joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e5af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [eax + 0x38], 0
mov cl, byte [eax + 0x34]
push ebx
push esi
mov dword [ebp - 4], 0
mov ebx, 1
jle 0x4e5b3a
mov edx, dword [eax + 0x260]
push edi
movzx edi, cl
mov esi, edx
shr esi, 0x18
xor esi, edi
shl edx, 8
xor edx, dword [esi*4 + 0x896158]
mov esi, dword [ebp - 4]
add esi, ebx
mov dword [eax + 0x260], edx
mov dword [ebp - 4], esi
cmp esi, dword [eax + 0x38]
jl 0x4e5b15
pop edi
mov edx, dword [eax + 0x34]
mov byte [eax + edx + 0x58], bl
mov esi, dword [eax + 0x38]
mov edx, esi
sub edx, ebx
je 0x4e5bc8
sub edx, ebx
je 0x4e5baa
sub edx, ebx
je 0x4e5b9e
mov byte [esi + eax + 0x54], bl
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
mov cl, byte [eax + 0x38]
mov esi, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
sub cl, 4
mov byte [esi + edx], cl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
mov edx, dword [eax + 0x44]
mov esi, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [eax + 0x44]
mov edx, dword [eax + 0x24]
mov byte [edx + esi], cl
add dword [eax + 0x44], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e6150
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x746d90
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x899944]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ebp + 8]
xor edi, edi
cmp esi, edi
je 0x4e622b
mov ebx, dword [ebp + 0x10]
cmp ebx, edi
je 0x4e6196
cmp ebx, 1
jne 0x4e622b
cmp dword [ebp + 0xc], 4
ja 0x4e622b
push 0xfa74
mov dword [ebp - 4], edi
call fcn.005c46fb
add esp, 4
cmp eax, edi
jne 0x4e61d3
mov eax, 0xfffffffd
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0xc]
mov dword [eax], esi
mov dword [esi + 0x20], eax
mov dword [eax + 4], 0xa
mov dword [eax + 0x20], edi
mov dword [eax + 0x1c], edi
mov dword [eax + 0xc64], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov byte [eax + 0x28], bl
mov dword [eax + 0xc54], edi
mov dword [eax + 0xc50], edi
mov dword [eax + 0xc4c], edi
mov dword [eax + 0x2c], edi
mov dword [eax + 0x30], ecx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, 0xfffffffe
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4e9750
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x746dbb
mov eax, dword fs:[0]
push eax
sub esp, 0xa60
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0xa68], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xa6c], eax
test eax, eax
jne 0x4e979e
xor al, al
jmp 0x4e990c
mov eax, dword [ebp + 0x18]
mov esi, 0x40
cmp eax, 3
je 0x4e97b0
cmp eax, 2
jne 0x4e97b5
mov esi, 0x80
push eax
call fcn.00488ef0
mov edi, dword [ebp + 0x14]
add esp, 4
mov dword [ebp - 0xa64], eax
cmp edi, esi
jle 0x4e97f2
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x198]
push ecx
push edx
push edi
push ebx
call fcn.00489120
mov edi, dword [ebp - 0xa64]
add esp, 0x10
lea ebx, [ebp - 0x198]
cmp edi, esi
jle 0x4e97f2
mov edi, esi
push esi
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.0070dc20
push esi
lea ecx, [ebp - 0x94]
push 0
push ecx
call fcn.0070dc20
push edi
lea edx, [ebp - 0x118]
push ebx
push edx
call fcn.0070d6a0
push edi
lea eax, [ebp - 0x94]
push ebx
push eax
call fcn.0070d6a0
add esp, 0x30
xor eax, eax
test esi, esi
jle 0x4e9855
jmp 0x4e9840
xor byte [ebp + eax - 0x118], 0x36
xor byte [ebp + eax - 0x94], 0x5c
inc eax
cmp eax, esi
jl 0x4e9840
lea ecx, [ebp - 0xa60]
call fcn.00410520
mov edx, dword [ebp - 0xa68]
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x118]
mov dword [ebp - 0xa5c], ecx
lea ecx, [ebp - 0x158]
push ecx
mov dword [ebp - 0xa58], edx
lea edx, [ebp - 0xa60]
push ebx
push edx
mov dword [ebp - 4], 0
mov dword [ebp - 0x25c], 2
mov dword [ebp - 0x65c], esi
mov dword [ebp - 0x658], eax
call fcn.00489010
push esi
lea eax, [ebp - 0x94]
push eax
lea ecx, [ebp - 0x258]
push ecx
call fcn.0070d6a0
mov edi, dword [ebp - 0xa64]
push edi
lea edx, [ebp - 0x158]
push edx
lea eax, [ebp + esi - 0x258]
push eax
call fcn.0070d6a0
mov ecx, dword [ebp - 0xa6c]
push ecx
push ebx
add edi, esi
lea edx, [ebp - 0x258]
push edi
push edx
call fcn.00489120
add esp, 0x34
lea ecx, [ebp - 0xa60]
mov dword [ebp - 4], 0xffffffff
call fcn.00410540
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret
Function at 0x4e9930
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x254], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x258], eax
test eax, eax
jne 0x4e996e
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
push esi
push edi
mov esi, 0x40
cmp eax, 3
je 0x4e9982
cmp eax, 2
jne 0x4e9987
mov esi, 0x80
push eax
call fcn.00488ef0
mov edi, dword [ebp + 0x10]
add esp, 4
mov dword [ebp - 0x250], eax
cmp edi, esi
jle 0x4e99c4
mov edx, dword [ebp + 0x14]
lea ecx, [ebp - 0x14c]
push ecx
push edx
push edi
push ebx
call fcn.00489120
mov edi, dword [ebp - 0x250]
add esp, 0x10
lea ebx, [ebp - 0x14c]
cmp edi, esi
jle 0x4e99c4
mov edi, esi
push esi
lea eax, [ebp - 0x10c]
push 0
push eax
call fcn.0070dc20
push esi
lea ecx, [ebp - 0x88]
push 0
push ecx
call fcn.0070dc20
push edi
lea edx, [ebp - 0x10c]
push ebx
push edx
call fcn.0070d6a0
push edi
lea eax, [ebp - 0x88]
push ebx
push eax
call fcn.0070d6a0
add esp, 0x30
xor eax, eax
test esi, esi
jle 0x4e9a25
jmp 0x4e9a10
xor byte [ebp + eax - 0x10c], 0x36
xor byte [ebp + eax - 0x88], 0x5c
inc eax
cmp eax, esi
jl 0x4e9a10
mov eax, dword [ebp - 0x254]
mov ebx, dword [ebp + 0x14]
lea edx, [ebp - 0x18c]
push edx
lea ecx, [ebp - 0x10c]
push ebx
push eax
mov dword [eax + 4], ecx
mov dword [eax + 0x404], esi
call fcn.00489010
push esi
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x24c]
push ecx
call fcn.0070d6a0
mov edi, dword [ebp - 0x250]
push edi
lea edx, [ebp - 0x18c]
push edx
lea eax, [ebp + esi - 0x24c]
push eax
call fcn.0070d6a0
mov ecx, dword [ebp - 0x258]
push ecx
push ebx
add edi, esi
lea edx, [ebp - 0x24c]
push edi
push edx
call fcn.00489120
mov ecx, dword [ebp - 4]
add esp, 0x34
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret

Function at 0x4e9e00
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx + 0x10], 0x67452301
mov dword [ecx + 0x14], 0xefcdab89
mov dword [ecx + 0x18], 0x98badcfe
mov dword [ecx + 0x1c], 0x10325476
mov dword [ecx + 0x20], 0xc3d2e1f0
mov dword [ecx + 0x24], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
ret
Function at 0x4eaec0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x746df8
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0x14
mov ecx, edi
call fcn.00414050
mov ebx, eax
test ebx, ebx
je 0x4eaf88
xor eax, eax
push 0x40
push eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x78], vtable._ckSha1.0
call fcn.0070dc20
add esp, 0xc
xor eax, eax
mov ecx, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x68], 0x67452301
mov dword [ebp - 0x64], 0xefcdab89
mov dword [ebp - 0x60], 0x98badcfe
mov dword [ebp - 0x5c], 0x10325476
mov dword [ebp - 0x58], 0xc3d2e1f0
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
call fcn.004033b0
push eax
mov ecx, esi
call fcn.0040fbb0
push eax
lea ecx, [ebp - 0x78]
call fcn.004ea420
push 0
push ebx
lea ecx, [ebp - 0x78]
call fcn.004eab10
push 0x14
mov ecx, edi
call fcn.0040fbc0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret

Function at 0x4eafb0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0x10]
push 0x40
push eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x6c], vtable._ckSha1.0
call fcn.0070dc20
mov ecx, dword [ebp + 0xc]
add esp, 0xc
push ecx
push esi
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x5c], 0x67452301
mov dword [ebp - 0x58], 0xefcdab89
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
mov dword [ebp - 0x4c], 0xc3d2e1f0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
call fcn.004ea420
push 0
push edi
lea ecx, [ebp - 0x6c]
call fcn.004eab10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret
Function at 0x4eb050
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0x40
xor edi, edi
mov dword [ebp - 0x70], eax
xor eax, eax
lea ecx, [ebp - 0x44]
push edi
push ecx
mov dword [ebp - 0x6c], vtable._ckSha1.0
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
call fcn.0070dc20
add esp, 0xc
mov dword [ebp - 0x5c], 0x67452301
mov dword [ebp - 0x58], 0xefcdab89
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
mov dword [ebp - 0x4c], 0xc3d2e1f0
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], edi
cmp dword [ebx + 0x804], edi
jbe 0x4eb0f1
push esi
lea esi, [ebx + 4]
lea esp, [esp]
mov edx, dword [esi + 0x400]
mov eax, dword [esi]
push edx
push eax
lea ecx, [ebp - 0x6c]
call fcn.004ea420
inc edi
add esi, 4
cmp edi, dword [ebx + 0x804]
jb 0x4eb0d0
xor edi, edi
pop esi
mov ecx, dword [ebp - 0x70]
push edi
push ecx
lea ecx, [ebp - 0x6c]
call fcn.004eab10
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret
Function at 0x4eb110
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
cmp byte [0x8a1a50], 0
jne 0x4eb33b
mov eax, 0xff00ff00
mov dword [0x8a1a58], eax
mov dword [0x8a1a5c], eax
mov eax, 0xff00ff
mov dword [0x8a1a60], eax
mov dword [0x8a1a64], eax
mov eax, 0xffff0000
push esi
mov dword [0x8a1a68], eax
mov dword [0x8a1a6c], eax
mov eax, 0xffff
push edi
mov dword [0x8a1a70], eax
mov dword [0x8a1a74], eax
mov dword [0x8a1a10], 0xc1059ed8
mov dword [0x8a1a14], 0xcbbb9d5d
mov dword [0x8a1a18], 0x367cd507
mov dword [0x8a1a1c], 0x629a292a
mov dword [0x8a1a20], 0x3070dd17
mov dword [0x8a1a24], 0x9159015a
mov dword [0x8a1a28], 0xf70e5939
mov dword [0x8a1a2c], 0x152fecd8
mov dword [0x8a1a30], 0xffc00b31
mov dword [0x8a1a34], 0x67332667
mov dword [0x8a1a38], 0x68581511
mov dword [0x8a1a3c], 0x8eb44a87
mov dword [0x8a1a40], 0x64f98fa7
mov dword [0x8a1a44], 0xdb0c2e0d
mov dword [0x8a1a48], 0xbefa4fa4
mov dword [0x8a1a4c], 0x47b5481d
mov edi, 0x8a1798
mov esi, 0x7b9e18
mov eax, dword [esi - 8]
mov edx, dword [esi - 4]
mov cl, 0x20
call fcn.0070bb60
or eax, dword [esi]
or edx, dword [esi + 4]
mov dword [edi - 8], eax
mov eax, dword [esi + 8]
mov dword [edi - 4], edx
mov edx, dword [esi + 0xc]
mov cl, 0x20
call fcn.0070bb60
or eax, dword [esi + 0x10]
or edx, dword [esi + 0x14]
mov dword [edi], eax
mov eax, dword [esi + 0x18]
mov dword [edi + 4], edx
mov edx, dword [esi + 0x1c]
mov cl, 0x20
call fcn.0070bb60
or eax, dword [esi + 0x20]
or edx, dword [esi + 0x24]
mov dword [edi + 8], eax
mov eax, dword [esi + 0x28]
mov dword [edi + 0xc], edx
mov edx, dword [esi + 0x2c]
mov cl, 0x20
call fcn.0070bb60
or eax, dword [esi + 0x30]
or edx, dword [esi + 0x34]
mov dword [edi + 0x10], eax
mov eax, dword [esi + 0x38]
mov dword [edi + 0x14], edx
mov edx, dword [esi + 0x3c]
mov cl, 0x20
call fcn.0070bb60
or eax, dword [esi + 0x40]
or edx, dword [esi + 0x44]
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], edx
add esi, 0x50
add edi, 0x28
cmp esi, 0x7ba318
jl 0x4eb205
pop edi
mov dword [0x8a1750], 0xf3bcc908
mov dword [0x8a1754], 0x6a09e667
mov dword [0x8a1758], 0x84caa73b
mov dword [0x8a175c], 0xbb67ae85
mov dword [0x8a1760], 0xfe94f82b
mov dword [0x8a1764], 0x3c6ef372
mov dword [0x8a1768], 0x5f1d36f1
mov dword [0x8a176c], 0xa54ff53a
mov dword [0x8a1770], 0xade682d1
mov dword [0x8a1774], 0x510e527f
mov dword [0x8a1778], 0x2b3e6c1f
mov dword [0x8a177c], 0x9b05688c
mov dword [0x8a1780], 0xfb41bd6b
mov dword [0x8a1784], 0x1f83d9ab
mov dword [0x8a1788], 0x137e2179
mov dword [0x8a178c], 0x5be0cd19
mov byte [0x8a1a50], 1
pop esi
ret
Function at 0x4eb580
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
mov eax, dword [ecx + 8]
cmp eax, 0x180
jg 0x4eb695
je 0x4eb60b
sub eax, 0xa0
je 0x4eb5df
sub eax, 0x60
jne 0x4eb73c
mov dword [ecx + 0xc], 0x6a09e667
mov dword [ecx + 0x10], 0xbb67ae85
mov dword [ecx + 0x14], 0x3c6ef372
mov dword [ecx + 0x18], 0xa54ff53a
mov dword [ecx + 0x1c], 0x510e527f
mov dword [ecx + 0x20], 0x9b05688c
mov dword [ecx + 0x24], 0x1f83d9ab
mov dword [ecx + 0x28], 0x5be0cd19
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
ret
xor eax, eax
mov dword [ecx + 0xc], 0x67452301
mov dword [ecx + 0x10], 0xefcdab89
mov dword [ecx + 0x14], 0x98badcfe
mov dword [ecx + 0x18], 0x10325476
mov dword [ecx + 0x1c], 0xc3d2e1f0
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
ret
mov eax, dword [0x8a1a10]
mov dword [ecx + 0x38], eax
mov edx, dword [0x8a1a14]
mov dword [ecx + 0x3c], edx
mov eax, dword [0x8a1a18]
mov dword [ecx + 0x40], eax
mov edx, dword [0x8a1a1c]
mov dword [ecx + 0x44], edx
mov eax, dword [0x8a1a20]
mov dword [ecx + 0x48], eax
mov edx, dword [0x8a1a24]
mov dword [ecx + 0x4c], edx
mov eax, dword [0x8a1a28]
mov dword [ecx + 0x50], eax
mov edx, dword [0x8a1a2c]
mov dword [ecx + 0x54], edx
mov eax, dword [0x8a1a30]
mov dword [ecx + 0x58], eax
mov edx, dword [0x8a1a34]
mov dword [ecx + 0x5c], edx
mov eax, dword [0x8a1a38]
mov dword [ecx + 0x60], eax
mov edx, dword [0x8a1a3c]
mov dword [ecx + 0x64], edx
mov eax, dword [0x8a1a40]
mov dword [ecx + 0x68], eax
mov edx, dword [0x8a1a44]
mov dword [ecx + 0x6c], edx
mov eax, dword [0x8a1a48]
mov dword [ecx + 0x70], eax
mov edx, dword [0x8a1a4c]
jmp 0x4eb725
cmp eax, 0x200
jne 0x4eb73c
mov eax, dword [0x8a1750]
mov dword [ecx + 0x38], eax
mov edx, dword [0x8a1754]
mov dword [ecx + 0x3c], edx
mov eax, dword [0x8a1758]
mov dword [ecx + 0x40], eax
mov edx, dword [0x8a175c]
mov dword [ecx + 0x44], edx
mov eax, dword [0x8a1760]
mov dword [ecx + 0x48], eax
mov edx, dword [0x8a1764]
mov dword [ecx + 0x4c], edx
mov eax, dword [0x8a1768]
mov dword [ecx + 0x50], eax
mov edx, dword [0x8a176c]
mov dword [ecx + 0x54], edx
mov eax, dword [0x8a1770]
mov dword [ecx + 0x58], eax
mov edx, dword [0x8a1774]
mov dword [ecx + 0x5c], edx
mov eax, dword [0x8a1778]
mov dword [ecx + 0x60], eax
mov edx, dword [0x8a177c]
mov dword [ecx + 0x64], edx
mov eax, dword [0x8a1780]
mov dword [ecx + 0x68], eax
mov edx, dword [0x8a1784]
mov dword [ecx + 0x6c], edx
mov eax, dword [0x8a1788]
mov dword [ecx + 0x70], eax
mov edx, dword [0x8a178c]
xor eax, eax
mov dword [ecx + 0x74], edx
mov dword [ecx + 0x84], eax
mov dword [ecx + 0x80], eax
mov dword [ecx + 0x7c], eax
mov dword [ecx + 0x78], eax
ret
Function at 0x4f6d80
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
lea eax, [edi + 0x24]
mov esi, 0x10
lea ecx, [ecx]
mov cl, byte [eax + 0x20]
mov dl, byte [eax - 0x10]
xor dl, cl
mov byte [eax], cl
mov byte [eax + 0x10], dl
inc eax
dec esi
jne 0x4f6d90
xor cl, cl
xor ebx, ebx
lea esi, [edi + 0x15]
jmp 0x4f6db0
mov eax, esi
mov edx, 8
jmp 0x4f6dc0
movzx edi, byte [eax - 1]
movzx ecx, cl
movzx ecx, byte [ecx + str._.C]
xor ecx, edi
movzx edi, byte [eax]
mov byte [eax - 1], cl
movzx ecx, cl
movzx ecx, byte [ecx + str._.C]
xor ecx, edi
movzx edi, byte [eax + 1]
mov byte [eax], cl
movzx ecx, cl
movzx ecx, byte [ecx + str._.C]
xor ecx, edi
movzx edi, byte [eax + 2]
mov byte [eax + 1], cl
movzx ecx, cl
movzx ecx, byte [ecx + str._.C]
xor ecx, edi
movzx edi, byte [eax + 3]
mov byte [eax + 2], cl
movzx ecx, cl
movzx ecx, byte [ecx + str._.C]
xor ecx, edi
movzx edi, byte [eax + 4]
mov byte [eax + 3], cl
movzx ecx, cl
movzx ecx, byte [ecx + str._.C]
xor ecx, edi
mov byte [eax + 4], cl
add eax, 6
dec edx
jne 0x4f6dc0
add cl, bl
inc ebx
cmp ebx, 0x12
jl 0x4f6db0
pop edi
pop esi
pop ebx
ret

Function at 0x4f6e50
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
mov cl, byte [eax + 0x13]
add eax, 4
mov edx, 4
push esi
mov edi, edi
movzx esi, byte [eax + 0x40]
movzx ecx, cl
xor esi, ecx
movzx ecx, byte [esi + str._.C]
movzx esi, byte [eax]
xor ecx, esi
movzx esi, byte [eax + 0x41]
mov byte [eax], cl
movzx ecx, cl
xor esi, ecx
movzx ecx, byte [esi + str._.C]
movzx esi, byte [eax + 1]
xor ecx, esi
movzx esi, byte [eax + 0x42]
mov byte [eax + 1], cl
movzx ecx, cl
xor esi, ecx
movzx ecx, byte [esi + str._.C]
movzx esi, byte [eax + 2]
xor ecx, esi
movzx esi, byte [eax + 0x43]
mov byte [eax + 2], cl
movzx ecx, cl
xor esi, ecx
movzx ecx, byte [esi + str._.C]
movzx esi, byte [eax + 3]
xor ecx, esi
mov byte [eax + 3], cl
add eax, 4
dec edx
jne 0x4f6e60
pop esi
ret
Function at 0x4f8b90
Capabilities:
Hash data using ripemd320
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x50], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
push eax
push ecx
mov ecx, esi
mov dword [esi + 0x54], 0x67452301
mov dword [esi + 0x58], 0xefcdab89
mov dword [esi + 0x5c], 0x98badcfe
mov dword [esi + 0x60], 0x10325476
mov dword [esi + 0x64], 0xc3d2e1f0
mov dword [esi + 0x68], 0x76543210
mov dword [esi + 0x6c], 0xfedcba98
mov dword [esi + 0x70], 0x89abcdef
mov dword [esi + 0x74], 0x1234567
mov dword [esi + 0x78], 0x3c2d1e0f
call fcn.004f88c0
mov edx, dword [ebp + 0x10]
push edx
mov ecx, esi
call fcn.004f8980
pop esi
pop ebp
ret 0xc
Function at 0x4f9cf0
Capabilities:
Hash data using ripemd256
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x50], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
push eax
push ecx
mov ecx, esi
mov dword [esi + 0x54], 0x67452301
mov dword [esi + 0x58], 0xefcdab89
mov dword [esi + 0x5c], 0x98badcfe
mov dword [esi + 0x60], 0x10325476
mov dword [esi + 0x64], 0x76543210
mov dword [esi + 0x68], 0xfedcba98
mov dword [esi + 0x6c], 0x89abcdef
mov dword [esi + 0x70], 0x1234567
call fcn.004f9a50
mov edx, dword [ebp + 0x10]
push edx
mov ecx, esi
call fcn.004f9b10
pop esi
pop ebp
ret 0xc
Function at 0x4fb540
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x50], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
push eax
push ecx
mov ecx, esi
mov dword [esi + 0x54], 0x67452301
mov dword [esi + 0x58], 0xefcdab89
mov dword [esi + 0x5c], 0x98badcfe
mov dword [esi + 0x60], 0x10325476
mov dword [esi + 0x64], 0xc3d2e1f0
call fcn.004fb2f0
mov edx, dword [ebp + 0x10]
push edx
mov ecx, esi
call fcn.004fb3b0
pop esi
pop ebp
ret 0xc
Function at 0x4fc4c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, dword [ebp + 8]
xor eax, eax
mov dword [esi + 0x50], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
push eax
push ecx
mov ecx, esi
mov dword [esi + 0x54], 0x67452301
mov dword [esi + 0x58], 0xefcdab89
mov dword [esi + 0x5c], 0x98badcfe
mov dword [esi + 0x60], 0x10325476
call fcn.004fc290
mov edx, dword [ebp + 0x10]
push edx
mov ecx, esi
call fcn.004fc350
pop esi
pop ebp
ret 0xc

Function at 0x4fc550
Capabilities:
Hash data with md5

Disassembly:
mov eax, ecx
xor ecx, ecx
mov dword [eax], vtable._ckMd4.0
mov dword [eax + 0x18], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 4], 0x67452301
mov dword [eax + 8], 0xefcdab89
mov dword [eax + 0xc], 0x98badcfe
mov dword [eax + 0x10], 0x10325476
ret
Function at 0x4fcbd0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x746e58
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x899944]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, ecx
lea ecx, [ebp - 0x3c]
call fcn.0040fe80
lea eax, [ebp - 0x3c]
push eax
push 0
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.00406510
xor eax, eax
lea ecx, [ebp - 0x3c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.004033b0
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040fbb0
push eax
mov ecx, esi
call fcn.004fca50
lea ecx, [ebp - 0x20]
push ecx
mov ecx, esi
call fcn.004fcb00
push 0x10
lea edx, [ebp - 0x20]
push edx
mov ecx, ebx
call fcn.00411260
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 0xffffffff
call fcn.004105c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0070bb4c
mov esp, ebp
pop ebp
ret 8

Function at 0x4fccb0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
mov esi, ecx
cmp ebx, eax
je 0x4fcd06
push edi
mov edi, dword [ebp + 8]
mov ecx, edi
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
call fcn.004033b0
push eax
mov ecx, edi
call fcn.0040fbb0
push eax
mov ecx, esi
call fcn.004fca50
push ebx
mov ecx, esi
call fcn.004fcb00
pop edi
pop esi
pop ebx
pop ebp
ret 8