joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ca580
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x88bba0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
cmp edi, 1
je 0x4ca61f
push ebx
push dword [ebp + 0x10]
push edi
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi + 0x34], eax
cmp eax, 0xffffffff
jne 0x4ca5d9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.004bea10
add esp, 4
neg eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00722035
mov esp, ebp
pop ebp
ret
push 0
push 1
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
je 0x4ca650
cmp edi, 0x17
jne 0x4ca616
push 4
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], 0
push eax
push 0x1b
push 0x29
push dword [esi + 0x34]
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x4ca6ad
push esi
call fcn.004c9480
add esp, 4
mov eax, dword [ebp + 0x10]
push esi
mov dword [esi + 0xa4], edi
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], ebx
call fcn.004c07a0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.00722035
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call fcn.005f0da0
push 0x100
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.004bebe0
add esp, 0xc
lea eax, [ebp - 0x104]
push 0x95
push str.c:.conan76myf3u_1_source_subfolder_src_aiousock_win.inc
push esi
push eax
push str._s___d____s:_d__n
call fcn.00724777
add eax, 0x40
push eax
call fcn.0072663b
call fcn.00724777
add eax, 0x40
push eax
call fcn.00723db0
add esp, 0x1c
call fcn.004be7e0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call fcn.005f0da0
push 0x100
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.004bebe0
add esp, 0xc
lea eax, [ebp - 0x104]
push 0x9e
push str.c:.conan76myf3u_1_source_subfolder_src_aiousock_win.inc
push esi
push eax
push str._s___d____s:_d__n
call fcn.00724777
add eax, 0x40
push eax
call fcn.0072663b
call fcn.00724777
add eax, 0x40
push eax
call fcn.00723db0
add esp, 0x1c
call fcn.004be7e0
int3
Function at 0x4cce70
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x88bba0]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x8c], edx
cmp dword [esi + 0x30], 1
jne 0x4cd02b
mov ecx, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
mov dword [esi + 0x34], ecx
lea eax, [ecx + 0x88]
push eax
lea eax, [ecx + 8]
push eax
push dword [ebp + 0x14]
push ebx
push edx
call fcn.004cd0d0
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x4ccee2
mov eax, dword [esi + 0x34]
mov dword [eax], edi
push esi
call fcn.004c07a0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00722035
mov esp, ebp
pop ebp
ret
cmp edi, 0xffffffea
je 0x4ccf0a
call fcn.005f0da0
push 0x58
neg edi
push str.c:.conan76myf3u_1_source_subfolder_src_transportsutilsdns_getaddrinfo.inc
push edi
push edi
call fcn.004be800
add esp, 4
push eax
push str._s___d____s:_d__n
jmp 0x4cd044
cmp dword [ebp + 0x14], 0
xorps xmm0, xmm0
movdqu xmmword [ebp - 0xac], xmm0
movdqu xmmword [ebp - 0x9c], xmm0
je 0x4ccf2f
mov dword [ebp - 0xa8], 2
jmp 0x4ccf43
mov dword [ebp - 0xa8], 0x17
mov dword [ebp - 0xac], 0x800
cmp ebx, 0x80
jb 0x4ccf85
call fcn.005f0da0
push 0x64
push str.c:.conan76myf3u_1_source_subfolder_src_transportsutilsdns_getaddrinfo.inc
push str.sizeof__hostname____addrlen
push str.Assertion_failed:__s___s:_d__n
call fcn.00724777
add eax, 0x40
push eax
call fcn.0072663b
call fcn.00724777
add eax, 0x40
push eax
call fcn.00723db0
add esp, 0x18
jmp 0x4cd063
push ebx
push dword [ebp - 0x8c]
lea eax, [ebp - 0x84]
mov dword [ebp - 0xa4], 1
push eax
call fcn.007224a0
add esp, 0xc
cmp ebx, 0x80
jae 0x4cd068
lea eax, [ebp - 0x88]
mov byte [ebp + ebx - 0x84], 0
push eax
lea eax, [ebp - 0xac]
push eax
push 0
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov ecx, dword [esi + 0x34]
mov dword [ecx], eax
mov eax, dword [esi + 0x34]
cmp dword [eax], 0
jne 0x4ccec8
mov dword [eax], 0
mov eax, dword [ebp - 0x88]
push dword [eax + 0x10]
push dword [eax + 0x18]
mov eax, dword [esi + 0x34]
add eax, 8
push eax
call fcn.007224a0
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov ecx, dword [esi + 0x34]
mov eax, dword [eax + 0x10]
mov dword [ecx + 0x88], eax
push dword [ebp - 0x88]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
jmp 0x4ccec8
call fcn.005f0da0
push 0x4b
push str.c:.conan76myf3u_1_source_subfolder_src_transportsutilsdns_getaddrinfo.inc
push str.NN_DNS_STATE_IDLE
push dword [esi + 0x30]
push str.Assertion_failed:__d___s___s:_d__n
call fcn.00724777
add eax, 0x40
push eax
call fcn.0072663b
call fcn.00724777
add eax, 0x40
push eax
call fcn.00723db0
add esp, 0x1c
call fcn.004be7e0
call fcn.00725327
int3
Function at 0x4cd0d0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x88bba0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
test esi, esi
je 0x4cd13b
cmp byte [ecx], 0x5b
jne 0x4cd13b
cmp byte [esi + ecx - 1], 0x5d
je 0x4cd115
pop edi
pop esi
mov eax, 0xffffffea
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00722035
mov esp, ebp
pop ebp
ret
lea eax, [esi - 1]
cmp eax, 0x41
ja 0x4cd0ff
add esi, 0xfffffffe
lea eax, [ecx + 1]
push esi
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.007224a0
add esp, 0xc
cmp esi, 0x41
jb 0x4cd15a
jmp 0x4cd210
lea eax, [esi + 1]
cmp eax, 0x41
ja 0x4cd0ff
push esi
push ecx
lea eax, [ebp - 0x48]
push eax
call fcn.007224a0
add esp, 0xc
cmp esi, 0x41
jae 0x4cd210
cmp dword [ebp + 0x10], 0
mov byte [ebp + esi - 0x48], 0
mov esi, dword [sym.imp.WS2_32.dll_inet_pton]
jne 0x4cd1b3
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x17
call esi
cmp eax, 1
jne 0x4cd1af
test edi, edi
je 0x4cd192
movdqu xmm0, xmmword [ebp - 0x58]
mov eax, 0x17
mov word [edi], ax
movdqu xmmword [edi + 8], xmm0
test ebx, ebx
je 0x4cd19c
mov dword [ebx], 0x1c
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00722035
mov esp, ebp
pop ebp
ret
test eax, eax
jne 0x4cd215
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x48]
push eax
push 2
call esi
cmp eax, 1
jne 0x4cd1f3
test edi, edi
je 0x4cd1d6
mov eax, 2
mov word [edi], ax
mov eax, dword [ebp - 0x5c]
mov dword [edi + 4], eax
test ebx, ebx
je 0x4cd19c
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
mov dword [ebx], 0x10
xor ecx, ebp
pop ebx
call fcn.00722035
mov esp, ebp
pop ebp
ret
test eax, eax
je 0x4cd0ff
call fcn.005f0da0
call fcn.00724f21
mov esi, eax
call fcn.00724f21
push 0x58
jmp 0x4cd228
call fcn.00725327
call fcn.005f0da0
call fcn.00724f21
mov esi, eax
call fcn.00724f21
push 0x4a
push str.C:.conan76myf3u_1_source_subfolder_src_transportsutilsliteral.c
push dword [esi]
push dword [eax]
call fcn.004be800
add esp, 4
push eax
push str._s___d____s:_d__n
call fcn.00724777
add eax, 0x40
push eax
call fcn.0072663b
call fcn.00724777
add eax, 0x40
push eax
call fcn.00723db0
add esp, 0x1c
call fcn.004be7e0
int3
Function at 0x4ce2d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x30], 4
jne 0x4ce443
push ebx
lea eax, [esi + 0x13c8]
mov dword [esi + 0x1444], 7
push edi
push eax
call fcn.004bf6c0
lea eax, [esi + 0x1488]
push eax
call fcn.004ce040
