joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e6f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov edx, str.adb_getsockname
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [ebp + 8]
call fcn.0042a800
test eax, eax
je 0x42e740
cmp dword [eax], 0x535468
jne 0x42e740
mov edx, dword [ebp + 0x10]
mov dword [esp + 8], edx
mov edx, dword [ebp + 0xc]
mov dword [esp + 4], edx
mov eax, dword [eax + 0xc]
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_getsockname]
sub esp, 0xc
cmp eax, 0xffffffff
je 0x42e802
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x56103c], 0x80
jne 0x42e764
mov ebx, dword [sym.imp.msvcrt.dll__errno]
call ebx
mov dword [eax], 9
lea esp, [ebp - 0xc]
mov eax, 0xffffffff
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.00435450
mov ebx, dword [sym.imp.msvcrt.dll__errno]
cmp eax, 2
jg 0x42e74f
call ebx
mov esi, dword [ebp + 8]
mov edi, dword [eax]
lea eax, [ebp - 0x1c]
mov dword [esp + 8], esi
lea esi, [ebp - 0x20]
mov dword [esp], eax
mov dword [esp + 4], str.adb_getsockname:_invalid_fd__d
call fcn.00435b60
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x3d5
mov dword [esp], str.system_core_adb_sysdeps_win32.cpp
call fcn.00434b70
mov ecx, esi
sub esp, 0x14
call fcn.00434cf0
mov edx, dword [ebp - 0x1c]
mov ecx, dword [edx - 0xc]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.0051a330
mov ecx, esi
call fcn.00434d50
mov eax, dword [ebp - 0x1c]
mov dword [esp], esi
lea ecx, [eax - 0xc]
call fcn.004ede60
push ecx
call ebx
mov dword [eax], edi
jmp 0x42e74f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
test byte [0x56103c], 0x80
mov ebx, eax
je 0x42e8e5
call fcn.00435450
cmp eax, 2
jg 0x42e8e5
mov edi, dword [sym.imp.msvcrt.dll__errno]
call edi
mov eax, dword [eax]
mov dword [esp + 4], ebx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
mov dword [esp], eax
call fcn.00435f00
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
mov esi, dword [ebp + 8]
mov dword [esp], edx
mov dword [esp + 4], str.adb_getsockname:_setsockopt_on_fd__d_failed:__s_n
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
lea esi, [ebp - 0x24]
mov dword [ebp - 0x30], edx
call fcn.00435b60
mov ecx, esi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0x3de
mov dword [esp], str.system_core_adb_sysdeps_win32.cpp
call fcn.00434b70
mov ecx, esi
sub esp, 0x14
call fcn.00434cf0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx - 0xc]
mov dword [esp + 4], ecx
mov dword [esp], eax
mov dword [esp + 8], edx
call fcn.0051a330
mov ecx, esi
call fcn.00434d50
mov ecx, dword [ebp - 0x1c]
mov dword [esp], esi
sub ecx, 0xc
call fcn.004ede60
mov edx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x20]
lea ecx, [esi - 0xc]
push eax
mov dword [esp], edx
call fcn.004ede60
push edx
call edi
mov edi, dword [ebp - 0x2c]
mov dword [eax], edi
mov eax, ebx
call fcn.0042a970
mov eax, 0xffffffff
jmp 0x42e738
Function at 0x42f5f0
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov edx, str.set_file_block_mode
mov ebp, esp
push ebx
sub esp, 0x24
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
call fcn.0042a800
test eax, eax
je 0x42f630
mov edx, dword [eax + 4]
test edx, edx
je 0x42f630
cmp dword [eax], 0x535468
je 0x42f643
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], pe_nt_image_headers32
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
call dword [sym.imp.msvcrt.dll__errno]
mov dword [eax], 9
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
lea edx, [ebp - 0xc]
xor ebx, 1
mov dword [esp + 8], edx
movzx ebx, bl
mov dword [esp + 4], 0x8004667e
mov eax, dword [eax + 0xc]
mov dword [ebp - 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov edx, eax
sub esp, 0xc
test edx, edx
mov eax, 1
je 0x42f628
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
call fcn.0042a970
xor eax, eax
jmp 0x42f628
Function at 0x4315b0
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov esi, dword [esp + 0x3c]
mov edi, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov ebp, dword [esp + 0x38]
mov eax, esi
call fcn.0042b5b0
test eax, eax
je 0x431600
mov edx, ebp
mov ecx, esi
imul edx, ebx
mov dword [esp], eax
mov eax, edi
call fcn.00431130
cmp eax, 0xffffffff
je 0x4315f4
add esp, 0x1c
xor edx, edx
div ebx
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x1c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], edi
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
jmp sub.msvcrt.dll_fwrite

