joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e9f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x65bf90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 4
mov dword [ebp - 0x208], edi
movzx ebx, byte [edx + edi + 0x30734]
mov ecx, ebx
mov esi, ebx
and esi, 1
shr ecx, 1
dec ecx
or esi, 2
shl esi, cl
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x20c], 0
mov dword [ebp - 0x210], 1
sub edi, esi
mov dword [ebp - 0x214], ecx
test ecx, ecx
je 0x44eaa3
jmp 0x44ea56
mov ebx, dword [ebp - 0x218]
mov ecx, dword [ebp - 0x210]
sub ecx, ebx
add ecx, esi
movzx ecx, word [edx + ecx*2 + 0x32b66]
mov eax, edi
and eax, 1
mov ebx, eax
neg ebx
shr ecx, 4
sar ebx, 4
and ebx, 0x7f
xor ecx, ebx
mov ecx, dword [edx + ecx*4 + 0x30f34]
add dword [ebp - 0x20c], ecx
mov ecx, dword [ebp - 0x210]
add ecx, ecx
or ecx, eax
shr edi, 1
dec dword [ebp - 0x214]
mov dword [ebp - 0x210], ecx
jne 0x44ea50
mov edi, dword [ebp - 0x208]
mov eax, dword [ebp - 0x20c]
mov dword [ebp + edi*4 - 0x204], eax
inc edi
mov dword [ebp - 0x208], edi
cmp edi, 0x80
jb 0x44ea11
lea esi, [ebp - 0x204]
sub esi, edx
lea ecx, [edx + 0x32968]
lea ebx, [edx + 0x31dd0]
sub esi, 0x31dc8
lea edi, [edx + 0x319c8]
mov dword [ebp - 0x208], ecx
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x218], 4
jmp 0x44eb10
xor ecx, ecx
mov dword [ebp - 0x214], ecx
cmp dword [edx + 0x88], ecx
jbe 0x44eb80
mov eax, ecx
or eax, 0x40
xor esi, esi
cmp eax, 1
je 0x44eb68
lea esp, [esp]
mov ebx, dword [ebp - 0x208]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebx, word [ebx + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebx, 4
xor ebx, eax
add esi, dword [edx + ebx*4 + 0x30f34]
mov eax, ecx
cmp eax, 1
jne 0x44eb30
mov ebx, dword [ebp - 0x20c]
mov ecx, dword [ebp - 0x214]
mov dword [edi + ecx*4], esi
inc ecx
mov dword [ebp - 0x214], ecx
cmp ecx, dword [edx + 0x88]
jb 0x44eb20
mov esi, dword [ebp - 0x210]
mov eax, 0xe
cmp dword [edx + 0x88], eax
jbe 0x44eba6
lea ecx, [ecx]
mov ecx, eax
shr ecx, 1
sub ecx, 5
shl ecx, 4
add dword [edi + eax*4], ecx
inc eax
cmp eax, dword [edx + 0x88]
jb 0x44eb90
mov eax, dword [edi]
mov dword [ebx - 8], eax
mov ecx, dword [edi + 4]
mov dword [ebx - 4], ecx
mov eax, dword [edi + 8]
mov dword [ebx], eax
mov ecx, dword [edi + 0xc]
mov dword [ebx + 4], ecx
mov eax, 4
lea ecx, [ebx + 8]
jmp 0x44ebd0
movzx ebx, byte [edx + eax + 0x30734]
mov ebx, dword [edi + ebx*4]
add ebx, dword [esi + ecx]
inc eax
mov dword [ecx], ebx
add ecx, 4
cmp eax, 0x80
jb 0x44ebd0
mov ebx, dword [ebp - 0x20c]
sub dword [ebp - 0x208], 0xffffff80
add ebx, 0x200
sub esi, 0x200
add edi, 0x100
dec dword [ebp - 0x218]
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x210], esi
jne 0x44eb10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov dword [edx + 0x80], 0
pop ebx
call fcn.005bdb17
mov esp, ebp
pop ebp
ret
Function at 0x454380
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
cmp ecx, 0x200
jb 0x454436
mov eax, 0x5a4d
cmp word [edx], ax
jne 0x454436
mov eax, dword [edx + 0x3c]
cmp eax, 0x1000
jae 0x454436
push esi
lea esi, [eax + 0x200]
cmp esi, ecx
pop esi
ja 0x454436
test al, 7
jne 0x454436
cmp dword [eax + edx], 0x4550
lea ecx, [eax + edx]
jne 0x454436
movzx eax, word [ecx + 4]
cmp eax, 0x1c4
jg 0x4543f3
je 0x4543ec