mov edi, dword [ebp + 0x10]
add esp, 8
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x4ce311
sub edi, ecx
lea ebx, [edi + 2]
cmp ebx, 0x7d
ja 0x4ce483
mov byte [esi + 0x151e], 0x88
mov byte [esi + 0x151f], bl
mov eax, dword [esi + 0x38]
mov dword [esi + 0x159c], 2
dec eax
je 0x4ce35f
dec eax
je 0x4ce384
call fcn.005f0da0
push 0x326
push str.C:.conan76myf3u_1_source_subfolder_src_transportsws_sws.c
push 0x79b8e0
jmp 0x4ce497
or byte [esi + 0x151f], 0x80
lea eax, [ebp - 4]
push 4
push eax
call fcn.004becb0
mov eax, dword [ebp - 4]
add esp, 8
mov dword [esi + 0x1520], eax
add dword [esi + 0x159c], 4
mov eax, dword [esi + 0x159c]
push dword [ebp + 0xc]
add eax, 0x151e
add eax, esi
push eax
mov dword [ebp + 8], eax
call fcn.004c0f50
mov eax, dword [ebp + 8]
add dword [esi + 0x159c], 2
add eax, 2
push edi
push dword [ebp + 0x10]
push eax
call fcn.007224a0
add dword [esi + 0x159c], edi
add esp, 0x14
cmp dword [esi + 0x38], 1
jne 0x4ce3e1
xor ecx, ecx
test ebx, ebx
je 0x4ce3e1
mov edx, dword [ebp + 8]
lea esp, [esp]
mov eax, ecx
and eax, 3
mov al, byte [ebp + eax - 4]
xor byte [ecx + edx], al
inc ecx
cmp ecx, ebx
jb 0x4ce3d0
cmp dword [esi + 0x15a0], 1
pop edi
pop ebx
jne 0x4ce425
lea eax, [esi + 0x151e]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x159c]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push 1
push eax
push dword [esi + 0x3c]
call fcn.004ca000
add esp, 0xc
mov dword [esi + 0x15a0], 2
mov dword [esi + 0x30], 5
pop esi
mov esp, ebp
pop ebp
ret
push 2
lea eax, [esi + 0x1614]
mov dword [esi + 0x30], 7
push eax
push esi
call fcn.004c0710
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret
call fcn.005f0da0
push 0x2fd
push str.C:.conan76myf3u_1_source_subfolder_src_transportsws_sws.c
push str.NN_SWS_STATE_ACTIVE
push dword [esi + 0x30]
push str.Assertion_failed:__d___s___s:_d__n
call fcn.00724777
add eax, 0x40
push eax
call fcn.0072663b
call fcn.00724777
add eax, 0x40
push eax
call fcn.00723db0
add esp, 0x1c
call fcn.004be7e0
call fcn.005f0da0
push 0x30b
push str.C:.conan76myf3u_1_source_subfolder_src_transportsws_sws.c
push str.payload_len___NN_SWS_PAYLOAD_MAX_LENGTH
push str.Assertion_failed:__s___s:_d__n
call fcn.00724777
add eax, 0x40
push eax
call fcn.0072663b
call fcn.00724777
add eax, 0x40
push eax
call fcn.00723db0
add esp, 0x18
call fcn.004be7e0
int3
Function at 0x4cf0f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x18]
xor ecx, ecx
push edi
test esi, esi
je 0x4cf139
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x14]
test edi, edi
je 0x4cf12a
lea esp, [esp]
mov eax, dword [esi]
xor edx, edx
add eax, ecx
mov edi, dword [ebp + 0x10]
div ebx
mov al, byte [edx + edi]
mov edx, dword [ebp + 8]
xor byte [ecx + edx], al
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x4cf110
mov eax, dword [esi]
xor edx, edx
add eax, ecx
div ebx
pop edi
mov dword [esi], edx
pop esi
pop ebx
pop ebp
ret
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x4cf15a
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
xor edx, edx
mov eax, ecx
div edi
mov al, byte [edx + ebx]
mov edx, dword [ebp + 8]
xor byte [ecx + edx], al
inc ecx
cmp ecx, esi
jb 0x4cf146
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4cf960
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x88bba0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push 0
push 0
push esi
push 0x4cfa10
mov dword [esi], eax
mov eax, dword [ebp + 0x10]
push 0
push 0
mov dword [esi + 4], eax
call fcn.00726bc4
add esp, 0x18
mov dword [esi + 8], eax
test eax, eax
je 0x4cf9ae
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00722035
mov esp, ebp
pop ebp
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
call fcn.005f0da0
push 0x100
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.004bebe0
add esp, 0xc
lea eax, [ebp - 0x104]
push 0x29
push str.c:.conan76myf3u_1_source_subfolder_srcutils_thread_win.inc
push esi
push eax
push str._s___d____s:_d__n
call fcn.00724777
add eax, 0x40
push eax
call fcn.0072663b
call fcn.00724777
add eax, 0x40
push eax
call fcn.00723db0
add esp, 0x1c
call fcn.004be7e0
int3
Function at 0x4d2550
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x88bba0]
xor eax, ebp
mov dword [ebp - 4], eax
movdqu xmm0, xmmword [0x7abfa0]
mov edx, dword [ebp + 0x10]
xor eax, eax
push ebx
movdqu xmmword [ebp - 0x44], xmm0
push esi
movdqu xmm0, xmmword [0x7abfb0]
xor ecx, ecx
mov dword [ebp - 0x4c], edx
xor ebx, ebx
mov dword [ebp - 0x48], ecx
movdqu xmmword [ebp - 0x34], xmm0
xor esi, esi
movdqu xmm0, xmmword [0x7abfc0]
push edi
mov edi, dword [ebp + 0x14]
movdqu xmmword [ebp - 0x24], xmm0
movdqu xmm0, xmmword [0x7abfd0]
movdqu xmmword [ebp - 0x14], xmm0
cmp dword [ebp + 0xc], eax
jbe 0x4d260f
mov edx, dword [ebp + 8]
add esi, 8
shl ebx, 8
movzx ecx, byte [ecx + edx]
mov edx, dword [ebp - 0x4c]
or ebx, ecx
cmp esi, 6
jb 0x4d25e7
sub esi, 6
cmp eax, edi
jae 0x4d2639
mov ecx, esi
mov edx, ebx
shr edx, cl
and edx, 0x3f
mov cl, byte [ebp + edx - 0x44]
mov edx, dword [ebp - 0x4c]
mov byte [edx + eax], cl
inc eax
cmp esi, 6
jae 0x4d25c7
mov ecx, dword [ebp - 0x48]
inc ecx
mov dword [ebp - 0x48], ecx
cmp ecx, dword [ebp + 0xc]
jb 0x4d25b0
test esi, esi
je 0x4d260f
cmp eax, edi
jae 0x4d2639
mov ecx, 6
sub ecx, esi
shl ebx, cl
and ebx, 0x3f
mov cl, byte [ebp + ebx - 0x44]
mov byte [edx + eax], cl
inc eax
test al, 3
je 0x4d2620
cmp eax, edi
jae 0x4d2639
mov byte [edx + eax], 0x3d
inc eax
test al, 3
jne 0x4d2613
cmp eax, edi
jae 0x4d2639
pop edi
pop esi
mov byte [edx + eax], 0
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00722035
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0xffffff89
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00722035
mov esp, ebp
pop ebp
ret

Function at 0x4d2c50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
xor eax, eax
push edi
mov edi, dword [ebp + 0x10]
mov byte [ebp + 0xb], 0
test edi, edi
je 0x4d2c8e
push esi
nop
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx + eax]
mov ecx, dword [ebp - 4]
movzx esi, byte [ecx + eax]
inc eax
mov cl, byte [ebp + 0xb]
xor esi, edx
or ecx, esi
mov byte [ebp + 0xb], cl
cmp eax, edi
jb 0x4d2c70
pop esi
movzx eax, byte [ebp + 0xb]
dec eax
sar eax, 8
and eax, 1
dec eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x4d3540
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x88bba0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x194]
push edi
push eax
call fcn.004d61c0
mov edi, dword [ebp + 0x20]
add esp, 4
test edi, edi
je 0x4d359c
push 0
push 0x22
lea eax, [ebp - 0x194]
push str.SigEd25519_no_Ed25519_collisions
push eax
call fcn.004d6220
add esp, 0x10
push 0
push 0x20
push dword [ebp - 0x23c]
lea eax, [ebp - 0x44]
push eax
call fcn.004d6070
push 0
push 0x20
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004d6220
push dword [ebp + 0x18]
lea eax, [ebp - 0x194]
push dword [ebp + 0x14]
push dword [ebp - 0x238]
push eax
call fcn.004d6220
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004d6150
mov eax, dword [ebp - 0x23c]
lea ecx, [ebx + 0x20]
push 0x20
add eax, 0x20
push eax
push ecx
call fcn.00721770
add esp, 0x44
lea eax, [ebp - 0x84]
push eax
call fcn.004e24e0
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x234]
push eax
call fcn.004dd370
lea eax, [ebp - 0x234]
push eax
push ebx
call fcn.004debc0
lea eax, [ebp - 0x194]
push eax
call fcn.004d61c0
add esp, 0x18
test edi, edi
je 0x4d365d
push 0
push 0x22
lea eax, [ebp - 0x194]
push str.SigEd25519_no_Ed25519_collisions
push eax
call fcn.004d6220
add esp, 0x10
push 0
push 0x40
lea eax, [ebp - 0x194]
push ebx
push eax
call fcn.004d6220
push dword [ebp + 0x18]
lea eax, [ebp - 0x194]
push dword [ebp + 0x14]
push dword [ebp - 0x238]
push eax
call fcn.004d6220
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x194]
push eax
call fcn.004d6150
lea eax, [ebp - 0xc4]
push eax
call fcn.004e24e0
mov al, byte [ebp - 0x25]
and byte [ebp - 0x44], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ebp - 0x25], al
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebx + 0x20]
push eax
call fcn.004dec80
lea eax, [ebp - 0x44]
push 0x40
push eax
call fcn.004d2ca0
add esp, 0x44
lea eax, [ebp - 0x84]
push 0x40
push eax
call fcn.004d2ca0
add esp, 8
xor eax, eax
test esi, esi
je 0x4d36fc
mov dword [esi], 0x40
mov dword [esi + 4], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00722035
mov esp, ebp
pop ebp
ret
Function at 0x4d8d80
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0x125
push 0
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
add eax, 0x40
push eax
call fcn.00723180
add esp, 0xc
xor eax, eax
pop ebp
ret

Function at 0x4dce10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x88bba0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push ebx
mov dword [ebp - 0xb], eax
xor bl, bl
mov cl, byte [ebp - 9]
mov dh, byte [ebp - 8]
push esi
mov byte [ebp - 0xf], cl
mov cl, byte [ebp - 0xa]
push edi
mov edi, dword [ebp + 8]
mov esi, edi
mov byte [ebp - 0xe], cl
sub esi, 0x7b40b0
mov word [ebp - 7], ax
mov cl, al
mov ch, byte [ebp - 6]
mov bh, byte [ebp - 7]
mov byte [ebp - 0xd], cl
jmp 0x4dce60
mov dl, byte [esi + eax + 0x7b40b0]
mov cl, byte [eax + 0x7b40b0]
xor cl, dl
or bl, cl
mov cl, byte [eax + 0x7b40d0]
xor cl, dl
or byte [ebp - 0xd], cl
mov cl, byte [eax + 0x7b40f0]
xor cl, dl
or byte [ebp - 0xe], cl
mov cl, byte [eax + 0x7b4110]
xor cl, dl
or byte [ebp - 0xf], cl
mov cl, byte [eax + 0x7b4130]
xor cl, dl
or dh, cl
mov cl, byte [eax + 0x7b4150]
xor cl, dl
or bh, cl
mov cl, byte [eax + 0x7b4170]
xor cl, dl
inc eax
or ch, cl
cmp eax, 0x1f
jb 0x4dce60
mov dl, byte [eax + edi]
mov cl, byte [eax + 0x7b40b0]
and dl, 0x7f
xor cl, dl
or bl, cl
mov cl, byte [eax + 0x7b40d0]
xor cl, dl
or byte [ebp - 0xd], cl
mov cl, byte [eax + 0x7b40f0]
xor cl, dl
or byte [ebp - 0xe], cl
mov cl, byte [eax + 0x7b4110]
xor cl, dl
or byte [ebp - 0xf], cl
mov cl, byte [eax + 0x7b4130]
xor cl, dl
or dh, cl
mov cl, byte [eax + 0x7b4150]
movzx eax, byte [eax + 0x7b4170]
xor cl, dl
xor al, dl
mov byte [ebp - 0x10], dh
or ch, al
or bh, cl
movzx edx, ch
dec edx
movzx eax, bh
dec eax
movzx ecx, bl
or edx, eax
dec ecx
movzx eax, byte [ebp - 0x10]
dec eax
or edx, eax
movzx eax, byte [ebp - 0xf]
dec eax
or edx, eax
movzx eax, byte [ebp - 0xe]
dec eax
or edx, eax
movzx eax, byte [ebp - 0xd]
dec eax
or eax, edx
or eax, ecx
mov ecx, dword [ebp - 4]
pop edi
shr eax, 8
xor ecx, ebp
pop esi
and eax, 1
pop ebx
call fcn.00722035
mov esp, ebp
pop ebp
ret

Function at 0x4dec30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 0x20
mov byte [ebp - 2], 0
mov byte [ebp - 1], 1
movzx edx, byte [eax + esi - 1]
dec eax
mov ecx, edx
movzx ebx, byte [eax + 0x7b4190]
sub ecx, ebx
xor ebx, edx
sar ecx, 8
dec ebx
and cl, byte [ebp - 1]
or byte [ebp - 2], cl
sar ebx, 8
and byte [ebp - 1], bl
test eax, eax
jne 0x4dec46
cmp byte [ebp - 2], al
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4e41c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
xor eax, eax
mov dword [ebp + 8], 0
lea esp, [esp]
mov ecx, dword [ebp + 0xc]
mov cl, byte [ecx + eax]
movzx edx, cl
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + eax]
inc eax
xor ecx, edx
or dword [ebp + 8], ecx
cmp eax, 0x10
jl 0x4e41e0
mov eax, dword [ebp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
mov esp, ebp
pop ebp
ret

Function at 0x4e4210
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp + 0xc], eax
xor eax, eax
mov dword [ebp + 8], 0
lea esp, [esp]
mov ecx, dword [ebp + 0xc]
mov cl, byte [ecx + eax]
movzx edx, cl
mov ecx, dword [ebp - 4]
movzx ecx, byte [ecx + eax]
inc eax
xor ecx, edx
or dword [ebp + 8], ecx
cmp eax, 0x20
jl 0x4e4230
mov eax, dword [ebp + 8]
dec eax
shr eax, 8
and eax, 1
dec eax
mov esp, ebp
pop ebp
ret

Function at 0x4e5840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x88bba0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xorps xmm0, xmm0
push esi
push edi
xor edi, edi
mov byte [ebp - 0x10], 0
movq qword [ebp - 0xf], xmm0
sub ebx, 0x7b4290
mov word [ebp - 7], 0
mov byte [ebp - 5], 0
jmp 0x4e5880
mov dl, byte [ebx + edi + 0x7b4290]
lea eax, [edi + 0x7b4290]
xor esi, esi
nop
movzx ecx, byte [eax - 0x40]
lea eax, [eax + 0xc0]
xor cl, dl
or byte [ebp + esi - 0x10], cl
movzx ecx, byte [eax - 0xe0]
xor cl, dl
or byte [ebp + esi - 0xf], cl
movzx ecx, byte [eax - 0xc0]
xor cl, dl
or byte [ebp + esi - 0xe], cl
movzx ecx, byte [eax - 0xa0]
xor cl, dl
or byte [ebp + esi - 0xd], cl
movzx ecx, byte [eax - 0x80]
xor cl, dl
or byte [ebp + esi - 0xc], cl
movzx ecx, byte [eax - 0x60]
xor cl, dl
or byte [ebp + esi - 0xb], cl
add esi, 6
cmp esi, 0xc
jb 0x4e5890
inc edi
cmp edi, 0x20
jb 0x4e5880
xor esi, esi
xor edx, edx
lea ecx, [ecx]
movzx ecx, byte [ebp + edx - 0x10]
movzx eax, byte [ebp + edx - 0xf]
dec ecx
dec eax
or ecx, eax
movzx eax, byte [ebp + edx - 0xe]
dec eax
or ecx, eax
movzx eax, byte [ebp + edx - 0xd]
dec eax
or ecx, eax
movzx eax, byte [ebp + edx - 0xb]
dec eax
or ecx, eax
movzx eax, byte [ebp + edx - 0xc]
dec eax
add edx, 6
or ecx, eax
or esi, ecx
cmp edx, 0xc
jb 0x4e58f0
mov ecx, dword [ebp - 4]
shr esi, 8
xor ecx, ebp
and esi, 1
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.00722035
mov esp, ebp
pop ebp
ret
Function at 0x4e8970
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
lea ecx, [edx + 0x3f8]
lea esi, [eax + 0x3f8]
cmp eax, ecx
ja 0x4e89ab
cmp esi, edx
jb 0x4e89ab
sub edx, eax
mov esi, 0x80
mov ecx, dword [eax + edx]
lea eax, [eax + 8]
xor dword [eax - 8], ecx
mov ecx, dword [eax + edx - 4]
xor dword [eax - 4], ecx
dec esi
jne 0x4e8995
pop esi
pop ebp
ret
mov esi, edx
lea ecx, [eax + 0x10]
sub esi, eax
mov eax, 0x20
jmp 0x4e89c0
lea edx, [edx + 0x20]
lea ecx, [ecx + 0x20]
movdqu xmm0, xmmword [edx - 0x20]
movdqu xmm1, xmmword [ecx - 0x30]
pxor xmm1, xmm0
movdqu xmmword [ecx - 0x30], xmm1
movdqu xmm1, xmmword [esi + ecx - 0x20]
movdqu xmm0, xmmword [ecx - 0x20]
pxor xmm1, xmm0
movdqu xmmword [ecx - 0x20], xmm1
dec eax
jne 0x4e89c0
pop esi
pop ebp
ret