joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b8b30
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa4
call fcn.0055bc20
mov eax, dword [0x5e2ec0]
xor eax, esp
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0xac]
push ebx
mov ebx, dword [esp + 0xb4]
push ebp
mov dword [esp + 0x10], edx
mov edx, dword [esp + 0xc0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xbc]
mov ebp, dword [ecx]
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0xc], edx
mov dword [esp + 0x18], 0
call fcn.004c60b0
push ebp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
push 0
push eax
call fcn.004f74c0
add esp, 0x10
test eax, eax
je 0x4b8ca5
inc ebp
test ebx, ebx
mov ebx, dword [esp + 0xc]
je 0x4b8bd1
mov ecx, dword [esp + 0x18]
push esi
push ebx
push ecx
call fcn.00469be0
add esp, 0xc
test eax, eax
jle 0x4b8cb0
push esi
push ebx
push edi
call fcn.0055bc50
push esi
lea edx, [esp + 0x78]
push ebx
push edx
call fcn.0055bc50
lea eax, [esi - 1]
add esp, 0x18
test eax, eax
jl 0x4b8bfb
nop
add byte [edi + eax], 1
jne 0x4b8bfb
sub eax, 1
jns 0x4b8bf0
mov eax, dword [esp + 0x10]
push 0
push eax
push 0
lea ecx, [esp + 0x34]
push ecx
push esi
push ebx
call fcn.00476250
add esp, 0x18
test eax, eax
je 0x4b8cb0
mov edx, dword [esp + 0x10]
push 0
push edx
push 0
lea eax, [esp + 0x74]
push eax
push esi
push edi
call fcn.00476250
add esp, 0x18
test eax, eax
je 0x4b8cb0
xor eax, eax
test esi, esi
jle 0x4b8c4e
mov cl, byte [esp + eax + 0x68]
xor byte [esp + eax + 0x28], cl
inc eax
cmp eax, esi
jl 0x4b8c41
mov ebx, dword [esp + 0x20]
or byte [esp + 0x28], 0x80
or byte [esp + esi + 0x27], 1
push ebx
lea edx, [esp + 0x2c]
push esi
push edx
call fcn.00479a20
add esp, 0xc
test eax, eax
je 0x4b8cb0
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x24]
push eax
push ecx
push ebx
call fcn.004f8200
add esp, 0xc
test eax, eax
jg 0x4b8ca8
jne 0x4b8cb0
mov edx, dword [esp + 8]
push ebp
push 0
push edx
mov ebx, 1
call fcn.004f74c0
add esp, 0xc
test eax, eax
jne 0x4b8bb1
inc ebp
jmp 0x4b8cb0
mov dword [esp + 0x14], 1
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0xa8]
mov dword [eax], ebp
mov eax, dword [esp + 0x14]
pop ebp
pop ebx
xor ecx, esp
call fcn.0055a67a
add esp, 0xa4
ret
Function at 0x4bc450
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x4bc519
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x4bc471
cmp al, 0x6b
jne 0x4bc519
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x4bc4d1
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x4bc491
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x4bc491
cmp al, 0xbb
jne 0x4bc4a5
inc ecx
cmp ecx, esi
jl 0x4bc481
sub esi, ecx
test ecx, ecx
jne 0x4bc4d4
call fcn.004671d0
push str.RSA_padding_check_X931
push 0x56
jmp 0x4bc4b1
call fcn.004671d0
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.00467260
push 0
push 0x8a
push 4
call fcn.004673f0
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x4bc506
call fcn.004671d0
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.00467260
push 0
push 0x8b
push 4
call fcn.004673f0
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.0055bc50
