joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41abce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x530
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
lea ebx, [esi + 0x49c]
push ebx
call fcn.0046ce10
mov edi, eax
pop ecx
cmp edi, 0x20
jl 0x41abf4
push 0x20
pop edi
push edi
lea eax, [ebp - 0x50]
push ebx
push eax
call fcn.0046d560
push 0x20
mov ebx, 0x50c5ac
pop eax
sub eax, edi
push eax
lea eax, [ebp + edi - 0x50]
push ebx
push eax
call fcn.0046d560
lea eax, [ebp - 0xe8]
push eax
call fcn.0042d760
lea eax, [ebp - 0x50]
push 0x20
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0042d788
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.0042e113
add esp, 0x30
cmp dword [esi + 0x4e0], 0x10
jne 0x41ac8f
push 0x32
pop edi
lea eax, [ebp - 0xe8]
push eax
call fcn.0042d760
lea eax, [ebp - 0x90]
push 0x10
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0042d788
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.0042e113
add esp, 0x18
dec edi
jne 0x41ac55
lea ecx, [ebp - 0x90]
lea eax, [esi + 0x524]
push 0x20
push ecx
push eax
mov dword [ebp + 8], eax
call fcn.0046d560
lea eax, [esi + 0x4bc]
push eax
call fcn.0046ce10
mov edi, eax
add esp, 0x10
cmp edi, 0x20
jl 0x41acc0
push 0x20
pop edi
lea eax, [esi + 0x4bc]
push edi
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0046d560
push 0x20
pop eax
sub eax, edi
push eax
lea eax, [ebp + edi - 0x50]
push ebx
push eax
call fcn.0046d560
push dword [ebp + 8]
lea eax, [ebp - 0x530]
push dword [esi + 0x4e0]
push eax
call fcn.0042cfc3
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x530]
push 0x20
push eax
call fcn.0042d0c3
add esp, 0x34
cmp dword [esi + 0x4e0], 0x10
jne 0x41ad73
push 1
pop ebx
mov edi, dword [esi + 0x4e0]
xor eax, eax
test edi, edi
jle 0x41ad3d
mov cl, byte [ebp + eax - 0x90]
xor cl, bl
mov byte [ebp + eax - 0x10], cl
inc eax
cmp eax, edi
jl 0x41ad2b
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x530]
push edi
push eax
call fcn.0042cfc3
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x530]
push 0x20
push eax
call fcn.0042d0c3
add esp, 0x1c
inc ebx
cmp ebx, 0x13
jle 0x41ad1f
lea eax, [ebp - 0x128]
push 0x20
push eax
push dword [ebp + 8]
call fcn.0046d560
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41b085
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x41b240
cmp byte [edi], 0
je 0x41b240
cmp dword [ebp + 0x18], 0
je 0x41b240
push ebx
push esi
push edi
call fcn.0046ce10
pop ecx
mov esi, eax
push 0x20
pop ebx
cmp esi, ebx
jge 0x41b0e3
push esi
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.0046d560
mov eax, ebx
sub eax, esi
push eax
lea eax, [ebp + esi - 0x24]
push 0x50c5ac
push eax
call fcn.0046d560
add esp, 0x18
jmp 0x41b0f1
push ebx
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.0046d560
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x24]
push ebx
push eax
call fcn.0041b30f
add esp, 0xc
cmp dword [ebp + 0x10], 3
jne 0x41b120
push 0x32
pop esi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x24]
push 0x10
push eax
call fcn.0041b30f
add esp, 0xc
dec esi
jne 0x41b10b
cmp dword [ebp + 0x10], 2
jne 0x41b17a
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x24]
push dword [ebp + 0xc]
push eax
call fcn.0041b245
mov ebx, dword [ebp + 0x18]
and byte [ebp + 0x17], 0
and byte [ebp - 1], 0
lea eax, [ebp - 0x44]
add esp, 0xc
xor edi, edi
sub ebx, eax
lea esi, [ebp + edi - 0x44]
mov al, byte [ebx + esi]
push eax
lea eax, [ebp + 0x17]
push eax
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 0x154]
push eax
call fcn.0041b2b1
add esp, 0x10
inc edi
cmp edi, 0x20
mov byte [esi], al
jl 0x41b14e
push 0x20
pop ebx
jmp 0x41b1f5
push ebx
lea eax, [ebp - 0x44]
push dword [ebp + 0x18]
push eax
call fcn.0046d560
add esp, 0xc
mov dword [ebp + 0x18], 0x13
xor eax, eax
cmp dword [ebp + 0xc], eax
jle 0x41b1a9
mov cl, byte [ebp + eax - 0x24]
xor cl, byte [ebp + 0x18]
inc eax
cmp eax, dword [ebp + 0xc]
mov byte [ebp + eax - 0x55], cl
jl 0x41b198
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x54]
push dword [ebp + 0xc]
push eax
call fcn.0041b245
and byte [ebp + 0x17], 0
and byte [ebp - 1], 0
add esp, 0xc
xor edi, edi
mov al, byte [ebp + edi - 0x44]
lea esi, [ebp + edi - 0x44]
push eax
lea eax, [ebp + 0x17]
push eax
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 0x154]
push eax
call fcn.0041b2b1
add esp, 0x10
inc edi
cmp edi, ebx
mov byte [esi], al
jl 0x41b1c9
dec dword [ebp + 0x18]
jns 0x41b191
mov edi, dword [ebp + 0x1c]
lea eax, [ebp - 0x44]
push ebx
push eax
push edi
call fcn.0046d560
add esp, 0xc
xor esi, esi
mov eax, ebx
sub eax, esi
push eax
lea eax, [esi + edi]
push 0x50c5ac
push eax
call fcn.0046ec80
add esp, 0xc
test eax, eax
je 0x41b229
inc esi
cmp esi, ebx
jl 0x41b208
jmp 0x41b239
sub ebx, esi
add esi, edi
push ebx
push 0
push esi
call fcn.0046ca50
add esp, 0xc
push 1
pop eax
pop esi
pop ebx
jmp 0x41b242
xor eax, eax
pop edi
leave
ret
Function at 0x41de65
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov eax, 0x48c8bc
call fcn.0046e054
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0041c708
mov eax, dword [ebp + 0xc]
push 1
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x18]
pop ecx
xor edi, edi
cmp eax, ecx
mov dword [ebp - 4], edi
mov dword [esi], 0x4901c0
mov dword [esi + 0x18], eax
jl 0x41deb2
mov ecx, Ordinal_1
cmp eax, ecx
jle 0x41deb5
mov dword [esi + 0x18], ecx
mov eax, dword [ebp + 0x1c]
push 4
mov dword [esi + 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x18]
inc eax
push eax
call fcn.004222bc
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x18]
inc eax
push 4
inc eax
push eax
call fcn.004222bc
mov dword [esi + 0x40], eax
add esp, 0x10
xor eax, eax
cmp dword [esi + 0xc], edi
mov ecx, dword [esi + 0x18]
mov dword [esi + 0x28], edi
setl al
mov dword [esi + 0x2c], eax
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x30], edi
mov dword [esi + 0x38], edi
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
or dword [esi + 0x50], 0xffffffff
mov dword [esi + 0x44], edi
mov dword [esi + 0x4c], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0x20
Function at 0x429334
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 4]
push esi
xor eax, eax
mov esi, dword [edx + 4]
mov edx, dword [edx]
test edx, edx
jle 0x429359
push edi
mov edi, edx
mov dl, byte [esi]
imul eax, eax, 0x11
and edx, 0xff
add eax, edx
inc esi
dec edi
jne 0x429347
pop edi
xor edx, edx
pop esi
div dword [ecx + 4]
mov eax, edx
ret 4

Function at 0x42c86b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x20]
mov ecx, dword [esi + 0x60]
mov eax, dword [esi + 0x30]
mov edx, dword [esi + 0x68]
sub eax, ecx
sub eax, edx
mov dword [ebp + 8], eax
jne 0x42c895
test ecx, ecx
jne 0x42c89f
test edx, edx
jne 0x42c89f
mov eax, edi
jmp 0x42c90b
cmp eax, 0xffffffff
jne 0x42c89f
push 0xfffffffffffffffe
pop eax
jmp 0x42c90b
mov edx, dword [esi + 0x20]
lea edx, [edi + edx - 0x106]
cmp ecx, edx
jb 0x42c90b
mov eax, dword [esi + 0x2c]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.0046d560
mov ecx, dword [esi + 0x40]
mov eax, dword [esi + 0x38]
sub dword [esi + 0x64], edi
sub dword [esi + 0x60], edi
add esp, 0xc
sub dword [esi + 0x50], edi
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx edx, word [eax]
mov ebx, edx
sub ebx, edi
cmp edx, edi
sbb edx, edx
not edx
and edx, ebx
dec ecx
mov word [eax], dx
jne 0x42c8d0
mov eax, dword [esi + 0x34]
mov edx, edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov ebx, ecx
sub ebx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, ebx
dec edx
mov word [eax], cx
jne 0x42c8ef
mov eax, dword [ebp + 8]
add eax, edi
mov ecx, dword [esi]
cmp dword [ecx + 4], 0
je 0x42c966
push eax
mov eax, dword [esi + 0x68]
add eax, dword [esi + 0x60]
add eax, dword [esi + 0x2c]
push eax
push ecx
call fcn.0042c96b
add dword [esi + 0x68], eax
mov ebx, dword [esi + 0x68]
add esp, 0xc
cmp ebx, 3
jb 0x42c952
mov eax, dword [esi + 0x60]
mov ecx, dword [esi + 0x2c]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x4c]
movzx eax, byte [edx]
mov dword [esi + 0x3c], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x48]
mov dword [esi + 0x3c], eax
cmp ebx, 0x106
jae 0x42c966
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x42c877
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42d760
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x43d138
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x10], 4
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0x18
mov byte [ebp - 0xc], cl
mov ecx, eax
shr eax, 8
mov byte [ebp - 4], al
mov al, byte [esi]
mov byte [ebp + 8], al
push dword [ebp + 8]
shr ecx, 0x10
mov byte [ebp - 8], cl
call fcn.0043d255
push dword [ebp - 4]
movzx edi, al
call fcn.0043d2bc
push dword [ebp - 8]
movzx eax, al
xor edi, eax
call fcn.0043d285
push dword [ebp - 0xc]
movzx eax, al
xor edi, eax
call fcn.0043d2f3
push dword [ebp + 8]
movzx eax, al
xor edi, eax
shl edi, 8
call fcn.0043d2bc
push dword [ebp - 4]
movzx ebx, al
call fcn.0043d285
push dword [ebp - 8]
movzx eax, al
xor ebx, eax
call fcn.0043d2f3
push dword [ebp - 0xc]
movzx eax, al
xor ebx, eax
call fcn.0043d255
push dword [ebp + 8]
movzx eax, al
xor ebx, eax
or edi, ebx
shl edi, 8
call fcn.0043d285
push dword [ebp - 4]
movzx ebx, al
call fcn.0043d2f3
push dword [ebp - 8]
movzx eax, al
xor ebx, eax
call fcn.0043d255
push dword [ebp - 0xc]
movzx eax, al
xor ebx, eax
call fcn.0043d2bc
push dword [ebp + 8]
movzx eax, al
xor ebx, eax
or edi, ebx
shl edi, 8
call fcn.0043d2f3
push dword [ebp - 4]
movzx ebx, al
call fcn.0043d255
push dword [ebp - 8]
movzx eax, al
xor ebx, eax
call fcn.0043d2bc
push dword [ebp - 0xc]
movzx eax, al
xor ebx, eax
call fcn.0043d285
movzx eax, al
xor ebx, eax
add esp, 0x40
or edi, ebx
mov dword [esi], edi
add esi, 4
dec dword [ebp - 0x10]
jne 0x43d14b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43d32a
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0xffffff4c
lea esi, [ecx + 2]
sub ebx, edi
lea eax, [edi + 0xb4]
lea ecx, [edi + 0xc1]
mov dl, byte [ecx - 1]
xor dl, byte [esi - 2]
mov byte [eax - 4], dl
mov dl, byte [esi - 1]
xor dl, byte [ecx]
add ecx, 4
mov byte [eax], dl
mov dl, byte [ecx - 3]
xor dl, byte [esi]
add esi, 4
mov byte [eax + 4], dl
mov dl, byte [ecx - 2]
xor dl, byte [esi - 3]
inc eax
mov byte [eax + 7], dl
lea edx, [ebx + eax]
cmp edx, 4
jl 0x43d34c
lea esi, [edi + 0xb0]
push edi
push esi
call fcn.0043d560
pop ecx
lea eax, [edi + 0x10]
pop ecx
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], 9
xor eax, eax
movzx ecx, byte [eax + esi]
mov cl, byte [ecx + 0x521858]
mov byte [eax + esi], cl
inc eax
cmp eax, 0x10
jl 0x43d39a
push esi
call fcn.0043d438
push esi
call fcn.0043d485
push dword [ebp + 8]
push esi
call fcn.0043d560
add dword [ebp + 8], 0x10
add esp, 0x10
dec dword [ebp + 0xc]
jne 0x43d398
xor eax, eax
movzx ecx, byte [eax + esi]
mov cl, byte [ecx + 0x521858]
mov byte [eax + esi], cl
inc eax
cmp eax, 0x10
jl 0x43d3d0
push esi
call fcn.0043d438
lea eax, [edi + 0xa0]
push eax
push esi
call fcn.0043d560
add esp, 0xc
lea ecx, [edi + 0xb4]
lea eax, [edi + 0xd0]
mov dl, byte [ecx - 4]
mov byte [eax - 0x10], dl
mov byte [eax], dl
mov dl, byte [ecx]
inc ecx
mov byte [eax - 0xf], dl
mov byte [eax + 1], dl
mov dl, byte [ecx + 3]
mov byte [eax - 0xe], dl
mov byte [eax + 2], dl
mov dl, byte [ecx + 7]
mov byte [eax - 0xd], dl
mov byte [eax + 3], dl
lea edx, [ecx + ebx]
add eax, 4
cmp edx, 4
jl 0x43d405
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x43d485
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xfffffffffffffffc
lea esi, [eax + 4]
pop edi
sub edi, eax
mov al, byte [esi - 4]
mov byte [ebp - 4], al
mov al, byte [esi]