sub eax, 0x14c
je 0x454401
sub eax, 0x74
je 0x4543e5
sub eax, 2
jne 0x454436
mov edx, 0x3030501
jmp 0x45440d
mov edx, 0x3030701
jmp 0x45440d
cmp eax, 0x200
je 0x454408
cmp eax, 0x8664
jne 0x454436
mov edx, 0x3030103
jmp 0x45440d
mov edx, 0x3030401
mov eax, 0x400
cmp word [ecx + 0x14], ax
ja 0x454436
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x45442a
cmp eax, 0x20b
jne 0x454436
mov ecx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4560b0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5eda1a
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x65bf90]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov al, byte [ebp + 0xc]
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [esi], vtable.NArchive::N7z::CThreadDecoder.0
mov byte [esi + 0x14], bl
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov byte [esi + 0x64], al
mov dword [esi + 0x74], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x98], ebx
mov byte [ebp - 4], 4
cmp al, bl
je 0x4561ac
push 0x38
mov byte [esi + 0x9c], bl
mov dword [esi + 0xa0], 1
call fcn.004ba280
add esp, 4
cmp eax, ebx
je 0x456179
mov dword [eax + 0x28], ebx
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x30], ebx
mov dword [eax], vtable.NArchive::N7z::CFolderOutStream2.0
mov dword [eax + 0x34], ebx
mov edi, eax
jmp 0x45617b
xor edi, edi
mov dword [esi + 0x80], edi
cmp edi, ebx
je 0x45618d
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push edi
call ecx
mov eax, dword [esi + 0x84]
cmp eax, ebx
je 0x45619f
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esi + 0x84], edi
mov dword [esi + 0x78], 0x80004005
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x45d120
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
push esi
lea ebx, [eax + 0x1c]
shr eax, 2
mov esi, eax
shr esi, 1
add esi, 3
mov dword [ecx], esi
xor esi, esi
push edi
mov dword [ebp - 8], ebx
mov dword [ebp + 8], eax
test eax, eax
je 0x45d155
mov edi, dword [edx]
mov dword [ecx + esi*4 + 0x10], edi
inc esi
add edx, 4
cmp esi, eax
jb 0x45d147
cmp esi, ebx
jae 0x45d242
mov edx, esi
sub edx, eax
lea eax, [ecx + edx*4 + 0x10]
mov dword [ebp - 4], eax
xor edx, edx
mov eax, esi
div dword [ebp + 8]
mov edi, dword [ecx + esi*4 + 0xc]
test edx, edx
jne 0x45d1d1
movzx eax, byte [eax + 0x62b8dc]
mov edx, edi
and edx, 0xff
movzx edx, byte [edx + str.cw]
mov ebx, edi
shr ebx, 0x18
movzx ebx, byte [ebx + str.cw]
shl edx, 8
or edx, ebx
mov ebx, edi
shr ebx, 0x10
shr edi, 8
and ebx, 0xff
movzx ebx, byte [ebx + str.cw]
and edi, 0xff
movzx edi, byte [edi + str.cw]
shl edx, 8
or edx, ebx
mov ebx, dword [ebp - 8]
shl edx, 8
xor edi, eax
or edi, edx
jmp 0x45d228
cmp dword [ebp + 8], 6
jbe 0x45d228
cmp edx, 4
jne 0x45d228
mov edx, edi
shr edx, 0x10
and edx, 0xff
movzx eax, byte [edx + str.cw]
mov edx, edi
shr edx, 0x18
movzx edx, byte [edx + str.cw]
shl edx, 8
or eax, edx
mov edx, edi
shr edx, 8
and edx, 0xff
movzx edx, byte [edx + str.cw]
shl eax, 8
and edi, 0xff
movzx edi, byte [edi + str.cw]
or eax, edx
shl eax, 8
or edi, eax
mov eax, dword [ebp - 4]
mov edx, dword [eax]
xor edx, edi
mov dword [ecx + esi*4 + 0x10], edx
inc esi
add eax, 4
mov dword [ebp - 4], eax
cmp esi, ebx
jb 0x45d168
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x460cf0
Capabilities:
