joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f3c80
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
push 0x40
mov dword [ebp - 8], esi
lea edi, [esi + 0x6c]
call fcn.00474c39
lea ebx, [esi + 0x70]
mov dword [edi], eax
push 0x40
mov dword [ebp - 4], ebx
call fcn.00474c39
push 0x40
push 0
push dword [edi]
mov dword [ebx], eax
call fcn.00506c70
push 0x40
push 0
push dword [ebx]
call fcn.00506c70
mov eax, dword [ebp + 0xc]
add esp, 0x20
cmp eax, 0x40
jbe 0x4f3d2b
mov eax, dword [esi + 4]
add esi, 4
mov ecx, esi
call dword [eax + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi]
push ecx
push dword [ebp + 8]
mov ecx, esi
call dword [eax + 0x10]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0xc]
mov esi, dword [edi]
mov ecx, eax
mov eax, dword [ebx]
mov edx, 0x40
mov dword [ebp + 8], ecx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
cmp ecx, dword [eax + 4]
je 0x4f3d46
mov eax, edx
dec edx
test eax, eax
jle 0x4f3d46
movzx eax, byte [ecx]
mov ebx, dword [ebp + 0xc]
inc dword [ebp + 0xc]
mov byte [esi], al
inc esi
movzx eax, byte [ecx]
inc ecx
mov byte [ebx], al
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 4]
cmp ecx, dword [eax + 4]
jne 0x4f3d05
jmp 0x4f3d46
mov esi, dword [ebp + 8]
push eax
push esi
push dword [edi]
call fcn.00506640
mov ecx, dword [ebp + 0xc]
push ecx
push esi
push dword [ebx]
call fcn.00506640
add esp, 0x18
mov eax, dword [edi]
xor ecx, ecx
mov edx, dword [ebx]
lea ebx, [eax + 0x3f]
cmp edx, ebx
lea esi, [edx + 0x3f]
mov ebx, dword [ebp - 4]
ja 0x4f3d5d
cmp esi, eax
jae 0x4f3d80
cmp edx, edi
ja 0x4f3d65
cmp esi, edi
jae 0x4f3d80
cmp edx, ebx
ja 0x4f3d6d
cmp esi, ebx
jae 0x4f3d80
lea esi, [eax + 0x3f]
cmp eax, edi
ja 0x4f3d78
cmp esi, edi
jae 0x4f3d80
cmp eax, ebx
ja 0x4f3da3
cmp esi, ebx
jb 0x4f3da3
mov eax, dword [edi]
xor byte [ecx + eax], 0x36
mov eax, dword [ebx]
xor byte [eax + ecx], 0x5c
inc ecx
cmp ecx, 0x40
jl 0x4f3d80
mov ecx, dword [ebp - 8]
mov eax, dword [ecx]
call dword [eax + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
movups xmm0, xmmword [eax]
mov ecx, dword [ebp - 8]
movaps xmm2, xmmword [str.6666666666666666_]
movaps xmm3, xmmword [0x6bc450]
pxor xmm0, xmm2
movups xmmword [eax], xmm0
movups xmm0, xmmword [edx]
movaps xmm1, xmm3
pxor xmm1, xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [edx], xmm1
pxor xmm0, xmm2
movaps xmm1, xmm2
movups xmmword [eax + 0x10], xmm0
movups xmm0, xmmword [edx + 0x10]
pxor xmm0, xmm3
movups xmmword [edx + 0x10], xmm0
movups xmm0, xmmword [eax + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [edx + 0x20]
movups xmmword [eax + 0x20], xmm1
movaps xmm1, xmm3
pxor xmm1, xmm0
movups xmm0, xmmword [eax + 0x30]
movups xmmword [edx + 0x20], xmm1
pxor xmm0, xmm2
movups xmmword [eax + 0x30], xmm0
mov eax, dword [ecx]
movups xmm0, xmmword [edx + 0x30]
pxor xmm0, xmm3
movups xmmword [edx + 0x30], xmm0
call dword [eax + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x520c63
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00520b26

Function at 0x52507e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00524d41

Function at 0x525089
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00524ec2

Function at 0x529663
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00528fd1

