joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f5f20
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x10
movzx eax, byte [eax + 0x1e4]
test al, 4
jne 0x4f6174
test al, 2
je 0x4f5f42
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov edx, 0x400
mov eax, 0x637b80
call dbg.prefetch_table
mov eax, 0x637680
mov edx, 0x500
call dbg.prefetch_table
mov eax, dword [ebx]
cmp dword [ebx + 0x1e0], 1
mov dword [ebx + 0xf0], eax
mov eax, dword [ebx + 4]
mov dword [ebx + 0xf4], eax
mov eax, dword [ebx + 8]
mov dword [ebx + 0xf8], eax
mov eax, dword [ebx + 0xc]
mov dword [ebx + 0xfc], eax
jle 0x4f6183
lea eax, [ebx + 0x10]
mov ecx, 1
nop
lea esi, [esi]
mov edx, dword [eax]
mov esi, edx
movzx edi, dl
shr esi, 0x18
movzx edi, byte [edi*4 + 0x637b81]
movzx esi, byte [esi*4 + 0x637b81]
mov esi, dword [esi*4 + 0x637680]
ror esi, 8
xor esi, dword [edi*4 + 0x637680]
mov edi, esi
movzx esi, dh
shr edx, 0x10
movzx esi, byte [esi*4 + 0x637b81]
movzx edx, dl
movzx edx, byte [edx*4 + 0x637b81]
mov esi, dword [esi*4 + 0x637680]
mov edx, dword [edx*4 + 0x637680]
rol esi, 8
xor esi, edi
rol edx, 0x10
xor edx, esi
mov dword [eax + 0xf0], edx
mov edx, dword [eax + 4]
mov esi, edx
movzx edi, dl
shr esi, 0x18
movzx edi, byte [edi*4 + 0x637b81]
movzx esi, byte [esi*4 + 0x637b81]
mov esi, dword [esi*4 + 0x637680]
ror esi, 8
xor esi, dword [edi*4 + 0x637680]
mov edi, esi
movzx esi, dh
shr edx, 0x10
movzx esi, byte [esi*4 + 0x637b81]
movzx edx, dl
movzx edx, byte [edx*4 + 0x637b81]
mov esi, dword [esi*4 + 0x637680]
mov edx, dword [edx*4 + 0x637680]
rol esi, 8
xor esi, edi
rol edx, 0x10
xor edx, esi
mov dword [eax + 0xf4], edx
mov edx, dword [eax + 8]
mov esi, edx
movzx edi, dl
shr esi, 0x18
movzx edi, byte [edi*4 + 0x637b81]
movzx esi, byte [esi*4 + 0x637b81]
mov esi, dword [esi*4 + 0x637680]
ror esi, 8
xor esi, dword [edi*4 + 0x637680]
mov edi, esi
movzx esi, dh
shr edx, 0x10
movzx esi, byte [esi*4 + 0x637b81]
movzx edx, dl
movzx edx, byte [edx*4 + 0x637b81]
mov esi, dword [esi*4 + 0x637680]
mov edx, dword [edx*4 + 0x637680]
rol esi, 8
xor esi, edi
rol edx, 0x10
xor edx, esi
mov dword [eax + 0xf8], edx
mov edx, dword [eax + 0xc]
mov esi, edx
movzx edi, dl
shr esi, 0x18
movzx esi, byte [esi*4 + 0x637b81]
mov esi, dword [esi*4 + 0x637680]
movzx edi, byte [edi*4 + 0x637b81]
ror esi, 8
xor esi, dword [edi*4 + 0x637680]
mov edi, esi
movzx esi, dh
shr edx, 0x10
movzx esi, byte [esi*4 + 0x637b81]
movzx edx, dl
movzx edx, byte [edx*4 + 0x637b81]
mov esi, dword [esi*4 + 0x637680]
mov edx, dword [edx*4 + 0x637680]
rol esi, 8
xor esi, edi
rol edx, 0x10
xor edx, esi
add ecx, 1
add eax, 0x10
mov dword [eax + 0xec], edx
cmp dword [ebx + 0x1e0], ecx
jg 0x4f5fa0
shl ecx, 4
add ebx, ecx
mov eax, dword [ebx]
mov dword [ebx + 0xf0], eax
mov eax, dword [ebx + 4]
mov dword [ebx + 0xf4], eax
mov eax, dword [ebx + 8]
mov dword [ebx + 0xf8], eax
mov eax, dword [ebx + 0xc]
mov dword [ebx + 0xfc], eax
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov dword [esp], ebx
call dbg._gcry_aes_aesni_prepare_decryption
add esp, 0x10
pop ebx
pop esi
pop edi
ret
mov ecx, 1
jmp 0x4f6145
Function at 0x4f6e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x60]
mov ebx, dword [esp + 0x64]
mov edi, dword [esp + 0x68]
mov esi, dword [esp + 0x6c]
test byte [eax + 0x1e4], 1
je 0x4f6ee0
mov eax, dword [esp + 0x60]
mov eax, dword [eax + 0x1f4]
test eax, eax
je 0x4f6e34
call eax
mov eax, dword [esp + 0x60]
test byte [eax + 0x1e4], 4
jne 0x4f6ef5
mov eax, dword [esp + 0x60]
mov eax, dword [eax + 0x1ec]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x70]
test eax, eax
je 0x4f6f1d
lea ebp, [esp + 0x30]
mov eax, dword [esp + 0x60]
mov dword [esp + 8], esi
mov dword [esp + 4], ebp
mov dword [esp], eax
mov eax, dword [esp + 0x2c]
call eax
mov dword [esp + 0x28], eax
xor eax, eax
nop
mov edx, dword [ebx + eax]
xor edx, dword [ebp + eax]
mov ecx, dword [esi + eax]
mov dword [edi + eax], edx
mov dword [ebx + eax], ecx
add eax, 4
cmp eax, 0x10
jne 0x4f6e80
add esi, 0x10
add edi, 0x10
sub dword [esp + 0x70], 1
jne 0x4f6e63
mov eax, dword [esp + 0x28]
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
test eax, eax
je 0x4f6ed8
add eax, 0x10
mov dword [esp], eax
call dbg.__gcry_burn_stack
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
call dbg.prepare_decryption
mov eax, dword [esp + 0x60]
or byte [eax + 0x1e4], 1
jmp 0x4f6e24
mov eax, dword [esp + 0x70]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], edi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dbg._gcry_aes_aesni_cbc_dec
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
jmp 0x4f6ed8

Function at 0x4f6f40
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x50]
mov ebx, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
mov ebp, dword [esp + 0x4c]
mov dword [esp + 0x14], eax
mov eax, dword [eax + 0x1f0]
mov dword [esp + 0x18], ecx
test eax, eax
je 0x4f6f6f
call eax
mov eax, dword [esp + 0x14]
test byte [eax + 0x1e4], 4
jne 0x4f6feb
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 0x1e8]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x4f6fe3
mov eax, dword [esp + 0x14]
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
call eax
xor edx, edx
lea esi, [esi]
mov ecx, dword [ebp + edx]
mov esi, dword [ebx + edx]
xor esi, ecx
mov dword [edi + edx], esi
mov dword [ebx + edx], ecx
add edx, 4
cmp edx, 0x10
jne 0x4f6fb0
add edi, 0x10
add ebp, 0x10
sub dword [esp + 0x18], 1
jne 0x4f6f92
test eax, eax
je 0x4f6fe3
add eax, 0x10
mov dword [esp], eax
call dbg.__gcry_burn_stack
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x18]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x44], edi
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x40], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp dbg._gcry_aes_aesni_cfb_dec
Function at 0x4f7020
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov eax, dword [esp + 0x60]
mov ebx, dword [esp + 0x68]
mov esi, dword [esp + 0x6c]
mov eax, dword [eax + 0x1f0]
test eax, eax
je 0x4f703f
call eax
mov eax, dword [esp + 0x60]
test byte [eax + 0x1e4], 4
jne 0x4f710a
mov eax, dword [esp + 0x60]
mov eax, dword [eax + 0x1e8]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x70]
test eax, eax
je 0x4f7136
mov eax, dword [esp + 0x64]
lea edi, [esp + 0x30]
add eax, 0xf
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x64]
lea ebp, [eax - 1]
mov eax, dword [esp + 0x64]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
mov eax, dword [esp + 0x28]
call eax
xor edx, edx
nop
lea esi, [esi]
mov ecx, dword [edi + edx]
xor ecx, dword [esi + edx]
mov dword [ebx + edx], ecx
add edx, 4
cmp edx, 0x10
jne 0x4f70a0
mov ecx, dword [esp + 0x2c]
add ebx, 0x10
add esi, 0x10
nop
lea esi, [esi]
add byte [ecx], 1
jne 0x4f70cc
sub ecx, 1
cmp ecx, ebp
jne 0x4f70c0
sub dword [esp + 0x70], 1
jne 0x4f7080
test eax, eax
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
je 0x4f7102
add eax, 0x10
mov dword [esp], eax
call dbg.__gcry_burn_stack
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x70]
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x60]
mov dword [esp], eax
call dbg._gcry_aes_aesni_ctr_enc
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
jmp 0x4f7102

Function at 0x4f7160
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
mov ebp, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov dword [esp + 0x18], eax
mov eax, dword [eax + 0x1f0]
test eax, eax
je 0x4f718b
call eax
mov eax, dword [esp + 0x18]
test byte [eax + 0x1e4], 4
jne 0x4f7207
mov eax, dword [esp + 0x18]
test esi, esi
mov eax, dword [eax + 0x1e8]
mov dword [esp + 0x1c], eax
je 0x4f71ff
lea esi, [esi]
mov eax, dword [esp + 0x18]
mov dword [esp + 8], ebx
mov dword [esp + 4], ebx
mov dword [esp], eax
mov eax, dword [esp + 0x1c]
call eax
xor edx, edx
mov esi, esi
lea edi, [edi]
mov ecx, dword [ebp + edx]
xor ecx, dword [ebx + edx]
mov dword [ebx + edx], ecx
mov dword [edi + edx], ecx
add edx, 4
cmp edx, 0x10
jne 0x4f71d0
add edi, 0x10
add ebp, 0x10
sub esi, 1
jne 0x4f71b0
test eax, eax
je 0x4f71ff
add eax, 0x10
mov dword [esp], eax
call dbg.__gcry_burn_stack
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp dbg._gcry_aes_aesni_cfb_enc
Function at 0x4f7230
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
mov ebp, dword [esp + 0x4c]
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x10], eax
mov eax, dword [eax + 0x1f0]
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0x54]
test eax, eax
mov dword [esp + 0x14], esi
je 0x4f7267
call eax
mov eax, dword [esp + 0x10]
test byte [eax + 0x1e4], 4
jne 0x4f7309
mov eax, dword [esp + 0x10]
test ebx, ebx
mov eax, dword [eax + 0x1e8]
mov dword [esp + 0x18], eax
je 0x4f7301
mov ecx, dword [esp + 0x1c]
nop
xor eax, eax
mov edx, dword [ebp + eax]
xor edx, dword [ecx + eax]
mov dword [edi + eax], edx
add eax, 4
cmp eax, 0x10
jne 0x4f7292
mov eax, dword [esp + 0x10]
mov dword [esp + 8], edi
lea esi, [edi + 0x10]
mov dword [esp + 4], edi
add ebp, 0x10
mov dword [esp], eax
mov eax, dword [esp + 0x18]
call eax
mov edx, dword [esp + 0x14]
mov ecx, edi
test edx, edx
cmovne esi, edi
sub ebx, 1
je 0x4f72d3
mov edi, esi
jmp 0x4f7290
mov ebp, dword [esp + 0x1c]
cmp ebp, edi
je 0x4f72f2
mov esi, dword [edi]
mov ebx, dword [edi + 4]
mov ecx, dword [edi + 8]
mov edx, dword [edi + 0xc]
mov dword [ebp], esi
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], edx
test eax, eax
je 0x4f7301
add eax, 0x10
mov dword [esp], eax
call dbg.__gcry_burn_stack
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x14]
mov dword [esp + 0x50], ebx
mov dword [esp + 0x48], ebp
mov dword [esp + 0x44], edi
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x40], eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp dbg._gcry_aes_aesni_cbc_enc
Function at 0x4f76a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ecx, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov eax, dword [ecx + 0x3f0]
test eax, eax
je 0x4f76c3
mov dword [esp + 0x10], ecx
call eax
mov ecx, dword [esp + 0x10]
test byte [ecx + 0x3e4], 4
jne 0x4f77d3
mov eax, dword [ecx + 0x3e8]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x58]
test eax, eax
je 0x4f77f1
lea eax, [ecx + 0x200]
lea ebx, [ecx + 0x1b0]
lea ebp, [ecx + 0x1c0]
lea esi, [esp + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx + 0x1e8]
mov edx, dword [ecx + 0x1ec]
mov dword [esp + 0x50], ecx
add eax, 1
adc edx, 0
mov dword [ecx + 0x1e8], eax
tzcnt eax, eax
add eax, 0xa
mov dword [ecx + 0x1ec], edx
shl eax, 4
lea edx, [ecx + eax]
xor eax, eax
mov ecx, dword [edx + eax]
xor dword [ebx + eax], ecx
add eax, 4
cmp eax, 0x10
jne 0x4f7731
mov ecx, dword [esp + 0x50]
xor eax, eax
mov edx, dword [ebx + eax]
xor edx, dword [edi + eax]
mov dword [esi + eax], edx
add eax, 4
cmp eax, 0x10
jne 0x4f7745
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 8], esi
mov dword [esp + 4], esi
mov dword [esp], eax
mov eax, dword [esp + 0x18]
call eax
mov ecx, dword [esp + 0x14]
xor edx, edx
mov dword [esp + 0x10], eax
mov eax, dword [esi + edx]
xor dword [ebp + edx], eax
add edx, 4
cmp edx, 0x10
jne 0x4f7779
add edi, 0x10
sub dword [esp + 0x58], 1
mov eax, dword [esp + 0x10]
jne 0x4f7700
test eax, eax
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
je 0x4f77c9
add eax, 0x10
mov dword [esp], eax
call dbg.__gcry_burn_stack
add esp, 0x3c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x58]
mov dword [esp + 4], edi
mov dword [esp], ecx
mov dword [esp + 8], eax
call dbg._gcry_aes_aesni_ocb_auth
add esp, 0x3c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
jmp 0x4f77c9
Function at 0x4f9530
Capabilities:
Hash data using sha1

Disassembly:
push esi
push ebx
sub esp, 0xd4
mov eax, dword [esp + 0xe8]
lea esi, [esp + 0x18]
mov ebx, dword [esp + 0xe0]
mov dword [esp + 0xb8], 0x67452301
mov dword [esp + 0xbc], 0xefcdab89
mov dword [esp], esi
mov dword [esp + 0xc0], 0x98badcfe
mov dword [esp + 8], eax
mov eax, dword [esp + 0xe4]
mov dword [esp + 0xc4], 0x10325476
mov dword [esp + 0xc8], 0xc3d2e1f0
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 4], eax
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0x40
mov dword [esp + 0xb0], sym._transform_2
call dbg._gcry_md_block_write
mov dword [esp], esi
call dbg.rmd160_final
mov eax, dword [esp + 0x18]
mov dword [ebx], eax
mov eax, dword [esp + 0x1c]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x20]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x10], eax
add esp, 0xd4
pop ebx
pop esi
ret

Function at 0x504a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebp, dword [esp + 0x50]
mov ebx, dword [esp + 0x44]
mov edi, dword [esp + 0x48]
mov esi, dword [esp + 0x4c]
test ebp, ebp
je 0x504ad4
nop
lea esi, [esi]
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x10]
mov edx, esi
call dbg.serpent_decrypt_internal
xor eax, eax
mov edx, dword [ebx + eax]
xor edx, dword [esp + eax + 0x10]
mov ecx, dword [esi + eax]
mov dword [edi + eax], edx
mov dword [ebx + eax], ecx
add eax, 4
cmp eax, 0x10
jne 0x504ab1
add esi, 0x10
add edi, 0x10
sub ebp, 1
jne 0x504aa0
mov dword [esp], 0x20
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dbg.__gcry_burn_stack
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x504b10
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [esp + 0x54]
mov ebp, dword [esp + 0x60]
mov esi, dword [esp + 0x58]
mov ebx, dword [esp + 0x5c]
add eax, 0xf
test ebp, ebp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x54]
lea edi, [eax - 1]
je 0x504b81
lea esi, [esi]
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
lea ecx, [esp + 0x20]
call dbg.serpent_encrypt_internal
xor eax, eax
mov edx, dword [esp + eax + 0x20]
xor edx, dword [ebx + eax]
mov dword [esi + eax], edx
add eax, 4
cmp eax, 0x10
jne 0x504b53
mov edx, dword [esp + 0x1c]
add esi, 0x10
add ebx, 0x10
nop
add byte [edx], 1
jne 0x504b7c
sub edx, 1
cmp edi, edx
jne 0x504b70
sub ebp, 1
jne 0x504b40
mov dword [esp], 0x20
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call dbg.__gcry_burn_stack
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x504bc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebp, dword [esp + 0x40]
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
test ebp, ebp
je 0x504c11
nop
lea esi, [esi]
mov eax, dword [esp + 0x30]
mov ecx, ebx
mov edx, ebx
call dbg.serpent_encrypt_internal
xor eax, eax
nop
mov edx, dword [esi + eax]
mov ecx, dword [ebx + eax]
xor ecx, edx
mov dword [edi + eax], ecx
mov dword [ebx + eax], edx
add eax, 4
cmp eax, 0x10
jne 0x504bf0
add edi, 0x10
add esi, 0x10
sub ebp, 1
jne 0x504be0
mov dword [esp], 0x20
call dbg.__gcry_burn_stack
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x506090
Capabilities:
Hash data using sha1

Disassembly:
push ebx
sub esp, 8
mov ebx, dword [esp + 0x10]
call dbg._gcry_get_hw_features
mov dword [ebx + 0xa0], 0x67452301
mov dword [ebx + 0xa4], 0xefcdab89
mov dword [ebx + 0xa8], 0x98badcfe
mov dword [ebx + 0xac], 0x10325476
mov dword [ebx + 0xb0], 0xc3d2e1f0
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x84], 0
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], 0
mov dword [ebx + 0x90], 0
mov dword [ebx + 0x94], 0x40
mov dword [ebx + 0x98], sym._transform_3
add esp, 8
pop ebx
ret

Function at 0x506170
Capabilities:
Hash data using sha1

Disassembly:
push esi
push ebx
sub esp, 0xd4
mov ebx, dword [esp + 0xe0]
lea esi, [esp + 0x18]
call dbg._gcry_get_hw_features
mov eax, dword [esp + 0xe8]
mov dword [esp], esi
mov dword [esp + 0xb8], 0x67452301
mov dword [esp + 0xbc], 0xefcdab89
mov dword [esp + 0xc0], 0x98badcfe
mov dword [esp + 0xc4], 0x10325476
mov dword [esp + 8], eax
mov eax, dword [esp + 0xe4]
mov dword [esp + 0xc8], 0xc3d2e1f0
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 4], eax
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0x40
mov dword [esp + 0xb0], sym._transform_3
call dbg._gcry_md_block_write
mov dword [esp], esi
call dbg.sha1_final
mov eax, dword [esp + 0x18]
mov dword [ebx], eax
mov eax, dword [esp + 0x1c]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x20]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x10], eax
add esp, 0xd4
pop ebx
pop esi
ret
Function at 0x506260
Capabilities:
Hash data using sha1

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xdc
mov esi, dword [esp + 0xf8]
mov ebp, dword [esp + 0xf0]
lea edi, [esp + 0x18]
mov ebx, dword [esp + 0xf4]
call dbg._gcry_get_hw_features
test esi, esi
mov dword [esp + 0xb8], 0x67452301
mov dword [esp + 0xbc], 0xefcdab89
mov dword [esp + 0xc0], 0x98badcfe
mov dword [esp + 0xc4], 0x10325476
mov dword [esp + 0xc8], 0xc3d2e1f0
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0
mov dword [esp + 0xa8], 0
mov dword [esp + 0xac], 0x40
mov dword [esp + 0xb0], sym._transform_3
jle 0x506331
mov eax, dword [ebx + 8]
add ebx, 0x10
mov dword [esp + 8], eax
mov eax, dword [ebx - 0xc]
add eax, dword [ebx - 4]
mov dword [esp], edi
mov dword [esp + 4], eax
call dbg._gcry_md_block_write
sub esi, 1
jne 0x506310
mov dword [esp], edi
call dbg.sha1_final
mov eax, dword [esp + 0x18]
mov dword [ebp], eax
mov eax, dword [esp + 0x1c]
mov dword [ebp + 4], eax
mov eax, dword [esp + 0x20]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x28]
mov dword [ebp + 0x10], eax
add esp, 0xdc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x508fb0
Capabilities:
Hash data using sha256

Disassembly:
push esi
push ebx
sub esp, 0xd4
mov ebx, dword [esp + 0xe0]
lea esi, [esp + 0x10]
call dbg._gcry_get_hw_features
mov eax, dword [esp + 0xe8]
mov dword [esp], esi
mov dword [esp + 0xb0], 0x6a09e667
mov dword [esp + 0xb4], 0xbb67ae85
mov dword [esp + 0xb8], 0x3c6ef372
mov dword [esp + 0xbc], 0xa54ff53a
mov dword [esp + 8], eax
mov eax, dword [esp + 0xe4]
mov dword [esp + 0xc0], 0x510e527f
mov dword [esp + 0xc4], 0x9b05688c
mov dword [esp + 0xc8], 0x1f83d9ab
mov dword [esp + 0xcc], 0x5be0cd19
mov dword [esp + 4], eax
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0x40
mov dword [esp + 0xa8], sym._transform_4
call dbg._gcry_md_block_write
mov dword [esp], esi
call dbg.sha256_final
mov eax, dword [esp + 0x10]
mov dword [ebx], eax
mov eax, dword [esp + 0x14]
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x18]
mov dword [ebx + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [ebx + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [ebx + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [ebx + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x1c], eax
add esp, 0xd4
pop ebx
pop esi
ret

Function at 0x5090e0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0xdc
mov esi, dword [esp + 0xf8]
mov ebp, dword [esp + 0xf0]
lea edi, [esp + 0x10]
mov ebx, dword [esp + 0xf4]
call dbg._gcry_get_hw_features
test esi, esi
mov dword [esp + 0xb0], 0x6a09e667
mov dword [esp + 0xb4], 0xbb67ae85
mov dword [esp + 0xb8], 0x3c6ef372
mov dword [esp + 0xbc], 0xa54ff53a
mov dword [esp + 0xc0], 0x510e527f
mov dword [esp + 0xc4], 0x9b05688c
mov dword [esp + 0xc8], 0x1f83d9ab
mov dword [esp + 0xcc], 0x5be0cd19
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
mov dword [esp + 0xa4], 0x40
mov dword [esp + 0xa8], sym._transform_4
jle 0x5091d2
mov eax, dword [ebx + 8]
add ebx, 0x10
mov dword [esp + 8], eax
mov eax, dword [ebx - 0xc]
add eax, dword [ebx - 4]
mov dword [esp], edi
mov dword [esp + 4], eax
call dbg._gcry_md_block_write
sub esi, 1
jne 0x5091b1
mov dword [esp], edi
call dbg.sha256_final
mov eax, dword [esp + 0x10]
mov dword [ebp], eax
mov eax, dword [esp + 0x14]
mov dword [ebp + 4], eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [ebp + 0x10], eax
mov eax, dword [esp + 0x24]
mov dword [ebp + 0x14], eax
mov eax, dword [esp + 0x28]
mov dword [ebp + 0x18], eax
mov eax, dword [esp + 0x2c]
mov dword [ebp + 0x1c], eax
add esp, 0xdc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x509230
Capabilities:
Hash data using sha256

Disassembly:
push ebx
sub esp, 8
mov ebx, dword [esp + 0x10]
call dbg._gcry_get_hw_features
mov dword [ebx + 0xa0], 0xf3bcc908
mov dword [ebx + 0xa4], 0x6a09e667
mov dword [ebx + 0xa8], 0x84caa73b
mov dword [ebx + 0xac], 0xbb67ae85
mov dword [ebx + 0xb0], 0xfe94f82b
mov dword [ebx + 0xb4], 0x3c6ef372
mov dword [ebx + 0xb8], 0x5f1d36f1
mov dword [ebx + 0xbc], 0xa54ff53a
mov dword [ebx + 0xc0], 0xade682d1
mov dword [ebx + 0xc4], 0x510e527f
mov dword [ebx + 0xc8], 0x2b3e6c1f
mov dword [ebx + 0xcc], 0x9b05688c
mov dword [ebx + 0xd0], 0xfb41bd6b
mov dword [ebx + 0xd4], 0x1f83d9ab
mov dword [ebx + 0xd8], 0x137e2179
mov dword [ebx + 0xdc], 0x5be0cd19
mov dword [ebx + 0x80], 0
mov dword [ebx + 0x84], 0
mov dword [ebx + 0x88], 0
mov dword [ebx + 0x8c], 0
mov dword [ebx + 0x90], 0
mov dword [ebx + 0x94], pe_nt_image_headers32
mov dword [ebx + 0x98], sym._transform_5
add esp, 8
pop ebx
ret