joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43cb00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], edx
test eax, eax
je 0x43cba6
mov eax, dword [sym.imp.msvcrt.dll__errno]
lea ebx, [ebp - 0x2c]
mov dword [ebp - 0x48], eax
nop
lea esi, [esi]
mov eax, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov edi, eax
mov esi, edx
mov eax, dword [ebp + 8]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 0x10], 0
mov dword [ebp - 0x24], edi
mov dword [esp], eax
mov dword [ebp - 0x20], esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
lea edx, [ebp - 0x30]
mov ecx, dword [ebp + 0x10]
mov dword [esp + 0xc], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 0x10], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x43cbd0
mov ecx, dword [ebp - 0x30]
cmp ecx, 0xffffffff
je 0x43cbb3
test ecx, ecx
jle 0x43cbc4
mov eax, ecx
cdq
add dword [ebp + 0xc], ecx
add dword [ebp - 0x40], ecx
adc dword [ebp - 0x3c], edx
sub dword [ebp + 0x10], ecx
jne 0x43cb30
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [sym.imp.msvcrt.dll__errno]
call edx
cmp dword [eax], 4
je 0x43cb3a
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
call eax
mov edx, dword [ebp - 0x44]
mov dword [eax], 5
jmp 0x43cbb9
Function at 0x4507e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], edi
mov dword [esp], eax
call dbg.AES_set_encrypt_key
test eax, eax
js 0x4509fe
mov edx, dword [edi + 0xf0]
mov eax, edi
lea ebp, [edx*4]
test ebp, ebp
jle 0x450879
shl edx, 4
mov ecx, edi
add edx, edi
xor ebx, ebx
mov dword [esp + 0xc], edi
nop
lea esi, [esi]
mov esi, dword [ecx]
add ebx, 4
add ecx, 0x10
mov eax, dword [edx]
sub edx, 0x10
mov dword [ecx - 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [edx + 0x10], esi
mov esi, dword [ecx - 0xc]
mov dword [ecx - 0xc], eax
mov eax, dword [edx + 0x18]
mov dword [edx + 0x14], esi
mov esi, dword [ecx - 8]
mov dword [ecx - 8], eax
mov eax, dword [edx + 0x1c]
mov dword [edx + 0x18], esi
mov esi, dword [ecx - 4]
mov dword [ecx - 4], eax
mov dword [edx + 0x1c], esi
mov esi, ebp
sub esi, ebx
cmp ebx, esi
jl 0x450830
mov eax, dword [esp + 0xc]
mov edx, dword [edi + 0xf0]
mov ecx, 1
cmp edx, 1
mov ebp, ecx
jle 0x4509fc
lea esi, [esi]
add eax, 0x10
mov ebx, dword [eax]
add ebp, 1
movzx edx, bl
mov esi, ebx
movzx edx, byte [edx*4 + 0x577980]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x577980]
mov edx, dword [edx*4 + 0x576180]
xor edx, dword [esi*4 + 0x576d80]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x577980]
movzx esi, cl
movzx esi, byte [esi*4 + 0x577980]
xor edx, dword [esi*4 + 0x576980]
xor edx, dword [ebx*4 + 0x576580]
mov ebx, dword [eax + 4]
mov dword [eax], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x577980]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x577980]
mov edx, dword [edx*4 + 0x576180]
xor edx, dword [esi*4 + 0x576d80]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x577980]
movzx esi, cl
movzx esi, byte [esi*4 + 0x577980]
xor edx, dword [esi*4 + 0x576980]
xor edx, dword [ebx*4 + 0x576580]
mov ebx, dword [eax + 8]
mov dword [eax + 4], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x577980]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x577980]
mov edx, dword [edx*4 + 0x576180]
xor edx, dword [esi*4 + 0x576d80]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x577980]
movzx esi, cl
movzx esi, byte [esi*4 + 0x577980]
xor edx, dword [esi*4 + 0x576980]
