joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ea52d
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
pshufd xmm2, xmm2, 0xff
movups xmm4, xmm1
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pshufb xmm4, xmm5
pxor xmm1, xmm4
pxor xmm1, xmm2
movups xmmword [edx], xmm1
add edx, 0x10
aeskeygenassist xmm4, xmm1, 0
pshufd xmm2, xmm4, 0xaa
movups xmm4, xmm3
pshufb xmm4, xmm5
pxor xmm3, xmm4
pshufb xmm4, xmm5
pxor xmm3, xmm4
pshufb xmm4, xmm5
pxor xmm3, xmm4
pxor xmm3, xmm2
movups xmmword [edx], xmm3
add edx, 0x10
ret
Function at 0x4eae38
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
mov ebx, 0x5bcec8
mov eax, 0x5beec8
add edx, 0x10
dec dword [esp]
mov ecx, dword [edx]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx], esi
mov ecx, dword [edx + 4]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx + 4], esi
mov ecx, dword [edx + 8]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx + 8], esi
mov ecx, dword [edx + 0xc]
mov esi, ecx
shr esi, 0x18
movzx esi, byte [eax + esi]
add esi, 0x300
mov esi, dword [ebx + esi*4]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x200
xor esi, dword [ebx + edi*4]
mov edi, ecx
shr edi, 8
and edi, 0xff
movzx edi, byte [eax + edi]
add edi, 0x100
xor esi, dword [ebx + edi*4]
and ecx, 0xff
movzx ecx, byte [eax + ecx]
xor esi, dword [ebx + ecx*4]
mov dword [edx + 0xc], esi
cmp dword [esp], 1
jne 0x4eae49
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4eb09c
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
push ebx
mov esi, eax
mov eax, dword [edx]
mov ebx, dword [edx + 4]
bswap eax
bswap ebx
mov dword [esi], eax
mov dword [esi + 4], ebx
mov eax, dword [edx + 8]
mov ebx, dword [edx + 0xc]
bswap eax
bswap ebx
mov dword [esi + 8], eax
mov dword [esi + 0xc], ebx
mov eax, dword [edx + 0x10]
mov ebx, dword [edx + 0x14]
bswap eax
bswap ebx
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], ebx
mov eax, dword [edx + 0x18]
mov ebx, dword [edx + 0x1c]
bswap eax
bswap ebx
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], ebx
mov eax, dword [edx + 0x20]
mov ebx, dword [edx + 0x24]
bswap eax
bswap ebx
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], ebx
mov eax, dword [edx + 0x28]
mov ebx, dword [edx + 0x2c]
bswap eax
bswap ebx
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], ebx
mov eax, dword [edx + 0x30]
mov ebx, dword [edx + 0x34]
bswap eax
bswap ebx
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ebx
mov eax, dword [edx + 0x38]
mov ebx, dword [edx + 0x3c]
bswap eax
bswap ebx
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], ebx
lea esi, [esi + 0x40]
mov ecx, 0x30
mov eax, dword [esi - 8]
mov edi, dword [esi - 0x1c]
mov edx, eax
mov ebx, eax
ror eax, 0x11
ror edx, 0x13
shr ebx, 0xa
xor eax, edx
xor eax, ebx
add edi, eax
mov eax, dword [esi - 0x3c]
mov ebx, eax
mov edx, eax
ror eax, 7
ror edx, 0x12
shr ebx, 3
xor eax, edx
xor eax, ebx
add eax, edi
add eax, dword [esi - 0x40]
mov dword [esi], eax
add esi, 4
dec ecx
jne 0x4eb127
pop ebx
pop edi
pop esi
ret
Function at 0x4eb168
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov ebx, eax
lea esi, [ebp - 0x20]
lea eax, [ebp - 0x120]
call fcn.004eb09c
mov eax, dword [ebx]
mov dword [esi], eax
mov eax, dword [ebx + 4]
mov dword [esi + 4], eax
mov eax, dword [ebx + 8]
mov dword [esi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 0x18]
mov dword [esi + 0x18], eax
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x1c], eax
push ebx
push esi
push edi
xor edi, edi
mov eax, dword [ebp - 0x10]
mov ecx, eax
mov edx, eax
mov ebx, eax
ror eax, 6
ror edx, 0xb
ror ecx, 0x19
xor eax, edx
mov edx, dword [ebp - 8]
xor eax, ecx
mov ecx, dword [ebp - 4]
add ecx, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, edx
mov dword [ebp - 0xc], ebx
and eax, ebx
xor eax, edx
add eax, dword [edi*4 + 0x568d2c]
add eax, ecx
mov ecx, dword [ebp - 0x14]
add eax, dword [ebp + edi*4 - 0x120]
mov ebx, dword [ebp - 0x20]
add ecx, eax
mov esi, eax
mov dword [ebp - 0x10], ecx
mov eax, ebx
mov edx, ebx
ror eax, 2
mov ecx, ebx
ror edx, 0xd
ror ecx, 0x16
xor eax, edx
xor eax, ecx
mov ecx, dword [ebp - 0x1c]
add esi, eax
mov eax, ebx
mov edx, ebx
or eax, ecx
and eax, dword [ebp - 0x18]
and edx, ecx
or eax, edx
inc edi
add esi, eax
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], eax
cmp edi, 0x40
jne 0x4eb1b6
pop edi
pop esi
pop ebx
mov eax, dword [esi]
add dword [ebx], eax
mov eax, dword [esi + 4]
add dword [ebx + 4], eax
mov eax, dword [esi + 8]
add dword [ebx + 8], eax
mov eax, dword [esi + 0xc]
add dword [ebx + 0xc], eax
mov eax, dword [esi + 0x10]
add dword [ebx + 0x10], eax
mov eax, dword [esi + 0x14]
add dword [ebx + 0x14], eax
mov eax, dword [esi + 0x18]
add dword [ebx + 0x18], eax
mov eax, dword [esi + 0x1c]
add dword [ebx + 0x1c], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4eb348
Capabilities:
Hash data using sha256

Disassembly:
push ebx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov ebx, dword [0x576dac]
mov ebx, dword [ebx]
add eax, 0x20
xor ecx, ecx
mov edx, 0x4c
call ebx
pop ebx
ret
Function at 0x4eb9c8
Capabilities:
Hash data using sha256

Disassembly:
push ebx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
xor edx, edx
mov dword [eax + 0xc8], edx
mov ebx, dword [0x576dac]
mov ebx, dword [ebx]
add eax, 0x48
xor ecx, ecx
mov edx, 0x80
call ebx
pop ebx
ret

Function at 0x4ebfac
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff10
mov esi, eax
mov edi, 0x18
mov ebx, 0x5690ac
lea ecx, [esp + 0xc8]
mov eax, esp
mov edx, esi
call fcn.004ebaf8
mov eax, dword [esi]
mov edx, dword [esi + 4]
xor eax, dword [ebx]
xor edx, dword [ebx + 4]
mov dword [esi], eax
mov dword [esi + 4], edx
add ebx, 8
dec edi
jne 0x4ebfc1
emms
add esp, 0xf0
pop edi
pop esi
pop ebx
ret

Function at 0x4ec1a4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov ecx, eax
lea ebx, [eax + 0xc8]
mov edx, dword [eax + 0x18c]
shr edx, 5
mov esi, edx
dec esi
test esi, esi
jl 0x4ec1cc
inc esi
xor edx, edx
mov edi, dword [ebx + edx*4]
xor dword [ecx + edx*4], edi
inc edx
dec esi
jne 0x4ec1c2
call fcn.004ebfac
pop edi
pop esi
pop ebx
ret
Function at 0x4ec1d8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffd4
mov dword [esp + 4], ecx
mov dword [esp], edx
mov esi, eax
test byte [esi + 0x194], 7
je 0x4ec206
mov ecx, 0x4ec3f4
mov dl, 1
mov eax, dword [0x4e914c]
call fcn.004032f8
call fcn.00401230
cmp byte [esi + 0x189], 0
je 0x4ec225
mov ecx, 0x4ec468
mov dl, 1
mov eax, dword [0x4e914c]
call fcn.004032f8
call fcn.00401230
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
cmp eax, dword [esp + 4]
jge 0x4ec3e0
cmp dword [esi + 0x194], 0
jne 0x4ec2f3
mov eax, dword [esi + 0x18c]
cmp eax, dword [esp + 4]
jg 0x4ec2f3
mov eax, dword [esp + 4]
sub eax, dword [esi + 0x18c]
cmp eax, dword [esp + 8]
jl 0x4ec2f3
mov eax, dword [esp + 4]
sub eax, dword [esp + 8]
cdq
idiv dword [esi + 0x18c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 8]
shr eax, 3
mov edx, dword [esp]
lea edi, [edx + eax]
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x4ec2e0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], esi
mov eax, dword [esi + 0x18c]
shr eax, 5
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
dec eax
test eax, eax
jl 0x4ec2c8
inc eax
mov dword [esp + 0x28], eax
xor ebx, ebx
mov eax, dword [edi + ebx*4]
mov edx, dword [esp + 0x20]
xor dword [edx + ebx*4], eax
inc ebx
dec dword [esp + 0x28]
jne 0x4ec2b7
mov eax, esi
call fcn.004ebfac
mov eax, dword [esi + 0x18c]
shr eax, 3
add edi, eax
dec dword [esp + 0x1c]
jne 0x4ec296
mov eax, dword [esi + 0x18c]
imul dword [esp + 0x10]
add dword [esp + 8], eax
jmp 0x4ec3d2
mov eax, dword [esp + 4]
sub eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esi + 0x18c]
mov edx, dword [esi + 0x194]
add edx, dword [esp + 0x14]
cmp eax, edx
jge 0x4ec323
mov eax, dword [esi + 0x18c]
sub eax, dword [esi + 0x194]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
and eax, 7
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
sub dword [esp + 0x14], eax
mov eax, dword [esi + 0x194]
shr eax, 3
lea edx, [esi + eax + 0xc8]
mov eax, dword [esp + 8]
shr eax, 3
mov ecx, dword [esp]
lea eax, [ecx + eax]
mov ebx, dword [0x576bec]
mov ebx, dword [ebx]
mov ecx, dword [esp + 0x14]
shr ecx, 3
call ebx
mov eax, dword [esp + 0x14]
add dword [esi + 0x194], eax
mov eax, dword [esp + 0x14]
add dword [esp + 8], eax
mov eax, dword [esi + 0x194]
cmp eax, dword [esi + 0x18c]
jne 0x4ec393
mov eax, esi
call fcn.004ec1a4
xor eax, eax
mov dword [esi + 0x194], eax
cmp dword [esp + 0x18], 0
jle 0x4ec3d2
mov ecx, dword [esp + 0x18]
mov al, 1
shl al, cl
dec eax
mov edx, dword [esp + 8]
shr edx, 3
mov ecx, dword [esp]
and al, byte [ecx + edx]
mov edx, dword [esi + 0x194]
shr edx, 3
mov byte [esi + edx + 0xc8], al
mov eax, dword [esp + 0x18]
add dword [esi + 0x194], eax
mov eax, dword [esp + 0x18]
add dword [esp + 8], eax
mov eax, dword [esp + 8]
cmp eax, dword [esp + 4]
jl 0x4ec239
add esp, 0x2c
pop edi
pop esi
pop ebx
ret
Function at 0x4ec884
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
mov dword [ebp - 4], edx
push 1
mov ecx, dword [ebp + 8]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ebx
call fcn.004ec82c
mov edx, ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
cmp eax, 4
jl 0x4ec8bf
sub eax, 4
mov ebx, dword [ecx]
xor dword [edx], ebx
add edx, 4
add ecx, 4
cmp eax, 4
jge 0x4ec8ad
test eax, eax
jle 0x4ec8cf
dec eax
movzx ebx, byte [ecx + eax]
xor byte [edx + eax], bl
test eax, eax
jg 0x4ec8c3
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x4ed1e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push ecx
mov dword [esp], edx
mov ebx, eax
cmp byte [ebx + 0x198], 1
je 0x4ed200
mov eax, ebx
call fcn.004ed184
lea ecx, [ebx + 0x6c]
lea edx, [ebx + 0x6c]
lea eax, [ebx + 0x7c]
call dword [ebx + 0x18c]
mov edx, dword [ebx + 0x68]
mov ecx, dword [ebx + 0x64]
lea esi, [ebx + 0x6c]
mov eax, dword [esp]
cmp eax, 4
jl 0x4ed237
sub eax, 4
mov ebx, dword [ecx]
xor ebx, dword [esi]
mov dword [edx], ebx
add edx, 4
add ecx, 4
add esi, 4
cmp eax, 4
jge 0x4ed220
test eax, eax
jle 0x4ed24a
dec eax
movzx ebx, byte [ecx + eax]
xor bl, byte [esi + eax]
mov byte [edx + eax], bl
test eax, eax
jg 0x4ed23b
pop edx
pop esi
pop ebx
ret

Function at 0x4ed614
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffefc
mov esi, edx
mov edi, eax
xor ebx, ebx
mov eax, 0x5bf0d0
call fcn.004ed558
test al, al
je 0x4ed66b
push 0xf0000000
push 1
push 0
push 0
lea eax, [esp + 0x10]
push eax
call dword [0x5bf0d0]
test eax, eax
je 0x4ed66b
push edi
push esi
mov eax, dword [esp + 8]
push eax
call dword [0x5bf0ec]
cmp eax, 1
sbb ebx, ebx
inc ebx
push 0
mov eax, dword [esp + 4]
push eax
call dword [0x5bf0d4]
test bl, bl
jne 0x4ed6de
mov ebx, esi
lea eax, [esp + 4]
xor ecx, ecx
mov edx, 0x40
call fcn.004d73cc
cmp ebx, 0x100
jg 0x4ed6bd
sub esi, ebx
lea edx, [edi + esi]
lea esi, [esp + 4]
mov eax, ebx
cmp eax, 4
jl 0x4ed6ab
sub eax, 4
mov ecx, dword [esi]
xor dword [edx], ecx
add edx, 4
add esi, 4
cmp eax, 4
jge 0x4ed699
test eax, eax
jle 0x4ed6de
dec eax
movzx ecx, byte [esi + eax]
xor byte [edx + eax], cl
test eax, eax
jg 0x4ed6af
jmp 0x4ed6de
mov eax, esi
sub eax, ebx
lea edx, [edi + eax]
xor eax, eax
lea ecx, [esp + 4]
mov ecx, dword [ecx + eax*4]
xor dword [edx + eax*4], ecx
inc eax
cmp eax, 0x40
jne 0x4ed6c6
sub ebx, 0x100
jmp 0x4ed671
add esp, 0x104
pop edi
pop esi
pop ebx
ret
Function at 0x4f482c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
add eax, 0xc
mov eax, dword [eax]
mov dword [edx + 0xc], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0xc]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x5691a4]
mov dword [edx + eax*4 + 0x10], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x14], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x18], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x1c], ecx
add eax, 4
cmp eax, 0x28
jl 0x4f4857
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4f4918
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
add eax, 0x14
mov eax, dword [eax]
mov dword [edx + 0x14], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x14]
mov ebx, ecx
shl ebx, 0x18
shr ecx, 8
or ebx, ecx
mov ecx, ebx
movzx ebx, cl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 4], ebx
mov ebx, ecx
shr ebx, 8
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, ecx
shr ebx, 0x10
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
shr ecx, 0x18
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, esi
shl ebx, 8
shr esi, 0x18
or ebx, esi
xor ebx, dword [esp + 4]
mov esi, dword [esp + 8]
shl esi, 0x10
mov edi, dword [esp + 8]
shr edi, 0x10
or esi, edi
xor ebx, esi
mov esi, ecx
shl esi, 0x18
shr ecx, 8
or esi, ecx
xor ebx, esi
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x5691a4]
mov dword [edx + eax*4 + 0x18], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x18]
mov dword [edx + eax*4 + 0x1c], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x20], ebx
mov ecx, dword [edx + eax*4 + 0xc]
xor ecx, ebx
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 0x10]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, ebx
mov dword [edx + eax*4 + 0x2c], ecx
add eax, 6
cmp eax, 0x2e
jl 0x4f4953
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x4f4a28
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
mov ecx, dword [eax]
mov dword [edx], ecx
lea ecx, [eax + 4]
mov ecx, dword [ecx]
mov dword [edx + 4], ecx
lea ecx, [eax + 8]
mov ecx, dword [ecx]
mov dword [edx + 8], ecx
lea ecx, [eax + 0xc]
mov ecx, dword [ecx]
mov dword [edx + 0xc], ecx
lea ecx, [eax + 0x10]
mov ecx, dword [ecx]
mov dword [edx + 0x10], ecx
lea ecx, [eax + 0x14]
mov ecx, dword [ecx]
mov dword [edx + 0x14], ecx
lea ecx, [eax + 0x18]
mov ecx, dword [ecx]
mov dword [edx + 0x18], ecx
add eax, 0x1c
mov eax, dword [eax]
mov dword [edx + 0x1c], eax
xor eax, eax
mov dword [esp], 1
mov ecx, dword [edx + eax*4 + 0x1c]
mov edi, ecx
shl edi, 0x18
shr ecx, 8
or edi, ecx
mov ecx, edi
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4]
mov ecx, dword [esp]
xor ebx, dword [ecx*4 + 0x5691a4]
mov dword [edx + eax*4 + 0x20], ebx
inc dword [esp]
mov ecx, dword [edx + eax*4 + 4]
xor ecx, dword [edx + eax*4 + 0x20]
mov dword [edx + eax*4 + 0x24], ecx
mov ebx, dword [edx + eax*4 + 8]
xor ebx, ecx
mov dword [edx + eax*4 + 0x28], ebx
mov edi, dword [edx + eax*4 + 0xc]
xor edi, ebx
mov dword [edx + eax*4 + 0x2c], edi
movzx ecx, byte [edx + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + str.cwko0]
mov dword [esp + 4], ecx
mov ecx, edi
shr ecx, 8
movzx ecx, cl
mov ecx, dword [ecx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x10
movzx ebx, bl
mov esi, dword [ebx*4 + str.cwko0]
mov ebx, edi
shr ebx, 0x18
movzx ebx, bl
mov ebx, dword [ebx*4 + str.cwko0]
mov dword [esp + 8], ebx
mov ebx, ecx
shl ebx, 8
shr ecx, 0x18
or ebx, ecx
xor ebx, dword [esp + 4]
mov ecx, esi
shl ecx, 0x10
shr esi, 0x10
or ecx, esi
xor ebx, ecx
mov ecx, dword [esp + 8]
shl ecx, 0x18
mov esi, dword [esp + 8]
shr esi, 8
or ecx, esi
xor ebx, ecx
xor ebx, dword [edx + eax*4 + 0x10]
mov dword [edx + eax*4 + 0x30], ebx
mov ecx, dword [edx + eax*4 + 0x14]
xor ecx, dword [edx + eax*4 + 0x30]
mov dword [edx + eax*4 + 0x34], ecx
mov ebx, dword [edx + eax*4 + 0x18]
xor ebx, ecx
mov dword [edx + eax*4 + 0x38], ebx
mov ecx, dword [edx + eax*4 + 0x1c]
xor ecx, ebx
mov dword [edx + eax*4 + 0x3c], ecx
add eax, 8
cmp eax, 0x34
jl 0x4f4a73
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x500d3c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push ecx
mov ebx, 0x56a22c
test edx, edx
jne 0x500d4f
xor eax, eax
jmp 0x500e64
mov dword [esp], 1
cmp byte [esp], 0
je 0x500d6c
push ecx
push edx
push eax
call fcn.00500e68
add esp, 0xc
jmp 0x500e64
push ecx
push edx
push eax
call fcn.0050116c
add esp, 0xc
jmp 0x500e64
pop edx
pop esi
pop ebx
ret
Function at 0x50610c
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00401fcc
ret

Function at 0x5063b8
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], ecx
mov esi, eax
mov ebp, edx
xor ebx, ebx
xor edi, edi
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
test eax, eax
jle 0x506452
movzx edx, byte [esi + ebx]
shr edx, 2
movzx edx, byte [edx + 0x56d948]
mov byte [ebp + edi], dl
movzx edx, byte [esi + ebx]
and dl, 3
movzx edx, dl
shl edx, 4
movzx ecx, byte [esi + ebx + 1]
shr ecx, 4
add edx, ecx
movzx edx, byte [edx + 0x56d948]
push edx
pop edx
mov byte [ebp + edi + 1], dl
movzx edx, byte [esi + ebx + 1]
and dl, 0xf
movzx edx, dl
add edx, edx
add edx, edx
movzx ecx, byte [esi + ebx + 2]
shr ecx, 6
add edx, ecx
movzx edx, byte [edx + 0x56d948]
push edx
pop edx
mov byte [ebp + edi + 2], dl
movzx edx, byte [esi + ebx + 2]
and dl, 0x3f
movzx edx, dl
movzx edx, byte [edx + 0x56d948]
mov byte [ebp + edi + 3], dl
add edi, 4
add ebx, 3
dec eax
jne 0x5063d7
mov eax, dword [esp]
mov ecx, 3
cdq
idiv ecx
dec edx
je 0x506468
dec edx
je 0x50649d
jmp 0x5064ee
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x56d948]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx eax, byte [eax + 0x56d948]
mov byte [ebp + edi + 1], al
mov byte [ebp + edi + 2], 0x3d
mov byte [ebp + edi + 3], 0x3d
jmp 0x5064ee
movzx eax, byte [esi + ebx]
shr eax, 2
movzx eax, byte [eax + 0x56d948]
mov byte [ebp + edi], al
movzx eax, byte [esi + ebx]
and al, 3
movzx eax, al
shl eax, 4
movzx edx, byte [esi + ebx + 1]
shr edx, 4
add eax, edx
movzx eax, byte [eax + 0x56d948]
mov byte [ebp + edi + 1], al
movzx eax, byte [esi + ebx + 1]
and al, 0xf
movzx eax, al
add eax, eax
add eax, eax
movzx eax, byte [eax + 0x56d948]
mov byte [ebp + edi + 2], al
mov byte [ebp + edi + 3], 0x3d
mov eax, dword [esp]
add eax, 2
mov ecx, 3
cdq
idiv ecx
add eax, eax
add eax, eax
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5072c8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jbe 0x5072e9
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
movzx ebx, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x5072d6
pop edi
pop esi
pop ebx
ret
Function at 0x509284
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x50932e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x5092bd
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
cmp edx, 0
jne 0x5092c7
cmp eax, 0
jne 0x5092c7
mov eax, dword [ebp - 8]
call fcn.00401270
jmp 0x509318
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov ecx, eax
dec ecx
test ecx, ecx
jl 0x5092f6
inc ecx
xor esi, esi
mov eax, esi
mov edi, 0x16
cdq
idiv edi
movzx eax, byte [edx + str.vkj8ze67dpa9wx3my2h5gu]
xor byte [ebx], al
inc ebx
inc esi
dec ecx
jne 0x5092de
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx]
mov edx, eax
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.0048eb1c
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.00401568
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x509335
lea eax, [ebp - 0xc]
call fcn.00401270
ret

Function at 0x535d2c
Capabilities:
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], eax
mov eax, 0xedb88320
xor esi, esi
mov ebx, dword [esp]
mov edx, esi
mov ecx, 0xfffffff8
mov edi, edx
and edi, 1
dec edi
jne 0x535d52
shr edx, 1
xor edx, eax
jmp 0x535d54
shr edx, 1
inc ecx
jne 0x535d44
mov dword [ebx], edx
inc esi
add ebx, 4
cmp esi, 0x100
jne 0x535d3d
pop edx
pop edi
pop esi
pop ebx
ret