joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41eee8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x42af80
call sub.MSVCRT.dll__EH_prolog
sub esp, 0x214
push ebx
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esi
push 0x2001f
lea ecx, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ebx]
call fcn.0041efe0
mov edi, eax
cmp edi, esi
je 0x41ef32
cmp dword [ebp - 0x10], esi
je 0x41ef2b
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x41efcf
lea eax, [ebp - 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x220]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x41efa3
lea eax, [ebp - 0x220]
lea ecx, [ebp - 0x10]
push eax
call fcn.0041eee8
cmp eax, esi
mov dword [ebp - 0x18], eax
jne 0x41ef90
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x100
push eax
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
lea eax, [ebp - 0x220]
push eax
push esi
push dword [ebp - 0x10]
jmp 0x41ef55
cmp dword [ebp - 0x10], esi
je 0x41ef9e
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
jmp 0x41efcf
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x41efb6
push dword [ebp - 0x10]
call edi
mov dword [ebp - 0x10], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 0x10], esi
mov ebx, eax
je 0x41efcd
push dword [ebp - 0x10]
call edi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41f3cd
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 1
pop esi
call fcn.0041f0e0
mov edi, dword [ebp + 8]
mov ecx, eax
mov dword [ebp + 8], 0xe
and dword [ecx + 0x134], 0
and dword [ecx + 0x130], 0
xor dword [ecx + 0x9c], edi
mov eax, dword [ebp + 8]
push 0x25
cdq
pop ebx
add dword [ebp + 8], 0xe
idiv ebx
xor dword [ecx + edx*4 + 0x9c], esi
sub edi, esi
cmp dword [ebp + 8], 0x206
lea eax, [ecx + edx*4 + 0x9c]
mov eax, esi
mov esi, edi
mov edi, eax
jl 0x41f3fb
mov esi, 0x3e8
call fcn.0041f34b
dec esi
jne 0x41f42c
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x430003
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x746271d2
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
mov esi, 0x75127d86
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x417c00
Capabilities:
Encode data using xor
Encrypt data using xtea

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
imul edi, eax, 0x9e3779b9
mov edx, dword [ebx]
mov esi, dword [ebx + 4]
test eax, eax
je 0x417c6d
nop dword [eax + eax]
mov ebx, dword [ebp + 0x10]
mov ecx, edx
shr ecx, 5
mov eax, edx
shl eax, 4
xor ecx, eax
mov eax, edi
shr eax, 0xb
add ecx, edx
and eax, 3
mov eax, dword [ebx + eax*4]
add eax, edi
add edi, 0x61c88647
xor ecx, eax
sub esi, ecx
mov ecx, esi
mov eax, esi
shl eax, 4
shr ecx, 5
xor ecx, eax
mov eax, edi
and eax, 3
add ecx, esi
mov eax, dword [ebx + eax*4]
add eax, edi
xor ecx, eax
sub edx, ecx
sub dword [ebp + 8], 1
jne 0x417c20
mov ebx, dword [ebp + 0xc]
pop edi
mov dword [ebx + 4], esi
pop esi
mov dword [ebx], edx
pop ebx
pop ebp
ret

Function at 0x46a875
Capabilities:
Encode data using xor

Disassembly:
call 0x46a87a
pop eax
sub eax, 5
push eax
pop edi
push edi
mov esi, edi
sub edi, 0x266e
add esi, 0x39
mov edx, 0
mov ebx, edi
mov ecx, 0xb
mov eax, dword [esi]
xor eax, dword [ebx]
mov dword [esi], eax
add esi, 4
add ebx, 4
loop 0x46a898
inc edx
cmp edx, 5
je 0x46a8ae
jmp 0x46a891
outsb dx, byte [esi]
xor dword [ebp - 0x7698e427], esi
aad 0x67
xor esi, dword [0xd9b33138]
sub dword [edx - 0x4b9d9d9f], edi
fnstsw word [eax + 0x6a]
mov ah, 0xf2
dec esi
cdq
push eax
invalid
Function at 0x4027e0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.0040489c
test esi, esi
jne 0x402816
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.0040498c
jmp 0x402834
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402694
mov edi, eax
test esi, esi
je 0x402834
cmp dword [ebx], 0
je 0x402834
dec esi
jmp 0x40281d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403010
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x4b9008], 0x8088405
inc edx
mov dword [ebx + 0x4b9008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403e38
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4b9010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403ed0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403eb0
xor eax, eax
push ebp
push 0x403ea9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403eec
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403eb0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x4b9010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4b9010], ax
mov esp, ebp
pop ebp
ret

Function at 0x404700
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4bf038], 0
je 0x404761
cmp word [0x4bf20c], 0xd7b2
jne 0x404729
cmp dword [0x4bf214], 0
jbe 0x404729
mov eax, 0x4bf208
call dword [0x4bf224]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x4b90a0
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404788
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4b901c], 0
jne 0x40477d
push 0
push 0x4b90c0
push 0x4b90a0
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x407928
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
add esp, 0xffffffe8
mov byte [esp + 4], dl
mov dword [esp], eax
mov cl, 0x10
mov eax, 0x4b97ec
mov edx, 0x4bf724
lea esi, [esp + 5]
mov bl, byte [eax]
xor bl, byte [edx]
mov byte [esi], bl
inc esi
inc edx
inc eax
dec cl
jne 0x407944
push 0
lea ecx, [esp + 9]
mov edx, dword [fcn.00407928]
xor eax, eax
call fcn.00407c1c
mov ebx, eax
cmp byte [esp + 4], 0
jne 0x407987
push 0
mov eax, dword [esp + 4]
call fcn.004b8144
mov ecx, eax
mov eax, ebx
mov edx, dword [esp + 4]
call fcn.00407c74
jmp 0x40799f
push 0
mov eax, dword [esp + 4]
call fcn.004b8144
mov ecx, eax
mov eax, ebx
mov edx, dword [esp + 4]
call fcn.00407d08
mov edx, 0x2c
mov eax, ebx
call fcn.00402524
add esp, 0x18
pop esi
pop ebx
ret
Function at 0x4079b4
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
test esi, esi
jne 0x407a2d
mov eax, 0x7fffffff
call fcn.00403010
lea edx, [ebp - 0x38]
mov dword [edx], eax
lea eax, [ebp - 8]
push eax
call sub.user32.dll_GetCursorPos
lea eax, [ebp - 0x34]
mov dx, word [ebp - 8]
mov word [eax], dx
lea eax, [ebp - 0x32]
mov dx, word [ebp - 4]
mov word [eax], dx
mov dword [ebp - 0x28], 0x20
lea eax, [ebp - 0x28]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0xc]
lea edx, [ebp - 0x30]
mov dword [edx], eax
call sub.kernel32.dll_GetTickCount
lea edx, [ebp - 0x2c]
mov dword [edx], eax
lea eax, [ebp - 0x58]
push eax
lea edx, [ebp - 0x38]
mov eax, ebx
mov ecx, 0x10
call fcn.00407d90
jmp 0x407a3c
lea eax, [ebp - 0x58]
mov ecx, 0x10
mov edx, esi
call fcn.004066dc
lea eax, [ebp - 0x48]
push eax
mov edx, dword [ebx + 0x28]
mov eax, ebx
mov ecx, 0x10
call fcn.00407d90
lea eax, [ebp - 0x68]
push eax
lea edx, [ebp - 0x58]
mov eax, ebx
mov ecx, 0x20
call fcn.00407d90
test esi, esi
jne 0x407a76
lea edx, [ebp - 0x58]
mov ecx, 0x10
mov eax, dword [ebp + 8]
call fcn.004066dc
lea edx, [ebp - 0x68]
mov ecx, 0x10
mov eax, edi
call fcn.004066dc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x407c74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x27], 0
je 0x407cb0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x16
mov eax, dword [ebp - 4]
xor edx, edx
call fcn.004079b4
mov eax, dword [ebp - 4]
call fcn.00407c44
mov eax, dword [ebp - 4]
mov byte [eax + 0x27], 0
dec ebx
test ebx, ebx
jl 0x407cfd
inc ebx
mov dword [ebp - 0x10], ebx
xor esi, esi
mov eax, dword [ebp - 8]
add eax, esi
mov bl, byte [eax]
mov eax, dword [ebp - 4]
call fcn.00407b00
mov word [ebp - 0xa], ax
mov edx, 0x10
mov eax, dword [ebp - 4]
add eax, 0x16
xor byte [eax], bl
inc eax
dec edx
jne 0x407cd9
movzx eax, word [ebp - 0xa]
shr eax, 8
mov dl, byte [ebp - 0xa]
and dl, 0xff
xor al, dl
xor bl, al
mov eax, dword [ebp - 8]
add eax, esi
mov byte [eax], bl
inc esi
dec dword [ebp - 0x10]
jne 0x407cbb
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x407d08
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x27], 0
je 0x407d43
push 0
mov ecx, dword [ebp - 4]
add ecx, 0x16
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 8]
call fcn.004079b4
mov eax, dword [ebp - 4]
call fcn.00407c44
mov eax, dword [ebp - 4]
mov byte [eax + 0x27], 0
dec ebx
test ebx, ebx
jl 0x407d85
inc ebx
mov dword [ebp - 0xc], ebx
xor esi, esi
mov eax, dword [ebp - 4]
call fcn.00407b00
movzx ecx, ax
shr ecx, 8
and al, 0xff
xor cl, al
mov eax, dword [ebp - 8]
add eax, esi
xor cl, byte [eax]
mov edx, 0x10
mov eax, dword [ebp - 4]
add eax, 0x16
xor byte [eax], cl
inc eax
dec edx
jne 0x407d72
mov eax, dword [ebp - 8]
add eax, esi
mov byte [eax], cl
inc esi
dec dword [ebp - 0xc]
jne 0x407d4e
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x407d90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov word [eax], 0
mov eax, dword [ebp - 4]
mov word [eax + 2], 0
mov eax, dword [ebp - 4]
mov word [eax + 4], 0
mov edx, 0x4b97dc
mov eax, dword [ebp - 4]
add eax, 0x16
mov ecx, 0x10
call fcn.004066dc
mov byte [ebp - 0xe], 0x10
mov byte [ebp - 0xd], 0
xor edx, edx
mov dl, byte [ebp - 0xe]
lea eax, [ebp - 0x24]
call fcn.004066e4
dec ebx
test ebx, ebx
jl 0x407e46
inc ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov bl, byte [eax]
mov eax, dword [ebp - 4]
call fcn.00407b00
mov esi, eax
mov eax, 0x10
mov edx, dword [ebp - 4]
add edx, 0x16
xor byte [edx], bl
inc edx
dec eax
jne 0x407e11
movzx eax, si
shr eax, 8
mov edx, esi
and dl, 0xff
xor al, dl
xor bl, al
xor eax, eax
mov al, byte [ebp - 0xd]
xor byte [ebp + eax - 0x24], bl
inc byte [ebp - 0xd]
mov al, byte [ebp - 0xd]
cmp al, byte [ebp - 0xe]
jb 0x407e3e
mov byte [ebp - 0xd], 0
inc dword [ebp - 0xc]
dec dword [ebp - 0x14]
jne 0x407df4
xor eax, eax
mov al, byte [ebp - 0xe]
inc eax
add eax, eax
lea eax, [eax + eax*4]
test eax, eax
jle 0x407ea8
mov dword [ebp - 0x14], eax
xor eax, eax
mov al, byte [ebp - 0xd]
mov bl, byte [ebp + eax - 0x24]
mov eax, dword [ebp - 4]
call fcn.00407b00
mov esi, eax
mov eax, 0x10
mov edx, dword [ebp - 4]
add edx, 0x16
xor byte [edx], bl
inc edx
dec eax
jne 0x407e76
movzx eax, si
shr eax, 8
mov edx, esi
and dl, 0xff
xor al, dl
xor bl, al
xor eax, eax
mov al, byte [ebp - 0xd]
xor byte [ebp + eax - 0x24], bl
inc byte [ebp - 0xd]
mov al, byte [ebp - 0xd]
cmp al, byte [ebp - 0xe]
jb 0x407ea3
mov byte [ebp - 0xd], 0
dec dword [ebp - 0x14]
jne 0x407e58
xor ecx, ecx
mov cl, byte [ebp - 0xe]
lea edx, [ebp - 0x24]
mov eax, dword [ebp + 8]
call fcn.004066dc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40e33c
Capabilities:
Hash data with md5

Disassembly:
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x40eddc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
test ecx, ecx
jbe 0x40ee0b
mov ebx, dword [eax]
movzx esi, byte [edx]
xor ebx, esi
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4bf748]
mov esi, dword [eax]
shr esi, 8
and esi, 0xffffff
xor ebx, esi
mov dword [eax], ebx
inc edx
dec ecx
test ecx, ecx
ja 0x40ede2
pop esi
pop ebx
ret

Function at 0x40ee84
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
cmp byte [0x4bcf6c], 0
je 0x40ee9b
call fcn.0040ed68
xor ebx, 0xffffffff
mov eax, edi
test eax, eax
jbe 0x40eec0
mov edx, ebx
xor dl, byte [esi]
and edx, 0xff
mov edx, dword [edx*4 + 0x4bf748]
shr ebx, 8
xor edx, ebx
mov ebx, edx
inc esi
dec eax
jne 0x40eea4
mov eax, ebx
xor eax, 0xffffffff
pop edi
pop esi
pop ebx
ret

Function at 0x40eed4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
test ecx, ecx
jbe 0x40ef03
xor ebx, ebx
mov bl, byte [edx]
xor bx, word [eax]
and bx, 0xff
movzx ebx, bx
mov bx, word [ebx*2 + 0x4bcf70]
movzx esi, word [eax]
shr esi, 8
xor bx, si
mov word [eax], bx
inc edx
dec ecx
test ecx, ecx
ja 0x40eeda
pop esi
pop ebx
ret

Function at 0x40f0d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffea8
mov dword [esp], eax
lea edi, [esp + 4]
mov edx, edi
mov eax, dword [esp]
mov ecx, 0x14
call fcn.00402654
xor esi, esi
lea ebx, [esp + 0x18]
mov eax, dword [esp]
add eax, 0x28
mov edx, esi
shl edx, 2
add eax, edx
mov eax, dword [eax]
call fcn.0040e2ec
mov dword [ebx], eax
inc esi
add ebx, 4
cmp esi, 0x10
jne 0x40f0fa
mov esi, 0x40
lea ebx, [esp + 0x4c]
mov eax, dword [ebx]
xor eax, dword [ebx - 0x14]
xor eax, dword [ebx - 0x2c]
xor eax, dword [ebx - 0x34]
mov dl, 1
call fcn.0040e2e4
mov dword [ebx + 0xc], eax
add ebx, 4
dec esi
jne 0x40f122
xor esi, esi
lea ebp, [esp + 0x18]
mov eax, dword [edi + 0xc]
push eax
mov ebx, esi
mov eax, ebx
mov ecx, dword [edi + 8]
mov edx, dword [edi + 4]
call fcn.0040f06c
push eax
mov dl, 5
mov eax, dword [edi]
call fcn.0040e2e4
pop edx
add edx, eax
add edx, dword [edi + 0x10]
push edx
mov eax, ebx
call fcn.0040f0b0
pop edx
add edx, eax
add edx, dword [ebp]
mov ebx, edx
mov eax, dword [edi + 0xc]
mov dword [edi + 0x10], eax
mov eax, dword [edi + 8]
mov dword [edi + 0xc], eax
mov dl, 0x1e
mov eax, dword [edi + 4]
call fcn.0040e2e4
mov dword [edi + 8], eax
mov eax, dword [edi]
mov dword [edi + 4], eax
mov dword [edi], ebx
inc esi
add ebp, 4
cmp esi, 0x50
jne 0x40f143
mov esi, 5
mov eax, edi
mov edx, dword [esp]
mov ecx, dword [eax]
add dword [edx], ecx
add edx, 4
add eax, 4
dec esi
jne 0x40f1a9
add esp, 0x158
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40f2e0
Capabilities:
Hash data using sha1

Disassembly:
xor edx, edx
mov dword [eax + 0x24], edx
xor edx, edx
mov dword [eax + 0x20], edx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret

Function at 0x40f310
Capabilities:
Hash data using sha256

Disassembly:
xor edx, edx
mov dword [eax + 0x24], edx
xor edx, edx
mov dword [eax + 0x20], edx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret

Function at 0x40f720
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 4], edx
test al, al
je 0x40f777
mov word [0x4bfb50], 0
mov word [0x4bfb52], 0
mov word [0x4bfb54], 0
mov edx, dword [0x4be76c]
mov eax, 0x4bfb68
mov ecx, 0x10
call fcn.004066dc
lea eax, [ebp - 0x2c]
mov edx, 0x20
call fcn.004066e4
mov byte [0x4bfb78], 0
jmp 0x40f787
lea eax, [ebp - 0x2c]
mov ecx, 0x20
mov edx, dword [ebp + 0xc]
call fcn.004066dc
dec ebx
test ebx, ebx
jl 0x40f7ee
inc ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
mov bl, byte [eax]
call fcn.0040f60c
mov esi, eax
mov edx, 0x10
mov eax, 0x4bfb68
xor byte [eax], bl
inc eax
dec edx
jne 0x40f7b0
movzx eax, si
shr eax, 8
mov edx, esi
and dl, 0xff
xor al, dl
xor bl, al
xor eax, eax
mov al, byte [0x4bfb78]
xor byte [ebp + eax - 0x2c], bl
inc byte [0x4bfb78]
cmp byte [0x4bfb78], 0x20
jb 0x40f7e6
mov byte [0x4bfb78], 0
inc dword [ebp - 8]
dec dword [ebp - 0xc]
jne 0x40f797
lea edx, [ebp - 0x2c]
mov ecx, 0x20
mov eax, dword [ebp + 8]
call fcn.004066dc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x40f808
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov dword [esp], edx
lea edx, [esp + 4]
mov ecx, 0x20
xchg edx, eax
call fcn.004066dc
mov esi, 0x14a
xor eax, eax
mov al, byte [0x4bfb78]
mov bl, byte [esp + eax + 4]
call fcn.0040f60c
mov edi, eax
mov edx, 0x10
mov eax, 0x4bfb68
xor byte [eax], bl
inc eax
dec edx
jne 0x40f841
movzx eax, di
shr eax, 8
mov edx, edi
and dl, 0xff
xor al, dl
xor bl, al
xor eax, eax
mov al, byte [0x4bfb78]
xor byte [esp + eax + 4], bl
inc byte [0x4bfb78]
cmp byte [0x4bfb78], 0x20
jb 0x40f877
mov byte [0x4bfb78], 0
dec esi
jne 0x40f825
lea edx, [esp + 4]
mov ecx, 0x20
mov eax, dword [esp]
call fcn.004066dc
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x40f894
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
push ebx
push esi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov word [0x4bfb50], 0
mov word [0x4bfb52], 0
mov word [0x4bfb54], 0
mov byte [ebp - 0x11], 0
mov eax, 0x4bfb68
mov ecx, 0x10
mov edx, dword [ebp - 8]
call fcn.004066dc
lea eax, [ebp - 0x38]
mov edx, 0x20
call fcn.004066e4
dec ebx
test ebx, ebx
jl 0x40f93e
inc ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov bl, byte [eax]
call fcn.0040f60c
mov esi, eax
mov eax, 0x10
mov edx, 0x4bfb68
xor byte [edx], bl
inc edx
dec eax
jne 0x40f90b
movzx eax, si
shr eax, 8
mov edx, esi
and dl, 0xff
xor al, dl
xor bl, al
xor eax, eax
mov al, byte [ebp - 0x11]
xor byte [ebp + eax - 0x38], bl
inc byte [ebp - 0x11]
cmp byte [ebp - 0x11], 0x20
jb 0x40f936
mov byte [ebp - 0x11], 0
inc dword [ebp - 0xc]
dec dword [ebp - 0x18]
jne 0x40f8f2
mov dword [ebp - 0x10], 0x14a
xor eax, eax
mov al, byte [ebp - 0x11]
mov bl, byte [ebp + eax - 0x38]
call fcn.0040f60c
mov esi, eax
mov eax, 0x10
mov edx, 0x4bfb68
xor byte [edx], bl
inc edx
dec eax
jne 0x40f95f
movzx eax, si
shr eax, 8
mov edx, esi
and dl, 0xff
xor al, dl
xor bl, al
xor eax, eax
mov al, byte [ebp - 0x11]
xor byte [ebp + eax - 0x38], bl
inc byte [ebp - 0x11]
cmp byte [ebp - 0x11], 0x20
jb 0x40f98a
mov byte [ebp - 0x11], 0
dec dword [ebp - 0x10]
jne 0x40f945
lea edx, [ebp - 0x38]
mov ecx, 0x20
mov eax, dword [ebp + 8]
call fcn.004066dc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40f9a8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff4c
mov dword [esp], ecx
mov esi, edx
mov ebx, eax
lea eax, [esp + 4]
mov edx, 0xb0
call fcn.004066e4
mov dl, 1
mov eax, ebx
call fcn.00407928
lea eax, [esp + 4]
push eax
mov ecx, dword [0x4be76c]
mov edx, 0x10
mov eax, ebx
call fcn.0040f894
mov edx, 0x10
lea eax, [esp + 4]
lea edi, [esp + 0x64]
mov cl, byte [eax]
xor cl, byte [eax + 0x10]
mov byte [edi], cl
inc edi
inc eax
dec edx
jne 0x40f9f3
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x68]
mov edx, 0x10
mov eax, ebx
call fcn.0040f894
mov edx, 0x10
lea eax, [esp + 0x24]
lea edi, [esp + 0x74]
mov cl, byte [eax]
xor cl, byte [eax + 0x10]
mov byte [edi], cl
inc edi
inc eax
dec edx
jne 0x40fa21
lea eax, [esp + 0x84]
mov ecx, 0x10
mov edx, esi
call fcn.004066dc
lea edx, [esp + 0x24]
lea eax, [esp + 0x94]
mov ecx, 0x20
call fcn.004066dc
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x78]
lea eax, [esp + 0x88]
mov edx, 0x30
call fcn.0040f894
lea edx, [esp + 0x44]
mov ecx, 0x20
mov eax, dword [esp]
call fcn.004066dc
xor edx, edx
mov eax, ebx
call fcn.00407928
lea eax, [esp + 4]
mov edx, 0xb0
call fcn.004066e4
add esp, 0xb4
pop edi
pop esi
pop ebx
ret