Hash data using sha256

Disassembly:
mov dword [eax], ecx
dec ecx
je 0x460d48
sub ecx, 3
je 0x460d3e
sub ecx, 6
jne 0x460d4f
mov dword [eax + 0x10], 0x6a09e667
mov dword [eax + 0x14], 0xbb67ae85
mov dword [eax + 0x18], 0x3c6ef372
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0x510e527f
mov dword [eax + 0x24], 0x9b05688c
mov dword [eax + 0x28], 0x1f83d9ab
mov dword [eax + 0x2c], 0x5be0cd19
mov dword [eax + 0x30], ecx
mov dword [eax + 0x34], ecx
ret
or ecx, 0xffffffff
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
ret
mov dword [eax + 4], 0xffffffff
ret
Function at 0x463af0
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push edi
mov edi, dword [esi + 0x18]
and edi, 0x3f
mov ebx, eax
mov eax, edi
shr edi, 2
xor edx, edx
and eax, 3
je 0x463b0a
mov edx, dword [esi + edi*4 + 0x20]
lea ecx, [eax*8]
mov eax, SysReAllocString
shr eax, cl
inc edi
or eax, edx
mov dword [esi + edi*4 + 0x1c], eax
cmp edi, 0xe
je 0x463b45
and edi, 0xf
jne 0x463b37
lea edx, [esi + 0x20]
push esi
mov ecx, esi
call fcn.00463150
add esp, 4
mov dword [esi + edi*4 + 0x20], 0
inc edi
cmp edi, 0xe
jne 0x463b24
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
mov dword [esi + 0x58], ecx
lea edx, [esi + 0x20]
push esi
mov ecx, esi
mov dword [esi + 0x5c], eax
call fcn.00463150
add esp, 4
xor ecx, ecx
xor eax, eax
lea ecx, [ecx]
mov edx, dword [esi + eax*4]
bswap edx
mov dword [ebx], edx
inc eax
add ebx, 4
cmp eax, 5
jb 0x463b70
pop edi
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], ecx
pop ebx
ret

Function at 0x463bb0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [esi + 0x18]
and edi, 0xf
mov dword [esi + edi*4 + 0x20], SysReAllocString
inc edi
xor ebx, ebx
cmp edi, 0xe
je 0x463be8
and edi, 0xf
jne 0x463bde
lea edx, [esi + 0x20]
push esi
mov ecx, esi
call fcn.00463150
add esp, 4
mov dword [esi + edi*4 + 0x20], ebx
inc edi
cmp edi, 0xe
jne 0x463bcb
mov eax, dword [esi + 0x18]
mov ecx, dword [esi + 0x1c]
shld ecx, eax, 5
shl eax, 5
mov dword [esi + 0x58], ecx
mov ecx, dword [ebp + 8]
lea edx, [esi + 0x20]
push esi
mov dword [esi + 0x5c], eax
call fcn.00463150
add esp, 4
pop edi
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
pop ebx
pop ebp
ret
Function at 0x463df0
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x65bf90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x40
lea eax, [ebp - 0x44]
push 0
push eax
mov esi, ecx
mov edi, edx
call fcn.005c2720
add esp, 0xc
cmp esi, 0x40
jbe 0x463e5e
xor eax, eax
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], eax
mov eax, esi
mov ecx, ebx
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
mov dword [edi + 0x10], 0xc3d2e1f0
call fcn.004639c0
lea eax, [ebp - 0x44]
mov esi, edi
call fcn.00463af0
jmp 0x463e70
test esi, esi
je 0x463e70
push esi
lea ecx, [ebp - 0x44]
push ebx
push ecx
call fcn.005c27a0
add esp, 0xc
xor ecx, ecx
xor eax, eax
xor byte [ebp + eax - 0x44], 0x36
inc eax
cmp eax, 0x40
jb 0x463e74
mov dword [edi + 0x18], ecx
mov dword [edi + 0x1c], ecx
mov ebx, 0x10325476
mov esi, 0xc3d2e1f0
mov eax, 0x40
lea ecx, [ebp - 0x44]
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], esi
call fcn.004639c0
xor ecx, ecx
xor eax, eax
lea ebx, [ebx]
xor byte [ebp + eax - 0x44], 0x6a
inc eax
cmp eax, 0x40
jb 0x463ec0
add edi, 0x60