Function at 0x4321f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov dword [esp], 8
call fcn.00520de0
mov ebx, dword [sym.imp.msvcrt.dll__beginthreadex]
mov dword [eax], 0x434270
mov dword [eax + 4], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x431c40
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
test eax, eax
je 0x4322c3
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp], 0
call esi
sub esp, 4
mov dword [esp], 8
call fcn.00520de0
mov dword [eax], 0x431d70
mov dword [eax + 4], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x431c40
mov dword [esp + 4], 0
mov dword [esp], 0
call ebx
test eax, eax
je 0x4322b7
mov dword [esp], 0
call esi
sub esp, 4
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp], str.cannot_create_power_notification_thread
call fcn.004166b0
mov dword [esp], str.cannot_create_device_poll_thread
call fcn.004166b0
nop
Function at 0x436d40
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
push ebx
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test esi, esi
je 0x436e4b
xor eax, eax
lea esi, [esi]
cmp esi, 2
jbe 0x436dd0
movzx ebp, byte [ebx]
add edx, 4
add eax, 4
movzx edi, byte [ebx + 1]
add ebx, 3
shl ebp, 0x10
shl edi, 8
or ebp, edi
movzx edi, byte [ebx - 1]
or ebp, edi
mov edi, ebp
shr edi, 0x12
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, ebp
shr edi, 0xc
and edi, 0x3f
mov byte [edx - 4], cl
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov edi, ebp
shr edi, 6
and edi, 0x3f
mov byte [edx - 3], cl
movzx ecx, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 2], cl
mov ecx, ebp
and ecx, 0x3f
sub esi, 3
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx - 1], cl
jne 0x436d60
mov ecx, edx
jmp 0x436e0b
movzx ecx, byte [ebx]
shl ecx, 0x10
cmp esi, 2
je 0x436e13
mov ebx, ecx
shr ecx, 0xc
shr ebx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], cl
mov ecx, 0x3d
mov byte [edx], bl
mov byte [edx + 2], cl
add eax, 4
lea ecx, [edx + 4]
mov byte [edx + 3], 0x3d
mov byte [ecx], 0
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ebx, byte [ebx + 1]
shl ebx, 8
or ebx, ecx
mov ecx, ebx
shr ecx, 0x12
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
mov ecx, ebx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shr ebx, 6
and ebx, 0x3f
mov byte [edx + 1], cl
movzx ecx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x436dfe
mov ecx, edx
xor eax, eax
jmp 0x436e0b
Function at 0x43d160
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
xor esi, esi
push ebx
sub esp, 0x44
mov eax, dword [esp + 0x58]
mov dword [esp + 0x34], esi
mov edx, dword [eax]
cmp dword [eax + 4], 1
mov ebx, dword [edx]
mov dword [esp + 0x30], ebx
jle 0x43d18a
mov eax, dword [edx + 4]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], eax
xor eax, eax
xor edx, edx
mov dword [esp + 0x3c], 0x40
mov esi, 1
xor edi, edi
mov ecx, eax
mov ebx, edx
mov eax, esi
and eax, 1
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], 0
mov edx, dword [esp + 0x14]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ecx
neg eax
mov dword [esp], eax
mov eax, dword [esp + 0x30]
adc edx, 0
mov ebp, dword [esp]
neg edx
mov dword [esp + 4], edx
mov edx, dword [esp + 0x34]
mov dword [esp + 0x20], 0
and ebp, eax
mov eax, dword [esp + 4]
mov ebx, ebp
and ebp, esi
xor ebx, esi
mov dword [esp + 0x18], ebx
and eax, edx
mov edx, dword [esp + 0x18]
mov ebx, eax
and eax, edi
xor ebx, edi
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0x2c]
mov dword [esp + 8], ebp
shrd edx, ecx, 1
shr ecx, 1
mov esi, edx
mov edi, ecx
mov ecx, dword [esp + 0x28]
add esi, dword [esp + 8]
adc edi, dword [esp + 0xc]
and eax, 0x80000000
mov dword [esp + 0x24], eax
shrd ecx, ebx, 1
shr ebx, 1
add ecx, dword [esp + 0x20]
adc ebx, dword [esp + 0x24]
sub dword [esp + 0x3c], 1
jne 0x43d1a1
add esp, 0x44
mov edx, ebx
mov eax, ecx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x444f20
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
test ebx, ebx
je 0x444f4e
xor edx, edx
xor eax, eax
movzx ecx, byte [edi + edx]
xor cl, byte [esi + edx]
add edx, 1
or eax, ecx
cmp edx, ebx
jne 0x444f37
movzx eax, al
pop ebx
pop esi
pop edi
ret
xor eax, eax
jmp 0x444f4a

