne 0x4b2df2
mov edx, dword [esi + 0x1c]
mov dl, byte [edx + 0xf]
xor eax, eax
cmp dword [esi + 8], eax
je 0x4b2eff
lea esp, [esp]
movzx ebx, byte [eax + edi]
mov ecx, dword [esi + 0x1c]
movzx edx, dl
xor ebx, edx
movzx edx, byte [ebx + 0x4fa368]
xor byte [ecx + eax], dl
mov dl, byte [ecx + eax]
inc eax
cmp eax, dword [esi + 8]
jne 0x4b2ee0
pop edi
pop esi
pop ebx
ret 4
Function at 0x4b2f10
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x3c]
push edi
cmp eax, dword [esi + 8]
je 0x4b2f32
lea ecx, [ecx]
mov cl, byte [esi + 8]
sub cl, byte [esi + 0x3c]
mov edx, dword [esi + 0x2c]
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 8]
jne 0x4b2f20
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 8]
mov edi, dword [esi + 0x2c]
add ecx, 0xfffffff0
cmp eax, ecx
jbe 0x4b2f44
mov eax, ecx
push eax
mov eax, dword [esi + 0xc]
add eax, 0x10
push edi
push eax
call fcn.0045e5f0
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push ecx
lea edx, [eax + 0x10]
push edx
push eax
add eax, 0x20
push eax
call fcn.0049b100
add esp, 0x1c
xor dl, dl
xor ebx, ebx
mov edi, edi
xor eax, eax
mov ecx, dword [esi + 0xc]
movzx edx, dl
movzx edx, byte [edx + 0x4fa368]
xor byte [ecx + eax], dl
mov cl, byte [ecx + eax]
mov edx, dword [esi + 0xc]
movzx ecx, cl
movzx ecx, byte [ecx + 0x4fa368]
xor byte [edx + eax + 1], cl
mov ecx, dword [esi + 0xc]
lea edx, [edx + eax + 1]
mov dl, byte [edx]
movzx edx, dl
movzx edx, byte [edx + 0x4fa368]
xor byte [ecx + eax + 2], dl
mov edx, dword [esi + 0xc]
lea ecx, [ecx + eax + 2]
mov cl, byte [ecx]
movzx ecx, cl
movzx ecx, byte [ecx + 0x4fa368]
xor byte [edx + eax + 3], cl
mov ecx, dword [esi + 0xc]
lea edx, [edx + eax + 3]
mov dl, byte [edx]
movzx edx, dl
movzx edx, byte [edx + 0x4fa368]
xor byte [ecx + eax + 4], dl
mov edx, dword [esi + 0xc]
lea ecx, [ecx + eax + 4]
mov cl, byte [ecx]
movzx ecx, cl
movzx ecx, byte [ecx + 0x4fa368]
xor byte [edx + eax + 5], cl
mov ecx, dword [esi + 0xc]
lea edx, [edx + eax + 5]
mov dl, byte [edx]
movzx edx, dl
movzx edx, byte [edx + 0x4fa368]
xor byte [ecx + eax + 6], dl
mov edx, dword [esi + 0xc]
lea ecx, [ecx + eax + 6]
mov cl, byte [ecx]
movzx ecx, cl
movzx ecx, byte [ecx + 0x4fa368]
xor byte [edx + eax + 7], cl
lea edx, [edx + eax + 7]
mov dl, byte [edx]
add eax, 8
cmp eax, 0x30
jne 0x4b2f72
add dl, bl
inc ebx
cmp ebx, 0x12
jne 0x4b2f70
mov edx, dword [esi + 0x1c]
mov dl, byte [edx + 0xf]
xor eax, eax
cmp dword [esi + 8], eax
je 0x4b306f
jmp 0x4b3050
movzx ebx, byte [eax + edi]
mov ecx, dword [esi + 0x1c]
movzx edx, dl
xor ebx, edx
movzx edx, byte [ebx + 0x4fa368]
xor byte [ecx + eax], dl
mov dl, byte [ecx + eax]
inc eax
cmp eax, dword [esi + 8]
jne 0x4b3050
mov eax, dword [esi + 0x1c]
push eax
mov ecx, esi
call fcn.004b2db0
mov ecx, dword [esi + 4]
mov edx, dword [esi + 0xc]
mov eax, dword [esp + 0x10]
push ecx
push edx
push eax
call fcn.0045e5f0
mov edx, dword [esi]
mov eax, dword [edx + 0x14]
add esp, 0xc
mov ecx, esi
call eax
pop edi
pop esi
pop ebx
ret 4
Function at 0x4b5970
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp dword [ecx + 4], esi
