joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431240
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
mov eax, esi
call fcn.0042b5f0
test eax, eax
je 0x431290
mov edx, ebp
mov ecx, esi
imul edx, ebx
mov dword [esp], eax
mov eax, edi
call fcn.00430dc0
cmp eax, 0xffffffff
je 0x431284
add esp, 0x1c
xor edx, edx
div ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp sub.msvcrt.dll_fwrite

Function at 0x431e80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov dword [esp], 8
call fcn.00520a70
mov ebx, dword [sym.imp.msvcrt.dll__beginthreadex]
mov dword [eax], 0x433f00
mov dword [eax + 4], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4318d0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
test eax, eax
je 0x431f53
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], 0
call esi
sub esp, 4
mov dword [esp], 8
call fcn.00520a70
mov dword [eax], 0x431a00
mov dword [eax + 4], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x4318d0
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
test eax, eax
je 0x431f47
mov dword [esp], 0
call esi
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp], str.cannot_create_power_notification_thread
call fcn.004166f0
mov dword [esp], str.cannot_create_device_poll_thread
call fcn.004166f0
nop
Function at 0x4369d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test esi, esi
je 0x436adb
xor eax, eax
lea esi, [esi]
cmp esi, 2
jbe 0x436a60
movzx ebp, byte [ebx]
add edx, 4
add eax, 4
movzx edi, byte [ebx + 1]
add ebx, 3
shl ebp, 0x10
shl edi, 8
or ebp, edi
movzx edi, byte [ebx - 1]
or ebp, edi
mov edi, ebp
shr edi, 0x12
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, ebp
shr edi, 0xc
and edi, 0x3f
mov byte [edx - 4], cl
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, ebp
shr edi, 6
and edi, 0x3f
mov byte [edx - 3], cl
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 2], cl
mov ecx, ebp
and ecx, 0x3f
sub esi, 3
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 1], cl
jne 0x4369f0
mov ecx, edx
jmp 0x436a9b
movzx ecx, byte [ebx]
shl ecx, 0x10
cmp esi, 2
je 0x436aa3
mov ebx, ecx
shr ecx, 0xc
shr ebx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], cl
mov ecx, 0x3d
mov byte [edx], bl
mov byte [edx + 2], cl
add eax, 4
lea ecx, [edx + 4]
mov byte [edx + 3], 0x3d
mov byte [ecx], 0
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ebx, byte [ebx + 1]
shl ebx, 8
or ebx, ecx
mov ecx, ebx
shr ecx, 0x12
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
mov ecx, ebx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shr ebx, 6
and ebx, 0x3f
mov byte [edx + 1], cl
movzx ecx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x436a8e
mov ecx, edx
xor eax, eax
jmp 0x436a9b
Function at 0x43cdf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x44
mov eax, dword [esp + 0x58]
mov dword [esp + 0x34], esi
mov edx, dword [eax]
cmp dword [eax + 4], 1
mov ebx, dword [edx]
mov dword [esp + 0x30], ebx
jle 0x43ce1a
mov eax, dword [edx + 4]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], eax
xor eax, eax
xor edx, edx
mov dword [esp + 0x3c], 0x40
mov esi, 1
xor edi, edi
mov ecx, eax
mov ebx, edx
mov eax, esi
and eax, 1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ecx
neg eax
mov dword [esp], eax
mov eax, dword [esp + 0x30]
adc edx, 0
mov ebp, dword [esp]
neg edx
mov dword [esp + 4], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x20], 0
and ebp, eax
mov eax, dword [esp + 4]
mov ebx, ebp
and ebp, esi
xor ebx, esi
mov dword [esp + 0x18], ebx
and eax, edx
mov edx, dword [esp + 0x18]
mov ebx, eax
and eax, edi
xor ebx, edi
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0x2c]
mov dword [esp + 8], ebp
shrd edx, ecx, 1
shr ecx, 1
mov esi, edx
mov edi, ecx
mov ecx, dword [esp + 0x28]
add esi, dword [esp + 8]
adc edi, dword [esp + 0xc]
and eax, 0x80000000
mov dword [esp + 0x24], eax
shrd ecx, ebx, 1
shr ebx, 1
add ecx, dword [esp + 0x20]
adc ebx, dword [esp + 0x24]
sub dword [esp + 0x3c], 1
jne 0x43ce31
add esp, 0x44
mov edx, ebx
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x444bb0
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
test ebx, ebx
je 0x444bde
xor edx, edx
xor eax, eax
movzx ecx, byte [edi + edx]
xor cl, byte [esi + edx]
add edx, 1
or eax, ecx
cmp edx, ebx
jne 0x444bc7
movzx eax, al
pop ebx
pop esi
pop edi
ret
xor eax, eax
jmp 0x444bda

Function at 0x444bf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x444c18
mov edx, dword [esp + 8]
mov eax, 0x811c9dc5
add ebx, edx
movzx ecx, byte [edx]
add edx, 1
xor ecx, eax
imul eax, ecx, 0x1000193
cmp edx, ebx
jne 0x444c04
pop ebx
ret
mov eax, 0x811c9dc5
pop ebx
ret
Function at 0x451f20
Capabilities:
Hash data using sha224

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x70
test dl, 1
mov edi, edx
jne 0x451fa0
test edi, 2
jne 0x451fb0
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x451f51
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x451f59
mov byte [edi], 0
mov dword [edx], 0xc1059ed8
mov eax, 1
mov dword [edx + 4], 0x367cd507
mov dword [edx + 8], 0x3070dd17
mov dword [edx + 0xc], 0xf70e5939
mov dword [edx + 0x10], 0xffc00b31
mov dword [edx + 0x14], 0x68581511
mov dword [edx + 0x18], 0x64f98fa7
mov dword [edx + 0x1c], 0xbefa4fa4
mov dword [edx + 0x6c], 0x1c
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x6f
test edi, 2
mov byte [edx], 0
je 0x451f3a
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x451f3a

Function at 0x451fd0
Capabilities:
Hash data using sha256

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x70
test dl, 1
mov edi, edx
jne 0x452050
test edi, 2
jne 0x452060
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x452001
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x452009
mov byte [edi], 0
mov dword [edx], 0x6a09e667
mov eax, 1
mov dword [edx + 4], 0xbb67ae85
mov dword [edx + 8], 0x3c6ef372
mov dword [edx + 0xc], 0xa54ff53a
mov dword [edx + 0x10], 0x510e527f
mov dword [edx + 0x14], 0x9b05688c
mov dword [edx + 0x18], 0x1f83d9ab
mov dword [edx + 0x1c], 0x5be0cd19
mov dword [edx + 0x6c], 0x20
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x6f
test edi, 2
mov byte [edx], 0
je 0x451fea
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x451fea

Function at 0x4520e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 8]
mov ecx, 1
mov eax, dword [esp + 4]
jmp fcn.00450c30
Function at 0x452f80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 8]
mov ecx, 1
mov eax, dword [esp + 4]
jmp fcn.00452400

Function at 0x453320
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov eax, 0x57b480
push ebx
sub esp, 0xf4
mov ebx, dword [esp + 0x108]
lea esi, [esp + 0x18]
mov dword [esp], esi
mov dword [esp + 0x18], 0xf3bcc908
mov dword [esp + 0x1c], 0x6a09e667
test ebx, ebx
cmove ebx, eax
mov eax, dword [esp + 0x104]
mov dword [esp + 0x20], 0x84caa73b
mov dword [esp + 0x24], 0xbb67ae85
mov dword [esp + 0x28], 0xfe94f82b
mov dword [esp + 8], eax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x2c], 0x3c6ef372
mov dword [esp + 0x30], 0x5f1d36f1
mov dword [esp + 0x34], 0xa54ff53a
mov dword [esp + 4], eax
mov dword [esp + 0x38], 0xade682d1
mov dword [esp + 0x3c], 0x510e527f
mov dword [esp + 0x40], 0x2b3e6c1f
mov dword [esp + 0x44], 0x9b05688c
mov dword [esp + 0x48], 0xfb41bd6b
mov dword [esp + 0x4c], 0x1f83d9ab
mov dword [esp + 0x50], 0x137e2179
mov dword [esp + 0x54], 0x5be0cd19
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], 0x40
call sym.adb.exe_SHA512_Update
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.adb.exe_SHA512_Final
mov dword [esp], esi
mov dword [esp + 4], 0xd8
call sym.adb.exe_OPENSSL_cleanse
add esp, 0xf4
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x453450
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov eax, 0x57b4c0
push ebx
sub esp, 0xf4
mov ebx, dword [esp + 0x108]
lea esi, [esp + 0x18]
mov dword [esp], esi
mov dword [esp + 0x18], 0xc1059ed8
mov dword [esp + 0x1c], 0xcbbb9d5d
test ebx, ebx
cmove ebx, eax
mov eax, dword [esp + 0x104]
mov dword [esp + 0x20], 0x367cd507
mov dword [esp + 0x24], 0x629a292a
mov dword [esp + 0x28], 0x3070dd17
mov dword [esp + 8], eax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x2c], 0x9159015a
mov dword [esp + 0x30], 0xf70e5939
mov dword [esp + 0x34], 0x152fecd8
mov dword [esp + 4], eax
mov dword [esp + 0x38], 0xffc00b31
mov dword [esp + 0x3c], 0x67332667
mov dword [esp + 0x40], 0x68581511
mov dword [esp + 0x44], 0x8eb44a87
mov dword [esp + 0x48], 0x64f98fa7
mov dword [esp + 0x4c], 0xdb0c2e0d
mov dword [esp + 0x50], 0xbefa4fa4
mov dword [esp + 0x54], 0x47b5481d
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], 0x30
call sym.adb.exe_SHA512_Update
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.adb.exe_SHA512_Final
mov dword [esp], esi
mov dword [esp + 4], 0xd8
call sym.adb.exe_OPENSSL_cleanse
add esp, 0xf4
mov eax, ebx
pop ebx
pop esi
ret
Function at 0x465e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, 1
push esi
mov esi, edi
push ebx
sub esp, 0x4c
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x2c], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov ecx, ebx
shl esi, cl
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], edx
call sym.adb.exe_bn_wexpand
test eax, eax
je 0x46604c
cmp ebx, 3
jg 0x465f05
mov ecx, dword [esp + 0x34]
test ecx, ecx
jle 0x465ee5
lea eax, [esi*4]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
lea esi, [esi]
test esi, esi
jle 0x466045
mov ecx, dword [esp + 0x2c]
xor edi, edi
xor eax, eax
mov ebx, dword [esp + 0x60]
add ecx, 4
mov ebp, dword [ecx - 4]
xor ebx, eax
add eax, 1
lea edx, [ebx - 1]
not ebx
and edx, ebx
sar edx, 0x1f
and edx, ebp
or edi, edx
cmp eax, esi
jne 0x465ea0
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 8]
add dword [esp + 8], 1
mov eax, dword [eax]
mov dword [eax + edx*4], edi
mov eax, dword [esp + 0xc]
add dword [esp + 0x2c], eax
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x34]
jne 0x465e90
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x34]
mov dword [eax + 4], esi
mov dword [esp], eax
call sym.adb.exe_bn_correct_top
add esp, 0x4c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea ecx, [ebx - 2]
shl edi, cl
lea eax, [edi - 1]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x60]
and dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
sar eax, cl
mov ecx, eax
mov edx, ecx
not edx
lea eax, [eax - 1]
and eax, edx
cdq
mov dword [esp + 0x18], edx
mov edx, ecx
xor edx, 1
lea eax, [edx - 1]
not edx
and eax, edx
cdq
mov dword [esp + 0x1c], edx
mov edx, ecx
xor edx, 2
lea eax, [edx - 1]
not edx
and eax, edx
cdq
mov dword [esp + 0x20], edx
mov edx, ecx
xor edx, 3
lea eax, [edx - 1]
not edx
and eax, edx
cdq
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x34]
test edx, edx
jle 0x465ee5
lea eax, [esi*4]
mov dword [esp + 0x3c], eax
lea eax, [edi*4]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], 0
test eax, eax
jle 0x46603b
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea esi, [esi]
mov edi, dword [esp + 0x28]
mov ebx, dword [edx]
mov ebp, dword [esp + 8]
xor ebp, dword [esp + 0x14]
lea ecx, [edx + edi]
add edx, 4
mov eax, dword [ecx]
add ecx, edi
mov esi, dword [ecx]
add ecx, edi
and eax, dword [esp + 0x1c]
and esi, dword [esp + 0x20]
and ebx, dword [esp + 0x18]
mov ecx, dword [ecx]
lea edi, [ebp - 1]
not ebp
and ecx, dword [esp + 0x24]
or eax, esi
and edi, ebp
or eax, ebx
sar edi, 0x1f
or eax, ecx
and edi, eax
mov eax, dword [esp + 0x10]
add dword [esp + 8], 1
or dword [esp + 0xc], edi
cmp dword [esp + 8], eax
jne 0x465fb0
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0xc]
add dword [esp + 0x30], 1
mov eax, dword [eax]
mov dword [eax + esi*4], edx
mov eax, dword [esp + 0x3c]
add dword [esp + 0x2c], eax
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x34]
je 0x465ee5
mov eax, dword [esp + 0x10]
test eax, eax
jg 0x465f98
mov dword [esp + 0xc], 0
jmp 0x466003
xor edi, edi
jmp 0x465ec1
add esp, 0x4c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x47f5b0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [esp + 0x14c]
mov esi, dword [esp + 0x140]
mov edi, dword [esp + 0x148]
test ebx, ebx
je 0x47f70b
cmp ebx, dword [esi]
je 0x47f70d
mov dword [esp], ebx
call sym.adb.exe_EVP_MD_block_size
cmp eax, edi
jb 0x47f73b
test edi, edi
lea ebp, [esp + 0xa0]
jne 0x47f6ef
mov dword [esp + 0x1c], edi
cmp edi, 0x80
je 0x47f627
mov eax, pe_nt_image_headers32
sub eax, edi
add edi, ebp
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], edi
call sub.msvcrt.dll_memset
xor eax, eax
lea esi, [esi]
movzx edx, byte [ebp + eax]
xor edx, 0x36
mov byte [esp + eax + 0x20], dl
add eax, 1
cmp eax, 0x80
jne 0x47f630
mov eax, dword [esp + 0x150]
lea edi, [esi + 0x14]
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 8], eax
call sym.adb.exe_EVP_DigestInit_ex
test eax, eax
jne 0x47f671
xor eax, eax
add esp, 0x12c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call sym.adb.exe_EVP_MD_block_size
mov dword [esp], edi
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
call sym.adb.exe_EVP_DigestUpdate
test eax, eax
je 0x47f664
xor eax, eax
movzx edx, byte [ebp + eax]
xor edx, 0x5c
mov byte [esp + eax + 0x20], dl
add eax, 1
cmp eax, 0x80
jne 0x47f693
mov eax, dword [esp + 0x150]
lea ebp, [esi + 0x24]
mov dword [esp + 4], ebx
mov dword [esp], ebp
mov dword [esp + 8], eax
call sym.adb.exe_EVP_DigestInit_ex
test eax, eax
je 0x47f664
mov dword [esp], ebx
call sym.adb.exe_EVP_MD_block_size
mov dword [esp], ebp
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
call sym.adb.exe_EVP_DigestUpdate
test eax, eax
je 0x47f664
mov dword [esi], ebx
jmp 0x47f71f
mov eax, dword [esp + 0x144]
mov dword [esp + 8], edi
mov dword [esp], ebp
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
jmp 0x47f5fe
mov ebx, dword [esi]
mov eax, dword [esp + 0x144]
test eax, eax
jne 0x47f5df
lea edi, [esi + 0x14]
add esi, 4
mov dword [esp + 4], edi
mov dword [esp], esi
call sym.adb.exe_EVP_MD_CTX_copy_ex
test eax, eax
setne al
movzx eax, al
jmp 0x47f666
mov eax, dword [esp + 0x150]
lea edx, [esi + 4]
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
call sym.adb.exe_EVP_DigestInit_ex
mov edx, dword [esp + 0xc]
test eax, eax
je 0x47f664
mov eax, dword [esp + 0x144]
mov dword [esp], edx
mov dword [esp + 8], edi
mov dword [esp + 4], eax
call sym.adb.exe_EVP_DigestUpdate
mov edx, dword [esp + 0xc]
test eax, eax
je 0x47f664
lea eax, [esp + 0x1c]
lea ebp, [esp + 0xa0]
mov dword [esp + 8], eax
mov dword [esp + 4], ebp
mov dword [esp], edx
call sym.adb.exe_EVP_DigestFinal_ex
test eax, eax
je 0x47f664
mov edi, dword [esp + 0x1c]
jmp 0x47f602
Function at 0x47ff20
Capabilities:
Hash data with md5

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x5c
test dl, 1
mov edi, edx
jne 0x47ff80
test edi, 2
jne 0x47ff90
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x47ff51
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x47ff59
mov byte [edi], 0
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x5b
test edi, 2
mov byte [edx], 0
je 0x47ff3a
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x47ff3a

Function at 0x480ac0
Capabilities:
Hash data with md5

Disassembly:
push edi
xor eax, eax
push esi
mov ecx, 0x17
push ebx
sub esp, 0x70
lea ebx, [esp + 0x14]
mov esi, dword [esp + 0x88]
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x84]
mov dword [esp], ebx
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 8], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
mov dword [esp + 4], eax
call sym.adb.exe_MD4_Update
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym.adb.exe_MD4_Final
add esp, 0x70
mov eax, esi
pop ebx
pop esi
pop edi
ret

Function at 0x480b30
Capabilities:
Hash data with md5

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x5c
test dl, 1
mov edi, edx
jne 0x480b90
test edi, 2
jne 0x480ba0
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x480b61
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x480b69
mov byte [edi], 0
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x5b
test edi, 2
mov byte [edx], 0
je 0x480b4a
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x480b4a

Function at 0x481910
Capabilities:
Hash data with md5

Disassembly:
push edi
mov eax, 0x57b580
push esi
mov ecx, 0x17
push ebx
sub esp, 0x70
mov ebx, dword [esp + 0x88]
lea esi, [esp + 0x14]
mov edi, esi
test ebx, ebx
cmove ebx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x84]
mov dword [esp], esi
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 8], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
mov dword [esp + 4], eax
call sym.adb.exe_MD5_Update
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.adb.exe_MD5_Final
add esp, 0x70
mov eax, ebx
pop ebx
pop esi
pop edi
ret
Function at 0x481c80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x48]
mov ebx, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov edi, dword [eax]
test edi, edi
je 0x481cdb
mov eax, dword [esp + 0x38]
test eax, eax
je 0x481cdb
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
jmp 0x481cb4
test ebp, ebp
je 0x481ccf
movzx eax, byte [esi + edi]
add edx, 1
add edi, 1
xor al, byte [edx - 1]
add ecx, 1
sub ebp, 1
and edi, 0xf
mov byte [ecx - 1], al
jne 0x481cb0
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ebp
cmp dword [esp + 0x38], 0xf
jbe 0x481de1
mov eax, dword [esp + 0x38]
mov ebp, dword [esp + 0x34]
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [esp + 0x4c]
mov edx, 1
mov eax, 0x10
sub eax, 1
movzx ecx, byte [ebx + eax]
add edx, ecx
mov byte [ebx + eax], dl
shr edx, 8
test eax, eax
jne 0x481d13
mov edx, dword [esi + eax]
xor edx, dword [edi + eax]
mov dword [ebp + eax], edx
add eax, 4
cmp eax, 0x10
jne 0x481d26
sub dword [esp + 0xc], 0x10
add ebp, 0x10
add edi, 0x10
cmp dword [esp + 0xc], 0xf
ja 0x481cf6
mov eax, dword [esp + 0x38]
xor edi, edi
mov ebp, dword [esp + 0x38]
sub eax, 0x10
and eax, 0xfffffff0
and ebp, 0xf
add eax, 0x10
add dword [esp + 0x34], eax
add dword [esp + 0x30], eax
test ebp, ebp
jne 0x481d7a
mov eax, dword [esp + 0x48]
mov dword [eax], edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [esp + 0x4c]
mov edx, 1
mov eax, 0x10
sub eax, 1
movzx ecx, byte [ebx + eax]
add edx, ecx
mov byte [ebx + eax], dl
shr edx, 8
test eax, eax
jne 0x481d97
mov ecx, dword [esp + 0x34]
lea ebx, [esi + edi]
mov esi, dword [esp + 0x30]
add ecx, edi
add esi, edi
lea esi, [esi]
movzx edx, byte [ebx + eax]
xor dl, byte [esi + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, ebp
jne 0x481dc0
add edi, eax
mov eax, dword [esp + 0x48]
mov dword [eax], edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [esp + 0x38]
jmp 0x481d68
Function at 0x482850
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebp, dword [esp + 0x40]
cmp dword [esp + 0x4c], 0xc
mov edi, dword [esp + 0x48]
mov dword [ebp], 0
mov dword [ebp + 4], 0
mov dword [ebp + 8], 0
mov dword [ebp + 0xc], 0
mov dword [ebp + 0x40], 0
mov dword [ebp + 0x44], 0
mov dword [ebp + 0x48], 0
mov dword [ebp + 0x4c], 0
mov dword [ebp + 0x30], 0
mov dword [ebp + 0x34], 0
mov dword [ebp + 0x38], 0
mov dword [ebp + 0x3c], 0
mov dword [ebp + 0x15c], 0
mov dword [ebp + 0x158], 0
je 0x4829c5
mov eax, dword [esp + 0x4c]
xor edx, edx
mov ebx, edi
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
lea eax, [ebp + 0x50]
cmp esi, 0xf
mov dword [esp + 0x14], eax
jbe 0x482940
mov dword [esp + 0x48], edi
mov edi, esi
mov esi, ebx
mov ebx, dword [esp + 0x14]
nop
xor eax, eax
movzx edx, byte [esi + eax]
xor byte [ebp + eax], dl
add eax, 1
cmp eax, 0x10
jne 0x482902
mov dword [esp + 4], ebx
sub edi, 0x10
add esi, 0x10
mov dword [esp], ebp
call fcn.004821a0
cmp edi, 0xf
ja 0x482900
mov eax, dword [esp + 0x4c]
mov edi, dword [esp + 0x48]
and dword [esp + 0x4c], 0xf
sub eax, 0x10
and eax, 0xfffffff0
lea edi, [edi + eax + 0x10]
mov ebx, dword [esp + 0x4c]
test ebx, ebx
je 0x48296f
mov ecx, dword [esp + 0x4c]
xor eax, eax
nop
movzx edx, byte [edi + eax]
xor byte [ebp + eax], dl
add eax, 1
cmp eax, ecx
jne 0x482950
mov eax, dword [esp + 0x14]
mov dword [esp], ebp
mov dword [esp + 4], eax
call fcn.004821a0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
shld edx, eax, 3
shl eax, 3
bswap edx
bswap eax
xor dword [ebp + 0xc], eax
mov eax, dword [esp + 0x14]
xor dword [ebp + 8], edx
mov dword [esp], ebp
mov dword [esp + 4], eax
call fcn.004821a0
mov ebx, dword [ebp + 0xc]
bswap ebx
add ebx, 1
bswap ebx
mov eax, dword [esp + 0x44]
mov dword [esp], ebp
mov dword [esp + 8], eax
lea eax, [ebp + 0x20]
mov dword [esp + 4], eax
call dword [ebp + 0x160]
mov dword [ebp + 0xc], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [edi]
mov ebx, 0x2000000
mov dword [ebp], eax
mov eax, dword [edi + 4]
mov dword [ebp + 4], eax
mov eax, dword [edi + 8]
mov byte [ebp + 0xf], 1
mov dword [ebp + 8], eax
jmp 0x4829a2