mov dword [edi + 0x18], ecx
mov dword [edi + 0x1c], ecx
mov eax, 0x40
lea ecx, [ebp - 0x44]
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], esi
call fcn.004639c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005bdb17
mov esp, ebp
pop ebp
ret 4
Function at 0x463f10
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0x65bf90]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
xor ecx, ecx
push esi
push edi
mov dword [ebp - 0xc0], edx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
cmp eax, 0x40
jbe 0x463fd4
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa0], ecx
mov ecx, edx
lea edi, [ebp - 0xbc]
mov dword [ebp - 0xbc], 0x67452301
mov dword [ebp - 0xb8], 0xefcdab89
mov dword [ebp - 0xb4], 0x98badcfe
mov dword [ebp - 0xb0], 0x10325476
mov dword [ebp - 0xac], 0xc3d2e1f0
call fcn.004639c0
lea eax, [ebp - 0x1c]
mov esi, edi
call fcn.00463af0
xor eax, eax
nop
mov ecx, dword [ebp + eax - 0x1c]
bswap ecx
mov dword [ebp + eax - 0x5c], ecx
add eax, 4
cmp eax, 0x14
jb 0x463fc0
jmp 0x464008
xor edx, edx
cmp eax, ecx
jbe 0x46400a
mov ecx, edx
shr ecx, 2
lea esi, [ebp + ecx*4 - 0x5c]
mov edi, edx
and edi, 3
mov ecx, 3
sub ecx, edi
mov edi, dword [ebp - 0xc0]
movzx edi, byte [edi + edx]
add ecx, ecx
add ecx, ecx
add ecx, ecx
shl edi, cl
inc edx
or dword [esi], edi
cmp edx, eax
jb 0x463fda
xor ecx, ecx
xor eax, eax
lea esp, [esp]
xor dword [ebp + eax*4 - 0x5c], 0x36363636
inc eax
cmp eax, 0x10
jb 0x464010
mov eax, 0x10
mov esi, ecx
mov dword [ebx], 0x67452301
mov dword [ebx + 4], 0xefcdab89
mov dword [ebx + 8], 0x98badcfe
mov dword [ebx + 0xc], 0x10325476
mov dword [ebx + 0x10], 0xc3d2e1f0
lea edi, [ebp - 0x5c]
and esi, 0xf
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], 0
mov edx, dword [edi]
mov dword [ebx + esi*4 + 0x20], edx
dec eax
inc esi
add edi, 4
mov dword [ebp - 0xc0], eax
cmp esi, 0x10
jne 0x464083
lea edx, [ebx + 0x20]
push ebx
mov ecx, ebx
xor esi, esi
call fcn.00463150
mov eax, dword [ebp - 0xc0]
add esp, 4
test eax, eax
jne 0x464057
jmp 0x464090
xor dword [ebp + eax*4 - 0x5c], 0x6a6a6a6a
inc eax
cmp eax, 0x10
jb 0x464090
lea esi, [ebx + 0x60]
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov ebx, dword [esi + 0x18]
mov eax, 0x10
and ebx, 0xf
add dword [esi + 0x18], eax
lea edi, [ebp - 0x5c]
adc dword [esi + 0x1c], 0
mov ecx, dword [edi]
mov dword [esi + ebx*4 + 0x20], ecx
dec eax
inc ebx
add edi, 4
mov dword [ebp - 0xc0], eax
cmp ebx, 0x10
jne 0x464112
lea edx, [esi + 0x20]
push esi
mov ecx, esi
xor ebx, ebx
call fcn.00463150
mov eax, dword [ebp - 0xc0]
add esp, 4
test eax, eax
jne 0x4640e6
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005bdb17
mov esp, ebp
pop ebp
ret 4
Function at 0x4641e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x65bf90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov eax, dword [edi + 0x18]
mov ecx, dword [edi + 0x1c]
add eax, 5
adc ecx, 0
shld ecx, eax, 5
shl eax, 5
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [edi + 0x78]
mov dword [ebp - 0x10], ecx
mov ecx, dword [edi + 0x7c]
add eax, 5
adc ecx, 0
shld ecx, eax, 5
shl eax, 5
mov dword [ebp - 0x4c], eax
xor eax, eax
mov edx, SysReAllocString
mov dword [ebp - 0x50], ecx
mov ecx, dword [esi + 4]
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov eax, dword [esi]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x74], edx
mov edx, dword [esi + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x44], ecx
mov ecx, dword [esi + 0x10]
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], ecx
mov ebx, 0x3e7
jmp 0x464290
push edi
lea ecx, [ebp - 0x88]
lea edx, [ebp - 0x48]
call fcn.00463150
lea eax, [edi + 0x60]
add esp, 4
push eax
lea ecx, [ebp - 0x48]
lea edx, [ebp - 0x88]
call fcn.00463150
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x44]
xor dword [esi], edx
xor dword [esi + 4], eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
xor dword [esi + 8], ecx
xor dword [esi + 0xc], edx
xor dword [esi + 0x10], eax
add esp, 4
dec ebx
jne 0x464290
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.005bdb17
mov esp, ebp
pop ebp
ret
Function at 0x4642f0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x65bf90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x70], 0x6a09e667
mov dword [ebp - 0x6c], 0xbb67ae85
mov dword [ebp - 0x68], 0x3c6ef372
mov dword [ebp - 0x64], 0xa54ff53a
mov dword [ebp - 0x60], 0x510e527f
mov dword [ebp - 0x5c], 0x9b05688c
mov dword [ebp - 0x58], 0x1f83d9ab
mov dword [ebp - 0x54], 0x5be0cd19
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x74]
push 4
push eax
lea eax, [ebp - 0x70]
call fcn.004725c0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x74], eax
push 4
push ecx
lea eax, [ebp - 0x70]
call fcn.004725c0
add esp, 8
mov dword [ebp - 0x78], 0x3e8
lea edx, [ebp - 0x80]
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4643a0
lea eax, [ebp - 0x80]
push 8
push eax
lea eax, [ebp - 0x70]
call fcn.004725c0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x74], eax
push 4
push ecx
lea eax, [ebp - 0x70]
call fcn.004725c0
add esp, 8
mov dword [ebp - 0x74], 0x64
mov esi, dword [ebp - 0x50]
and esi, 0x3f
mov byte [ebp + esi - 0x48], 0x80
inc esi
mov edi, 0x65dec4
cmp esi, 0x38
je 0x4643f2
and esi, 0x3f
jne 0x4643e8
lea edx, [ebp - 0x70]
push edx
call fcn.00471b90
add esp, 4
mov byte [ebp + esi - 0x48], bl
inc esi
cmp esi, 0x38
jne 0x4643d7
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
shld ecx, eax, 3
add eax, eax
add eax, eax
add eax, eax
bswap eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x70]
bswap ecx
push eax
mov dword [ebp - 0x10], ecx
call fcn.00471b90
add esp, 4
xor eax, eax
lea ebx, [ebx]
mov ecx, dword [ebp + eax*4 - 0x70]
mov edx, dword [ebp + eax*4 - 0x6c]
bswap ecx
bswap edx
mov dword [edi], ecx
mov dword [edi + 4], edx
add eax, 2
add edi, 8
cmp eax, 8
jb 0x464420
push 0x20
push 0x65dec4
lea eax, [ebp - 0x70]
mov dword [ebp - 0x70], 0x6a09e667
mov dword [ebp - 0x6c], 0xbb67ae85
mov dword [ebp - 0x68], 0x3c6ef372
mov dword [ebp - 0x64], 0xa54ff53a
mov dword [ebp - 0x60], 0x510e527f
mov dword [ebp - 0x5c], 0x9b05688c
mov dword [ebp - 0x58], 0x1f83d9ab
mov dword [ebp - 0x54], 0x5be0cd19
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
call fcn.004725c0
add esp, 8
dec dword [ebp - 0x74]
jne 0x4643c1
dec dword [ebp - 0x78]
jne 0x464381
mov eax, 0x65dec4
lea esi, [ebp - 0x70]
call fcn.00472680
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov byte [0x65dee4], bl
xor ecx, ebp
pop ebx
call fcn.005bdb17
mov esp, ebp
pop ebp
ret