xor edx, dword [ebx*4 + 0x576580]
mov ebx, dword [eax + 0xc]
mov dword [eax + 8], edx
mov esi, ebx
movzx edx, bl
movzx edx, byte [edx*4 + 0x577980]
shr esi, 0x18
movzx esi, byte [esi*4 + 0x577980]
mov edx, dword [edx*4 + 0x576180]
xor edx, dword [esi*4 + 0x576d80]
mov esi, ebx
shr esi, 0x10
movzx ebx, bh
mov ecx, esi
movzx ebx, byte [ebx*4 + 0x577980]
movzx esi, cl
movzx esi, byte [esi*4 + 0x577980]
xor edx, dword [esi*4 + 0x576980]
xor edx, dword [ebx*4 + 0x576580]
mov dword [eax + 0xc], edx
cmp dword [edi + 0xf0], ebp
jg 0x450890
xor eax, eax
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x450b00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x60]
mov ebx, dword [esp + 0x54]
sub eax, 8
cmp eax, 0x7fffffef
ja 0x450c1a
test byte [esp + 0x60], 7
jne 0x450c1a
test ebx, ebx
mov eax, 0x576020
cmove ebx, eax
mov eax, dword [esp + 0x58]
lea edi, [esp + 0x20]
add eax, 8
mov edx, eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x60]
mov dword [esp], edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 4], eax
call sym._memmove
mov eax, dword [ebx]
mov dword [esp + 0x14], 1
mov dword [esp + 0x1c], 6
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 4]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x60]
shr eax, 3
mov dword [esp + 0x10], eax
mov ebp, dword [esp + 0x18]
mov esi, 1
mov ebx, dword [esp + 0x14]
mov ecx, dword [ebp]
add esi, 1
add ebp, 8
mov eax, dword [esp + 0x50]
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp - 4]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], edi
mov dword [esp + 0x2c], ecx
call dbg.AES_encrypt
mov ecx, ebx
shr ecx, 8
xor byte [esp + 0x26], cl
mov ecx, ebx
shr ecx, 0x10
xor byte [esp + 0x25], cl
mov ecx, ebx
shr ecx, 0x18
xor byte [esp + 0x24], cl
mov ecx, dword [esp + 0x28]
xor byte [esp + 0x27], bl
add ebx, 1
mov dword [ebp - 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [ebp - 4], ecx
cmp dword [esp + 0x10], esi
jae 0x450b90
mov eax, dword [esp + 0x10]
add dword [esp + 0x14], eax
sub dword [esp + 0x1c], 1
jne 0x450b83
mov eax, dword [edi]
mov edx, dword [esp + 0x58]
mov dword [edx], eax
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
mov eax, dword [esp + 0x60]
add eax, 8
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, 0xffffffff
jmp 0x450c12
Function at 0x450c30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov esi, dword [esp + 0x60]
mov ebx, dword [esp + 0x58]
mov eax, dword [esp + 0x5c]
lea edx, [esi - 0x10]
cmp edx, 0x7fffffef
ja 0x450d63
test esi, 7
jne 0x450d63
mov edx, dword [esp + 0x54]
lea ecx, [esi - 8]
mov dword [esp + 0x1c], ecx
lea ebp, [esp + 0x20]
test edx, edx
mov edx, 0x576020
cmovne edx, dword [esp + 0x54]
add eax, 8
shr esi, 3
mov dword [esp + 0x54], edx
mov edx, dword [eax - 8]
mov dword [esp + 0x20], edx
mov edx, dword [eax - 4]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp], ebx
mov dword [esp + 0x24], edx
call sym._memmove
lea eax, [esi - 1]
mov dword [esp + 0xc], eax
lea eax, [esi + esi*2]
lea eax, [eax + eax - 6]
mov dword [esp + 0x10], eax
lea eax, [ebx + esi*8 - 0x10]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 6
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0xc]
nop
mov edx, edi
mov eax, edi
shr edx, 8
sub esi, 8
xor byte [esp + 0x26], dl
mov edx, edi
shr edx, 0x10
xor byte [esp + 0x25], dl
mov edx, edi
shr edx, 0x18
sub edi, 1
xor byte [esp + 0x24], dl
mov edx, dword [esi + 8]
xor byte [esp + 0x27], al
mov eax, dword [esp + 0x50]
mov dword [esp + 0x28], edx
mov edx, dword [esi + 0xc]
mov dword [esp + 4], ebp
mov dword [esp + 8], eax
mov dword [esp], ebp
mov dword [esp + 0x2c], edx
call dbg.AES_decrypt
mov edx, dword [esp + 0x28]
mov dword [esi + 8], edx
mov edx, dword [esp + 0x2c]
mov dword [esi + 0xc], edx
sub ebx, 1
jne 0x450cd0
mov eax, dword [esp + 0xc]
sub dword [esp + 0x10], eax
sub dword [esp + 0x14], 1
jne 0x450cc3
mov eax, dword [esp + 0x54]
mov dword [esp + 8], 8
mov dword [esp], ebp
mov dword [esp + 4], eax
call dbg.CRYPTO_memcmp
test eax, eax
jne 0x450d63
mov eax, dword [esp + 0x1c]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x3c
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x450d70
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
cmp dword [esp + 0x10], 1
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
je 0x450d94
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
jmp dbg.AES_decrypt
jmp dbg.AES_encrypt
Function at 0x4537d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebp, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov ebx, dword [ebp + 4]
mov ecx, dword [eax + 4]
cmp ebx, ecx
jge 0x453836
mov esi, dword [eax]
mov edx, ebx
xor eax, eax
lea esi, [esi]
or eax, dword [esi + edx*4]
add edx, 1
cmp edx, ecx
jne 0x4537f0
cmp ecx, ebx
cmovle ebx, ecx
test ebx, ebx
jle 0x45381f
mov edi, dword [esp + 0x18]
xor edx, edx
mov esi, dword [ebp]
mov edi, dword [edi]
nop
mov ecx, dword [edi + edx*4]
xor ecx, dword [esi + edx*4]
add edx, 1
or eax, ecx
cmp edx, ebx
jne 0x453810
mov edi, dword [esp + 0x18]
pop ebx
pop esi
mov edx, dword [edi + 0xc]
xor edx, dword [ebp + 0xc]
pop edi
pop ebp
or eax, edx
sete al
movzx eax, al
ret
jle 0x45384e
mov eax, dword [ebp]
lea edx, [eax + ecx*4]
lea esi, [eax + ebx*4]
xor eax, eax
or eax, dword [edx]
add edx, 4
cmp edx, esi
jne 0x453843
jmp 0x4537fa
xor eax, eax
jmp 0x4537fa

Function at 0x453860
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x453878
cmp dword [ecx + 0xc], 0
je 0x453885
pop ebx
ret
mov eax, dword [ecx + 0xc]
test eax, eax
je 0x4538a0
mov eax, ebx
mov ebx, ecx
mov ecx, eax
mov eax, dword [ecx + 4]
mov edx, dword [ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [ebx]
mov ecx, dword [ecx]
pop ebx
jmp dbg.bn_less_than_words_impl
mov eax, 1
pop ebx
ret

Function at 0x456950
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x44
mov eax, dword [esp + 0x58]
mov dword [esp + 0x34], esi
mov edx, dword [eax]
cmp dword [eax + 4], 1
mov ebx, dword [edx]
mov dword [esp + 0x30], ebx
jle 0x45697a
mov eax, dword [edx + 4]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], eax
xor eax, eax
xor edx, edx
mov dword [esp + 0x3c], 0x40
mov esi, 1
xor edi, edi
mov ecx, eax
mov ebx, edx
mov eax, esi
and eax, 1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ecx
neg eax
mov dword [esp], eax
mov eax, dword [esp + 0x30]
adc edx, 0
mov ebp, dword [esp]
neg edx
mov dword [esp + 4], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x20], 0
and ebp, eax
mov eax, dword [esp + 4]
mov ebx, ebp
and ebp, esi
xor ebx, esi
mov dword [esp + 0x18], ebx
and eax, edx
mov edx, dword [esp + 0x18]
mov ebx, eax
and eax, edi
xor ebx, edi
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0x2c]
mov dword [esp + 8], ebp
shrd edx, ecx, 1
shr ecx, 1
mov esi, edx
mov edi, ecx
mov ecx, dword [esp + 0x28]
add esi, dword [esp + 8]
adc edi, dword [esp + 0xc]
and eax, 0x80000000
mov dword [esp + 0x24], eax
shrd ecx, ebx, 1
shr ebx, 1
add ecx, dword [esp + 0x20]
adc ebx, dword [esp + 0x24]
sub dword [esp + 0x3c], 1
jne 0x456991
add esp, 0x44
mov edx, ebx
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x465e50
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [esp + 0x14c]
mov esi, dword [esp + 0x140]
mov ebp, dword [esp + 0x148]
test ebx, ebx
je 0x46601d
cmp ebx, dword [esi]
je 0x46601f
cmp ebp, dword [ebx + 0x18]
ja 0x465f8f
test ebp, ebp
lea edi, [esp + 0xa0]
jne 0x466001
mov dword [esp + 0x1c], ebp
cmp ebp, 0x80
je 0x465ec0
mov eax, pe_nt_image_headers32
sub eax, ebp
add ebp, edi
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], ebp
call sym._memset
xor eax, eax
movzx ecx, byte [edi + eax]
xor ecx, 0x36
mov byte [esp + eax + 0x20], cl
add eax, 1
cmp eax, 0x80
jne 0x465ec2
mov eax, dword [esp + 0x150]
lea ebp, [esi + 0x14]
mov dword [esp + 4], ebx
mov dword [esp], ebp
mov dword [esp + 8], eax
call sym.adb.exe_EVP_DigestInit_ex
test eax, eax
jne 0x465f02
add esp, 0x12c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi + 0x14]
lea edx, [esp + 0x20]
mov ecx, dword [ebx + 0x18]
mov dword [esp + 4], edx
mov dword [esp], ebp
mov dword [esp + 8], ecx
call dword [eax + 0x10]
xor eax, eax
lea esi, [esi]
movzx ecx, byte [edi + eax]
xor ecx, 0x5c
mov byte [esp + eax + 0x20], cl
add eax, 1
cmp eax, 0x80
jne 0x465f20
mov eax, dword [esp + 0x150]
lea edi, [esi + 0x24]
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 8], eax
call sym.adb.exe_EVP_DigestInit_ex
test eax, eax
je 0x465ef5
mov eax, dword [esi + 0x24]
lea edx, [esp + 0x20]
mov ecx, dword [ebx + 0x18]
mov dword [esp + 4], edx
mov dword [esp], edi
mov dword [esp + 8], ecx
call dword [eax + 0x10]
mov dword [esi], ebx
add esi, 4
mov dword [esp + 4], ebp
mov dword [esp], esi
call dbg.EVP_MD_CTX_copy_ex
test eax, eax
setne al
add esp, 0x12c
pop ebx
movzx eax, al
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x150]
lea ecx, [esi + 4]
mov dword [esp], ecx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], eax
call sym.adb.exe_EVP_DigestInit_ex
mov ecx, dword [esp + 0xc]
test eax, eax
je 0x465ef5
mov eax, dword [esi + 4]
lea edi, [esp + 0xa0]
mov edx, dword [esp + 0x144]
mov dword [esp], ecx
mov dword [esp + 8], ebp
mov dword [esp + 4], edx
call dword [eax + 0x10]
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], ecx
call dbg.EVP_DigestFinal_ex
test eax, eax
je 0x465ef5
mov ebp, dword [esp + 0x1c]
jmp 0x465e9b
mov eax, dword [esp + 0x144]
mov dword [esp + 8], ebp
mov dword [esp], edi
mov dword [esp + 4], eax
call sym._memcpy
jmp 0x465e97
mov ebx, dword [esi]
mov eax, dword [esp + 0x144]
test eax, eax
jne 0x465e7f
lea ebp, [esi + 0x14]
jmp 0x465f6d
Function at 0x4665a0
Capabilities:
Hash data with md5

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x5c
test dl, 1
mov edi, edx
jne 0x466600
test edi, 2
jne 0x466610
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x4665d1
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x4665d9
mov byte [edi], 0
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x5b
test edi, 2
mov byte [edx], 0
je 0x4665ba
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x4665ba

Function at 0x4671b0
Capabilities:
Hash data with md5

Disassembly:
push edi
xor eax, eax
push esi
mov ecx, 0x17
push ebx
sub esp, 0x70
mov edx, dword [esp + 0x84]
lea ebx, [esp + 0x14]
mov edi, ebx
mov esi, dword [esp + 0x88]
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], 0x67452301
test edx, edx
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
je 0x467207
mov ecx, edx
mov edx, dword [esp + 0x80]
mov eax, ebx
call sym._MD4_Update.part.79
mov dword [esp + 4], ebx
mov dword [esp], esi
call dbg.MD4_Final
add esp, 0x70
mov eax, esi
pop ebx
pop esi
pop edi
ret

Function at 0x467220
Capabilities:
Hash data with md5

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x5c
test dl, 1
mov edi, edx
jne 0x467280
test edi, 2
jne 0x467290
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x467251
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x467259
mov byte [edi], 0
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x5b
test edi, 2
mov byte [edx], 0
je 0x46723a
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x46723a

Function at 0x4680b0
Capabilities:
Hash data with md5

Disassembly:
push edi
xor eax, eax
push esi
mov ecx, 0x17
push ebx
sub esp, 0x70
mov edx, dword [esp + 0x84]
lea ebx, [esp + 0x14]
mov edi, ebx
mov esi, dword [esp + 0x88]
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], 0x67452301
test edx, edx
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
je 0x468107
mov ecx, edx
mov edx, dword [esp + 0x80]
mov eax, ebx
call sym._MD5_Update.part.80
mov dword [esp + 4], ebx
mov dword [esp], esi
call dbg.MD5_Final
add esp, 0x70
mov eax, esi
pop ebx
pop esi
pop edi
ret

Function at 0x468420
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x20], 0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
jne 0x468460
mov dword [esp + 0x20], dbg.AES_decrypt
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
pop ebx
pop esi
jmp dbg.CRYPTO_cbc128_decrypt
mov dword [esp + 0x20], dbg.AES_encrypt
pop ebx
pop esi
jmp dbg.CRYPTO_cbc128_encrypt
Function at 0x468940
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x48]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov edi, dword [eax]
test edi, edi
je 0x46899b
mov eax, dword [esp + 0x38]
test eax, eax
je 0x46899b
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
jmp 0x468974
test ebp, ebp
je 0x46898f
movzx eax, byte [esi + edi]
add edx, 1
add edi, 1
xor al, byte [edx - 1]
add ecx, 1
sub ebp, 1
and edi, 0xf
mov byte [ecx - 1], al
jne 0x468970
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ebp
cmp dword [esp + 0x38], 0xf
jbe 0x468aa1
mov eax, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [esp + 0x4c]
mov edx, 1
mov eax, 0x10
sub eax, 1
movzx ecx, byte [ebx + eax]
add edx, ecx
mov byte [ebx + eax], dl
shr edx, 8
test eax, eax
jne 0x4689d3
mov edx, dword [esi + eax]
xor edx, dword [edi + eax]
mov dword [ebp + eax], edx
add eax, 4
cmp eax, 0x10
jne 0x4689e6
sub dword [esp + 0xc], 0x10
add ebp, 0x10
add edi, 0x10
cmp dword [esp + 0xc], 0xf
ja 0x4689b6
mov eax, dword [esp + 0x38]
xor edi, edi
mov ebp, dword [esp + 0x38]
sub eax, 0x10
and eax, 0xfffffff0
and ebp, 0xf
add eax, 0x10
add dword [esp + 0x34], eax
add dword [esp + 0x30], eax
test ebp, ebp
jne 0x468a3a
mov eax, dword [esp + 0x48]
mov dword [eax], edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [esp + 0x4c]
mov edx, 1
mov eax, 0x10
sub eax, 1
movzx ecx, byte [ebx + eax]
add edx, ecx
mov byte [ebx + eax], dl
shr edx, 8
test eax, eax
jne 0x468a57
mov ecx, dword [esp + 0x34]
lea ebx, [esi + edi]
mov esi, dword [esp + 0x30]
add ecx, edi
add esi, edi
lea esi, [esi]
movzx edx, byte [ebx + eax]
xor dl, byte [esi + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, ebp