add esp, 0xc
mov eax, esi
pop esi
ret
call fcn.004671d0
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.00467260
push 0
push 0x89
push 4
call fcn.004673f0
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
Function at 0x4c87c0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x134
call fcn.0055bc20
mov eax, dword [0x5e2ec0]
xor eax, esp
mov dword [esp + 0x130], eax
mov eax, dword [esp + 0x148]
push ebx
mov ebx, dword [esp + 0x140]
push ebp
mov ebp, dword [esp + 0x148]
push esi
mov esi, dword [esp + 0x150]
mov dword [esp + 0x14], eax
xor eax, eax
push edi
mov edi, dword [esp + 0x148]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
cmp esi, eax
je 0x4c8825
cmp esi, dword [edi]
je 0x4c8821
cmp ebx, eax
je 0x4c889e
cmp ebp, eax
jl 0x4c889e
mov dword [edi], esi
jmp 0x4c882b
mov esi, dword [edi]
cmp esi, eax
je 0x4c889e
push esi
call fcn.00467cc0
add esp, 4
test al, 2
jne 0x4c889e
test ebx, ebx
je 0x4c8998
push esi
mov dword [esp + 0x14], 1
call fcn.00467b80
add esp, 4
cmp eax, 0x90
jg 0x4c889e
cmp eax, ebp
jge 0x4c88b9
mov ecx, dword [esp + 0x18]
mov edx, dword [edi + 4]
push ecx
push esi
push edx
call fcn.00475de0
add esp, 0xc
test eax, eax
je 0x4c889e
mov eax, dword [edi + 4]
push ebp
push ebx
push eax
call fcn.00475140
add esp, 0xc
test eax, eax
je 0x4c889e
mov eax, dword [edi + 4]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
call fcn.00475240
add esp, 0xc
test eax, eax
jne 0x4c88d8
xor eax, eax
mov ecx, dword [esp + 0x140]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0055a67a
add esp, 0x134
ret
cmp ebp, 0x90
ja 0x4c889e
push ebp
lea ecx, [esp + 0x24]
push ebx
push ecx
call fcn.0055bc50
mov eax, ebp
add esp, 0xc
mov dword [esp + 0x1c], eax
jmp 0x4c88dc
mov eax, dword [esp + 0x1c]
cmp eax, 0x90
je 0x4c88fa
mov edx, 0x90
sub edx, eax
push edx
lea eax, [esp + eax + 0x24]
push 0
push eax
call fcn.0055bfc0
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x20]
xor cl, 0x36
mov byte [esp + eax + 0xb0], cl
inc eax
cmp eax, 0x90
jl 0x4c8900
mov ebx, dword [esp + 0x18]
mov edx, dword [edi + 8]
push ebx
push esi
push edx
call fcn.00475de0
add esp, 0xc
test eax, eax
je 0x4c89bb
push esi
call fcn.00467b80
mov ecx, dword [edi + 8]
push eax
lea eax, [esp + 0xb8]
push eax
push ecx
call fcn.00475140
add esp, 0x10
test eax, eax
je 0x4c89bb
xor eax, eax
mov dl, byte [esp + eax + 0x20]
xor dl, 0x5c
mov byte [esp + eax + 0xb0], dl
inc eax
cmp eax, 0x90
jl 0x4c8951
mov eax, dword [edi + 0xc]
push ebx
push esi
push eax
call fcn.00475de0
add esp, 0xc
test eax, eax
je 0x4c89bb
push esi
call fcn.00467b80
mov edx, dword [edi + 0xc]
push eax
lea ecx, [esp + 0xb8]
push ecx
push edx
call fcn.00475140
add esp, 0x10
test eax, eax
je 0x4c89bb
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
call fcn.00475850
add esp, 8
test eax, eax
je 0x4c89b4
mov dword [esp + 0x14], 1
cmp dword [esp + 0x10], 0
je 0x4c89df
lea edx, [esp + 0x20]
push 0x90
push edx
call fcn.0046b340
lea eax, [esp + 0xb8]
push 0x90
push eax
call fcn.0046b340
add esp, 0x10
mov eax, dword [esp + 0x14]
jmp 0x4c88a0
Function at 0x4c8e50
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, 4
call fcn.0055bc20
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 1
cmp esi, 0xffffffff
jne 0x4c8e98
call fcn.004671d0
push str.BIO_connect
push 0x53
push str.crypto_bio_b_sock2.c
call fcn.00467260
push 0
push 0x87
push 0x20
call fcn.004673f0
add esp, 0x18
xor eax, eax
pop esi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
mov eax, ebx
shr eax, 3
and eax, 1
push eax
push esi
call fcn.00496b80
add esp, 8
test eax, eax
jne 0x4c8eb7
pop ebx
pop esi
pop ecx
ret
push edi
mov edi, dword [sym.imp.WS2_32.dll_setsockopt]
test bl, 4
je 0x4c8f32
push 4
lea ecx, [esp + 0x10]
push ecx
push 8
push 0xffff
push esi
call edi
test eax, eax
je 0x4c8f32
call fcn.004671d0
push str.BIO_connect
push 0x5d
push str.crypto_bio_b_sock2.c
call fcn.00467260
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.004673f0
call fcn.004671d0
push str.BIO_connect
push 0x5f
push str.crypto_bio_b_sock2.c
call fcn.00467260
push 0
push 0x89
push 0x20
call fcn.004673f0
add esp, 0x24
pop edi
pop ebx
xor eax, eax
pop esi
pop ecx
ret
test bl, 0x10
je 0x4c8fa3
push 4
lea edx, [esp + 0x10]
push edx
push 1
push 6
push esi
call edi
test eax, eax
je 0x4c8fa3
call fcn.004671d0
push str.BIO_connect
push 0x67
push str.crypto_bio_b_sock2.c
call fcn.00467260
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.004673f0
call fcn.004671d0
push str.BIO_connect
push 0x69
push str.crypto_bio_b_sock2.c
call fcn.00467260
push 0
push 0x8a
push 0x20
call fcn.004673f0
add esp, 0x24
pop edi
pop ebx
xor eax, eax
pop esi
pop ecx
ret
mov edi, dword [esp + 0x18]
push edi
call fcn.00496310
add esp, 4
push eax
push edi
call fcn.004d7960
add esp, 4
push eax
push esi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x4c902b
push eax
call fcn.004c91e0
add esp, 4
test eax, eax
jne 0x4c9024
call fcn.004671d0
push str.BIO_connect
push 0x71
push str.crypto_bio_b_sock2.c
call fcn.00467260
add esp, 0xc
push str.calling_connect__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.004673f0
call fcn.004671d0
push str.BIO_connect
push 0x73
push str.crypto_bio_b_sock2.c
call fcn.00467260
push 0
push 0x67
push 0x20
call fcn.004673f0
add esp, 0x24
pop edi
pop ebx
xor eax, eax
pop esi
pop ecx
ret
pop edi
pop ebx
mov eax, 1
pop esi
pop ecx
ret

Function at 0x4c9290
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov edx, dword [edi + 0x20]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.0047c370
add esp, 8
test esi, esi
jg 0x4c92ee
je 0x4c92cc
cmp esi, 0xffffffff
jne 0x4c92ee
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 4
je 0x4c92e3
cmp eax, 0xb
je 0x4c92e3
cmp eax, 0x2733
jne 0x4c92ee
push 0xa
push edi
call fcn.0047c390
add esp, 8
pop edi
mov eax, esi
pop esi
ret
Function at 0x4c9d20
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [eax + 0x60]
mov eax, dword [edi + 0x70]
test eax, eax
je 0x4c9d89
test ebp, ebp
je 0x4c9d65
lea esp, [esp]
cmp eax, 0x40
jae 0x4c9d65
mov dl, byte [eax + edi + 0x30]
mov ecx, dword [esp + 0x18]
xor dl, byte [ecx]
mov esi, dword [esp + 0x14]
mov byte [esi], dl
inc esi
inc ecx
inc eax
sub ebp, 1
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ecx
jne 0x4c9d40
mov dword [edi + 0x70], eax
test ebp, ebp
je 0x4c9e32
cmp eax, 0x40
jne 0x4c9d89
mov eax, 1
add dword [edi + 0x20], eax
mov dword [edi + 0x70], 0
jne 0x4c9d89
add dword [edi + 0x24], eax
mov eax, ebp
and eax, 0x3f
sub ebp, eax
push ebx
mov ebx, dword [edi + 0x20]
mov dword [esp + 0x14], eax
cmp ebp, 0x40
jb 0x4c9de7
lea ecx, [ecx]
mov esi, ebp
shr esi, 6
add ebx, esi
cmp ebx, esi
jae 0x4c9daf
sub esi, ebx
xor ebx, ebx
mov ecx, dword [esp + 0x18]
lea eax, [edi + 0x20]
push eax
mov eax, dword [esp + 0x20]
push edi
shl esi, 6
push esi
push eax
push ecx
call fcn.00504b00
add dword [esp + 0x30], esi
add dword [esp + 0x2c], esi
add esp, 0x14
sub ebp, esi
mov dword [edi + 0x20], ebx
test ebx, ebx
jne 0x4c9dde
inc dword [edi + 0x24]
cmp ebp, 0x40
jae 0x4c9da0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4c9e31
push 0x40
lea esi, [edi + 0x30]
push 0
push esi
call fcn.0055bfc0
lea eax, [edi + 0x20]
push eax
push edi
push 0x40
push esi
push esi
call fcn.00504b00
mov ebp, dword [esp + 0x34]
add esp, 0x20
xor eax, eax
test ebp, ebp
jbe 0x4c9e2e
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub edx, ecx
lea ecx, [ecx]
mov bl, byte [edx + ecx]
xor bl, byte [esi + eax]
inc eax
mov byte [ecx], bl
inc ecx
cmp eax, ebp
jb 0x4c9e20
mov dword [edi + 0x70], ebp
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
Function at 0x4cff70
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.0055bfc0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret

Function at 0x4ddf00
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, 8
call fcn.0055bc20
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x18]
cmp ebp, esi
jne 0x4ddf31
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
push ebp
push eax
push ecx
call fcn.0055bc50
add esp, 0xc
pop esi
pop ebp
add esp, 8
ret
push ebx
push edi
mov edi, esi
mov ecx, ebp
test ebp, ebp
je 0x4ddf4e
jmp 0x4ddf40
mov eax, edi
xor edx, edx
div ecx
mov edi, ecx
mov ecx, edx
test edx, edx
jne 0x4ddf40
mov edx, dword [esp + 0x1c]
push esi
push 0
push edx
call fcn.0055bfc0
mov eax, esi
imul eax, ebp
xor edx, edx
div edi
add esp, 0xc
xor ebx, ebx
mov edi, eax
sub edi, 1
js 0x4ddffb
xor edx, edx
mov eax, edi
div esi
mov eax, edi
mov esi, edi
mov dword [esp + 0x14], edx
xor edx, edx
div ebp
xor edx, edx
imul eax, eax, 0xd
mov ecx, eax
and eax, 7
mov dword [esp + 0x28], eax
shr ecx, 3
sub esi, ecx
lea eax, [esi - 1]
div ebp
mov eax, dword [esp + 0x24]
mov ecx, 8
sub ecx, dword [esp + 0x28]
movzx eax, byte [edx + eax]
shl eax, cl
xor edx, edx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov eax, esi
div ebp
mov eax, dword [esp + 0x10]
movzx edx, byte [edx + ecx]
mov cl, byte [esp + 0x28]
shr edx, cl
mov ecx, dword [esp + 0x14]
or eax, edx
mov edx, dword [esp + 0x1c]
and eax, 0xff
mov esi, eax
movzx eax, byte [ecx + edx]
add esi, ebx
add eax, esi
mov esi, dword [esp + 0x20]
mov byte [ecx + edx], al
shr eax, 8
sub edi, 1
mov ebx, eax
jns 0x4ddf74
add esi, 0xffffffff
js 0x4de019
test ebx, ebx
je 0x4de019
mov eax, dword [esp + 0x1c]
movzx ecx, byte [esi + eax]
add ebx, ecx
mov byte [esi + eax], bl
shr ebx, 8
sub esi, 1
jns 0x4de000
pop edi
pop ebx
pop esi
pop ebp
add esp, 8
ret
Function at 0x4e07b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0055bc20
cmp dword [esp + 8], 0
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push edi
mov edi, ecx
mov ebx, edx
je 0x4e08c0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x1c]
push ebp
inc esi
push eax
shr esi, 1
push esi
push edi
call fcn.004e0550
add esp, 0x10
test eax, eax
je 0x4e0836
push 0x179
push str.providersimplementationskdfs_tls1_prf.c
push ebp
call fcn.00466b70
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4e083e
call fcn.004671d0
push str.tls1_prf_alg
push 0x17a
push str.providersimplementationskdfs_tls1_prf.c
call fcn.00467260
push 0
push 0x41
push 0x39
call fcn.004673f0
add esp, 0x18
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x18]
push ebp
push ecx
mov ecx, dword [esp + 0x28]
sub edi, esi
add edi, dword [esp + 0x24]
push esi
push edi
mov edx, eax
call fcn.004e0550
add esp, 0x10
test eax, eax
jne 0x4e0882
mov edx, dword [esp + 0x10]
push 0x180
push str.providersimplementationskdfs_tls1_prf.c
push ebp
push edx
call fcn.00466c30
add esp, 0x10
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
test ebp, ebp
jbe 0x4e089d
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
sub ecx, eax
mov esi, ebp
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub esi, 1
jne 0x4e0892
mov eax, dword [esp + 0x10]
push 0x185
push str.providersimplementationskdfs_tls1_prf.c
push ebp
push eax
call fcn.00466c30
add esp, 0x10
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
push ebp
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x30]
push edi
call fcn.004e0550
add esp, 0x10
neg eax
pop edi
sbb eax, eax
pop ebp
neg eax
pop ebx
pop ecx
ret
Function at 0x4f1900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x5c
call fcn.0055bc20
push ebx
push ebp
push esi
mov esi, dword [esp + 0x74]
push edi
xor edi, edi
push 0x38
lea eax, [esp + 0x38]
push edi
push eax
mov dword [esp + 0x3c], edi
call fcn.0055bfc0
lea ecx, [esp + 0x3c]
sub ecx, esi
mov dword [esp + 0x20], ecx
xor eax, eax
lea ecx, [esp + 0x40]
add esp, 0xc
sub ecx, esi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
jmp 0x4f1954
mov esi, dword [esp + 0x78]
mov ecx, dword [esp + 0x74]
mov edx, dword [ecx + eax*4]
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x10], edx
xor ebp, ebp
mov dword [esp + 0x18], 7
lea ecx, [ecx]
mov ecx, dword [esp + 0x10]
mov eax, dword [esi]
push ebp
push ecx
push 0
push eax
call fcn.0055e200
mov ecx, dword [esp + 0x14]
mov ecx, dword [ecx + esi]
xor ebp, ebp
add eax, ecx
mov ecx, dword [esp + 0x10]
push ebp
adc edx, ebp
add edi, eax
mov eax, dword [esi + 4]
push ecx
adc ebx, edx
mov edx, dword [esp + 0x1c]
push ebp
push eax
mov dword [edx + esi], edi
call fcn.0055e200
xor ecx, ecx
add eax, ebx
adc edx, ecx
mov ecx, dword [esp + 0x24]
mov edi, dword [ecx + esi]
xor ebx, ebx
add eax, edi
adc edx, ebx
mov dword [ecx + esi], eax
add esi, 8
sub dword [esp + 0x18], 1
mov edi, edx
jne 0x4f1970
mov ebp, dword [esp + 0x30]
imul ebp, ebp, 0xae918bc5
mov dword [esp + 0x68], edi
xor edi, edi
xor esi, esi
mov dword [esp + 0x10], ebp
xor eax, eax
jmp 0x4f19e8
mov eax, dword [esp + 0x2c]
mov edx, dword [esi*4 + 0x5b4384]
push eax
push ebp
push 0
push edx
call fcn.0055e200
mov ecx, dword [esp + esi*4 + 0x30]
xor ebp, ebp
add eax, ecx
adc edx, ebp
add ebx, eax
adc edi, edx
test esi, esi
je 0x4f1a0f
mov dword [esp + esi*4 + 0x2c], ebx
mov ebp, dword [esp + 0x10]
mov edx, dword [esi*4 + 0x5b4388]
xor eax, eax
push eax
push ebp
push eax
push edx
mov dword [esp + 0x3c], eax
call fcn.0055e200
mov ecx, dword [esp + esi*4 + 0x34]
xor ebx, ebx
add eax, ecx
adc edx, ebx
xor ecx, ecx
add eax, edi
adc edx, ecx
lea ecx, [esi + 1]
test ecx, ecx
je 0x4f1a44
mov dword [esp + esi*4 + 0x30], eax
add esi, 2
xor edi, edi
mov ebx, edx
cmp esi, 0xe
jb 0x4f19e4
mov edx, dword [esp + esi*4 + 0x30]
xor eax, eax
lea esi, [esp + esi*4 + 0x30]
xor ecx, ecx
add edx, dword [esp + 0x1c]
adc eax, ecx
add ebx, edx
adc edi, eax
mov eax, dword [esp + 0x20]
inc eax
mov dword [esi - 4], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], eax
cmp eax, 0xe
jb 0x4f1950
mov eax, dword [esp + 0x70]
push edi
push 0x5b4384
lea edx, [esp + 0x38]
push edx
push eax
mov edx, 0x5b4384
call fcn.004f17e0
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x5c
ret
Function at 0x4f32f0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x4f6420
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.0055bc20
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
mov edi, edx
push ebp
mov esi, 1
push eax
mov ebx, ecx
shl esi, cl
mov dword [esp + 0x18], edi
call fcn.00479900
add esp, 8
test eax, eax
jne 0x4f645b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
cmp ebx, 3
jg 0x4f64bd
xor ebx, ebx
test ebp, ebp
jle 0x4f6620
lea ebx, [ebx]
xor edx, edx
xor ecx, ecx
test esi, esi
jle 0x4f649f
mov eax, ecx
xor eax, dword [esp + 0x44]
inc ecx
lea ebp, [eax - 1]
shr ebp, 0x1f
not eax
shr eax, 0x1f
and ebp, eax
mov eax, dword [edi + ecx*4 - 4]
neg ebp
and ebp, 1
neg ebp
and ebp, eax
or edx, ebp
cmp ecx, esi
jl 0x4f6478
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx]
mov dword [eax + ebx*4], edx
lea eax, [esi*4]
inc ebx
add edi, eax
cmp ebx, dword [esp + 0x40]
jl 0x4f6470
jmp 0x4f6620
mov edx, dword [esp + 0x44]
lea ecx, [ebx - 2]
mov eax, edx
sar eax, cl
mov edi, 1
shl edi, cl
lea ebx, [eax - 1]
shr ebx, 0x1f
lea ecx, [edi - 1]
and edx, ecx
mov dword [esp + 0x44], edx
mov edx, eax
not edx
shr edx, 0x1f
and ebx, edx
mov ecx, eax
xor ecx, 1
lea edx, [ecx - 1]
not ecx
shr ecx, 0x1f
shr edx, 0x1f
and edx, ecx
mov ecx, eax
xor ecx, 2
lea ebp, [ecx - 1]
not ecx
shr ecx, 0x1f
shr ebp, 0x1f
and ebp, ecx
xor eax, 3
lea ecx, [eax - 1]
shr ecx, 0x1f
not eax
shr eax, 0x1f
and ecx, eax
neg ebx
neg edx
neg ebp
neg ecx
and ebx, 1
and edx, 1
and ebp, 1
and ecx, 1
xor eax, eax
neg edx
neg ebp
neg ecx
neg ebx
cmp dword [esp + 0x40], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
jle 0x4f6620
lea edx, [esi*4]
mov dword [esp + 0x34], edx
mov edi, edi
xor esi, esi
cmp edi, esi
mov dword [esp + 0x20], esi
jle 0x4f65fc
mov eax, dword [esp + 0x10]
lea edx, [eax + edi*4]
mov dword [esp + 0x1c], edx
lea edx, [eax + edi*8]
mov dword [esp + 0x18], edx
lea edx, [edi + edi*2]
lea eax, [eax + edx*4]
mov dword [esp + 0x14], eax
lea ebx, [ebx]
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
and edx, ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx]
and ecx, ebp
or ecx, edx
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
and edx, dword [esp + 0x30]
mov ebp, dword [esp + 0x24]
or edx, ecx
mov eax, esi
xor eax, dword [esp + 0x44]
inc esi
lea ecx, [eax - 1]
not eax
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + esi*4 - 4]
neg ecx
and ecx, 1
and eax, ebx
neg ecx
or eax, edx
and ecx, eax
or dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x28]
mov eax, 4
add dword [esp + 0x14], eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
cmp esi, edi
jl 0x4f6590
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x3c]
mov edx, dword [edx]
mov esi, dword [esp + 0x20]
mov dword [edx + eax*4], esi
mov edx, dword [esp + 0x34]
add dword [esp + 0x10], edx
inc eax
cmp eax, dword [esp + 0x40]
mov dword [esp + 0x2c], eax
jl 0x4f6560
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
mov eax, 1
pop ebx
add esp, 0x28
ret
Function at 0x504b00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, 0x88
call fcn.0055bc20
mov eax, dword [0x5e2ec0]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x98]
mov edx, dword [eax]
mov ecx, dword [esp + 0x9c]
mov dword [esp + 0x14], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x18], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x1c], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x20], edx
mov edx, dword [eax + 0x10]
mov dword [esp + 0x24], edx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x28], edx
mov edx, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x2c], edx
mov edx, dword [ecx]
mov dword [esp + 0x30], eax
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [esp + 0x98]
push ebp
mov ebp, dword [esp + 0x94]
mov dword [esp + 0x3c], edx
mov edx, dword [ecx + 8]
mov dword [esp + 0x40], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 8], ebp
mov dword [esp + 0xc], 0x61707865
mov dword [esp + 0x10], 0x3320646e
mov dword [esp + 0x14], 0x79622d32
mov dword [esp + 0x18], 0x6b206574
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], eax
test ebx, ebx
jbe 0x504c14
push esi
push edi
mov esi, 0x40
cmp ebx, esi
jae 0x504bbd
mov esi, ebx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x58]
push edx
call fcn.00504860
add esp, 8
xor ecx, ecx
test esi, esi
jbe 0x504bf7
mov edi, dword [esp + 0xa0]
lea eax, [esp + 0x54]
mov edx, eax
sub edi, eax
sub ebp, edx
lea eax, [esp + ecx + 0x54]
mov dl, byte [edi + eax]
xor dl, byte [eax]
inc ecx
mov byte [eax + ebp], dl
cmp ecx, esi
jb 0x504be6
mov ebp, dword [esp + 0x10]
add dword [esp + 0xa0], esi
inc dword [esp + 0x44]
add ebp, esi
sub ebx, esi
mov dword [esp + 0x10], ebp
test ebx, ebx
ja 0x504bb2
pop edi
pop esi
mov ecx, dword [esp + 0x8c]
pop ebp
pop ebx
xor ecx, esp
call fcn.0055a67a
add esp, 0x88
ret