Function at 0x4644d0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x65bf90]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 0x6687c0
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
cmp byte [0x65dee4], bl
je 0x464502
call fcn.004642f0
cmp dword [ebp + 8], ebx
je 0x464623
jmp 0x464510
push 0x20
push 0x65dec4
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x6a09e667
mov dword [ebp - 0x90], 0xbb67ae85
mov dword [ebp - 0x8c], 0x3c6ef372
mov dword [ebp - 0x88], 0xa54ff53a
mov dword [ebp - 0x84], 0x510e527f
mov dword [ebp - 0x80], 0x9b05688c
mov dword [ebp - 0x7c], 0x1f83d9ab
mov dword [ebp - 0x78], 0x5be0cd19
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
call fcn.004725c0
mov eax, 0x65dec4
lea esi, [ebp - 0x94]
call fcn.00472680
lea eax, [ebp - 0x98]
push 4
push eax
mov eax, esi
mov dword [ebp - 0x94], 0x6a09e667
mov dword [ebp - 0x90], 0xbb67ae85
mov dword [ebp - 0x8c], 0x3c6ef372
mov dword [ebp - 0x88], 0xa54ff53a
mov dword [ebp - 0x84], 0x510e527f
mov dword [ebp - 0x80], 0x9b05688c
mov dword [ebp - 0x7c], 0x1f83d9ab
mov dword [ebp - 0x78], 0x5be0cd19
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x98], 0xf672abd1
call fcn.004725c0
push 0x20
push 0x65dec4
mov eax, esi
call fcn.004725c0
add esp, 0x18
lea eax, [ebp - 0x28]
call fcn.00472680
lea eax, [ebp - 0x28]
xor ecx, ecx
sub eax, edi
cmp dword [ebp + 8], ebx
je 0x464623
mov dl, byte [eax + edi]
dec dword [ebp + 8]
mov byte [edi], dl
inc ecx
inc edi
cmp ecx, 0x20
jb 0x464606
cmp dword [ebp + 8], ebx
jne 0x464510
push 0x6687c0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005bdb17
mov esp, ebp
pop ebp
ret 4
Function at 0x464b20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + 0x18]
mov dword [edi + 8], ecx
mov edx, dword [eax + 0x1c]
push ebx
xor ecx, ecx
xor ebx, ebx
mov dword [edi + 0xc], edx
mov word [edi], cx
push esi
cmp byte [eax + 1], bl
je 0x464bab
mov dl, byte [eax + 2]
lea ebx, [eax + 0x20]
lea esi, [edi + 0x20]
mov byte [ebp - 1], dl
call fcn.00417bd0
mov eax, dword [ebp + 0x10]
cmp byte [eax + 4], 0
je 0x464b65
mov ecx, 0x800
or word [edi], cx
jmp 0x464b6d
mov edx, 0xf7ff
and word [edi], dx
mov ecx, dword [eax + 0x10]
mov dword [edi + 0x3c], ecx
mov edx, dword [eax + 0x14]
mov dword [edi + 0x18], edx
mov ecx, dword [eax + 0x2c]
mov dword [edi + 0x60], ecx
mov edx, dword [eax + 0x30]
mov dword [edi + 0x64], edx
mov ecx, dword [eax + 0x34]
mov dword [edi + 0x68], ecx
mov edx, dword [eax + 0x38]
mov dword [edi + 0x6c], edx
mov ecx, dword [eax + 0x3c]
mov dword [edi + 0x70], ecx
mov edx, dword [eax + 0x40]
mov dword [edi + 0x74], edx
movzx eax, byte [eax + 3]
mov byte [edi + 0x78], al
mov al, byte [ebp - 1]
xor ebx, ebx
jmp 0x464bb2
mov esi, edi
call fcn.00440790
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x38]
mov dword [edi + 0x40], edx
mov ecx, dword [ecx + 0x3c]
mov dword [edi + 0x44], ecx
mov byte [edi + 5], bl
mov dword [edi + 0x38], 0x3f
cmp al, bl
jne 0x464be1
mov ecx, dword [ebp + 0xc]
cmp byte [ecx + 0x24], bl
je 0x464be1
or word [edi], 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, 0xfffe
and word [edi], dx
cmp al, bl
je 0x464c06
xor eax, eax
mov byte [edi + 4], 0x14
mov word [edi + 2], ax
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x1c], ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret