joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498e83
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov eax, ecx
push esi
mov dword [ebp - 4], ecx
xor esi, esi
push edi
xor ecx, ecx
xor edi, edi
jmp 0x498f24
mov al, byte [eax]
dec ebx
shl ecx, 6
cmp al, 0x41
jl 0x498eb3
cmp al, 0x5a
jg 0x498eb3
movsx eax, al
sub eax, 0x41
jmp 0x498ed1
cmp al, 0x61
jl 0x498ec3
cmp al, 0x7a
jg 0x498ec3
movsx eax, al
sub eax, 0x47
jmp 0x498ed1
cmp al, 0x30
jl 0x498ed5
cmp al, 0x39
jg 0x498ed5
movsx eax, al
add eax, 4
or ecx, eax
jmp 0x498ef1
cmp al, 0x2b
jne 0x498ede
or ecx, 0x3e
jmp 0x498ef1
cmp al, 0x2f
jne 0x498ee7
or ecx, 0x3f
jmp 0x498ef1
cmp al, 0x3d
jne 0x498f35
cmp ebx, 1
jg 0x498f35
inc edi
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
test bl, 3
jne 0x498f24
mov eax, ecx
shr eax, 0x10
inc esi
mov byte [edx], al
cmp edi, 2
je 0x498f2c
mov eax, ecx
shr eax, 8
inc esi
mov byte [edx + 1], al
cmp edi, 1
je 0x498f2c
mov eax, dword [ebp - 4]
mov byte [edx + 2], cl
add edx, 3
inc esi
xor ecx, ecx
test ebx, ebx
jg 0x498e9d
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
jmp 0x498f2e

Function at 0x49a4f0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
mov dword [ebp - 0x10], 0x8040201
push ebx
push esi
push edi
lea ebx, [eax + 0xb0]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], ebx
mov esi, ebx
mov dword [ebp - 0xc], 0x80402010
xor ecx, ecx
mov word [ebp - 8], 0x361b
mov ebx, edx
xor edx, edx
lea edi, [ecx + ebx]
mov al, byte [edi]
lea edi, [edi + 4]
mov byte [esi + edx], al
inc edx
cmp edx, 4
jl 0x49a530
inc ecx
add esi, 4
cmp ecx, 4
jl 0x49a52b
mov ebx, dword [ebp - 0x1c]
xor ecx, ecx
mov edi, dword [ebp - 0x14]
mov esi, ebx
sub esi, edi
push 4
lea edx, [edi + ecx]
pop edi
mov al, byte [esi + edx]
mov byte [edx], al
lea edx, [edx + 4]
dec edi
jne 0x49a559
mov edi, dword [ebp - 0x14]
inc ecx
cmp ecx, 4
jl 0x49a553
lea eax, [edi + 0x10]
xor esi, esi
inc esi
mov dword [ebp - 0x14], eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x18], esi
dec edi
mov dword [ebp - 0x20], edi
xor edx, edx
lea eax, [edx + 1]
and eax, 3
movzx eax, byte [ebx + eax*4 + 3]
mov al, byte [eax + 0x5e1b20]
xor byte [ebx + edx*4], al
inc edx
cmp edx, 4
jl 0x49a582
mov al, byte [edi + esi]
xor ecx, ecx
xor byte [ebx], al
inc ecx
push 4
lea edx, [ecx + ebx]
pop edi
mov al, byte [edx - 1]
xor byte [edx], al
lea edx, [edx + 4]
dec edi
jne 0x49a5aa
inc ecx
cmp ecx, 4
jl 0x49a5a4
mov esi, dword [ebp - 0x14]
xor ecx, ecx
push 4
lea edx, [ecx + ebx]
lea edi, [esi + ecx]
pop ebx
mov al, byte [edx]
lea edx, [edx + 4]
mov byte [edi], al
lea edi, [edi + 4]
dec ebx
jne 0x49a5c9
mov ebx, dword [ebp - 0x1c]
inc ecx
cmp ecx, 4
jl 0x49a5c0
mov esi, dword [ebp - 0x18]
add dword [ebp - 0x14], 0x10
inc esi
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
cmp esi, 0xb
jl 0x49a580
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
Function at 0x49a603
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0xc], ebx
xor esi, esi
lea edi, [ebx + 0xb0]
mov ebx, edx
xor ecx, ecx
lea edx, [esi + ebx]
mov al, byte [edi + ecx - 0xb0]
xor al, byte [edx]
mov byte [edi + ecx], al
inc ecx
push 4
pop eax
add edx, eax
cmp ecx, eax
jl 0x49a620
inc esi
add edi, eax
cmp esi, eax
jl 0x49a61b
mov ebx, dword [ebp - 0xc]
mov esi, 0xb0
mov dword [ebp - 0x1c], 9
lea eax, [ebx + 0x10]
mov dword [ebp - 4], eax
xor edi, edi
mov ecx, esi
xor edx, edx
add eax, ecx
mov dword [ebp - 0x18], eax
mov esi, eax
lea eax, [edx + edi]
and eax, 3
add eax, ecx
movzx eax, byte [eax + ebx]
mov al, byte [eax + 0x5e1b20]
mov byte [esi + edx], al
inc edx
cmp edx, 4
jl 0x49a65f
add ecx, 4
lea eax, [ebx + 0x10]
inc edi
cmp ecx, 0xc0
jl 0x49a656
mov edi, dword [ebp - 4]
lea ecx, [ebx + 0xb0]
push 0xfffffffffffffffe
pop edx
mov dword [ebp - 0x18], 4
lea eax, [edx + 1]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], eax
and eax, 3
add eax, 0x30
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], 4
lea esi, [ebx + eax*4]
mov eax, edx
and eax, 3
add eax, 0x30
lea eax, [ebx + eax*4]
mov dword [ebp - 8], eax
lea ebx, [ebx + 0xc0]
lea eax, [edx - 1]
and eax, 3
lea eax, [ebx + eax*4]
mov dword [ebp - 0x20], eax
mov ebx, eax
mov al, byte [ecx + 0x10]
mov dl, al
add dl, dl
test al, al
jns 0x49a6e8
xor dl, 0x1b
mov al, byte [ebx]
mov cl, al
add cl, cl
xor cl, al
test al, al
jns 0x49a6f7
xor cl, 0x1b
mov al, byte [edi]
xor al, byte [esi]
mov edi, dword [ebp - 8]
xor al, byte [edi]
mov edi, dword [ebp - 4]
xor al, cl
mov ecx, dword [ebp - 0x10]
xor al, dl
inc ebx
inc edi
inc dword [ebp - 8]
inc esi
mov dword [ebp - 4], edi
mov byte [ecx], al
inc ecx
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
jne 0x49a6da
dec dword [ebp - 0x18]
mov esi, 0xb0
mov edx, dword [ebp - 0x24]
mov ebx, dword [ebp - 0xc]
jne 0x49a69c
dec dword [ebp - 0x1c]
lea eax, [ebx + 0x10]
jne 0x49a652
xor edx, edx
mov edi, dword [ebp + 8]
lea eax, [esi - 0x10]
xor ecx, ecx
add edi, edx
add eax, ebx
mov dword [ebp - 0x24], eax
lea eax, [ecx + edx]
and eax, 3
add eax, esi
movzx eax, byte [eax + ebx]
mov ebx, dword [ebp - 0x24]
mov al, byte [eax + 0x5e1b20]
xor al, byte [ebx + ecx]
inc ecx
mov ebx, dword [ebp - 0xc]
mov byte [edi], al
lea edi, [edi + 4]
cmp ecx, 4
jl 0x49a74f
add esi, 4
inc edx
cmp esi, 0xc0
jl 0x49a740
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49a788
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], ecx
push edi
mov edi, dword [ebp + 0x10]
test ebx, ebx
je 0x49a82a
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x49a829
test edi, edi
je 0x49a829
lea edx, [ebp - 0x14]
sub ebx, edx
sub edi, edx
lea edx, [ebp - 0x14]
push edx
mov edx, eax
call fcn.0049a603
pop ecx
push 0x10
pop eax
cmp esi, eax
mov edx, esi
cmovae edx, eax
and dword [ebp - 0x1c], 0
test edx, edx
je 0x49a7f8
mov esi, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
add ecx, esi
mov al, byte [ebx + ecx]
xor al, byte [ecx]
inc esi
mov byte [edi + ecx], al
cmp esi, edx
jb 0x49a7e0
mov esi, dword [ebp + 0xc]
push 0x10
pop eax
cmp esi, edx
je 0x49a81a
sub esi, eax
add ebx, eax
add edi, eax
mov dword [ebp + 0xc], esi
mov eax, dword [ebp - 0x18]
add eax, 0xf
inc byte [eax]
jne 0x49a812
dec eax
jmp 0x49a80b
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
jmp 0x49a7bf
push eax
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00540250
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0053cd12
mov esp, ebp
pop ebp
ret

Function at 0x49a83a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, ecx
push edi
mov edi, dword [ebp + 0xc]
push 0x10
pop eax
push eax
push 0
push esi
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ebx
call fcn.00540250
mov eax, dword [ebp - 0x1c]
add esp, 0xc
cmp eax, 3
je 0x49a880
push esi
mov edx, esi
mov byte [esi + 0xf], al
mov ecx, ebx
call fcn.0049a603
pop ecx
mov ebx, dword [ebp + 8]
push 0x10
sub ebx, esi
pop eax
cmp edi, eax
mov edx, edi
cmova edx, eax
test edx, edx
je 0x49a8a1
mov ecx, esi
mov al, byte [ebx + ecx]
xor byte [ecx], al
inc ecx
dec edx
jne 0x49a895
push 0x10
pop eax
cmp edi, eax
jbe 0x49a8ba
mov ecx, dword [ebp - 0x18]
mov edx, esi
push esi
call fcn.0049a603
pop ecx
push 0x10
pop eax
sub edi, eax
add ebx, eax
jmp 0x49a888
push eax
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00540250
mov ebx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
mov edx, eax
mov ecx, ebx
call fcn.0049a603
add esp, 0x10
lea ecx, [ebp - 0x14]
call fcn.0049a4b7
cmp edi, 0x10
jae 0x49a8f2
lea ecx, [ebp - 0x14]
call fcn.0049a4b7
xor byte [esi + edi], 0x80
lea edi, [ebp - 0x14]
mov edx, esi
push 0x10
sub edi, esi
pop ecx
mov al, byte [edi + edx]
xor byte [edx], al
inc edx
dec ecx
jne 0x49a8fc
push esi
mov edx, esi
mov ecx, ebx
call fcn.0049a603
push 0x10
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00540250
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
Function at 0x49a930
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x20]
push edi
mov edi, edx
mov dword [ebp - 0x108], eax
test edi, edi
je 0x49aa34
mov edx, ecx
lea ecx, [ebp - 0x104]
call fcn.0049a4f0
lea eax, [ebp - 0x24]
xor edx, edx
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x104]
push edi
call fcn.0049a83a
lea eax, [ebp - 0x34]
xor edx, edx
push eax
push 0
push 0
inc edx
lea ecx, [ebp - 0x104]
call fcn.0049a83a
push 0x10
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.005406f0
push ebx
push dword [ebp + 0x18]
lea edx, [ebp - 0x14]
push dword [ebp - 0x108]
lea ecx, [ebp - 0x104]
call fcn.0049a788
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x18]
lea ecx, [ebp - 0x104]
push ebx
push 2
pop edx
call fcn.0049a83a
xor ebx, ebx
lea edi, [ebp - 0x24]
add esp, 0x3c
mov edx, ebx
sub edi, esi
lea ecx, [esi + edx]
mov al, byte [edi + ecx]
xor al, byte [ebp + edx - 0x14]
xor al, byte [ebp + edx - 0x34]
inc edx
mov byte [ecx], al
cmp edx, 0x10
jb 0x49a9e0
push 0xd0
lea eax, [ebp - 0x104]
push ebx
push eax
call fcn.00540250
push 0x10
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.00540250
push 0x10
lea ecx, [ebp - 0x34]
push ebx
push ecx
call fcn.00540250
push 0x10
lea ecx, [ebp - 0x14]
push ebx
push ecx
call fcn.00540250
xor eax, eax
add esp, 0x30
inc eax
jmp 0x49aa36
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053cd12
mov esp, ebp
pop ebp
ret
Function at 0x49abb9
Capabilities:
Create process on windows

Disassembly:
push 0x108
mov eax, 0x5920e2
call fcn.005692da
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x104], eax
xor eax, eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x110]
mov eax, dword [edi + 0x10]
inc eax
push eax
call fcn.00495c98
cmp dword [edi + 0x14], 0x10
jb 0x49ac08
mov esi, dword [edi]
jmp 0x49ac0a
mov esi, edi
lea eax, [ebp - 0x114]
mov ecx, edi
push eax
call fcn.00420600
push dword [ebp - 0x114]
lea ecx, [ebp - 0x110]
push dword [eax]
push esi
push dword [ebp - 0x110]
call fcn.00495ee8
lea eax, [ebp - 0xfd]
mov byte [ebp - 0xfd], 0
push eax
lea ecx, [ebp - 0x110]
call fcn.0045b290
push ebx
push dword [ebp - 0x104]
xor eax, eax
push eax
push eax
push eax
push 1
push eax
push eax
push dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x49acb6
lea eax, [ebp - 0x2c]
push eax
call fcn.0049ad6c
push edi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.00420980
pop ecx
push 0x2e
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x44]
call fcn.00408b00
push eax
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 3
call fcn.00495842
push 0x5fa010
lea eax, [ebp - 0xb4]
push eax
call fcn.005491a6
cmp dword [0x606ca0], 4
jl 0x49ad29
call fcn.004107c0
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
cmp dword [ecx + eax + 0x38], 0
je 0x49ad29
lea eax, [ebp - 0x2c]
push eax
call fcn.0049ae90
mov esi, eax
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 4
call fcn.00410a10
push 4
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.0041b8b0
mov edx, esi
mov ecx, eax
call fcn.0041b2e0
mov edx, edi
mov ecx, eax
call fcn.0041b2e0
mov dl, 0x22
mov ecx, eax
call fcn.00457410
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 4
call fcn.0041b7f0
lea ecx, [ebp - 0x2c]
call fcn.00407cb0
push 0xffffffffffffffff
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x104]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebx]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebx + 4]
call esi
mov esi, dword [ebp - 0x104]
lea ecx, [ebp - 0x110]
call fcn.0040b940
mov eax, esi
call fcn.00569289
ret 0x14
Function at 0x49af94
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [0x6119b9]
xor edx, edx
push ebx
push esi
mov esi, ecx
inc edx
test al, al
movzx ecx, al
push edi
cmove ecx, edx
mov ebx, 0xa950c4
mov byte [0x6119b9], cl
mov edi, 0x80
mov ecx, ebx
mov dword [esi], vtable.CPKCS1Server.0
mov dword [ebp - 0x8c], edi
call fcn.0044a740
mov eax, dword [0x611a00]
mov edx, eax
inc eax
mov dword [0x611a00], eax
test edx, edx
jne 0x49affb
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0xa99c60], eax
mov ecx, ebx
call fcn.0044a780
call fcn.004a2640
call fcn.004a259c
mov dword [esi + 4], eax
call fcn.004a259c
mov dword [esi + 8], eax
lea edx, [ebp - 0x88]
lea eax, [ebp - 0x8c]
mov ecx, 0xc4
push eax
call fcn.004a22d0
pop ecx
test eax, eax
jne 0x49b05e
push dword [esi + 4]
lea edx, [ebp - 0x88]
mov ecx, edi
call fcn.004a32c9
mov edx, dword [esi + 8]
pop ecx
call fcn.004a2545
push edi
lea eax, [ebp - 0x88]
push 0
push eax
call fcn.00540250
add esp, 0xc
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053cd12
mov esp, ebp
pop ebp
ret

Function at 0x49b0fa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
push ebx
push esi
push edi
push 0x6b
pop esi
xor ebx, ebx
mov dword [ebp - 0x194], ecx
xor edi, edi
mov dword [ebp - 0x18c], esi
add eax, esi
mov dword [ebp - 0x188], ebx
mov dword [ebp - 0x190], eax
mov eax, ebx
mov byte [ebp - 0x181], bl
sar eax, 0x18
lea ecx, [ebp - 0x180]
mov byte [ebp - 0x184], al
mov eax, ebx
sar eax, 0x10
mov byte [ebp - 0x183], al
mov eax, ebx
sar eax, 8
mov byte [ebp - 0x182], al
call fcn.004a3732
push 0x14
push dword [ebp - 0x190]
lea eax, [ebp - 0x180]
push eax
call fcn.0049b0d6
push 4
lea ebx, [ebp - 0x184]
pop esi
movzx edx, byte [ebx]
lea ecx, [ebp - 0x180]
call fcn.004a3769
inc ebx
dec esi
jne 0x49b186
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x180]
call fcn.004a379d
mov esi, dword [ebp - 0x18c]
mov edx, esi
mov ebx, dword [ebp - 0x188]
push 0x14
pop eax
cmp esi, eax
cmovge edx, eax
xor ecx, ecx
test edx, edx
jle 0x49b1e4
mov ebx, dword [ebp - 0x194]
mov al, byte [ebp + ecx - 0x18]
xor byte [edi + ebx], al
inc edi
inc ecx
cmp ecx, edx
jl 0x49b1c8
mov ebx, dword [ebp - 0x188]
mov esi, dword [ebp - 0x18c]
push 0x14
pop eax
sub esi, eax
inc ebx
mov dword [ebp - 0x18c], esi
mov dword [ebp - 0x188], ebx
cmp ebx, 6
jl 0x49b137
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0053cd12
mov esp, ebp
pop ebp
ret 0x18
Function at 0x49bf1f
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
push 0x10
mov eax, dword [ebx + 4]
lea esi, [ebx + 8]
shl eax, 4
lea edi, [ebx + 0xf8]
add esi, eax
push esi
push edi
call fcn.005406f0
xor eax, eax
add esp, 0xc
inc eax
add edi, 0x10
sub esi, 0x10
mov dword [ebp - 4], eax
cmp dword [ebx + 4], eax
jbe 0x49c0b6
mov edx, dword [esi]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [eax*4 + 0xa97db0]
movzx eax, byte [esi + 1]
mov ecx, dword [ecx*4 + 0xa96db0]
movzx eax, byte [eax*4 + 0xa97db0]
xor ecx, dword [eax*4 + 0xa969b0]
movzx eax, dl
movzx eax, byte [eax*4 + 0xa97db0]
xor ecx, dword [eax*4 + 0xa971b0]
movzx eax, byte [esi + 2]
movzx eax, byte [eax*4 + 0xa97db0]
xor ecx, dword [eax*4 + 0xa975b0]
mov dword [edi], ecx
mov edx, dword [esi + 4]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [eax*4 + 0xa97db0]
movzx eax, byte [esi + 5]
mov ecx, dword [ecx*4 + 0xa96db0]
movzx eax, byte [eax*4 + 0xa97db0]
xor ecx, dword [eax*4 + 0xa969b0]
movzx eax, byte [esi + 6]
movzx eax, byte [eax*4 + 0xa97db0]
xor ecx, dword [eax*4 + 0xa975b0]
movzx eax, dl
movzx eax, byte [eax*4 + 0xa97db0]
xor ecx, dword [eax*4 + 0xa971b0]
mov dword [edi + 4], ecx
mov edx, dword [esi + 8]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [eax*4 + 0xa97db0]
movzx eax, byte [esi + 9]
mov ecx, dword [ecx*4 + 0xa96db0]
movzx eax, byte [eax*4 + 0xa97db0]
xor ecx, dword [eax*4 + 0xa969b0]
movzx eax, byte [esi + 0xa]
movzx eax, byte [eax*4 + 0xa97db0]
xor ecx, dword [eax*4 + 0xa975b0]
movzx eax, dl
movzx eax, byte [eax*4 + 0xa97db0]
xor ecx, dword [eax*4 + 0xa971b0]
mov dword [edi + 8], ecx
mov edx, dword [esi + 0xc]
mov eax, edx
shr eax, 0x18
movzx ecx, byte [eax*4 + 0xa97db0]
movzx eax, byte [esi + 0xd]
mov ecx, dword [ecx*4 + 0xa96db0]
movzx eax, byte [eax*4 + 0xa97db0]
xor ecx, dword [eax*4 + 0xa969b0]
movzx eax, byte [esi + 0xe]
sub esi, 0x10
movzx eax, byte [eax*4 + 0xa97db0]
xor ecx, dword [eax*4 + 0xa975b0]
movzx eax, dl
movzx eax, byte [eax*4 + 0xa97db0]
xor ecx, dword [eax*4 + 0xa971b0]
mov eax, dword [ebp - 4]
mov dword [edi + 0xc], ecx
add edi, 0x10
inc eax
mov dword [ebp - 4], eax
cmp eax, dword [ebx + 4]
jb 0x49bf5a
push 0x10
push esi
push edi
call fcn.005406f0
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49e0b6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ebx
je 0x49e158
test ebx, ebx
je 0x49e158
test edi, edi
je 0x49e158
push esi
push 0x10
xor esi, esi
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.00540250
mov ebx, dword [ebp + 8]
add esp, 0xc
mov al, byte [esi + ebx]
mov ecx, esi
and ecx, 0xf
xor byte [ebp + ecx - 0x14], al
inc esi
cmp esi, 0x10
jb 0x49e0f7
mov ebx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
sub esi, ebx
mov dword [ebp - 0x18], 0x38
sub ebx, edi
push 0x10
lea ecx, [ebx + edi]
pop edx
mov al, byte [esi + ecx]
xor byte [ecx], al
inc ecx
dec edx
jne 0x49e120
mov edx, dword [ebp - 0x1c]
lea ecx, [ebx + edi]
push edi
push ecx
mov ecx, edx
mov eax, dword [edx]
call dword [eax + 0xc]
push 0x10
lea eax, [ebp - 0x14]
push edi
push eax
call fcn.005406f0
add esp, 0xc
sub esi, 0x10
add edi, 0x10
dec dword [ebp - 0x18]
jne 0x49e11a
xor eax, eax
inc eax
pop esi
jmp 0x49e15a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0053cd12
mov esp, ebp
pop ebp
ret 0x18

Function at 0x49e16c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x600f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], eax
push edi
mov edi, dword [ebp + 0x18]
test ebx, ebx
je 0x49e23c
test edi, edi
je 0x49e23c
test eax, eax
je 0x49e23c
push esi
push 0x10
xor esi, esi
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.00540250
add esp, 0xc
mov al, byte [ebx + esi]
mov ecx, esi
and ecx, 0xf
xor byte [ebp + ecx - 0x14], al
inc esi
cmp esi, 0x10
jb 0x49e1b7
push 0x10
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.005406f0
mov eax, ebx
mov dword [ebp - 0x1c], 0x38
sub eax, edi
add esp, 0xc
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
sub eax, edi
mov dword [ebp - 0x18], eax
lea esi, [eax + edi]
push 0x10
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.005406f0
mov ecx, dword [ebp - 0x24]
add esp, 0xc
mov eax, dword [ecx]
push edi
push esi
call dword [eax + 0x10]
mov esi, dword [ebp - 0x20]
push 0x10
pop ecx
mov al, byte [esi + edi]
xor byte [edi], al
inc edi
dec ecx
jne 0x49e210
push 0x10
lea eax, [ebp - 0x14]
push eax
push ebx
call fcn.005406f0
mov eax, dword [ebp - 0x18]
sub esi, 0x10
add esp, 0xc
mov dword [ebp - 0x20], esi
dec dword [ebp - 0x1c]
jne 0x49e1ee
xor eax, eax
inc eax
pop esi
jmp 0x49e23e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0053cd12
mov esp, ebp
pop ebp
ret 0x18
Function at 0x49f973
Capabilities:
Hash data using sha256

Disassembly:
test ecx, ecx
jne 0x49f97a
mov al, 2
ret
and dword [ecx + 0x60], 0
mov al, 1
and dword [ecx + 0x64], 0
mov dword [ecx + 0x40], 0x6a09e667
mov dword [ecx + 0x44], 0xbb67ae85
mov dword [ecx + 0x48], 0x3c6ef372
mov dword [ecx + 0x4c], 0xa54ff53a
mov dword [ecx + 0x50], 0x510e527f
mov dword [ecx + 0x54], 0x9b05688c
mov dword [ecx + 0x58], 0x1f83d9ab
mov dword [ecx + 0x5c], 0x5be0cd19
ret

Function at 0x49fa3d
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, edx
test esi, esi
jne 0x49fa4e
mov al, 2
jmp 0x49fb35
mov ecx, dword [esi + 0x64]
mov eax, ecx
shl eax, 3
add dword [esi + 0x60], eax
push ebx
mov byte [ecx + esi], 0x80
xor ebx, ebx
inc dword [esi + 0x64]
mov ecx, dword [esi + 0x64]
cmp ecx, 0x38
jbe 0x49fa88
push 0x40
pop eax
sub eax, ecx
push eax
lea eax, [ecx + esi]
push ebx
push eax
call fcn.00540250
add esp, 0xc
mov ecx, esi
call fcn.0049e86a
mov dword [esi + 0x64], ebx
mov ecx, dword [esi + 0x64]
push 0x38
pop eax
sub eax, ecx
push eax
lea eax, [ecx + esi]
push ebx
push eax
call fcn.00540250
mov dword [esi + 0x64], 0x38
add esp, 0xc
mov dword [esi + 0x38], ebx
mov ecx, esi
mov al, byte [esi + 0x63]
mov byte [esi + 0x3c], al
mov al, byte [esi + 0x62]
mov byte [esi + 0x3d], al
mov eax, dword [esi + 0x60]
shr eax, 8
mov byte [esi + 0x3e], al
mov al, byte [esi + 0x60]
mov byte [esi + 0x3f], al
call fcn.0049e86a
push 8
lea ecx, [edi + 1]
lea edx, [esi + 0x40]
pop edi
mov al, byte [edx + 3]
mov byte [ecx - 1], al
mov al, byte [edx + 2]
mov byte [ecx], al
lea ecx, [ecx + 4]
mov eax, dword [edx]
shr eax, 8
mov byte [ecx - 3], al
mov al, byte [edx]
lea edx, [edx + 4]
mov byte [ecx - 2], al
dec edi
jne 0x49fad3
and dword [esi + 0x60], ebx
mov al, 1
and dword [esi + 0x64], ebx
mov dword [esi + 0x40], 0x6a09e667
mov dword [esi + 0x44], 0xbb67ae85
mov dword [esi + 0x48], 0x3c6ef372
mov dword [esi + 0x4c], 0xa54ff53a
mov dword [esi + 0x50], 0x510e527f
mov dword [esi + 0x54], 0x9b05688c
mov dword [esi + 0x58], 0x1f83d9ab
mov dword [esi + 0x5c], 0x5be0cd19
pop ebx
pop edi
pop esi
ret