jne 0x468a80
add edi, eax
mov eax, dword [esp + 0x48]
mov dword [eax], edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [esp + 0x38]
jmp 0x468a28
Function at 0x469520
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, eax
push esi
push ebx
sub esp, 0x5c
lea ebx, [esp + 0x20]
lea ebp, [eax + 0xfc]
mov esi, ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [edi + 0x108]
mov dword [esp + 4], esi
add esi, 0x10
mov dword [esp + 8], edi
mov dword [esp], ebp
bswap ecx
add ecx, 1
bswap ecx
mov dword [edi + 0x108], ecx
call dword [edi + 0xf4]
lea eax, [esp + 0x50]
cmp esi, eax
jne 0x46953d
mov esi, dword [esp + 0x1c]
xor ecx, ecx
mov edx, dword [esp + 0x18]
test esi, esi
je 0x46958e
lea esi, [esi]
movzx eax, byte [edx + ecx]
xor byte [ebx + ecx], al
add ecx, 1
cmp ecx, esi
jne 0x469580
mov dword [esp + 8], edi
mov dword [esp], ebx
mov dword [esp + 4], 0x100
call dbg.AES_set_encrypt_key
mov eax, dword [esp + 0x40]
mov dword [edi + 0xf4], dbg.AES_encrypt
mov dword [edi + 0xf8], 0
mov dword [edi + 0xfc], eax
mov eax, dword [esp + 0x44]
mov dword [ebp + 4], eax
mov eax, dword [esp + 0x48]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x4c]
mov dword [ebp + 0xc], eax
add esp, 0x5c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x469700
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebp, dword [esp + 0x40]
cmp dword [esp + 0x4c], 0xc
mov edi, dword [esp + 0x48]
mov dword [ebp], 0
mov dword [ebp + 4], 0
mov dword [ebp + 8], 0
mov dword [ebp + 0xc], 0
mov dword [ebp + 0x40], 0
mov dword [ebp + 0x44], 0
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 0
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0
mov dword [ebp + 0x38], 0
mov dword [ebp + 0x3c], 0
mov dword [ebp + 0x16c], 0
mov dword [ebp + 0x168], 0
je 0x469875
mov eax, dword [esp + 0x4c]
xor edx, edx
mov ebx, edi
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
lea eax, [ebp + 0x60]
cmp esi, 0xf
mov dword [esp + 0x14], eax
jbe 0x4697f0
mov dword [esp + 0x48], edi
mov edi, esi
mov esi, ebx
mov ebx, dword [esp + 0x14]
nop
xor eax, eax
movzx edx, byte [esi + eax]
xor byte [ebp + eax], dl
add eax, 1
cmp eax, 0x10
jne 0x4697b2
mov dword [esp + 4], ebx
sub edi, 0x10
add esi, 0x10
mov dword [esp], ebp
call dbg.gcm_gmult_4bit
cmp edi, 0xf
ja 0x4697b0
mov eax, dword [esp + 0x4c]
mov edi, dword [esp + 0x48]
and dword [esp + 0x4c], 0xf
sub eax, 0x10
and eax, 0xfffffff0
lea edi, [edi + eax + 0x10]
mov ebx, dword [esp + 0x4c]
test ebx, ebx
je 0x46981f
mov ecx, dword [esp + 0x4c]
xor eax, eax
nop
movzx edx, byte [edi + eax]
xor byte [ebp + eax], dl
add eax, 1
cmp eax, ecx
jne 0x469800
mov eax, dword [esp + 0x14]
mov dword [esp], ebp
mov dword [esp + 4], eax
call dbg.gcm_gmult_4bit
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
shld edx, eax, 3
shl eax, 3
bswap edx
bswap eax
xor dword [ebp + 0xc], eax
mov eax, dword [esp + 0x14]
xor dword [ebp + 8], edx
mov dword [esp], ebp
mov dword [esp + 4], eax
call dbg.gcm_gmult_4bit
mov ebx, dword [ebp + 0xc]
bswap ebx
add ebx, 1
bswap ebx
mov eax, dword [esp + 0x44]
mov dword [esp], ebp
mov dword [esp + 8], eax
lea eax, [ebp + 0x20]
mov dword [esp + 4], eax
call dword [ebp + 0x170]
mov dword [ebp + 0xc], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi]
mov ebx, 0x2000000
mov dword [ebp], eax
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 8]
mov byte [ebp + 0xf], 1
mov dword [ebp + 8], eax
jmp 0x469852