joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d6b0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x6d4888]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [0x6d4888]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x41cfb5
pop edi
pop esi
ret
mov eax, dword [fcn.00413ef0]
test eax, eax
je 0x41cfda
cmp eax, fcn.00413ef0
je 0x41cfda
push 0x49
push str.....crypto_async_async.c
push edi
call eax
add esp, 0xc
pop edi
mov eax, 1
pop esi
ret
push edi
call fcn.005dcea1
add esp, 4
pop edi
mov eax, 1
pop esi
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
call ebx
mov edi, eax
mov eax, dword [0x6d488c]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x41d720
push esi
call fcn.0041d480
mov edi, dword [esi]
add esp, 4
call fcn.0042cfc0
mov eax, dword [fcn.00413ef0]
test eax, eax
je 0x41d708
cmp eax, fcn.00413ef0
je 0x41d708
push 0x180
push str.....crypto_async_async.c
push esi
call eax
add esp, 0xc
jmp 0x41d711
push esi
call fcn.005dcea1
add esp, 4
mov ecx, dword [0x6d488c]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call ebx
mov edx, dword [0x6d4888]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x41d755
cmp dword [esi], 0
je 0x41d755
cmp dword [esi + 4], 0
je 0x41d755
call dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov dword [esi], 0
pop edi
pop esi
pop ebx
jmp 0x41cf80

Function at 0x41d780
Capabilities:
Get thread local storage value

Disassembly:
push 0
push 0
push 0x100
call fcn.00403c80
add esp, 0xc
test eax, eax
jne 0x41d796
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x6d4888]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x41d7be
pop edi
xor eax, eax
pop esi
ret
mov eax, dword [esi + 8]
pop edi
pop esi
ret

Function at 0x428020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push esi
xor esi, esi
test edx, edx
je 0x42806e
mov al, byte [edx]
test al, al
je 0x42806e
push edi
mov edi, 0x100
lea esp, [esp]
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
inc edx
xor esi, eax
mov al, byte [edx]
test al, al
jne 0x428040
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x431890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x84], 0xffffffff
jne 0x4318a9
pop edi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, dword [edi]
mov ecx, dword [eax]
push esi
mov esi, dword [ecx + 4]
mov dword [edx], esi
test ebx, ebx
je 0x43193c
mov eax, dword [edi + 0x84]
cmp eax, esi
jne 0x4318de
test esi, esi
jle 0x431917
mov ecx, ebx
lea eax, [edi + 4]
mov edx, esi
mov bl, byte [eax + 0x60]
xor bl, byte [eax]
inc eax
mov byte [ecx], bl
inc ecx
dec edx
jne 0x4318d0
jmp 0x431914
mov ecx, esi
sub ecx, eax
mov byte [eax + edi + 0x64], 0x80
cmp ecx, 1
jle 0x4318fd
dec ecx
push ecx
lea eax, [eax + edi + 0x65]
push 0
push eax
call fcn.005dd9b0
add esp, 0xc
test esi, esi
jle 0x431917
mov ecx, ebx
lea eax, [edi + 0x24]
mov edx, esi
mov bl, byte [eax + 0x40]
xor bl, byte [eax]
inc eax
mov byte [ecx], bl
inc ecx
dec edx
jne 0x431908
mov ebx, dword [ebp + 8]
mov edi, dword [edi]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x18]
push esi
push ebx
push ebx
push edi
call edx
add esp, 0x10
test eax, eax
jne 0x43193c
push esi
push ebx
call fcn.00587a20
add esp, 8
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
pop esi
pop edi
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x433870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
movzx edi, byte [ebp + 0xc]
mov eax, edi
and eax, 1
add esi, ecx
add edx, ecx
test ecx, ecx
je 0x4338a3
push ebx
lea ebx, [ebx]
movzx ebx, byte [edx - 1]
dec edx
xor ebx, edi
add eax, ebx
dec esi
mov byte [esi], al
shr eax, 8
dec ecx
jne 0x433890
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x435330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push edi
cmp eax, 0x1e
ja 0x435348
mov ecx, dword [eax*4 + 0x675b40]
jmp 0x43534a
xor ecx, ecx
test ecx, 0x2956
jne 0x43538f
mov edi, dword [ebp + 8]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [esi]
push eax
call fcn.00449e50
add esp, 4
test eax, eax
je 0x435389
and dword [edi + 0xc], 0x80
mov ecx, dword [esi + 0xc]
and ecx, 0xffffff7f
or ecx, dword [edi + 0xc]
mov eax, 1
mov dword [edi + 0xc], ecx
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
lea edi, [ebx + 8]
push edi
mov ecx, esi
mov dword [ebx + 4], 0xc
call fcn.0045e6a0
add esp, 4
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x4353b6
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret
mov edx, dword [edi]
mov edi, eax
mov ecx, edx
test edi, edi
jle 0x4353f8
movzx eax, byte [ecx]
cmp eax, 0x7f
ja 0x4353d8
test byte [eax*2 + 0x684b40], 8
je 0x4353d8
dec edi
inc ecx
test edi, edi
jg 0x4353c0
test edi, edi
jle 0x4353f8
lea esi, [edi + ecx - 1]
movzx eax, byte [esi]
cmp eax, 0x7f
ja 0x4353f8
test byte [eax*2 + 0x684b40], 8
je 0x4353f8
dec edi
dec esi
test edi, edi
jg 0x4353e0
xor esi, esi
test edi, edi
jle 0x435458
mov edi, edi
mov bl, byte [ecx]
movzx eax, bl
test eax, 0xffffff80
je 0x435410
mov byte [edx], bl
jmp 0x43544e
cmp eax, 0x7f
ja 0x43544c
test byte [eax*2 + 0x684b40], 8
je 0x43543a
mov byte [edx], 0x20
inc edx
movzx eax, byte [ecx + 1]
inc ecx
inc esi
cmp eax, 0x7f
ja 0x435451
test byte [eax*2 + 0x684b40], 8
jne 0x435423
jmp 0x435451
cmp eax, 0x7f
ja 0x43544c
test byte [eax*2 + 0x684b40], 2
je 0x43544c
xor eax, 0x20
mov byte [edx], al
inc edx
inc ecx
inc esi
cmp esi, edi
jl 0x435400
mov ebx, dword [ebp + 8]
sub edx, dword [ebx + 8]
mov eax, 1
mov dword [ebx], edx
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x443c20
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x42c
call fcn.005e38a0
mov eax, dword [0x6c6e10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x42c], eax
call fcn.00443430
cmp eax, 1
je 0x443c63
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dcf8a
mov esp, ebp
pop ebp
ret
push 0x400
lea ecx, [ebp - 0x427]
push 0
push ecx
mov byte [ebp - 0x428], 0
call fcn.005dd9b0
xor eax, eax
add esp, 0xc
cmp word [esi], 2
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov byte [ebp - 0x24], 0
mov eax, 0x10
je 0x443cb2
mov eax, 0x1c
push edi
push 0xa
push 0x20
lea edx, [ebp - 0x24]
push edx
push 0x401
lea ecx, [ebp - 0x428]
push ecx
push eax
push esi
call dword [sym.imp.WS2_32.dll_getnameinfo]
mov edi, eax
test edi, edi
je 0x443d31
push 0xd7
push str.....crypto_bio_b_addr.c
push 2
push 0x86
push 0x20
call fcn.004058f0
add esp, 0x14
push 0
push 0x400
push 0x6d60a0
push 0x400
push edi
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x6d60a0
push 1
call fcn.00406f60
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dcf8a
mov esp, ebp
pop ebp
ret
cmp byte [ebp - 0x24], 0
jne 0x443d70
movzx eax, word [esi]
cmp eax, 2
jne 0x443d45
movzx eax, word [esi + 2]
jmp 0x443d52
cmp eax, 0x17
jne 0x443d50
movzx eax, word [esi + 2]
jmp 0x443d52
xor eax, eax
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx edx, ax
push edx
push 0x699f00
lea eax, [ebp - 0x24]
push 0x20
push eax
call fcn.004295d0
add esp, 0x10
test ebx, ebx
je 0x443d8e
push 0xe9
push str.....crypto_bio_b_addr.c
lea edi, [ebp - 0x428]
call fcn.00427310
add esp, 8
mov dword [ebx], eax
mov esi, dword [ebp - 0x42c]
test esi, esi
je 0x443daf
push 0xeb
push str.....crypto_bio_b_addr.c
lea edi, [ebp - 0x24]
call fcn.00427310
add esp, 8
mov dword [esi], eax
test ebx, ebx
je 0x443db8
cmp dword [ebx], 0
je 0x443dc9
test esi, esi
je 0x443e6f
cmp dword [esi], 0
jne 0x443e6f
mov esi, dword [fcn.00413ef0]
test ebx, ebx
je 0x443e08
mov eax, dword [ebx]
test esi, esi
je 0x443df9
cmp esi, fcn.00413ef0
je 0x443df9
push 0xfa
push str.....crypto_bio_b_addr.c
push eax
call esi
mov esi, dword [fcn.00413ef0]
add esp, 0xc
jmp 0x443e02
push eax
call fcn.005dcea1
add esp, 4
mov dword [ebx], 0
mov edi, dword [ebp - 0x42c]
test edi, edi
je 0x443e41
mov eax, dword [edi]
test esi, esi
je 0x443e32
cmp esi, fcn.00413ef0
je 0x443e32
push 0xfe
push str.....crypto_bio_b_addr.c
push eax
call esi
add esp, 0xc
jmp 0x443e3b
push eax
call fcn.005dcea1
add esp, 4
mov dword [edi], 0
push 0x101
push str.....crypto_bio_b_addr.c
push 0x41
push 0x86
push 0x20
call fcn.004058f0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dcf8a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.005dcf8a
mov esp, ebp
pop ebp
ret
Function at 0x444420
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24
call fcn.005e38a0
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, esi
sub eax, edi
mov dword [ebp - 4], edi
je 0x44446c
sub eax, 2
je 0x44446c
sub eax, 0x15
je 0x44446c
push 0x293
push str.....crypto_bio_b_addr.c
push 0x83
push 0x8f
push 0x20
call fcn.004058f0
add esp, 0x14
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call fcn.00443430
mov ecx, 1
cmp eax, ecx
jne 0x444464
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edi
cmp esi, edi
jne 0x4444a9
or eax, 0x400
mov dword [ebp - 0x24], eax
cmp dword [ebp + 0x10], ecx
jne 0x4444b3
or eax, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_getaddrinfo]
push eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x24]
push ecx
push edx
push eax
call ebx
mov esi, eax
test esi, esi
je 0x444506
cmp esi, 8
je 0x444553
mov eax, dword [ebp - 0x24]
test eax, 0x400
je 0x444517
mov ecx, dword [ebp + 0x14]
and eax, 0xfffffbff
push ecx
mov ecx, dword [ebp + 8]
or eax, 4
lea edx, [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
push edx
push eax
push ecx
mov edi, esi
call ebx
mov esi, eax
test esi, esi
jne 0x4444d2
pop ebx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x2d6
push str.....crypto_bio_b_addr.c
push 2
push 0x8f
push 0x20
call fcn.004058f0
add esp, 0x14
test edi, edi
je 0x444538
mov esi, edi
push esi
call fcn.004439b0
push eax
push 1
call fcn.00406f60
mov eax, dword [ebp - 4]
add esp, 0xc
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x2c7
push str.....crypto_bio_b_addr.c
push 0x41
push 0x8f
push 0x20
call fcn.004058f0
mov eax, dword [ebp - 4]
add esp, 0x14
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x446050
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x68
call fcn.005e38a0
mov eax, dword [0x6c6e10]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
test esi, esi
jne 0x44607b
mov esi, 0x6d4a24
push 0x60
lea eax, [esp + 0xc]
push 0
push eax
call fcn.005dd9b0
add esp, 0xc
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
mov dword [esp + 0x18], 0xc3d2e1f0
test ebx, ebx
je 0x4460c7
push edi
mov ecx, ebx
lea edx, [esp + 0xc]
call fcn.0045a5f0
add esp, 4
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.0045a700
lea edx, [esp + 0xc]
push 0x60
push edx
call fcn.00587a20
mov ecx, dword [esp + 0x78]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.005dcf8a
mov esp, ebp
pop ebp
ret
Function at 0x446100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x38
call fcn.005e38a0
mov eax, dword [0x6c6e10]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
movzx ebx, byte [eax + 5]
mov dword [ebp - 0x34], eax
inc eax
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x28], edx
movzx edx, byte [eax]
mov dword [ebp - 0x10], ecx
mov edi, dword [ecx]
movzx ecx, byte [eax - 1]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 1]
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 2]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax + 3]
mov dword [ebp - 0x2c], eax
shl ebx, 8
or edx, ebx
movzx ebx, byte [eax + 6]
movzx eax, byte [eax + 5]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xb], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xa], al
shl ebx, 0x10
or edx, ebx
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 9], al
mov eax, edx
shr eax, 8
mov byte [ebp - 7], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 6], al
mov eax, edx
shr eax, 0x18
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
mov byte [ebp - 0xc], cl
mov byte [ebp - 8], dl
mov byte [ebp - 5], al
test esi, esi
je 0x4462b4
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
sub eax, esi
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x18]
test edi, edi
jne 0x446238
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
push ecx
push edx
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.00588ca0
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov ebx, eax
shr ebx, 8
mov byte [ebp - 0xb], bl
mov ebx, eax
mov ecx, eax
mov byte [ebp - 0xc], al
shr eax, 0x18
shr ebx, 0x10
mov byte [ebp - 9], al
mov eax, edx
mov byte [ebp - 0xa], bl
mov ebx, eax
shr ebx, 8
mov byte [ebp - 7], bl
mov ebx, eax
mov byte [ebp - 8], al
shr eax, 0x18
shr ebx, 0x10
add esp, 0x10
inc dword [ebp - 0x1c]
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x14]
mov byte [ebp - 6], bl
mov bl, byte [ebp + edi - 0xc]
xor bl, byte [esi]
inc edi
mov byte [eax + esi], bl
inc esi
and edi, 7
cmp dword [ebp - 0x18], 0
jne 0x4461d7
cmp dword [ebp - 0x1c], 0
je 0x44629e
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov byte [eax], cl
mov eax, ecx
shr eax, 8
mov byte [esi], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 1], al
shr ecx, 0x18
mov byte [esi + 2], cl
mov byte [esi + 3], dl
mov ecx, edx
shr ecx, 8
mov byte [esi + 4], cl
mov ecx, dword [ebp - 0x10]
mov eax, edx
shr eax, 0x10
mov byte [esi + 5], al
shr edx, 0x18
mov byte [esi + 6], dl
mov dword [ecx], edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dcf8a
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x10]
mov dword [edx], edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dcf8a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov dword [eax], edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005dcf8a
mov esp, ebp
pop ebp
ret
Function at 0x44f750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.005e38a0
cmp dword [ecx], 0x72
mov eax, dword [ebp + 0xc]
jne 0x44f8a6
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
push ebx
mov ebx, eax
push edi
push ecx
mov ecx, dword [ebp + 0x10]
and eax, 1
shr ebx, 1
add eax, ebx
push eax
push edx
mov edx, dword [ebp + 0x18]
push 0x691b70
mov dword [ebp - 4], eax
call fcn.0044f480
add esp, 0x14
test eax, eax
jne 0x44f79c
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [fcn.00413cb0]
push esi
test eax, eax
je 0x44f7bf
cmp eax, fcn.00413cb0
je 0x44f7bf
push 0x104
push str.....cryptokdf_tls1_prf.c
push edi
call eax
add esp, 0xc
jmp 0x44f7df
test edi, edi
je 0x44f7e5
cmp dword [0x6cc8e4], 0
je 0x44f7d6
mov dword [0x6cc8e4], 0
push edi
call fcn.005e325a
add esp, 4
mov esi, eax
test esi, esi
jne 0x44f805
push 0x105
push str.....cryptokdf_tls1_prf.c
push 0x41
push 0x6f
push 0x34
call fcn.004058f0
add esp, 0x14
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
add ebx, dword [ebp + 8]
push edi
push eax
push ecx
mov ecx, dword [ebp + 0x10]
push ebx
push 0x68467c
mov edx, esi
call fcn.0044f480
add esp, 0x14
test eax, eax
jne 0x44f843
push 0x10a
push str.....cryptokdf_tls1_prf.c
push edi
call fcn.00413f20
add esp, 0xc
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x44f867
mov eax, dword [ebp + 0x18]
mov ecx, esi
sub ecx, eax
mov edx, edi
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec edx
jne 0x44f850
test edi, edi
je 0x44f867
push edi
push esi
call fcn.00587a20
add esp, 8
mov eax, dword [fcn.00413ef0]
test eax, eax
je 0x44f892
cmp eax, fcn.00413ef0
je 0x44f892
push 0x10f
push str.....cryptokdf_tls1_prf.c
push esi
call eax
add esp, 0xc
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.005dcea1
add esp, 4
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x14]
push edi
push edx
mov edx, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.0044f480
add esp, 0x14
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret
Function at 0x458430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test edx, edx
je 0x458488
test esi, esi
je 0x458488
push edi
mov edi, dword [ecx + 0xc]
cmp esi, edi
jae 0x458449
mov edi, esi
xor eax, eax
push ebx
test edi, edi
je 0x45845c
mov bl, byte [eax + edx]
xor byte [ecx + eax + 0x10], bl
inc eax
cmp eax, edi
jb 0x458450
mov eax, dword [ecx + 0xc]
cmp esi, eax
jbe 0x458486
sub esi, eax
cmp esi, 0x10
jbe 0x45846f
mov esi, 0x10
xor eax, eax
test esi, esi
je 0x458486
mov edi, dword [ecx + 0xc]
add edi, eax
mov bl, byte [edi + edx]
xor byte [ecx + eax + 0x30], bl
inc eax
cmp eax, esi
jb 0x458475
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x458490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.005e38a0
push esi
mov esi, ecx
lea ecx, [esi + 2]
mov dword [ebp - 4], 0x10
mov eax, edi
sub esi, edi
mov edx, 4
push ebx
movzx ebx, byte [esi + eax]
xor byte [eax], bl
movzx ebx, byte [ecx - 1]
xor byte [eax + 1], bl
movzx ebx, byte [ecx]
xor byte [eax + 2], bl
movzx ebx, byte [ecx + 1]
xor byte [eax + 3], bl
add eax, 4
add ecx, 4
dec edx
jne 0x4584b4
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
pop ebx
cmp dword [esi + 8], edx
je 0x4584f6
push edi
lea ecx, [ebp - 4]
push ecx
push edi
lea ecx, [edx + 0x10]
call fcn.004047b0
add esp, 0xc
jmp 0x458508
push 0x10
push edi
lea edx, [ebp - 4]
push edx
push edi
mov ecx, esi
call fcn.00404b80
add esp, 0x10
pop esi
test eax, eax
je 0x45851c
cmp dword [ebp - 4], 0x10
jne 0x45851c
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x45a850
Capabilities:
Hash data using sha1

Disassembly:
push 0x60
push 0
push esi
call fcn.005dd9b0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
ret
Function at 0x46ab70
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax + 0xc]
push 0x5c
push 0
push esi
call fcn.005dd9b0
push 0x60
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
add esi, 0x5c
push 0
push esi
call fcn.005dd9b0
add esp, 0x18
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
pop ebp
ret
Function at 0x4723c0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
cmp dword [ebp + 0xc], esi
jne 0x472441
mov al, byte [ecx]
cmp al, 0x6a
je 0x4723d5
cmp al, 0x6b
jne 0x472441
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x472417
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x4723f5
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x4723f5
cmp al, 0xbb
jne 0x472409
inc ecx
cmp ecx, esi
jl 0x4723e5
sub esi, ecx
test ecx, ecx
jne 0x47241a
push 0x50
push str.....crypto_rsa_rsa_x931.c
push 0x8a
jmp 0x47244d
push 0x48
push str.....crypto_rsa_rsa_x931.c
push 0x8a
jmp 0x47244d
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x47242e
push 0x59
push str.....crypto_rsa_rsa_x931.c
push 0x8b
jmp 0x47244d
mov eax, dword [ebp + 8]
push esi
push edx
push eax
call fcn.005e12d0
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret
push 0x3d
push str.....crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.004058f0
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x47e990
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
lea eax, [ecx + 1]
pop ebp
ret

Function at 0x47ea30
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
pop ebp
ret

Function at 0x47f450
Capabilities:
Hash data using sha224

Disassembly:
push 0x70
push 0
push esi
call fcn.005dd9b0
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
mov eax, 1
ret

Function at 0x47f4b0
Capabilities:
Hash data using sha256

Disassembly:
push 0x70
push 0
push esi
call fcn.005dd9b0
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
ret