je 0x4b59f3
push ebx
push ebp
push edi
jmp 0x4b5980
mov edi, dword [ecx + 0x38]
mov edx, esi
shr edx, 3
mov eax, dword [edi + edx*8]
mov edx, dword [edi + edx*8 + 4]
mov ebx, eax
mov ebp, edx
shrd ebx, ebp, 0x18
shr ebp, 0x18
mov edi, edx
shr edi, 8
xor edi, ebx
mov ebx, eax
mov ebp, edx
shrd ebx, ebp, 0x18
shr ebp, 0x18
mov ebp, eax
shrd ebp, edx, 8
shr edx, 8
mov edx, eax
shl edx, 8
and edi, 0xff00ff
xor ebp, edx
xor edi, ebx
shl eax, 8
and ebp, 0xff00ff
xor ebp, eax
rol edi, 0x10
xor ebx, ebx
xor eax, eax
rol ebp, 0x10
or edi, eax
mov eax, dword [esp + 0x14]
or ebx, ebp
mov dword [esi + eax], edi
mov dword [esi + eax + 4], ebx
add esi, 8
cmp esi, dword [ecx + 4]
jne 0x4b5980
pop edi
pop ebp
pop ebx
pop esi
ret 4

Function at 0x4b5a30
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, ecx
call fcn.004abc50
mov eax, dword [esi + 0x50]
test eax, eax
je 0x4b5a54
mov ecx, dword [esi + 0x48]
add eax, eax
add eax, eax
add eax, eax
push eax
push 0
push ecx
call fcn.0045f2d0
add esp, 0xc
mov eax, dword [esi + 0x38]
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov eax, dword [esi + 0x38]
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov eax, dword [esi + 0x38]
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov eax, dword [esi + 0x38]
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov eax, dword [esi + 0x38]
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov eax, dword [esi + 0x38]
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov eax, dword [esi + 0x38]
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov esi, dword [esi + 0x38]
mov dword [esi + 0x38], 0xbefa4fa4
mov dword [esi + 0x3c], 0x47b5481d
pop esi
ret

Function at 0x4b5ae0
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
call fcn.004abc50
mov eax, dword [esi + 0x50]
test eax, eax
je 0x4b5b04
mov ecx, dword [esi + 0x48]
add eax, eax
add eax, eax
add eax, eax
push eax
push 0
push ecx
call fcn.0045f2d0
add esp, 0xc
mov eax, dword [esi + 0x38]
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov eax, dword [esi + 0x38]
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov eax, dword [esi + 0x38]
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov eax, dword [esi + 0x38]
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov eax, dword [esi + 0x38]
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov eax, dword [esi + 0x38]
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov eax, dword [esi + 0x38]
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov esi, dword [esi + 0x38]
mov dword [esi + 0x38], 0x137e2179
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
ret
Function at 0x4b6da0
Capabilities:
Encode data using xor

Disassembly:
push esi
xor esi, esi
cmp dword [ecx + 4], esi
je 0x4b6e23
push ebx
push ebp
push edi
jmp 0x4b6db0
mov edi, dword [ecx + 0x48]
mov edx, esi
shr edx, 3
mov eax, dword [edi + edx*8]
mov edx, dword [edi + edx*8 + 4]
mov ebx, eax
mov ebp, edx
shrd ebx, ebp, 0x18
shr ebp, 0x18
mov edi, edx
shr edi, 8
xor edi, ebx
mov ebx, eax
mov ebp, edx
shrd ebx, ebp, 0x18
shr ebp, 0x18
mov ebp, eax
shrd ebp, edx, 8
shr edx, 8
mov edx, eax
shl edx, 8
and edi, 0xff00ff
xor ebp, edx
xor edi, ebx
shl eax, 8
and ebp, 0xff00ff
xor ebp, eax
rol edi, 0x10
xor ebx, ebx
xor eax, eax
rol ebp, 0x10
or edi, eax
mov eax, dword [esp + 0x14]
or ebx, ebp
mov dword [esi + eax], edi
mov dword [esi + eax + 4], ebx
add esi, 8
cmp esi, dword [ecx + 4]
jne 0x4b6db0
pop edi
pop ebp
pop ebx
pop esi
ret 4
Function at 0x4b7310
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4e626b
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x53450c]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x1c], ebx
xor ebp, ebp
xor edi, edi
xor esi, esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], ebp
mov eax, dword [ebx + 0x10]
sub eax, dword [ebx + 0xc]
mov dword [esp + 0x38], ebp
mov dword [esp + 0x18], ebp
test eax, 0xfffffffc
je 0x4b7472
mov ecx, dword [ebx + 0xc]
mov edx, dword [esp + 0x18]
mov ecx, dword [ecx + edx*4]
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
cmp eax, esi
jae 0x4b73f4
mov ecx, eax
cmp edi, ecx
ja 0x4b73f4
mov ebx, eax
sub ebx, edi
sar ebx, 2
cmp esi, ebp
jne 0x4b73e5
mov eax, esi
sub eax, edi
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x4b74c7
mov ecx, ebp
sub ecx, edi
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x4b73e5
mov edx, ecx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, ecx
jae 0x4b73c7
xor ecx, ecx
jmp 0x4b73c9
add ecx, edx
cmp ecx, eax
jae 0x4b73cf
mov ecx, eax
push ecx
lea ecx, [esp + 0x24]
call fcn.0047c2c0
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
test esi, esi
je 0x4b73ee
mov edx, dword [edi + ebx*4]
mov dword [esi], edx
mov ebx, dword [esp + 0x1c]
jmp 0x4b7451
cmp esi, ebp
jne 0x4b7447
mov eax, esi
sub eax, edi
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x4b74c7
mov ecx, ebp
sub ecx, edi
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x4b7447
mov edx, ecx
shr edx, 1
mov esi, 0x3fffffff
sub esi, edx
cmp esi, ecx
jae 0x4b7429
xor ecx, ecx
jmp 0x4b742b
add ecx, edx
cmp ecx, eax
jae 0x4b7431
mov ecx, eax
push ecx
lea ecx, [esp + 0x24]
call fcn.0047c2c0
mov ebp, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
test esi, esi
je 0x4b7451
mov eax, dword [esp + 0x14]
mov dword [esi], eax
mov ecx, dword [ebx + 0x10]
sub ecx, dword [ebx + 0xc]
mov eax, dword [esp + 0x18]
inc eax
add esi, 4
sar ecx, 2
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], eax
cmp eax, ecx
jne 0x4b7368
push 0x1c
call fcn.0045ec94
mov ebx, eax
add esp, 4
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x38], 1
test ebx, ebx
je 0x4b74d1
sub esi, edi
sar esi, 2
xor ecx, ecx
xor eax, eax
test esi, esi
je 0x4b74a3
mov edx, dword [edi + eax*4]
add ecx, dword [edx + 4]
inc eax
cmp eax, esi
jne 0x4b7498
mov dword [ebx + 4], ecx
mov dword [ebx + 8], 0
lea eax, [esp + 0x20]
push eax
lea ecx, [ebx + 0xc]
mov byte [esp + 0x3c], 2
mov dword [ebx], vtable.Botan::Parallel.0
call fcn.004b7060
jmp 0x4b74d3
push 0x518740
call fcn.0044e46b
xor ebx, ebx
test edi, edi
je 0x4b74e0
push edi
call fcn.0045e266
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret