joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a7e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov eax, 0x552fc8
mov ebp, esp
mov ecx, 0x44a610
push edi
mov edx, 0x44a4a0
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
call fcn.0044a4e0
mov eax, dword [0x552fc0]
test eax, eax
jne 0x44a860
mov eax, dword [0x552fc4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
test eax, eax
mov edi, eax
je 0x44a873
mov dword [esp], 0x552fdc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 0x10]
mov dword [ebx*4 + 0x552fcc], eax
sub esp, 4
mov dword [esp], 0x552fdc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 0xc]
mov dword [edi + ebx*4], eax
mov eax, 1
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [ebp + 0x10]
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0x10
call sub.msvcrt.dll_malloc
test eax, eax
mov esi, eax
mov edi, eax
je 0x44a860
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
mov dword [esp + 4], eax
mov eax, dword [0x552fc4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x44a820
mov dword [esp], esi
mov dword [ebp - 0x1c], eax
call fcn.004b0fa0
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [ebp + 0x10]
mov eax, dword [ebp - 0x1c]
jmp 0x44a855
Function at 0x46f700
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
mov eax, dword [edx]
cmp eax, dword [ecx]
je 0x46f751
mov dword [esp + 0x10], 0x332
mov dword [esp + 0xc], str.external_boringssl_src_crypto_ec_ec.c
mov dword [esp + 8], 0x6a
mov dword [esp + 4], 0
mov dword [esp], 0xf
call sym.adb.exe_ERR_put_error
add esp, 0x20
xor eax, eax
pop ebx
pop esi
pop edi
ret
cmp eax, dword [ebx]
jne 0x46f71c
cmp eax, dword [esi]
jne 0x46f71c
add esp, 0x20
pop ebx
pop esi
pop edi
jmp fcn.00473610
Function at 0x478260
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [esp + 0x14c]
mov edi, dword [esp + 0x140]
mov esi, dword [esp + 0x148]
test ebx, ebx
je 0x4783cf
cmp ebx, dword [edi]
je 0x4783d1
mov dword [esp], ebx
call sym.adb.exe_EVP_MD_block_size
cmp eax, esi
jb 0x4783a0
mov eax, dword [esp + 0x144]
lea ebp, [esp + 0xa0]
mov dword [esp + 8], esi
mov dword [esp], ebp
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
mov dword [esp + 0x1c], esi
cmp esi, 0x80
je 0x4782e6
mov eax, pe_nt_image_headers32
sub eax, esi
add esi, ebp
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], esi
call sub.msvcrt.dll_memset
xor eax, eax
movzx ecx, byte [ebp + eax]
xor ecx, 0x36
mov byte [esp + eax + 0x20], cl
add eax, 1
cmp eax, 0x80
jne 0x4782e8
mov eax, dword [esp + 0x150]
lea esi, [edi + 0x14]
mov dword [esp + 4], ebx
mov dword [esp], esi
mov dword [esp + 8], eax
call sym.adb.exe_EVP_DigestInit_ex
test eax, eax
je 0x4783c2
mov dword [esp], ebx
call sym.adb.exe_EVP_MD_block_size
mov dword [esp], esi
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
call sym.adb.exe_EVP_DigestUpdate
test eax, eax
je 0x4783c2
xor eax, eax
movzx ecx, byte [ebp + eax]
xor ecx, 0x5c
mov byte [esp + eax + 0x20], cl
add eax, 1
cmp eax, 0x80
jne 0x478346
mov eax, dword [esp + 0x150]
lea ebp, [edi + 0x24]
mov dword [esp + 4], ebx
mov dword [esp], ebp
mov dword [esp + 8], eax
call sym.adb.exe_EVP_DigestInit_ex
test eax, eax
je 0x4783c2
mov dword [esp], ebx
call sym.adb.exe_EVP_MD_block_size
mov dword [esp], ebp
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
call sym.adb.exe_EVP_DigestUpdate
test eax, eax
je 0x4783c2
mov dword [edi], ebx
jmp 0x4783e3
mov edx, dword [esp + 0x150]
lea eax, [edi + 4]
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
call sym.adb.exe_EVP_DigestInit_ex
test eax, eax
jne 0x4783fc
xor eax, eax
add esp, 0x12c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [edi]
mov eax, dword [esp + 0x144]
test eax, eax
jne 0x47828f
lea esi, [edi + 0x14]
add edi, 4
mov dword [esp + 4], esi
mov dword [esp], edi
call sym.adb.exe_EVP_MD_CTX_copy_ex
test eax, eax
setne al
movzx eax, al
jmp 0x4783c4
mov eax, dword [esp + 0x144]
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov eax, dword [esp + 0xc]
mov dword [esp], eax
call sym.adb.exe_EVP_DigestUpdate
test eax, eax
je 0x4783c2
lea eax, [esp + 0x1c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0xc]
lea ebp, [esp + 0xa0]
mov dword [esp + 4], ebp
mov dword [esp], eax
call sym.adb.exe_EVP_DigestFinal_ex
test eax, eax
je 0x4783c2
mov esi, dword [esp + 0x1c]
jmp 0x4782c1
Function at 0x478720
Capabilities:
Encode data using xor

Disassembly:
push esi
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x478770
movzx ecx, byte [ebx]
xor eax, eax
test cl, cl
je 0x47876d
xor edx, edx
mov esi, 0x100
lea esi, [esi]
movsx eax, cl
add ebx, 1
or eax, esi
add esi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
rol edx, cl
movzx ecx, byte [ebx]
imul eax, eax
xor edx, eax
test cl, cl
jne 0x478740
mov eax, edx
shr eax, 0x10
xor eax, edx
pop ebx
pop esi
ret
xor eax, eax
pop ebx
pop esi
ret

Function at 0x478bb0
Capabilities:
Hash data with md5

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x5c
test dl, 1
mov edi, edx
jne 0x478c10
test edi, 2
jne 0x478c20
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x478be1
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x478be9
mov byte [edi], 0
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x5b
test edi, 2
mov byte [edx], 0
je 0x478bca
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x478bca

Function at 0x479480
Capabilities:
Hash data with md5

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x5c
test dl, 1
mov edi, edx
jne 0x4794e0
test edi, 2
jne 0x4794f0
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x4794b1
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x4794b9
mov byte [edi], 0
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x5b
test edi, 2
mov byte [edx], 0
je 0x47949a
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x47949a

Function at 0x479f70
Capabilities:
Hash data with md5

Disassembly:
push edi
mov eax, 0x553180
push esi
mov ecx, 0x17
push ebx
sub esp, 0x70
mov ebx, dword [esp + 0x88]
lea esi, [esp + 0x14]
mov edi, esi
test ebx, ebx
cmove ebx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x84]
mov dword [esp], esi
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 8], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
mov dword [esp + 4], eax
call sym.adb.exe_MD5_Update
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.adb.exe_MD5_Final
add esp, 0x70
mov eax, ebx
pop ebx
pop esi
pop edi
ret
Function at 0x47a2e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [esp + 0x58]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebx, dword [eax]
test ebx, ebx
je 0x47a33b
mov eax, dword [esp + 0x48]
test eax, eax
je 0x47a33b
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov ebp, dword [esp + 0x48]
jmp 0x47a314
test ebp, ebp
je 0x47a32f
movzx eax, byte [edi + ebx]
add edx, 1
add ebx, 1
xor al, byte [edx - 1]
add ecx, 1
sub ebp, 1
and ebx, 0xf
mov byte [ecx - 1], al
jne 0x47a310
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x48], ebp
cmp dword [esp + 0x48], 0xf
jbe 0x47a451
mov ecx, dword [esp + 0x44]
mov ebp, dword [esp + 0x40]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x54], edi
mov edi, ebp
mov ebp, ecx
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp], esi
mov dword [esp + 8], eax
call dword [esp + 0x5c]
mov ecx, dword [esp + 0x1c]
mov eax, 0x10
sub eax, 1
add byte [esi + eax], 1
jne 0x47a3a1
test eax, eax
jne 0x47a382
cmp ebx, 0xf
ja 0x47a3a6
mov eax, dword [ecx + ebx]
xor eax, dword [edi + ebx]
mov dword [ebp + ebx], eax
add ebx, 4
cmp ebx, 0xf
jbe 0x47a394
sub dword [esp + 0x18], 0x10
add ebp, 0x10
add edi, 0x10
cmp dword [esp + 0x18], 0xf
jbe 0x47a3bc
xor ebx, ebx
jmp 0x47a362
mov eax, dword [esp + 0x48]
mov edi, ecx
xor ebx, ebx
mov ebp, dword [esp + 0x48]
sub eax, 0x10
and eax, 0xfffffff0
and ebp, 0xf
add eax, 0x10
add dword [esp + 0x44], eax
add dword [esp + 0x40], eax
test ebp, ebp
jne 0x47a3ee
mov eax, dword [esp + 0x58]
mov dword [eax], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x4c]
mov dword [esp + 4], edi
mov dword [esp], esi
mov dword [esp + 8], eax
call dword [esp + 0x5c]
mov eax, 0x10
sub eax, 1
movzx ecx, byte [esi + eax]
lea edx, [ecx + 1]
test dl, dl
mov byte [esi + eax], dl
jne 0x47a41b
test eax, eax
jne 0x47a406
mov ecx, dword [esp + 0x44]
lea esi, [edi + ebx]
xor eax, eax
mov edi, dword [esp + 0x40]
add ecx, ebx
add edi, ebx
lea esi, [esi]
movzx edx, byte [esi + eax]
xor dl, byte [edi + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, ebp
jne 0x47a430
add ebx, eax
mov eax, dword [esp + 0x58]
mov dword [eax], ebx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, dword [esp + 0x48]
jmp 0x47a3dc
Function at 0x47b050
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [esp + 0x40]
cmp dword [esp + 0x4c], 0xc
mov ebp, dword [esp + 0x48]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x40], 0
mov dword [ebx + 0x44], 0
mov dword [ebx + 0x48], 0
mov dword [ebx + 0x4c], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x34], 0
mov dword [ebx + 0x38], 0
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x16c], 0
mov dword [ebx + 0x168], 0
je 0x47b214
mov eax, dword [esp + 0x4c]
xor edx, edx
mov edi, ebp
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], eax
lea eax, [ebx + 0x60]
cmp esi, 0xf
mov dword [esp + 0x14], eax
jbe 0x47b13f
mov dword [esp + 0x48], ebp
mov ebp, esi
mov esi, dword [esp + 0x14]
nop
lea esi, [esi]
xor eax, eax
movzx edx, byte [edi + eax]
xor byte [ebx + eax], dl
add eax, 1
cmp eax, 0x10
jne 0x47b102
mov dword [esp + 4], esi
sub ebp, 0x10
add edi, 0x10
mov dword [esp], ebx
call fcn.0047a660
cmp ebp, 0xf
ja 0x47b100
mov eax, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
and dword [esp + 0x4c], 0xf
sub eax, 0x10
and eax, 0xfffffff0
lea ebp, [ebp + eax + 0x10]
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x47b16f
mov ecx, dword [esp + 0x4c]
xor eax, eax
lea esi, [esi]
movzx edx, byte [ebp + eax]
xor byte [ebx + eax], dl
add eax, 1
cmp eax, ecx
jne 0x47b150
mov eax, dword [esp + 0x14]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0047a660
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
shld edx, eax, 3
shl eax, 3
mov edi, edx
mov esi, eax
mov eax, esi
shrd eax, edx, 0x18
xor byte [ebx + 0xc], al
mov eax, esi
shrd eax, edi, 0x10
xor byte [ebx + 0xd], al
mov eax, esi
shrd eax, edi, 8
xor byte [ebx + 0xe], al
mov eax, esi
xor byte [ebx + 0xf], al
mov eax, dword [esp + 0x14]
xor byte [ebx + 0xb], dl
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0047a660
movzx eax, byte [ebx + 0xc]
movzx edx, byte [ebx + 0xd]
shl eax, 0x18
shl edx, 0x10
or eax, edx
movzx edx, byte [ebx + 0xf]
or eax, edx
movzx edx, byte [ebx + 0xe]
shl edx, 8
or eax, edx
lea esi, [eax + 1]
mov eax, dword [esp + 0x44]
mov dword [esp], ebx
mov dword [esp + 8], eax
lea eax, [ebx + 0x20]
mov dword [esp + 4], eax
call dword [ebx + 0x170]
mov eax, esi
shr eax, 0x18
mov byte [ebx + 0xc], al
mov eax, esi
shr eax, 0x10
mov byte [ebx + 0xd], al
mov eax, esi
shr eax, 8
mov byte [ebx + 0xe], al
mov eax, esi
mov byte [ebx + 0xf], al
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp]
mov esi, 2
mov dword [ebx], eax
mov eax, dword [ebp + 4]
mov dword [ebx + 4], eax
mov eax, dword [ebp + 8]
mov byte [ebx + 0xf], 1
mov dword [ebx + 8], eax
jmp 0x47b1d7
Function at 0x47b230
Capabilities:
Encode data using xor

Disassembly:
push ebp
xor eax, eax
push edi
push esi
push ebx
sub esp, 0x14
mov esi, dword [esp + 0x28]
mov ebp, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov edx, dword [esi + 0x3c]
or edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x30]
mov ebx, dword [esi + 0x34]
jne 0x47b265
mov eax, edi
xor edx, edx
add eax, ecx
adc edx, ebx
cmp edx, 0x20000000
jbe 0x47b26d
xor eax, eax
add esp, 0x14
pop ebx
pop esi
pop edi
pop ebp
ret
jae 0x47b363
mov dword [esi + 0x34], edx
mov edx, dword [esi + 0x16c]
mov dword [esi + 0x30], eax
test edx, edx
je 0x47b2d3
test edi, edi
jne 0x47b294
jmp 0x47b2ae
test edi, edi
je 0x47b2aa
add ebp, 1
movzx eax, byte [ebp - 1]
sub edi, 1
xor byte [esi + edx + 0x40], al
add edx, 1
and edx, 0xf
jne 0x47b290
test edx, edx
je 0x47b2c1
mov dword [esi + 0x16c], edx
add esp, 0x14
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esi + 0x60]
mov dword [esp + 4], eax
lea eax, [esi + 0x40]
mov dword [esp], eax
call fcn.0047a660
cmp edi, 0xf
jbe 0x47b336
lea ecx, [esi + 0x40]
mov ebx, ebp
lea eax, [esi + 0x60]
mov dword [esp + 0xc], ecx
mov ecx, edi
mov dword [esp + 0x2c], ebp
mov ebp, eax
mov dword [esp + 0x30], edi
mov edi, ebx
mov ebx, ecx
xor eax, eax
movzx edx, byte [edi + eax]
xor byte [esi + eax + 0x40], dl
add eax, 1
cmp eax, 0x10
jne 0x47b2f6
mov eax, dword [esp + 0xc]
sub ebx, 0x10
add edi, 0x10
mov dword [esp + 4], ebp
mov dword [esp], eax
call fcn.0047a660
cmp ebx, 0xf
ja 0x47b2f4
mov edi, dword [esp + 0x30]
mov ebp, dword [esp + 0x2c]
lea eax, [edi - 0x10]
and edi, 0xf
and eax, 0xfffffff0
lea ebp, [ebp + eax + 0x10]
test edi, edi
je 0x47b350
xor edx, edx
lea esi, [esi]
movzx eax, byte [ebp + edx]
xor byte [esi + edx + 0x40], al
add edx, 1
cmp edx, edi
jne 0x47b340
mov dword [esi + 0x16c], edi
add esp, 0x14
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0
jbe 0x47b273
xor eax, eax
jmp 0x47b265
Function at 0x47c0c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov esi, dword [esp + 0x40]
mov ebx, dword [eax]
test ebx, ebx
je 0x47c10a
test edx, edx
je 0x47c10a
mov edi, dword [esp + 0x30]
jmp 0x47c0eb
test edx, edx
je 0x47c106
movzx eax, byte [esi + ebx]
add edi, 1
add ebx, 1
xor al, byte [edi - 1]
add ecx, 1
sub edx, 1
and ebx, 0xf
mov byte [ecx - 1], al
jne 0x47c0e7
mov dword [esp + 0x30], edi
cmp edx, 0xf
jbe 0x47c1f2
mov edi, dword [esp + 0x30]
mov eax, edx
mov ebp, ecx
mov dword [esp + 0x38], edx
mov edx, esi
mov dword [esp + 0x34], ecx
mov esi, edi
mov edi, eax
lea esi, [esi]
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], edx
mov dword [esp], edx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
call dword [esp + 0x48]
cmp ebx, 0xf
mov edx, dword [esp + 0xc]
ja 0x47c162
mov eax, dword [edx + ebx]
xor eax, dword [esi + ebx]
mov dword [ebp + ebx], eax
add ebx, 4
cmp ebx, 0xf
jbe 0x47c150
sub edi, 0x10
add ebp, 0x10
add esi, 0x10
cmp edi, 0xf
jbe 0x47c174
xor ebx, ebx
jmp 0x47c130
mov esi, edx
mov edx, dword [esp + 0x38]
xor ebx, ebx
mov ecx, dword [esp + 0x34]
mov edi, edx
sub edx, 0x10
and edx, 0xfffffff0
and edi, 0xf
lea eax, [edx + 0x10]
add dword [esp + 0x30], eax
add ecx, eax
test edi, edi
jne 0x47c1a6
mov eax, dword [esp + 0x44]
mov dword [eax], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], ecx
mov dword [esp + 4], esi
mov dword [esp], esi
add esi, ebx
mov dword [esp + 8], eax
call dword [esp + 0x48]
mov ecx, dword [esp + 0xc]
xor eax, eax
mov edx, dword [esp + 0x30]
add ecx, ebx
lea ebp, [edx + ebx]
nop
movzx edx, byte [esi + eax]
xor dl, byte [ebp + eax]
mov byte [ecx + eax], dl
add eax, 1
cmp eax, edi
jne 0x47c1d0
add ebx, eax
mov eax, dword [esp + 0x44]
mov dword [eax], ebx
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, edx
jmp 0x47c194
Function at 0x47feb0
Capabilities:
Hash data using sha1

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x60
test dl, 1
mov edi, edx
jne 0x47ff13
test edi, 2
jne 0x47ff23
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x47fee1
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x47fee9
mov byte [edi], 0
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x5f
test edi, 2
mov byte [edx], 0
je 0x47feca
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x47feca

Function at 0x4800d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 8]
mov ecx, 1
mov eax, dword [esp + 4]
jmp fcn.0047e950

Function at 0x4802c0
Capabilities:
Hash data using sha1

Disassembly:
push edi
mov eax, 0x553190
push esi
mov ecx, 0x18
push ebx
sub esp, 0x70
mov ebx, dword [esp + 0x88]
lea esi, [esp + 0x10]
mov edi, esi
test ebx, ebx
cmove ebx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x84]
mov dword [esp], esi
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 8], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
mov dword [esp + 0x20], 0xc3d2e1f0
mov dword [esp + 4], eax
call sym.adb.exe_SHA1_Update
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.adb.exe_SHA1_Final
mov dword [esp], esi
mov dword [esp + 4], 0x60
call sym.adb.exe_OPENSSL_cleanse
add esp, 0x70
mov eax, ebx
pop ebx
pop esi
pop edi
ret
Function at 0x481620
Capabilities:
Hash data using sha224

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x70
test dl, 1
mov edi, edx
jne 0x4816a0
test edi, 2
jne 0x4816b0
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x481651
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x481659
mov byte [edi], 0
mov dword [edx], 0xc1059ed8
mov eax, 1
mov dword [edx + 4], 0x367cd507
mov dword [edx + 8], 0x3070dd17
mov dword [edx + 0xc], 0xf70e5939
mov dword [edx + 0x10], 0xffc00b31
mov dword [edx + 0x14], 0x68581511
mov dword [edx + 0x18], 0x64f98fa7
mov dword [edx + 0x1c], 0xbefa4fa4
mov dword [edx + 0x6c], 0x1c
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x6f
test edi, 2
mov byte [edx], 0
je 0x48163a
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x48163a

Function at 0x4816d0
Capabilities:
Hash data using sha256

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x70
test dl, 1
mov edi, edx
jne 0x481750
test edi, 2
jne 0x481760
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x481701
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x481709
mov byte [edi], 0
mov dword [edx], 0x6a09e667
mov eax, 1
mov dword [edx + 4], 0xbb67ae85
mov dword [edx + 8], 0x3c6ef372
mov dword [edx + 0xc], 0xa54ff53a
mov dword [edx + 0x10], 0x510e527f
mov dword [edx + 0x14], 0x9b05688c
mov dword [edx + 0x18], 0x1f83d9ab
mov dword [edx + 0x1c], 0x5be0cd19
mov dword [edx + 0x6c], 0x20
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x6f
test edi, 2
mov byte [edx], 0
je 0x4816ea
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x4816ea

Function at 0x4817e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 8]
mov ecx, 1
mov eax, dword [esp + 4]
jmp fcn.00480360
Function at 0x482660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 8]
mov ecx, 1
mov eax, dword [esp + 4]
jmp fcn.00481ae0

Function at 0x4829f0
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov eax, 0x553240
push ebx
sub esp, 0xf4
mov ebx, dword [esp + 0x108]
lea esi, [esp + 0x18]
mov dword [esp], esi
mov dword [esp + 0x18], 0xc1059ed8
mov dword [esp + 0x1c], 0xcbbb9d5d
test ebx, ebx
cmove ebx, eax
mov eax, dword [esp + 0x104]
mov dword [esp + 0x20], 0x367cd507
mov dword [esp + 0x24], 0x629a292a
mov dword [esp + 0x28], 0x3070dd17
mov dword [esp + 8], eax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x2c], 0x9159015a
mov dword [esp + 0x30], 0xf70e5939
mov dword [esp + 0x34], 0x152fecd8
mov dword [esp + 4], eax
mov dword [esp + 0x38], 0xffc00b31
mov dword [esp + 0x3c], 0x67332667
mov dword [esp + 0x40], 0x68581511
mov dword [esp + 0x44], 0x8eb44a87
mov dword [esp + 0x48], 0x64f98fa7
mov dword [esp + 0x4c], 0xdb0c2e0d
mov dword [esp + 0x50], 0xbefa4fa4
mov dword [esp + 0x54], 0x47b5481d
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], 0x30
call sym.adb.exe_SHA512_Update
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.adb.exe_SHA512_Final
mov dword [esp], esi
mov dword [esp + 4], 0xd8
call sym.adb.exe_OPENSSL_cleanse
add esp, 0xf4
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x482b10
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov eax, 0x553200
push ebx
sub esp, 0xf4
mov ebx, dword [esp + 0x108]
lea esi, [esp + 0x18]
mov dword [esp], esi
mov dword [esp + 0x18], 0xf3bcc908
mov dword [esp + 0x1c], 0x6a09e667
test ebx, ebx
cmove ebx, eax
mov eax, dword [esp + 0x104]
mov dword [esp + 0x20], 0x84caa73b
mov dword [esp + 0x24], 0xbb67ae85
mov dword [esp + 0x28], 0xfe94f82b
mov dword [esp + 8], eax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x2c], 0x3c6ef372
mov dword [esp + 0x30], 0x5f1d36f1
mov dword [esp + 0x34], 0xa54ff53a
mov dword [esp + 4], eax
mov dword [esp + 0x38], 0xade682d1
mov dword [esp + 0x3c], 0x510e527f
mov dword [esp + 0x40], 0x2b3e6c1f
mov dword [esp + 0x44], 0x9b05688c
mov dword [esp + 0x48], 0xfb41bd6b
mov dword [esp + 0x4c], 0x1f83d9ab
mov dword [esp + 0x50], 0x137e2179
mov dword [esp + 0x54], 0x5be0cd19
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], 0x40
call sym.adb.exe_SHA512_Update
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.adb.exe_SHA512_Final
mov dword [esp], esi
mov dword [esp + 4], 0xd8
call sym.adb.exe_OPENSSL_cleanse
add esp, 0xf4
mov eax, ebx
pop ebx
pop esi
ret