Function at 0x52966e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0052920c
Function at 0x55d5d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x98
call fcn.0049bfd0
mov eax, dword [0x79b544]
xor eax, esp
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xa0]
push ebx
push edi
mov edi, dword [esp + 0xac]
xor ebx, ebx
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
sub ecx, edi
mov dword [esp + 0x10], ecx
cmp edx, edi
jb 0x55d790
cmp edi, 0x40
ja 0x55d790
lea eax, [esp + 0x1c]
neg eax
lea ecx, [esp + 0x1c]
and eax, 0x3f
add ecx, eax
lea eax, [edi + 0x100]
mov dword [esp + 0xc], ecx
cmp edx, eax
jbe 0x55d649
mov ebx, edx
sub ebx, edi
sub ebx, 0x100
push ebp
push esi
push edi
xor esi, esi
mov dword [esp + 0x20], 0
push esi
push ecx
call fcn.00506c70
mov eax, dword [esp + 0xbc]
add esp, 0xc
xor ebp, ebp
cmp ebx, dword [eax + 0xc]
jae 0x55d70c
mov ecx, ebx
sub ecx, dword [eax + 8]
mov dword [esp + 0x10], ecx
nop dword [eax + eax]
mov edi, dword [esp + 0xb0]
mov eax, ebx
xor eax, dword [esp + 0x18]
lea edx, [eax - 1]
not eax
shr eax, 0x1f
shr edx, 0x1f
and edx, eax
mov eax, dword [esp + 0xb0]
neg edx
xor ecx, dword [eax + 8]
mov eax, ebx
xor eax, dword [edi + 8]
or ecx, eax
mov eax, edx
or eax, dword [esp + 0x1c]
xor ecx, ebx
shr ecx, 0x1f
and edx, ebp
neg ecx
or esi, edx
mov edx, dword [esp + 0x14]
and ecx, eax
mov eax, dword [edi + 0x14]
mov edi, dword [esp + 0xb4]
mov dword [esp + 0x1c], ecx
mov al, byte [eax + ebx]
inc ebx
and al, cl
or byte [edx + ebp], al
inc ebp
mov ecx, ebp
mov eax, ebp
sub ecx, edi
xor eax, edi
xor ecx, edi
or ecx, eax
mov eax, dword [esp + 0xb0]
xor ecx, ebp
shr ecx, 0x1f
neg ecx
and ebp, ecx
mov ecx, dword [esp + 0x10]
inc ecx
mov dword [esp + 0x10], ecx
cmp ebx, dword [eax + 0xc]
jb 0x55d680
jmp 0x55d710
mov edx, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
je 0x55d772
mov eax, esi
and eax, 0xffffffdf
mov bl, byte [eax + edx]
mov eax, esi
or eax, 0x20
mov dl, byte [eax + edx]
mov eax, esi
and eax, 0x20
inc esi
dec eax
shr eax, 0x1f
neg al
movzx eax, al
mov dword [esp + 0x10], eax
not eax
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
and cl, dl
mov edx, dword [esp + 0x14]
and al, bl
or al, cl
mov ecx, dword [esp + 0x20]
mov byte [ecx + ebp], al
mov ecx, esi
sub ecx, edi
mov eax, esi
xor ecx, edi
xor eax, edi
or ecx, eax
inc ebp
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp ebp, edi
jb 0x55d716
pop esi
pop ebp
pop edi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0049b511
add esp, 0x98
ret
mov ecx, dword [esp + 0x9c]
xor eax, eax
pop edi
pop ebx
xor ecx, esp
call fcn.0049b511
add esp, 0x98
ret
Function at 0x55e6b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.0049bfd0
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x18]
inc ebp
push edi
mov edi, dword [esp + 0x20]
mov eax, dword [esi + 4]
mov ecx, dword [edi + 8]
mov eax, dword [eax + 0x64]
test byte [eax + 0x30], 1
je 0x55e73a
mov edx, dword [esp + 0x24]
lea eax, [edx + ebp]
cmp eax, ecx
ja 0x55e73e
add dword [edi + 0x14], edx
sub ecx, edx
add dword [edi + 0x18], edx
sub dword [edi + 0xc], edx
mov dword [edi + 8], ecx
mov eax, dword [edi + 0x14]
push ebx
push dword [esi + 0x3cc]
mov al, byte [eax + ecx - 1]
movzx ebx, al
mov byte [esp + 0x30], al
mov dword [esp + 0x24], ebx
call fcn.00534370
push eax
call fcn.00532330
mov esi, dword [edi + 8]
add esp, 8
mov dword [esp + 0x18], esi
and eax, 0x200000
je 0x55e747
sub esi, ebx
mov eax, 1
dec esi
pop ebx
mov dword [edi + 8], esi
pop edi
pop esi
pop ebp
add esp, 0xc
ret
cmp ebp, ecx
jbe 0x55e6f2
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
lea ecx, [ebx + ebp]
mov eax, esi
mov ebx, esi
xor eax, ecx
sub ebx, ecx
xor ebx, ecx
or ebx, eax
mov eax, 0x100
xor ebx, esi
shr ebx, 0x1f
dec ebx
cmp esi, eax
cmovb eax, esi
xor ebp, ebp
mov dword [esp + 0x10], eax
test eax, eax
je 0x55e7c3
mov edx, dword [esp + 0x20]
dec esi
mov edi, dword [edi + 0x14]
shr edx, 0x1f
add edi, esi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x14], edx
mov eax, esi
lea edi, [edi - 1]
sub eax, ebp
mov ecx, ebp
shr ecx, 0x1f
inc ebp
shr eax, 0x1f
xor al, cl
xor cl, dl
or al, cl
movzx ecx, byte [esp + 0x2c]
dec al
movzx edx, al
movzx eax, byte [edi + 1]
xor ecx, eax
and edx, ecx
not edx
and ebx, edx
mov edx, dword [esp + 0x14]
cmp ebp, dword [esp + 0x10]
jb 0x55e785
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
not ebx
movzx ecx, bl
inc eax
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub esi, eax
mov dword [edi + 8], esi
mov dword [esp + 0x2c], ecx
not ecx
pop ebx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
and ecx, 1
pop edi
pop esi
or eax, ecx
pop ebp
add esp, 0xc
ret

Function at 0x57f6c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0049bfd0
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x57f740
mov cl, byte [edi]
test cl, cl
je 0x57f740
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x57f6f0
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x57f7e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0049bfd0
push ebx
mov ebx, dword [esp + 0xc]
push esi
xor esi, esi
mov dword [esp + 8], esi
test ebx, ebx
je 0x57f863
mov al, byte [ebx]
test al, al
je 0x57f863
push ebp
push edi
mov ebp, 0x100
movsx eax, al
push eax
call fcn.0059f0b0
movd xmm1, dword [esp + 0x14]
lea ebx, [ebx + 1]
mov edi, eax
mov edx, 0x20
or edi, ebp
add esp, 4
mov ecx, edi
add ebp, 0x100
shr ecx, 2
xor ecx, edi
imul edi, edi
and ecx, 0xf
sub edx, ecx
shl esi, cl
movd xmm0, edx
psrlq xmm1, xmm0
movd eax, xmm1
or esi, eax
mov al, byte [ebx]
xor esi, edi
mov dword [esp + 0x10], esi
test al, al
jne 0x57f807
mov eax, esi
pop edi
shr eax, 0x10
pop ebp
xor eax, esi
pop esi
pop ebx
pop ecx
ret
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x5d3820
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x5d3834
mov dword [esp + 0x18], fcn.005d2000
jmp fcn.005cb330
mov dword [esp + 0x18], fcn.005d12a0
jmp fcn.005cb030
Function at 0x62e900
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0062e910

Function at 0x62eb90
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0062eba0
Function at 0x631c00
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69de5c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x79b544]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x10], 0
je 0x631c7f
mov dword [ecx], 0x72c8d8
mov dword [ecx + 0x60], 0x72c8e0
mov dword [ecx + 0x78], 0
mov dword [ecx + 0x98], 0
mov dword [ecx + 0x9c], 0
mov dword [ecx + 0xa0], 0
mov dword [ecx + 0x70], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ecx]
push 8
mov eax, dword [eax + 4]
mov dword [ecx + eax], vtable.Poco::Base64EncoderIOS.0
lea eax, [ecx + 4]
mov dword [ebp + 0x10], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00474bfc
mov esi, eax
add esp, 4
test esi, esi
je 0x631cbd
push 1
mov dword [ebp - 4], 2
call fcn.0049ea62
add esp, 4
mov dword [esi + 4], eax
jmp 0x631cbf
xor esi, esi
mov eax, dword [ebp + 0x10]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
lea edi, [eax + 0x14]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, 0
mov dword [eax], 0
mov dword [ebx], 0
mov ebx, dword [ebp + 0x10]
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
mov dword [ebx + 0x38], 0xffffffff
mov byte [ebx + 0x3c], 0
mov dword [eax], 0
mov eax, dword [ebx + 0x1c]
mov dword [eax], 0
mov eax, dword [ebx + 0x2c]
mov dword [eax], 0
mov eax, dword [ebx + 0x10]
mov dword [eax], 0
mov eax, dword [ebx + 0x20]
mov dword [eax], 0
mov eax, dword [ebx + 0x30]
mov dword [eax], 0
mov eax, 0x48
mov dword [ebx + 0x40], edx
and edx, 1
mov dword [ebx], vtable.Poco::Base64EncoderBuf.0
cmovne eax, ecx
mov dword [ebx + 0x48], 0
mov ecx, dword [ebp + 8]
test edx, 1
mov dword [ebx + 0x50], eax
mov dword [ebx + 0x4c], 0
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx + 0x38]
mov ecx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789__w
mov dword [ebx + 0x54], eax
mov eax, 0x72c840
cmove eax, ecx
mov dword [ebx + 0x58], eax
mov esi, dword [ebp - 0x18]
push 0
push 0
push ebx
lea ecx, [esi + 0x60]
mov dword [ebp - 4], 3
call fcn.0045964d
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.Poco::Base64Encoder.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + esi - 4], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x632b50
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69df98
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x79b544]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.006326c0
lea ecx, [edi + 0x5c]
mov dword [edi], vtable.Poco::MD5Engine.0
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
push 0x10
mov byte [ebp - 4], 1
call fcn.00632730
push 0x58
lea esi, [edi + 4]
push 0
push esi
call fcn.00506c70
add esp, 0xc
mov dword [edi + 0x18], 0
mov dword [edi + 0x14], 0
mov eax, edi
mov dword [esi], 0x67452301
mov dword [edi + 8], 0xefcdab89
mov dword [edi + 0xc], 0x98badcfe
mov dword [edi + 0x10], 0x10325476
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x632c00
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 0x1c]
mov dword [esi], vtable.Poco::MD5Engine.0
push eax
call fcn.00506c70
mov dword [esi + 0x18], 0
add esp, 0xc
mov dword [esi + 0x14], 0
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x632c88
mov ecx, dword [esi + 0x64]
sub ecx, eax
cmp ecx, 0x1000
jb 0x632c69
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x632c90
mov eax, edx
push ecx
push eax
call fcn.0049ba50
mov dword [esi + 0x5c], 0
add esp, 8
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov ecx, esi
pop esi
jmp fcn.006326d0
call fcn.005122ef
int3

Function at 0x632ca0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 0x1c]
mov dword [esi], vtable.Poco::MD5Engine.0
push eax
call fcn.00506c70
mov dword [esi + 0x18], 0
add esp, 0xc
mov dword [esi + 0x14], 0
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
mov eax, dword [esi + 0x5c]
test eax, eax
je 0x632d2b
mov ecx, dword [esi + 0x64]
sub ecx, eax
cmp ecx, 0x1000
jb 0x632d0c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x632d4a
mov eax, edx
push ecx
push eax
call fcn.0049ba50
mov dword [esi + 0x5c], 0
add esp, 8
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov ecx, esi
call fcn.006326d0
test byte [ebp + 8], 1
je 0x632d43
push 0x68
push esi
call fcn.0049ba50
add esp, 8
mov eax, esi
pop esi
pop ebp
ret 4
call fcn.005122ef
int3

Function at 0x632e50
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
lea eax, [esi + 0x1c]
push eax
call fcn.00506c70
add esp, 0xc
mov dword [esi + 0x18], 0
mov dword [esi + 0x14], 0
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
pop esi
ret
Function at 0x633660
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69dfd8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x79b544]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.006326c0
lea ecx, [esi + 0x64]
mov dword [esi], vtable.Poco::SHA1Engine.0
mov dword [ebp - 4], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
push 0x10
mov byte [ebp - 4], 1
call fcn.00632730
push 0x40
mov dword [esi + 4], 0x67452301
lea eax, [esi + 0x20]
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
mov dword [esi + 0x14], 0xc3d2e1f0
push 0
push eax
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x60], 0
call fcn.00506c70
add esp, 0xc
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x633720
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, ecx
push 0x40
push 0
mov dword [esi], vtable.Poco::SHA1Engine.0
lea eax, [esi + 0x20]
push eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
mov dword [esi + 0x14], 0xc3d2e1f0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x60], 0
call fcn.00506c70
mov eax, dword [esi + 0x64]
add esp, 0xc
test eax, eax
je 0x6337b6
mov ecx, dword [esi + 0x6c]
sub ecx, eax
cmp ecx, 0x1000
jb 0x633797
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x6337be
mov eax, edx
push ecx
push eax
call fcn.0049ba50
mov dword [esi + 0x64], 0
add esp, 8
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov ecx, esi
pop esi
jmp fcn.006326d0
call fcn.005122ef
int3

Function at 0x6337d0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push 0x40
push 0
mov dword [esi], vtable.Poco::SHA1Engine.0
lea eax, [esi + 0x20]
push eax
mov dword [esi + 4], 0x67452301
mov dword [esi + 8], 0xefcdab89
mov dword [esi + 0xc], 0x98badcfe
mov dword [esi + 0x10], 0x10325476
mov dword [esi + 0x14], 0xc3d2e1f0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x60], 0
call fcn.00506c70
mov eax, dword [esi + 0x64]
add esp, 0xc
test eax, eax
je 0x633869
mov ecx, dword [esi + 0x6c]
sub ecx, eax
cmp ecx, 0x1000
jb 0x63384a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x633888
mov eax, edx
push ecx
push eax
call fcn.0049ba50
mov dword [esi + 0x64], 0
add esp, 8
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov ecx, esi
call fcn.006326d0
test byte [ebp + 8], 1
je 0x633881
push 0x70
push esi
call fcn.0049ba50
add esp, 8
mov eax, esi
pop esi
pop ebp
ret 4
call fcn.005122ef
int3
Function at 0x633890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
shr edi, 2
test edi, edi
je 0x6338cb
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + esi*4]
rol edx, 0x10
mov ecx, edx
mov eax, edx
shr ecx, 8
shl eax, 8
xor ecx, eax
shl edx, 8
and ecx, 0xff00ff
xor ecx, edx
mov dword [ebx + esi*4], ecx
inc esi
cmp esi, edi
jl 0x6338a5
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x6339e0
Capabilities:
Hash data using sha1

Disassembly:
push 0x40
lea eax, [ecx + 0x20]
mov dword [ecx + 4], 0x67452301
push 0
push eax
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
mov dword [ecx + 0x14], 0xc3d2e1f0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x60], 0
call fcn.00506c70
add esp, 0xc
ret
Function at 0x634eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, ecx
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
lea edx, [eax + ebx*8]
cmp edx, eax
jae 0x634ec8
inc ecx
mov eax, ebx
mov dword [edi + 0x18], edx
shr eax, 0x1d
add eax, ecx
mov dword [edi + 0x1c], eax
test ebx, ebx
je 0x634f3e
mov edx, dword [ebp + 8]
push esi
nop dword [eax]
mov ecx, dword [edi + 0x60]
dec ebx
mov al, byte [edx]
inc edx
mov dword [ebp + 8], edx
mov byte [edi + ecx + 0x20], al
inc dword [edi + 0x60]
cmp dword [edi + 0x60], 0x40
jne 0x634f39
xor eax, eax
nop dword [eax]
mov esi, dword [edi + eax*4 + 0x20]
rol esi, 0x10
mov edx, esi
mov ecx, esi
shr edx, 8
shl ecx, 8
xor edx, ecx
shl esi, 8
and edx, 0xff00ff
xor edx, esi
mov dword [edi + eax*4 + 0x20], edx
inc eax
cmp eax, 0x10
jl 0x634f00
mov ecx, edi
call fcn.00633a30
mov edx, dword [ebp + 8]
mov dword [edi + 0x60], 0
test ebx, ebx
jne 0x634ee0
pop esi
pop edi
pop ebx
pop ebp
ret 8
Function at 0x637ce0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x69e111
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x79b544]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp + 0x14], 0
mov dword [ebp - 0x10], 0
je 0x637d52
mov dword [ecx], 0x72cf3c
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x78], 0
mov dword [ecx + 0x7c], 0
mov dword [ecx + 0x80], 0
mov dword [ecx + 0x50], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
mov eax, dword [ecx]
push 8
mov eax, dword [eax + 4]
mov dword [ecx + eax], vtable.Poco::MemoryIOS.0
lea eax, [ecx + 8]
mov dword [ebp + 0x14], eax
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00474bfc
mov esi, eax
add esp, 4
test esi, esi
je 0x637d90
push 1
mov dword [ebp - 4], 1
call fcn.0049ea62
add esp, 4
mov dword [esi + 4], eax
jmp 0x637d92
xor esi, esi
mov eax, dword [ebp + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
lea edi, [eax + 0x14]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
add eax, 0x28
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x10]
mov dword [esi], 0
mov dword [ecx], 0
mov ecx, dword [ebp + 0xc]
mov dword [eax], 0
mov eax, dword [ebp + 0x10]
mov dword [ebx], 0
mov ebx, dword [ebp + 0x14]
mov dword [edi], 0
mov dword [edx], 0
mov edx, dword [ebp + 8]
mov dword [ebx + 0x44], eax
mov eax, dword [ebx + 0xc]
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x40], ecx
mov dword [ebx], vtable.Poco::BasicMemoryStreamBuf_char__struct_std::char_traits_char__.0
mov dword [eax], edx
mov eax, dword [ebx + 0x1c]
mov dword [eax], edx
mov eax, dword [ebx + 0x2c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x10]
mov edx, dword [ebx + 0x40]
mov ecx, dword [ebx + 0x38]
mov dword [eax], ecx
mov eax, dword [ebx + 0x20]
mov dword [eax], ecx
mov eax, dword [ebx + 0x30]
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10