Function at 0x444f60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
test ebx, ebx
je 0x444f88
mov edx, dword [esp + 8]
mov eax, 0x811c9dc5
add ebx, edx
movzx ecx, byte [edx]
add edx, 1
xor ecx, eax
imul eax, ecx, 0x1000193
cmp edx, ebx
jne 0x444f74
pop ebx
ret
mov eax, 0x811c9dc5
pop ebx
ret
Function at 0x452290
Capabilities:
Hash data using sha224

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x70
test dl, 1
mov edi, edx
jne 0x452310
test edi, 2
jne 0x452320
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x4522c1
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x4522c9
mov byte [edi], 0
mov dword [edx], 0xc1059ed8
mov eax, 1
mov dword [edx + 4], 0x367cd507
mov dword [edx + 8], 0x3070dd17
mov dword [edx + 0xc], 0xf70e5939
mov dword [edx + 0x10], 0xffc00b31
mov dword [edx + 0x14], 0x68581511
mov dword [edx + 0x18], 0x64f98fa7
mov dword [edx + 0x1c], 0xbefa4fa4
mov dword [edx + 0x6c], 0x1c
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x6f
test edi, 2
mov byte [edx], 0
je 0x4522aa
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x4522aa

Function at 0x452340
Capabilities:
Hash data using sha256

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x70
test dl, 1
mov edi, edx
jne 0x4523c0
test edi, 2
jne 0x4523d0
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x452371
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x452379
mov byte [edi], 0
mov dword [edx], 0x6a09e667
mov eax, 1
mov dword [edx + 4], 0xbb67ae85
mov dword [edx + 8], 0x3c6ef372
mov dword [edx + 0xc], 0xa54ff53a
mov dword [edx + 0x10], 0x510e527f
mov dword [edx + 0x14], 0x9b05688c
mov dword [edx + 0x18], 0x1f83d9ab
mov dword [edx + 0x1c], 0x5be0cd19
mov dword [edx + 0x6c], 0x20
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x6f
test edi, 2
mov byte [edx], 0
je 0x45235a
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x45235a

Function at 0x452450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 8]
mov ecx, 1
mov eax, dword [esp + 4]
jmp fcn.00450fa0
Function at 0x4532f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 8]
mov ecx, 1
mov eax, dword [esp + 4]
jmp fcn.00452770

Function at 0x453690
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov eax, 0x57b480
push ebx
sub esp, 0xf4
mov ebx, dword [esp + 0x108]
lea esi, [esp + 0x18]
mov dword [esp], esi
mov dword [esp + 0x18], 0xf3bcc908
mov dword [esp + 0x1c], 0x6a09e667
test ebx, ebx
cmove ebx, eax
mov eax, dword [esp + 0x104]
mov dword [esp + 0x20], 0x84caa73b
mov dword [esp + 0x24], 0xbb67ae85
mov dword [esp + 0x28], 0xfe94f82b
mov dword [esp + 8], eax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x2c], 0x3c6ef372
mov dword [esp + 0x30], 0x5f1d36f1
mov dword [esp + 0x34], 0xa54ff53a
mov dword [esp + 4], eax
mov dword [esp + 0x38], 0xade682d1
mov dword [esp + 0x3c], 0x510e527f
mov dword [esp + 0x40], 0x2b3e6c1f
mov dword [esp + 0x44], 0x9b05688c
mov dword [esp + 0x48], 0xfb41bd6b
mov dword [esp + 0x4c], 0x1f83d9ab
mov dword [esp + 0x50], 0x137e2179
mov dword [esp + 0x54], 0x5be0cd19
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], 0x40
call sym.adb.exe_SHA512_Update
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.adb.exe_SHA512_Final
mov dword [esp], esi
mov dword [esp + 4], 0xd8
call sym.adb.exe_OPENSSL_cleanse
add esp, 0xf4
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x4537c0
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov eax, 0x57b4c0
push ebx
sub esp, 0xf4
mov ebx, dword [esp + 0x108]
lea esi, [esp + 0x18]
mov dword [esp], esi
mov dword [esp + 0x18], 0xc1059ed8
mov dword [esp + 0x1c], 0xcbbb9d5d
test ebx, ebx
cmove ebx, eax
mov eax, dword [esp + 0x104]
mov dword [esp + 0x20], 0x367cd507
mov dword [esp + 0x24], 0x629a292a
mov dword [esp + 0x28], 0x3070dd17
mov dword [esp + 8], eax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x2c], 0x9159015a
mov dword [esp + 0x30], 0xf70e5939
mov dword [esp + 0x34], 0x152fecd8
mov dword [esp + 4], eax
mov dword [esp + 0x38], 0xffc00b31
mov dword [esp + 0x3c], 0x67332667
mov dword [esp + 0x40], 0x68581511
mov dword [esp + 0x44], 0x8eb44a87
mov dword [esp + 0x48], 0x64f98fa7
mov dword [esp + 0x4c], 0xdb0c2e0d
mov dword [esp + 0x50], 0xbefa4fa4
mov dword [esp + 0x54], 0x47b5481d
mov dword [esp + 0x58], 0
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
mov dword [esp + 0xe8], 0
mov dword [esp + 0xec], 0x30
call sym.adb.exe_SHA512_Update
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.adb.exe_SHA512_Final
mov dword [esp], esi
mov dword [esp + 4], 0xd8
call sym.adb.exe_OPENSSL_cleanse
add esp, 0xf4
mov eax, ebx
pop ebx
pop esi
ret
Function at 0x4661a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, 1
push esi
mov esi, edi
push ebx
sub esp, 0x4c
mov ebx, dword [esp + 0x64]
mov dword [esp + 0x2c], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov ecx, ebx
shl esi, cl
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], edx
call sym.adb.exe_bn_wexpand
test eax, eax
je 0x4663bc
cmp ebx, 3
jg 0x466275
mov ecx, dword [esp + 0x34]
test ecx, ecx
jle 0x466255
lea eax, [esi*4]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
lea esi, [esi]
test esi, esi
jle 0x4663b5
mov ecx, dword [esp + 0x2c]
xor edi, edi
xor eax, eax
mov ebx, dword [esp + 0x60]
add ecx, 4
mov ebp, dword [ecx - 4]
xor ebx, eax
add eax, 1
lea edx, [ebx - 1]
not ebx
and edx, ebx
sar edx, 0x1f
and edx, ebp
or edi, edx
cmp eax, esi
jne 0x466210
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 8]
add dword [esp + 8], 1
mov eax, dword [eax]
mov dword [eax + edx*4], edi
mov eax, dword [esp + 0xc]
add dword [esp + 0x2c], eax
mov eax, dword [esp + 8]
cmp eax, dword [esp + 0x34]
jne 0x466200
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x34]
mov dword [eax + 4], esi
mov dword [esp], eax
call sym.adb.exe_bn_correct_top
add esp, 0x4c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
lea ecx, [ebx - 2]
shl edi, cl
lea eax, [edi - 1]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x60]
and dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
sar eax, cl
mov ecx, eax
mov edx, ecx
not edx
lea eax, [eax - 1]
and eax, edx
cdq
mov dword [esp + 0x18], edx
mov edx, ecx
xor edx, 1
lea eax, [edx - 1]
not edx
and eax, edx
cdq
mov dword [esp + 0x1c], edx
mov edx, ecx
xor edx, 2
lea eax, [edx - 1]
not edx
and eax, edx
cdq
mov dword [esp + 0x20], edx
mov edx, ecx
xor edx, 3
lea eax, [edx - 1]
not edx
and eax, edx
cdq
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x34]
test edx, edx
jle 0x466255
lea eax, [esi*4]
mov dword [esp + 0x3c], eax
lea eax, [edi*4]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], 0
test eax, eax
jle 0x4663ab
mov edx, dword [esp + 0x2c]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
lea esi, [esi]
mov edi, dword [esp + 0x28]
mov ebx, dword [edx]
mov ebp, dword [esp + 8]
xor ebp, dword [esp + 0x14]
lea ecx, [edx + edi]
add edx, 4
mov eax, dword [ecx]
add ecx, edi
mov esi, dword [ecx]
add ecx, edi
and eax, dword [esp + 0x1c]
and esi, dword [esp + 0x20]
and ebx, dword [esp + 0x18]
mov ecx, dword [ecx]
lea edi, [ebp - 1]
not ebp
and ecx, dword [esp + 0x24]
or eax, esi
and edi, ebp
or eax, ebx
sar edi, 0x1f
or eax, ecx
and edi, eax
mov eax, dword [esp + 0x10]
add dword [esp + 8], 1
or dword [esp + 0xc], edi
cmp dword [esp + 8], eax
jne 0x466320
mov eax, dword [esp + 0x38]
mov esi, dword [esp + 0x30]
mov edx, dword [esp + 0xc]
add dword [esp + 0x30], 1
mov eax, dword [eax]
mov dword [eax + esi*4], edx
mov eax, dword [esp + 0x3c]
add dword [esp + 0x2c], eax
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x34]
je 0x466255
mov eax, dword [esp + 0x10]
test eax, eax
jg 0x466308
mov dword [esp + 0xc], 0
jmp 0x466373
xor edi, edi
jmp 0x466231
add esp, 0x4c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x47f920
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x12c
mov ebx, dword [esp + 0x14c]
mov esi, dword [esp + 0x140]
mov edi, dword [esp + 0x148]
test ebx, ebx
je 0x47fa7b
cmp ebx, dword [esi]
je 0x47fa7d
mov dword [esp], ebx
call sym.adb.exe_EVP_MD_block_size
cmp eax, edi
jb 0x47faab
test edi, edi
lea ebp, [esp + 0xa0]
jne 0x47fa5f
mov dword [esp + 0x1c], edi
cmp edi, 0x80
je 0x47f997
mov eax, pe_nt_image_headers32
sub eax, edi
add edi, ebp
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], edi
call sub.msvcrt.dll_memset
xor eax, eax
lea esi, [esi]
movzx edx, byte [ebp + eax]
xor edx, 0x36
mov byte [esp + eax + 0x20], dl
add eax, 1
cmp eax, 0x80
jne 0x47f9a0
mov eax, dword [esp + 0x150]
lea edi, [esi + 0x14]
mov dword [esp + 4], ebx
mov dword [esp], edi
mov dword [esp + 8], eax
call sym.adb.exe_EVP_DigestInit_ex
test eax, eax
jne 0x47f9e1
xor eax, eax
add esp, 0x12c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
call sym.adb.exe_EVP_MD_block_size
mov dword [esp], edi
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
call sym.adb.exe_EVP_DigestUpdate
test eax, eax
je 0x47f9d4
xor eax, eax
movzx edx, byte [ebp + eax]
xor edx, 0x5c
mov byte [esp + eax + 0x20], dl
add eax, 1
cmp eax, 0x80
jne 0x47fa03
mov eax, dword [esp + 0x150]
lea ebp, [esi + 0x24]
mov dword [esp + 4], ebx
mov dword [esp], ebp
mov dword [esp + 8], eax
call sym.adb.exe_EVP_DigestInit_ex
test eax, eax
je 0x47f9d4
mov dword [esp], ebx
call sym.adb.exe_EVP_MD_block_size
mov dword [esp], ebp
mov dword [esp + 8], eax
lea eax, [esp + 0x20]
mov dword [esp + 4], eax
call sym.adb.exe_EVP_DigestUpdate
test eax, eax
je 0x47f9d4
mov dword [esi], ebx
jmp 0x47fa8f
mov eax, dword [esp + 0x144]
mov dword [esp + 8], edi
mov dword [esp], ebp
mov dword [esp + 4], eax
call sub.msvcrt.dll_memcpy
jmp 0x47f96e
mov ebx, dword [esi]
mov eax, dword [esp + 0x144]
test eax, eax
jne 0x47f94f
lea edi, [esi + 0x14]
add esi, 4
mov dword [esp + 4], edi
mov dword [esp], esi
call sym.adb.exe_EVP_MD_CTX_copy_ex
test eax, eax
setne al
movzx eax, al
jmp 0x47f9d6
mov eax, dword [esp + 0x150]
lea edx, [esi + 4]
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
call sym.adb.exe_EVP_DigestInit_ex
mov edx, dword [esp + 0xc]
test eax, eax
je 0x47f9d4
mov eax, dword [esp + 0x144]
mov dword [esp], edx
mov dword [esp + 8], edi
mov dword [esp + 4], eax
call sym.adb.exe_EVP_DigestUpdate
mov edx, dword [esp + 0xc]
test eax, eax
je 0x47f9d4
lea eax, [esp + 0x1c]
lea ebp, [esp + 0xa0]
mov dword [esp + 8], eax
mov dword [esp + 4], ebp
mov dword [esp], edx
call sym.adb.exe_EVP_DigestFinal_ex
test eax, eax
je 0x47f9d4
mov edi, dword [esp + 0x1c]
jmp 0x47f972
Function at 0x480290
Capabilities:
Hash data with md5

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x5c
test dl, 1
mov edi, edx
jne 0x4802f0
test edi, 2
jne 0x480300
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x4802c1
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x4802c9
mov byte [edi], 0
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x5b
test edi, 2
mov byte [edx], 0
je 0x4802aa
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x4802aa

Function at 0x480e30
Capabilities:
Hash data with md5

Disassembly:
push edi
xor eax, eax
push esi
mov ecx, 0x17
push ebx
sub esp, 0x70
lea ebx, [esp + 0x14]
mov esi, dword [esp + 0x88]
mov edi, ebx
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x84]
mov dword [esp], ebx
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 8], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
mov dword [esp + 4], eax
call sym.adb.exe_MD4_Update
mov dword [esp + 4], ebx
mov dword [esp], esi
call sym.adb.exe_MD4_Final
add esp, 0x70
mov eax, esi
pop ebx
pop esi
pop edi
ret

Function at 0x480ea0
Capabilities:
Hash data with md5

Disassembly:
push edi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, 0x5c
test dl, 1
mov edi, edx
jne 0x480f00
test edi, 2
jne 0x480f10
mov ecx, ebx
xor eax, eax
shr ecx, 2
test bl, 2
rep stosd dword es:[edi], eax
je 0x480ed1
xor eax, eax
add edi, 2
mov word [edi - 2], ax
and ebx, 1
je 0x480ed9
mov byte [edi], 0
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
pop ebx
pop edi
ret
lea edi, [edx + 1]
mov bl, 0x5b
test edi, 2
mov byte [edx], 0
je 0x480eba
xor ecx, ecx
add edi, 2
mov word [edi - 2], cx
sub ebx, 2
jmp 0x480eba

Function at 0x481c80
Capabilities:
Hash data with md5

Disassembly:
push edi
mov eax, 0x57b580
push esi
mov ecx, 0x17
push ebx
sub esp, 0x70
mov ebx, dword [esp + 0x88]
lea esi, [esp + 0x14]
mov edi, esi
test ebx, ebx
cmove ebx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x84]
mov dword [esp], esi
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x18], 0xefcdab89
mov dword [esp + 8], eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
mov dword [esp + 4], eax
call sym.adb.exe_MD5_Update
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.adb.exe_MD5_Final
add esp, 0x70
mov eax, ebx
pop ebx
pop esi
pop edi
ret