mov byte [ebp - 0xc], al
mov al, byte [esi + 4]
push dword [ebp - 0xc]
mov byte [ebp - 8], al
mov al, byte [esi + 8]
mov byte [ebp + 8], al
call fcn.0043d548
push dword [ebp - 4]
mov bl, al
call fcn.0043d538
push dword [ebp - 8]
xor bl, al
xor bl, byte [ebp + 8]
xor bl, byte [ebp - 8]
mov byte [esi - 4], bl
call fcn.0043d548
push dword [ebp - 0xc]
mov bl, al
call fcn.0043d538
push dword [ebp + 8]
xor bl, al
xor bl, byte [ebp + 8]
xor bl, byte [ebp - 4]
mov byte [esi], bl
call fcn.0043d548
push dword [ebp - 8]
mov bl, al
call fcn.0043d538
push dword [ebp + 8]
xor bl, al
xor bl, byte [ebp - 0xc]
xor bl, byte [ebp - 4]
mov byte [esi + 4], bl
call fcn.0043d538
push dword [ebp - 4]
mov bl, al
call fcn.0043d548
xor bl, al
add esp, 0x20
xor bl, byte [ebp - 8]
xor bl, byte [ebp - 0xc]
inc esi
mov byte [esi + 7], bl
lea eax, [edi + esi]
cmp eax, 4
jl 0x43d499
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43d560
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov ecx, dword [esp + 8]
push esi
push 0xfffffffffffffffc
pop esi
lea eax, [edx + 4]
sub esi, edx
mov edx, dword [ecx]
shr edx, 0x18
xor byte [eax - 4], dl
mov edx, dword [ecx]
shr edx, 0x10
xor byte [eax], dl
mov edx, dword [ecx]
shr edx, 8
xor byte [eax + 4], dl
mov dl, byte [ecx]
xor byte [eax + 8], dl
inc eax
add ecx, 4
lea edx, [esi + eax]
cmp edx, 4
jl 0x43d571
pop esi
ret

Function at 0x43d59e
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0xffffff4c
add ecx, 2
sub edi, esi
lea eax, [esi + 0xb4]
mov dword [ebp - 4], edi
mov dl, byte [ecx - 2]
mov byte [eax - 4], dl
mov dl, byte [ecx - 1]
mov byte [eax], dl
mov dl, byte [ecx]
mov byte [eax + 4], dl
mov dl, byte [ecx + 1]
mov byte [eax + 8], dl
inc eax
add ecx, 4
lea edx, [edi + eax]
cmp edx, 4
jl 0x43d5bd
lea eax, [esi + 0xa0]
push ebx
lea edi, [esi + 0xb0]
push eax
push edi
call fcn.0043d560
pop ecx
lea ebx, [esi + 0x90]
pop ecx
mov dword [ebp + 8], 9
xor eax, eax
movzx ecx, byte [eax + edi]
mov cl, byte [ecx + 0x521958]
mov byte [eax + edi], cl
inc eax
cmp eax, 0x10
jl 0x43d604
push edi
call fcn.0043d6f3
push edi
call fcn.0043d740
push ebx
push edi
call fcn.0043d560
add esp, 0x10
sub ebx, 0x10
dec dword [ebp + 8]
jne 0x43d602
xor eax, eax
pop ebx
movzx ecx, byte [eax + edi]
mov cl, byte [ecx + 0x521958]
mov byte [eax + edi], cl
inc eax
cmp eax, 0x10
jl 0x43d638
push edi
call fcn.0043d6f3
push esi
push edi
call fcn.0043d560
lea edi, [esi + 0xd0]
add esp, 0xc
lea ecx, [esi + 0xb4]
mov eax, edi
mov dl, byte [eax - 0x10]
xor dl, byte [ecx - 4]
mov byte [eax], dl
mov dl, byte [eax - 0xf]
xor dl, byte [ecx]
add eax, 4
mov byte [eax - 3], dl
mov dl, byte [eax - 0x12]
xor dl, byte [ecx + 4]
mov byte [eax - 2], dl
mov dl, byte [eax - 0x11]
xor dl, byte [ecx + 8]
inc ecx
mov byte [eax - 1], dl
mov edx, dword [ebp - 4]
add edx, ecx
cmp edx, 4
jl 0x43d669
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov cl, byte [eax + ecx]
mov byte [esi + eax + 0xc0], cl
inc eax
cmp eax, 0x10
jl 0x43d69b
and dword [esi + 0xe0], 0
cmp dword [ebp + 0x10], 0
je 0x43d6ef
movzx eax, byte [esi + 0xdf]
cmp eax, 1
jl 0x43d6cc
cmp eax, 0x10
jle 0x43d6cf
push 0x10
pop eax
push 0xf
pop ecx
cmp eax, ecx
jg 0x43d6e9
mov edx, ecx
sub edx, eax
mov dl, byte [edx + esi + 0xd0]
mov byte [edi + ecx], dl
dec ecx
cmp ecx, eax
jge 0x43d6d6
mov dword [esi + 0xe0], eax
pop edi
pop esi
leave
ret
Function at 0x43d740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0xc], 0xfffffffc
push esi
sub dword [ebp - 0xc], eax
push edi
lea esi, [eax + 4]
mov al, byte [esi - 4]
mov byte [ebp - 8], al
mov al, byte [esi]
mov byte [ebp - 4], al
mov al, byte [esi + 4]
mov byte [ebp + 8], al
mov al, byte [esi + 8]
mov byte [ebp - 0x10], al
mov edi, dword [ebp - 0x10]
push edi
call fcn.0043d255
push dword [ebp + 8]
mov bl, al
call fcn.0043d2bc
push dword [ebp - 4]
xor bl, al
call fcn.0043d285
push dword [ebp - 8]
xor bl, al
call fcn.0043d2f3
xor bl, al
push edi
mov byte [esi - 4], bl
call fcn.0043d2bc
push dword [ebp + 8]
mov bl, al
call fcn.0043d285
push dword [ebp - 4]
xor bl, al
call fcn.0043d2f3
push dword [ebp - 8]
xor bl, al
call fcn.0043d255
xor bl, al
push edi
mov byte [esi], bl
call fcn.0043d285
push dword [ebp + 8]
mov bl, al
call fcn.0043d2f3
push dword [ebp - 4]
xor bl, al
call fcn.0043d255
push dword [ebp - 8]
xor bl, al
call fcn.0043d2bc
xor bl, al
push edi
mov byte [esi + 4], bl
call fcn.0043d2f3
push dword [ebp + 8]
mov bl, al
call fcn.0043d255
push dword [ebp - 4]
xor bl, al
call fcn.0043d2bc
push dword [ebp - 8]
xor bl, al
call fcn.0043d285
xor bl, al
mov eax, dword [ebp - 0xc]
add esp, 0x40
mov byte [esi + 8], bl
inc esi
add eax, esi
cmp eax, 4
jl 0x43d759
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43d8d4
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0xffffff0c
add ecx, 2
sub edi, esi
lea eax, [esi + 0xf4]
mov dword [ebp - 4], edi
mov dl, byte [ecx - 2]
mov byte [eax - 4], dl
mov dl, byte [ecx - 1]
mov byte [eax], dl
mov dl, byte [ecx]
mov byte [eax + 4], dl
mov dl, byte [ecx + 1]
mov byte [eax + 8], dl
inc eax
add ecx, 4
lea edx, [edi + eax]
cmp edx, 4
jl 0x43d8f3
lea eax, [esi + 0xe0]
push ebx
lea edi, [esi + 0xf0]
push eax
push edi
call fcn.0043d560
pop ecx
lea ebx, [esi + 0xd0]
pop ecx
mov dword [ebp + 8], 0xd
xor eax, eax
movzx ecx, byte [eax + edi]
mov cl, byte [ecx + 0x521958]
mov byte [eax + edi], cl
inc eax
cmp eax, 0x10
jl 0x43d93a
push edi
call fcn.0043d6f3
push edi
call fcn.0043d740
push ebx
push edi
call fcn.0043d560
add esp, 0x10
sub ebx, 0x10
dec dword [ebp + 8]
jne 0x43d938
xor eax, eax
pop ebx
movzx ecx, byte [eax + edi]
mov cl, byte [ecx + 0x521958]
mov byte [eax + edi], cl
inc eax
cmp eax, 0x10
jl 0x43d96e
push edi
call fcn.0043d6f3
push esi
push edi
call fcn.0043d560
lea edi, [esi + 0x110]
add esp, 0xc
lea ecx, [esi + 0xf4]
mov eax, edi
mov dl, byte [eax - 0x10]
xor dl, byte [ecx - 4]
mov byte [eax], dl
mov dl, byte [eax - 0xf]
xor dl, byte [ecx]
add eax, 4
mov byte [eax - 3], dl
mov dl, byte [eax - 0x12]
xor dl, byte [ecx + 4]
mov byte [eax - 2], dl
mov dl, byte [eax - 0x11]
xor dl, byte [ecx + 8]
inc ecx
mov byte [eax - 1], dl
mov edx, dword [ebp - 4]
add edx, ecx
cmp edx, 4
jl 0x43d99f
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov cl, byte [eax + ecx]
mov byte [esi + eax + 0x100], cl
inc eax
cmp eax, 0x10
jl 0x43d9d1
and dword [esi + 0x120], 0
cmp dword [ebp + 0x10], 0
je 0x43da25
movzx eax, byte [esi + 0x11f]
cmp eax, 1
jl 0x43da02
cmp eax, 0x10
jle 0x43da05
push 0x10
pop eax
push 0xf
pop ecx
cmp eax, ecx
jg 0x43da1f
mov edx, ecx
sub edx, eax
mov dl, byte [edx + esi + 0x110]
mov byte [edi + ecx], dl
dec ecx
cmp ecx, eax
jge 0x43da0c
mov dword [esi + 0x120], eax
pop edi
pop esi
leave
ret

Function at 0x43da29
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x50], 0
and dword [eax + 0x54], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x43e4cc
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x40
xor edi, edi
pop esi
mov dword [ebp - 0x20], 0x6a09e667
cmp ebx, esi
mov dword [ebp - 0x1c], 0xbb67ae85
mov dword [ebp - 0x18], 0x3c6ef372
mov dword [ebp - 0x14], 0xa54ff53a
mov dword [ebp - 0x10], 0x510e527f
mov dword [ebp - 0xc], 0x9b05688c
mov dword [ebp - 8], 0x1f83d9ab
mov dword [ebp - 4], 0x5be0cd19
jl 0x43e536
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
lea eax, [eax + esi - 0x40]
push eax
call fcn.0043e61c
add esi, 0x40
pop ecx
add edi, 0x40
cmp esi, ebx
pop ecx
jle 0x43e519
mov esi, ebx
sub esi, edi
test esi, esi
jle 0x43e551
mov eax, dword [ebp + 8]
push esi
add edi, eax
lea eax, [ebp - 0x60]
push edi
push eax
call fcn.0046d560
add esp, 0xc
mov byte [ebp + esi - 0x60], 0x80
inc esi
cmp esi, 0x38
jle 0x43e58a
push 0x40
pop ecx
cmp esi, ecx
jge 0x43e579
sub ecx, esi
lea edi, [ebp + esi - 0x60]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.0043e61c
pop ecx
xor esi, esi
pop ecx
push 0x38
pop ecx
cmp esi, ecx
jge 0x43e5a7
sub ecx, esi
lea edi, [ebp + esi - 0x60]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, ebx
and byte [ebp - 0x28], 0
sar eax, 0x15
mov byte [ebp - 0x24], al
mov eax, ebx
sar eax, 0xd
mov byte [ebp - 0x23], al
mov eax, ebx
sar eax, 5
and byte [ebp - 0x27], 0
and byte [ebp - 0x26], 0
and byte [ebp - 0x25], 0
mov byte [ebp - 0x22], al
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x60]
shl bl, 3
push eax
mov byte [ebp - 0x21], bl
call fcn.0043e61c
mov eax, dword [ebp + 0x10]
pop ecx
pop ecx
add eax, 2
push 8
lea ecx, [ebp - 0x20]
pop edi
mov esi, dword [ecx]
mov edx, esi
shr edx, 0x18
mov byte [eax - 2], dl
mov edx, esi
shr edx, 0x10
mov byte [eax - 1], dl
mov edx, esi
shr edx, 8
mov byte [eax], dl
mov dl, byte [ecx]
mov byte [eax + 1], dl
add ecx, 4
add eax, 4
dec edi
jne 0x43e5f0
pop edi
pop esi
pop ebx
leave
ret