joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f5700
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x5875a4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x58c59c], 0
je 0x4f572c
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004db63a
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [0x58c598]
test esi, esi
jne 0x4f57fb
push 0x18
call fcn.004db11c
mov esi, eax
add esp, 4
test esi, esi
je 0x4f57f3
push edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov ecx, esi
mov word [esi], ax
lea eax, [ebp - 0x20c]
push eax
call fcn.004c0418
cmp dword [esi + 0x14], 8
mov edx, esi
mov edi, dword [esi + 0x10]
jb 0x4f5792
mov edx, dword [esi]
test edi, edi
je 0x4f57e2
lea eax, [edi - 1]
mov ecx, edi
cmp eax, edi
cmovb ecx, eax
cmp word [edx + ecx*2], 0x5c
lea eax, [edx + ecx*2]
je 0x4f57bd
nop word [eax + eax]
cmp eax, edx
je 0x4f57e2
sub eax, 2
cmp word [eax], 0x5c
jne 0x4f57b0
sub eax, edx
sar eax, 1
cmp eax, 0xffffffff
je 0x4f57e2
inc eax
cmp edi, eax
jb 0x4f5904
mov dword [esi + 0x10], eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x4f57dc
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
push 9
push str.debug.log
mov ecx, esi
call fcn.004aed30
pop edi
jmp 0x4f57f5
xor esi, esi
mov dword [0x58c598], esi
test byte [0x5875c8], 1
je 0x4f58f3
cmp dword [esi + 0x14], 8
jb 0x4f5810
mov esi, dword [esi]
push 0
push 0x80
push 4
push 0
push 3
push 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
call esi
mov dword [0x58c59c], eax
cmp eax, 0xffffffff
je 0x4f583a
test eax, eax
jne 0x4f58f3
xor eax, eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x4f58e2
cmp eax, 0x104
ja 0x4f58e2
mov ecx, dword [0x58c598]
lea eax, [ebp - 0x20c]
push eax
call fcn.004c0418
mov ecx, dword [0x58c598]
mov edx, ecx
cmp dword [ecx + 0x14], 8
jb 0x4f5886
mov edx, dword [ecx]
mov eax, dword [ecx + 0x10]
cmp word [edx + eax*2 - 2], 0x5c
je 0x4f58a1
push 0x55afec
call fcn.004f5210
mov ecx, dword [0x58c598]
push str.debug.log
call fcn.004f5210
mov eax, dword [0x58c598]
cmp dword [eax + 0x14], 8
jb 0x4f58b8
mov eax, dword [eax]
push 0
push 0x80
push 4
push 0
push 3
push 4
push eax
call esi
mov dword [0x58c59c], eax
cmp eax, 0xffffffff
je 0x4f58d8
test eax, eax
jne 0x4f58f3
mov dword [0x58c59c], 0
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004db63a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.004db63a
mov esp, ebp
pop ebp
ret
call fcn.004027d0
int3
Function at 0x4f5960
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0xc
call fcn.004db11c
mov ecx, dword [ebp + 0xc]
mov ebx, eax
cmp dword [ebp + 0x10], 0
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 4], ebx
mov dword [ebx], ecx
setne cl
mov byte [ebx + 4], cl
mov ecx, dword [ebp + 0x14]
mov dword [ebx + 8], ecx
call fcn.004fb3f0
mov ecx, dword [ebp + 8]
add esp, 8
xor eax, eax
cmp eax, ecx
push 0
sbb eax, eax
and eax, 0x10000
push eax
push ebx
push 0x4f5db0
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, dword [ebp - 0xc]
mov ebx, eax
mov edi, dword [ebp - 8]
lea eax, [ebp - 0x1c]
push eax
call fcn.004fb3f0
add esp, 4
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub ecx, esi
mov dword [ebp - 0x14], ecx
sbb eax, edi
mov dword [ebp - 0x10], eax
mov eax, dword [0x58c5c0]
test eax, eax
jne 0x4f5a27
push 1
push 0x32
sub esp, 8
mov eax, esp
push 0
push 0xf4240
push 0
push 0xa
push eax
call fcn.004f5ab0
add esp, 0xc
mov eax, esp
push 0
push 0x3e8
push 0
push 1
push eax
call fcn.004f5ab0
add esp, 0x14
push str.Windows.CreateThreadTime
call fcn.004fcb80
add esp, 0x1c
mov dword [0x58c5c0], eax
lea ecx, [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.004fb8c0
test ebx, ebx
jne 0x4f5a4a
push dword [ebp - 4]
call fcn.004db150
add esp, 4
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4f5a5c
mov dword [eax], ebx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4f8d50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
cmp eax, 0x7fffffff
jbe 0x4f8d61
xor eax, eax
pop ebp
ret
mov dword [ebp + 0xc], eax
pop ebp
jmp fcn.00502d00
Function at 0x4f8d90
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x5875d0]
sub esp, 0x170
push edi
mov edi, ecx
cmp eax, 0xffffffff
je 0x4f8db1
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x4f8db6
call fcn.004f8f40
push ebx
push esi
mov dword [edi + 4], 0xffffffff
mov dword [edi + 8], 0
call fcn.004f9130
mov esi, eax
mov ecx, esi
call fcn.004f7620
mov ebx, dword [0x58d1d8]
xor ecx, ecx
inc ebx
nop dword [eax]
lea eax, [ebx + ecx]
movzx edx, al
lea eax, [edx + edx*2]
cmp dword [eax*4 + 0x58c5d8], 0
je 0x4f8dfe
inc ecx
cmp ecx, 0x100
jl 0x4f8de0
jmp 0x4f8e29
mov eax, dword [ebp + 8]
lea ecx, [edx + edx*2]
mov dword [ecx*4 + 0x58c5dc], eax
mov dword [ecx*4 + 0x58c5d8], 1
mov dword [0x58d1d8], edx
mov dword [edi + 4], edx
mov eax, dword [ecx*4 + 0x58c5e0]
mov dword [edi + 8], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [edi + 4]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], eax
pop esi
pop ebx
cmp eax, 0xffffffff
jne 0x4f8e7e
push str.slot____kInvalidSlotValue
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.004f4530
add esp, 0xc
test eax, eax
je 0x4f8e7e
push eax
push 0x11d
push str..._.._base_threading_thread_local_storage.cc
lea ecx, [ebp - 0xc0]
call fcn.004f4880
lea ecx, [ebp - 0xc0]
call fcn.004f49c0
mov eax, dword [edi + 4]
mov dword [ebp - 0xc], 0x100
mov dword [ebp - 0x10], eax
cmp eax, 0x100
jl 0x4f8ecc
push str.slot____kThreadLocalStorageSize
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004f4530
add esp, 0xc
test eax, eax
je 0x4f8ecc
push eax
push 0x11e
push str..._.._base_threading_thread_local_storage.cc
lea ecx, [ebp - 0x170]
call fcn.004f4880
lea ecx, [ebp - 0x170]
call fcn.004f49c0
mov dword [edi], 1
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x4f8f40
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
mov eax, dword [0x5875a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov dword [ebp - 0x808], ebx
mov eax, dword [0x5875d0]
mov dword [ebp - 0x808], eax
push esi
push edi
cmp eax, 0xffffffff
jne 0x4f904a
lea eax, [ebp - 0x808]
push eax
call fcn.00502e00
add esp, 4
test al, al
jne 0x4f8fa1
push str.PlatformThreadLocalStorage::AllocTLS_key_
push 0x73
push str..._.._base_threading_thread_local_storage.cc
lea ecx, [ebp - 0x8b8]
call fcn.004f47b0
mov ebx, 1
test bl, 1
je 0x4f8fb4
lea ecx, [ebp - 0x8b8]
and ebx, 0xfffffffe
call fcn.004f49c0
mov ecx, dword [ebp - 0x808]
cmp ecx, 0xffffffff
jne 0x4f9018
lea eax, [ebp - 0x808]
push eax
call fcn.00502e00
add esp, 4
test al, al
je 0x4f8fdb
cmp dword [ebp - 0x808], 0xffffffff
jne 0x4f8ff5
push str.PlatformThreadLocalStorage::AllocTLS_key___key___PlatformThreadLocalStorage::TLS_KEY_OUT_OF_INDEXES
push 0x7d
push str..._.._base_threading_thread_local_storage.cc
lea ecx, [ebp - 0x968]
or ebx, 2
call fcn.004f47b0
test bl, 2
je 0x4f9008
lea ecx, [ebp - 0x968]
and ebx, 0xfffffffd
call fcn.004f49c0
push 0xffffffffffffffff
call fcn.00502e20
mov ecx, dword [ebp - 0x808]
add esp, 4
mov edx, 0x5875d0
or eax, 0xffffffff
lock cmpxchg dword [edx], ecx
cmp eax, 0xffffffff
je 0x4f9044
push dword [ebp - 0x808]
call fcn.00502e20
mov eax, dword [0x5875d0]
add esp, 4
mov dword [ebp - 0x808], eax
jmp 0x4f904a
mov eax, dword [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4f9072
push str._PlatformThreadLocalStorage::GetTLSValue_key_
push 0x8f
push str..._.._base_threading_thread_local_storage.cc
lea ecx, [ebp - 0xa18]
or ebx, 4
call fcn.004f47b0
test bl, 4
je 0x4f9082
lea ecx, [ebp - 0xa18]
call fcn.004f49c0
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00520ff0
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x808]
call fcn.00502e30
push 0x800
call fcn.004db155
mov ebx, eax
lea esi, [ebp - 0x804]
mov ecx, 0x200
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push dword [ebp - 0x808]
call fcn.00502e30
mov ecx, dword [ebp - 4]
add esp, 0x20
mov eax, ebx
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004db63a
mov esp, ebp
pop ebp
ret
Function at 0x4f91c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x140c
call fcn.004dbcb0
mov eax, dword [0x5875a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5875d0]
cmp eax, 0xffffffff
je 0x4f92ce
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
je 0x4f92cd
mov eax, dword [0x5875d0]
mov ecx, 0x200
push esi
push edi
mov esi, ebx
mov dword [ebp - 0x140c], eax
lea edi, [ebp - 0x804]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x804]
push ecx
push eax
call fcn.00502e30
push ebx
call fcn.004db15e
add esp, 0xc
call fcn.004f9130
mov ecx, eax
mov dword [ebp - 0x1408], eax
call fcn.004f7620
push dword [ebp - 0x1408]
mov ecx, 0x300
lea edi, [ebp - 0x1404]
mov esi, 0x58c5d8
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov ebx, 0x100
nop
xor dl, dl
lea esi, [ebp - 0x13fc]
xor edi, edi
nop word [eax + eax]
mov ecx, dword [ebp + edi*8 - 0x804]
test ecx, ecx
je 0x4f92a6
cmp dword [esi - 8], 0
je 0x4f92a6
mov eax, dword [ebp + edi*8 - 0x800]
cmp eax, dword [esi]
jne 0x4f92a6
mov eax, dword [esi - 4]
test eax, eax
je 0x4f92a6
push ecx
mov dword [ebp + edi*8 - 0x804], 0
call eax
add esp, 4
mov dl, 1
inc edi
add esi, 0xc
cmp edi, 0x100
jl 0x4f9270
dec ebx
test ebx, ebx
jle 0x4f92bb
test dl, dl
jne 0x4f9260
push 0
push dword [ebp - 0x140c]
call fcn.00502e30
add esp, 8
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004db63a
mov esp, ebp
pop ebp
ret
Function at 0x4fb5a0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
movsd xmm0, qword [0x58d250]
sub esp, 0x14
ucomisd xmm0, qword [0x551568]
lahf
test ah, 0x44
jnp 0x4fb5c6
fld qword [0x58d250]
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push esi
push edi
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 2
mov dword [ebp - 4], eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edx, dword [0x58c028]
mov ecx, dword fs:[0x2c]
mov eax, dword [0x58d260]
mov esi, dword [ecx + edx*4]
cmp eax, dword [esi + 4]
jg 0x4fb6cc
mov eax, dword [0x58d270]
cmp eax, dword [esi + 4]
jg 0x4fb705
rdtsc
mov esi, eax
xorps xmm0, xmm0
lea eax, [ebp - 0xc]
movq qword [ebp - 0xc], xmm0
push eax
mov edi, edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push dword [ebp - 4]
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [0x58d268]
mov edx, dword [ebp - 8]
sbb edx, dword [0x58d26c]
call fcn.004dc000
mov edx, dword [ebp - 0x10]
movaps xmm1, xmm0
mov ecx, dword [ebp - 0x14]
movsd qword [ebp - 0xc], xmm1
call fcn.004dc040
movsd xmm1, qword [ebp - 0xc]
divsd xmm1, xmm0
movsd xmm0, qword [0x56cf98]
comisd xmm0, xmm1
movsd qword [ebp - 0xc], xmm1
jbe 0x4fb69d
fldz
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub esi, dword [0x58d258]
mov ecx, esi
sbb edi, dword [0x58d25c]
mov edx, edi
call fcn.004dc000
divsd xmm0, qword [ebp - 0xc]
pop edi
pop esi
pop ebx
movsd qword [0x58d250], xmm0
fld qword [0x58d250]
mov esp, ebp
pop ebp
ret
push 0x58d260
call fcn.004db539
add esp, 4
cmp dword [0x58d260], 0xffffffff
jne 0x4fb607
rdtsc
push 0x58d260
mov dword [0x58d258], eax
mov dword [0x58d25c], edx
call fcn.004db4fa
add esp, 4
jmp 0x4fb607
push 0x58d270
call fcn.004db539
add esp, 4
cmp dword [0x58d270], 0xffffffff
jne 0x4fb618
lea eax, [ebp - 0xc]
xorps xmm0, xmm0
push eax
movq qword [ebp - 0xc], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 0xc]
mov dword [0x58d268], eax
mov eax, dword [ebp - 8]
push 0x58d270
mov dword [0x58d26c], eax
call fcn.004db4fa
add esp, 4
jmp 0x4fb618

Function at 0x4ffbe0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ebx
test esi, esi
je 0x4ffc51
mov eax, dword [ebp + 8]
or edx, 0xffffffff
push edi
nop
xor cl, cl
mov edi, esi
cmovne edi, edx
push edi
push eax
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x4ffc2c
push str.success
push 0x20
push str..._.._base_rand_util_win.cc
lea ecx, [ebp - 0xb4]
or ebx, 1
call fcn.004f47b0
test bl, 1
je 0x4ffc3f
lea ecx, [ebp - 0xb4]
and ebx, 0xfffffffe
call fcn.004f49c0
mov eax, dword [ebp + 8]
mov edx, 0xffffffff
add eax, edi
mov dword [ebp + 8], eax
sub esi, edi
jne 0x4ffc00
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x505e40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword [ecx + 4]
push edi
mov edi, dword [ecx]
sub eax, edi
sar eax, 2
test eax, eax
je 0x505eb1
push ebx
push esi
mov ebx, eax
mov ecx, dword [edi]
lea edi, [edi + 4]
movzx esi, al
movzx edx, cl
xor esi, edx
shr eax, 8
mov edx, ecx
shr edx, 8
xor eax, dword [esi*4 + 0x56d7d8]
movzx esi, dl
movzx edx, al
xor esi, edx
shr eax, 8
mov edx, ecx
shr ecx, 0x18
shr edx, 0x10
xor eax, dword [esi*4 + 0x56d7d8]
movzx esi, dl
movzx edx, al
xor esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x56d7d8]
movzx edx, al
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x56d7d8]
sub ebx, 1
jne 0x505e53
pop esi
pop ebx
pop edi
ret

Function at 0x50cae0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x5875a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x64], eax
push edi
mov edi, dword [ebp + 8]
lea eax, [ebx*8]
mov dword [ebp - 0x5c], 0x67452301
mov dword [ebp - 0x4c], eax
mov eax, ebx
shr eax, 0x1d
mov dword [ebp - 0x58], 0xefcdab89
mov dword [ebp - 0x54], 0x98badcfe
mov dword [ebp - 0x50], 0x10325476
mov dword [ebp - 0x48], eax
cmp ebx, 0x40
jb 0x50cbb7
mov eax, ebx
shr eax, 6
mov dword [ebp - 0x60], eax
push esi
nop
movups xmm0, xmmword [edi]
mov esi, 0x10
lea eax, [ebp - 0x42]
movups xmmword [ebp - 0x44], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [ebp - 0x34], xmm0
movups xmm0, xmmword [edi + 0x20]
movups xmmword [ebp - 0x24], xmm0
movups xmm0, xmmword [edi + 0x30]
movups xmmword [ebp - 0x14], xmm0
nop word [eax + eax]
movzx edx, byte [eax + 1]
lea eax, [eax + 4]
movzx ecx, byte [eax - 4]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 5]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 6]
shl edx, 8
or edx, ecx
mov dword [eax - 6], edx
sub esi, 1
jne 0x50cb70
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.0050cbf0
add esp, 8
add edi, 0x40
sub ebx, 0x40
sub dword [ebp - 0x60], 1
jne 0x50cb40
pop esi
push ebx
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.00521b30
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 0x64]
call fcn.0050ca40
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
pop edi
pop ebx
call fcn.004db63a
mov esp, ebp
pop ebp
ret
Function at 0x50d9a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, ecx
push edi
mov edi, 0x10
lea edx, [esi + 0x28]
mov ecx, edx
mov eax, dword [ecx]
lea ecx, [ecx + 4]
bswap eax
mov dword [ecx - 4], eax
sub edi, 1
jne 0x50d9b5
lea ecx, [edi + 0x40]
mov eax, dword [edx + 0x34]
lea edx, [edx + 4]
xor eax, dword [edx + 0x1c]
xor eax, dword [edx + 4]
xor eax, dword [edx - 4]
rol eax, 1
mov dword [edx + 0x3c], eax
sub ecx, 1
jne 0x50d9c7
mov eax, dword [esi + 0x14]
xor edx, edx
mov dword [esi], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
mov eax, dword [esi + 0x20]
mov ebx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x24]
mov edi, dword [esi + 0xc]
mov dword [ebp - 0xc], eax
mov dword [esi + 0x10], eax
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], 0x28
jmp 0x50da23
mov edi, dword [ebp - 4]
cmp edx, 0x14
jae 0x50da34
mov eax, ecx
and ecx, ebx
not eax
and eax, edi
or eax, ecx
jmp 0x50da52
cmp edx, 0x28
jb 0x50da4c
cmp edx, 0x3c
jae 0x50da4c
mov eax, ebx
or eax, edi
and eax, ecx
mov ecx, ebx
and ecx, edi
or eax, ecx
jmp 0x50da52
mov eax, ecx
xor eax, ebx
xor eax, edi
cmp edx, 0x14
jae 0x50da5e
mov ecx, 0x5a827999
jmp 0x50da7b
cmp edx, 0x28
jae 0x50da6a
mov ecx, 0x6ed9eba1
jmp 0x50da7b
cmp edx, 0x3c
sbb ecx, ecx
and ecx, 0xc4b8fb06
add ecx, 0xca62c1d6
mov edx, dword [ebp - 8]
mov edi, dword [esi]
rol edi, 5
add edi, dword [edx + esi]
add edi, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
add edi, ecx
mov ecx, dword [esi]
add edi, eax
mov eax, dword [ebp - 4]
inc edx
mov dword [ebp - 0xc], eax
mov dword [esi + 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ebx
add eax, 4
mov dword [esi + 0xc], ebx
mov ebx, dword [ebp - 0x10]
ror ebx, 2
mov dword [esi + 8], ebx
mov dword [ebp - 0x10], ecx
mov dword [esi + 4], ecx
mov dword [esi], edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], eax
cmp eax, 0x168
jb 0x50da20
add dword [esi + 0x14], edi
mov eax, ecx
add dword [esi + 0x18], eax
mov eax, ebx
add dword [esi + 0x1c], eax
mov eax, dword [esi + 0xc]
add dword [esi + 0x20], eax
mov eax, dword [esi + 0x10]
add dword [esi + 0x24], eax
pop edi
mov dword [esi + 0x168], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x50db00
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
mov eax, dword [0x5875a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x17c]
push esi
push dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
xorps xmm0, xmm0
push eax
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x178], 0
mov dword [ebp - 0x174], 0
mov dword [ebp - 0x170], 0
mov dword [ebp - 0x16c], 0
mov dword [ebp - 0x14], 0
movlpd qword [ebp - 0xc], xmm0
mov dword [ebp - 0x168], 0x67452301
mov dword [ebp - 0x164], 0xefcdab89
mov dword [ebp - 0x160], 0x98badcfe
mov dword [ebp - 0x15c], 0x10325476
mov dword [ebp - 0x158], 0xc3d2e1f0
call fcn.0050dd00
mov eax, dword [ebp - 0x14]
mov byte [ebp + eax - 0x154], 0x80
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x38
jbe 0x50dbe5
cmp ecx, 0x40
jae 0x50dbd4
nop dword [eax + eax]
mov byte [ebp + ecx - 0x154], 0
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x40
jb 0x50dbc0
lea ecx, [ebp - 0x17c]
call fcn.0050d9a0
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x38
jae 0x50dc04
nop word [eax + eax]
mov byte [ebp + ecx - 0x154], 0
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x38
jb 0x50dbf0
mov eax, dword [ebp - 8]
shr eax, 0x18
mov byte [ebp + ecx - 0x154], al
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
inc ecx
mov dword [ebp - 0x14], ecx
shr eax, 0x10
mov byte [ebp + ecx - 0x154], al
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
inc ecx
mov dword [ebp - 0x14], ecx
shr eax, 8
mov byte [ebp + ecx - 0x154], al
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
inc ecx
mov dword [ebp - 0x14], ecx
mov byte [ebp + ecx - 0x154], al
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
inc edx
mov eax, dword [ebp - 8]
shrd ecx, eax, 0x18
mov dword [ebp - 0x14], edx
mov byte [ebp + edx - 0x154], cl
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
inc edx
shr eax, 0x18
mov eax, dword [ebp - 8]
shrd ecx, eax, 0x10
mov dword [ebp - 0x14], edx
mov byte [ebp + edx - 0x154], cl
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
inc edx
shr eax, 0x10
mov eax, dword [ebp - 8]
shrd ecx, eax, 8
mov dword [ebp - 0x14], edx
mov byte [ebp + edx - 0x154], cl
mov ecx, dword [ebp - 0x14]
inc ecx
shr eax, 8
mov al, byte [ebp - 0xc]
mov dword [ebp - 0x14], ecx
mov byte [ebp + ecx - 0x154], al
lea ecx, [ebp - 0x17c]
inc dword [ebp - 0x14]
call fcn.0050d9a0
xor eax, eax
nop dword [eax]
mov ecx, dword [ebp + eax*4 - 0x168]
bswap ecx
mov dword [ebp + eax*4 - 0x168], ecx
inc eax
cmp eax, 5
jl 0x50dcc0
movups xmm0, xmmword [ebp - 0x168]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x158]
xor ecx, ebp
movups xmmword [esi], xmm0
mov dword [esi + 0x10], eax
pop esi
call fcn.004db63a
mov esp, ebp
pop ebp
ret
Function at 0x50dd00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x14
mov edx, ecx
test eax, eax
je 0x50dea3
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
nop dword [eax]
mov ecx, dword [edx + 0x168]
dec eax
mov dword [ebp + 0xc], eax
mov al, byte [ebx]
inc ebx
mov dword [ebp + 8], ebx
mov byte [ecx + edx + 0x28], al
inc dword [edx + 0x168]
cmp dword [edx + 0x168], 0x40
jb 0x50de87
lea ecx, [edx + 0x28]
mov edi, 0x10
mov esi, ecx
mov eax, dword [esi]
lea esi, [esi + 4]
bswap eax
mov dword [esi - 4], eax
sub edi, 1
jne 0x50dd51
lea esi, [edi + 0x40]
mov eax, dword [ecx + 0x34]
lea ecx, [ecx + 4]
xor eax, dword [ecx + 0x1c]
xor eax, dword [ecx + 4]
xor eax, dword [ecx - 4]
rol eax, 1
mov dword [ecx + 0x3c], eax
sub esi, 1
jne 0x50dd63
mov eax, dword [edx + 0x14]
mov dword [edx], eax
mov eax, dword [edx + 0x18]
mov dword [edx + 4], eax
mov eax, dword [edx + 0x1c]
mov ecx, dword [edx + 4]
mov dword [edx + 8], eax
mov eax, dword [edx + 0x20]
mov ebx, dword [edx + 8]
mov dword [edx + 0xc], eax
mov eax, dword [edx + 0x24]
mov edi, dword [edx + 0xc]
mov dword [ebp - 0xc], eax
mov dword [edx + 0x10], eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], 0x28
jmp 0x50ddba
mov edi, dword [ebp - 4]
cmp esi, 0x14
jae 0x50ddcb
mov eax, ecx
and ecx, ebx
not eax
and eax, edi
or eax, ecx
jmp 0x50dde9
cmp esi, 0x28
jb 0x50dde3
cmp esi, 0x3c
jae 0x50dde3
mov eax, ebx
or eax, edi
and eax, ecx
mov ecx, ebx
and ecx, edi
or eax, ecx
jmp 0x50dde9
mov eax, ecx
xor eax, ebx
xor eax, edi
cmp esi, 0x14
jae 0x50ddf5
mov ecx, 0x5a827999
jmp 0x50de12
cmp esi, 0x28
jae 0x50de01
mov ecx, 0x6ed9eba1
jmp 0x50de12
cmp esi, 0x3c
sbb ecx, ecx
and ecx, 0xc4b8fb06
add ecx, 0xca62c1d6
mov esi, dword [ebp - 8]
mov edi, dword [edx]
rol edi, 5
add edi, dword [esi + edx]
add edi, dword [ebp - 0xc]
mov esi, dword [ebp - 0x14]
add edi, ecx
mov ecx, dword [edx]
add edi, eax
mov eax, dword [ebp - 4]
inc esi
mov dword [ebp - 0xc], eax
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ebx
add eax, 4
mov dword [edx + 0xc], ebx
mov ebx, dword [ebp - 0x10]
ror ebx, 2
mov dword [edx + 8], ebx
mov dword [ebp - 0x10], ecx
mov dword [edx + 4], ecx
mov dword [edx], edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], eax
cmp eax, 0x168
jb 0x50ddb7
add dword [edx + 0x14], edi
mov eax, ecx
add dword [edx + 0x18], eax
mov eax, ebx
add dword [edx + 0x1c], eax
mov eax, dword [edx + 0xc]
add dword [edx + 0x20], eax
mov eax, dword [edx + 0x10]
add dword [edx + 0x24], eax
mov ebx, dword [ebp + 8]
mov dword [edx + 0x168], 0
add dword [edx + 0x170], 8
mov eax, dword [ebp + 0xc]
adc dword [edx + 0x174], 0
test eax, eax
jne 0x50dd20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8