joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d7fa
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498658], 1
jne 0x41d8ab
mov eax, 0xd423
mov word [0x497ae4], ax
add eax, 0xfffffffd
mov word [0x497ae6], ax
or dword [0x498658], 1
mov edx, 0xd42e
mov eax, edx
mov word [0x497ae8], ax
add eax, 4
mov word [0x497aea], ax
lea ecx, [edx + 6]
mov eax, ecx
mov word [0x497aec], ax
add eax, 0xfffffff4
mov word [0x497aee], ax
lea eax, [edx - 7]
mov word [0x497af0], ax
add eax, 3
mov word [0x497af2], ax
lea eax, [edx + 0xa]
push edi
mov edi, eax
add eax, 0xffffffec
mov ecx, eax
mov word [0x497b02], ax
lea eax, [edx + 0x11]
mov word [0x497b04], ax
add eax, 0x2c
mov word [0x497af4], di
mov word [0x497af6], di
mov dword [0x497af8], 0xd438d42e
mov dword [0x497afc], 0xd439d434
mov word [0x497b00], cx
mov word [0x497b06], ax
pop edi
xor eax, eax
mov ecx, 0xd46b
xor cx, word [eax + 0x497ae4]
add eax, 2
mov word [eax + 0x4982aa], cx
cmp eax, 0x24
jb 0x41d8ad
mov eax, 0x4982ac
ret

Function at 0x41dc79
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498640], 1
jne 0x41dcce
or dword [0x498640], 1
mov dword [0x497b90], 0x280c0e39
mov dword [0x497b94], 0x1f0a0e19
mov dword [0x497b98], 0x120e200e
mov dword [0x497b9c], 0x4243132e
mov dword [0x497ba0], 0x20a0d4b
mov dword [0x497ba4], 0x510f0e07
mov word [0x497ba8], 0x6b4b
xor eax, eax
mov cl, byte [eax + 0x497b90]
xor cl, 0x6b
mov byte [eax + 0x498308], cl
inc eax
cmp eax, 0x1a
jb 0x41dcd0
mov eax, 0x498308
ret

Function at 0x41ddb0
Capabilities:
Encode data using xor

Disassembly:
test byte [0x49863c], 1
jne 0x41de16
or dword [0x49863c], 1
mov dword [0x497bac], 0x61e052e
mov dword [0x497bb0], 0x1f0a190e
mov dword [0x497bb4], 0x4b050402
mov dword [0x497bb8], 0xe0f0502
mov dword [0x497bbc], 0x1e044b13
mov dword [0x497bc0], 0xd044b1f
mov dword [0x497bc4], 0x50a194b
mov word [0x497bc8], 0xe0c
mov byte [0x497bca], 0x6b
xor eax, eax
mov cl, byte [eax + 0x497bac]
xor cl, 0x6b
mov byte [eax + 0x498324], cl
inc eax
cmp eax, 0x1f
jb 0x41de18
mov eax, 0x498324
ret

Function at 0x41de33
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498638], 1
jne 0x41de7f
or dword [0x498638], 1
mov dword [0x497bcc], 0x2e0c0e39
mov dword [0x497bd0], 0x20061e05
mov dword [0x497bd4], 0x132e120e
mov dword [0x497bd8], 0xd4b4243
mov dword [0x497bdc], 0xe07020a
mov dword [0x497be0], 0x6b4b510f
xor eax, eax
mov cl, byte [eax + 0x497bcc]
xor cl, 0x6b
mov byte [eax + 0x498344], cl
inc eax
cmp eax, 0x18
jb 0x41de81
mov eax, 0x498344
ret

Function at 0x41dfe4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498634], 1
jne 0x41e019
or dword [0x498634], 1
mov dword [0x497be4], 0x7071e25
mov dword [0x497be8], 0x504084b
mov dword [0x497bec], 0x1f130e1f
mov byte [0x497bf0], 0x6b
xor eax, eax
mov cl, byte [eax + 0x497be4]
xor cl, 0x6b
mov byte [eax + 0x49835c], cl
inc eax
cmp eax, 0xd
jb 0x41e01b
mov eax, 0x49835c
ret
Function at 0x41e036
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498630], 1
jne 0x41e082
or dword [0x498630], 1
mov dword [0x497bf4], 0x240c0e39
mov dword [0x497bf8], 0x20050e1b
mov dword [0x497bfc], 0x132e120e
mov dword [0x497c00], 0xd4b4243
mov dword [0x497c04], 0xe07020a
mov dword [0x497c08], 0x6b4b510f
xor eax, eax
mov cl, byte [eax + 0x497bf4]
xor cl, 0x6b
mov byte [eax + 0x49836c], cl
inc eax
cmp eax, 0x18
jb 0x41e084
mov eax, 0x49836c
ret

Function at 0x41e09f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x49862c], 1
jne 0x41e0fb
or dword [0x49862c], 1
mov dword [0x497c0c], 0x3a0c0e39
mov dword [0x497c10], 0x12190e1e
mov dword [0x497c14], 0x40d0522
mov dword [0x497c18], 0x43120e20
mov dword [0x497c1c], 0xa0d4b42
mov dword [0x497c20], 0xf0e0702
mov word [0x497c24], 0x4b51
mov byte [0x497c26], 0x6b
xor eax, eax
mov cl, byte [eax + 0x497c0c]
xor cl, 0x6b
mov byte [eax + 0x498384], cl
inc eax
cmp eax, 0x1b
jb 0x41e0fd
mov eax, 0x498384
ret

Function at 0x41e1ee
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498628], 1
jne 0x41e254
or dword [0x498628], 1
mov dword [0x497c28], 0x61e052e
mov dword [0x497c2c], 0x1f0a190e
mov dword [0x497c30], 0x4b050402
mov dword [0x497c34], 0xe0f0502
mov dword [0x497c38], 0x1e044b13
mov dword [0x497c3c], 0xd044b1f
mov dword [0x497c40], 0x50a194b
mov word [0x497c44], 0xe0c
mov byte [0x497c46], 0x6b
xor eax, eax
mov cl, byte [eax + 0x497c28]
xor cl, 0x6b
mov byte [eax + 0x4983a0], cl
inc eax
cmp eax, 0x1f
jb 0x41e256
mov eax, 0x4983a0
ret

Function at 0x41e271
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498624], 1
jne 0x41e2cd
or dword [0x498624], 1
mov dword [0x497c48], 0x3a0c0e39
mov dword [0x497c4c], 0x12190e1e
mov dword [0x497c50], 0x40d0522
mov dword [0x497c54], 0x43120e20
mov dword [0x497c58], 0xa0d4b42
mov dword [0x497c5c], 0xf0e0702
mov word [0x497c60], 0x4b51
mov byte [0x497c62], 0x6b
xor eax, eax
mov cl, byte [eax + 0x497c48]
xor cl, 0x6b
mov byte [eax + 0x4983c0], cl
inc eax
cmp eax, 0x1b
jb 0x41e2cf
mov eax, 0x4983c0
ret

Function at 0x41e42f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498620], 1
jne 0x41e464
or dword [0x498620], 1
mov dword [0x497c64], 0x7071e25
mov dword [0x497c68], 0x504084b
mov dword [0x497c6c], 0x1f130e1f
mov byte [0x497c70], 0x6b
xor eax, eax
mov cl, byte [eax + 0x497c64]
xor cl, 0x6b
mov byte [eax + 0x4983dc], cl
inc eax
cmp eax, 0xd
jb 0x41e466
mov eax, 0x4983dc
ret

Function at 0x41e481
Capabilities:
Encode data using xor

Disassembly:
test byte [0x49861c], 1
jne 0x41e4cd
or dword [0x49861c], 1
mov dword [0x497c74], 0x240c0e39
mov dword [0x497c78], 0x20050e1b
mov dword [0x497c7c], 0x132e120e
mov dword [0x497c80], 0xd4b4243
mov dword [0x497c84], 0xe07020a
mov dword [0x497c88], 0x6b4b510f
xor eax, eax
mov cl, byte [eax + 0x497c74]
xor cl, 0x6b
mov byte [eax + 0x4983ec], cl
inc eax
cmp eax, 0x18
jb 0x41e4cf
mov eax, 0x4983ec
ret
Function at 0x41e4ea
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498618], 1
jne 0x41e546
or dword [0x498618], 1
mov dword [0x497c8c], 0x3a0c0e39
mov dword [0x497c90], 0x12190e1e
mov dword [0x497c94], 0x40d0522
mov dword [0x497c98], 0x43120e20
mov dword [0x497c9c], 0xa0d4b42
mov dword [0x497ca0], 0xf0e0702
mov word [0x497ca4], 0x4b51
mov byte [0x497ca6], 0x6b
xor eax, eax
mov cl, byte [eax + 0x497c8c]
xor cl, 0x6b
mov byte [eax + 0x498404], cl
inc eax
cmp eax, 0x1b
jb 0x41e548
mov eax, 0x498404
ret

Function at 0x41e7f4
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498614], 1
mov ecx, 0xd46b
jne 0x41e860
or dword [0x498614], 1
lea eax, [ecx - 0x28]
mov word [0x497ca8], ax
add eax, 0xffffffec
mov word [0x497caa], ax
lea eax, [ecx - 0x5d]
mov word [0x497cac], ax
dec eax
mov word [0x497cae], ax
lea eax, [ecx - 0x61]
mov word [0x497cb0], ax
add eax, 0x14
mov word [0x497cb2], ax
lea eax, [ecx - 0x64]
mov word [0x497cb4], ax
add eax, 0x18
mov word [0x497cb6], ax
lea eax, [ecx - 0x29]
mov word [0x497cb8], ax
mov eax, ecx
mov word [0x497cba], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x497ca8]
add eax, 2
mov word [eax + 0x49841e], dx
cmp eax, 0x14
jb 0x41e862
mov eax, 0x498420
ret

Function at 0x41e880
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498610], 1
mov ecx, 0xd46b
jne 0x41e8ec
or dword [0x498610], 1
lea eax, [ecx - 0x28]
mov word [0x497cbc], ax
add eax, 0xffffffcc
mov word [0x497cbe], ax
lea eax, [ecx - 0x5d]
mov word [0x497cc0], ax
dec eax
mov word [0x497cc2], ax
lea eax, [ecx - 0x61]
mov word [0x497cc4], ax
add eax, 0x14
mov word [0x497cc6], ax
lea eax, [ecx - 0x64]
mov word [0x497cc8], ax
add eax, 0x18
mov word [0x497cca], ax
lea eax, [ecx - 0x29]
mov word [0x497ccc], ax
mov eax, ecx
mov word [0x497cce], ax
xor eax, eax
mov edx, ecx
xor dx, word [eax + 0x497cbc]
add eax, 2
mov word [eax + 0x498432], dx
cmp eax, 0x14
jb 0x41e8ee
mov eax, 0x498434
ret

Function at 0x41e90c
Capabilities:
Encode data using xor

Disassembly:
test byte [0x49860c], 1
jne 0x41e958
or dword [0x49860c], 1
mov dword [0x497cd0], 0x240c0e39
mov dword [0x497cd4], 0x20050e1b
mov dword [0x497cd8], 0x132e120e
mov dword [0x497cdc], 0xd4b4243
mov dword [0x497ce0], 0xe07020a
mov dword [0x497ce4], 0x6b4b510f
xor eax, eax
mov cl, byte [eax + 0x497cd0]
xor cl, 0x6b
mov byte [eax + 0x498448], cl
inc eax
cmp eax, 0x18
jb 0x41e95a
mov eax, 0x498448
ret

Function at 0x41e975
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498608], 1
jne 0x41e9d1
or dword [0x498608], 1
mov dword [0x497ce8], 0x3a0c0e39
mov dword [0x497cec], 0x12190e1e
mov dword [0x497cf0], 0x1e070a3d
mov dword [0x497cf4], 0x43132e0e
mov dword [0x497cf8], 0xa0d4b42
mov dword [0x497cfc], 0xf0e0702
mov word [0x497d00], 0x4b51
mov byte [0x497d02], 0x6b
xor eax, eax
mov cl, byte [eax + 0x497ce8]
xor cl, 0x6b
mov byte [eax + 0x498460], cl
inc eax
cmp eax, 0x1b
jb 0x41e9d3
mov eax, 0x498460
ret
Function at 0x41e9ee
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498604], 1
jne 0x41ea4a
or dword [0x498604], 1
mov dword [0x497d04], 0x3a0c0e39
mov dword [0x497d08], 0x12190e1e
mov dword [0x497d0c], 0x1e070a3d
mov dword [0x497d10], 0x43132e0e
mov dword [0x497d14], 0xa0d4b42
mov dword [0x497d18], 0xf0e0702
mov word [0x497d1c], 0x4b51
mov byte [0x497d1e], 0x6b
xor eax, eax
mov cl, byte [eax + 0x497d04]
xor cl, 0x6b
mov byte [eax + 0x49847c], cl
inc eax
cmp eax, 0x1b
jb 0x41ea4c
mov eax, 0x49847c
ret

Function at 0x41ebc6
Capabilities:
Encode data using xor

Disassembly:
test byte [0x498600], 1
jne 0x41ec12
or dword [0x498600], 1
mov dword [0x497d20], 0x240c0e39
mov dword [0x497d24], 0x20050e1b
mov dword [0x497d28], 0x132e120e
mov dword [0x497d2c], 0xd4b4243
mov dword [0x497d30], 0xe07020a
mov dword [0x497d34], 0x6b4b510f
xor eax, eax
mov cl, byte [eax + 0x497d20]
xor cl, 0x6b
mov byte [eax + 0x498498], cl
inc eax
cmp eax, 0x18
jb 0x41ec14
mov eax, 0x498498
ret

Function at 0x41ec2f
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4985fc], 1
jne 0x41ec95
or dword [0x4985fc], 1
mov dword [0x497d38], 0x380c0e39
mov dword [0x497d3c], 0xa3d1f0e
mov dword [0x497d40], 0x2e0e1e07
mov dword [0x497d44], 0x1f184313
mov dword [0x497d48], 0xc050219
mov dword [0x497d4c], 0xa0d4b42
mov dword [0x497d50], 0xf0e0702
mov word [0x497d54], 0x4b51
mov byte [0x497d56], 0x6b
xor eax, eax
mov cl, byte [eax + 0x497d38]
xor cl, 0x6b
mov byte [eax + 0x4984b0], cl
inc eax
cmp eax, 0x1f
jb 0x41ec97
mov eax, 0x4984b0
ret

Function at 0x41ee01
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4985f8], 1
jne 0x41ee4d
or dword [0x4985f8], 1
mov dword [0x497d58], 0x240c0e39
mov dword [0x497d5c], 0x20050e1b
mov dword [0x497d60], 0x132e120e
mov dword [0x497d64], 0xd4b4243
mov dword [0x497d68], 0xe07020a
mov dword [0x497d6c], 0x6b4b510f
xor eax, eax
mov cl, byte [eax + 0x497d58]
xor cl, 0x6b
mov byte [eax + 0x4984d0], cl
inc eax
cmp eax, 0x18
jb 0x41ee4f
mov eax, 0x4984d0
ret

Function at 0x41ee6a
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4985f4], 1
jne 0x41eec9
or dword [0x4985f4], 1
mov dword [0x497d70], 0x380c0e39
mov dword [0x497d74], 0xa3d1f0e
mov dword [0x497d78], 0x2e0e1e07
mov dword [0x497d7c], 0x1c0f4313
mov dword [0x497d80], 0x420f1904
mov dword [0x497d84], 0x20a0d4b
mov dword [0x497d88], 0x510f0e07
mov word [0x497d8c], 0x6b4b
xor eax, eax
mov cl, byte [eax + 0x497d70]
xor cl, 0x6b
mov byte [eax + 0x4984e8], cl
inc eax
cmp eax, 0x1e
jb 0x41eecb
mov eax, 0x4984e8
ret

Function at 0x41f036
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4985f0], 1
jne 0x41f0b2
or dword [0x4985f0], 1
mov dword [0x497d90], 0x1f181e26
mov dword [0x497d94], 0xe1b184b
mov dword [0x497d98], 0x120d0208
mov dword [0x497d9c], 0x54b0a4b
mov dword [0x497da0], 0xe460504
mov dword [0x497da4], 0x121f1b06
mov dword [0x497da8], 0x91e184b
mov dword [0x497dac], 0x4b120e00
mov dword [0x497db0], 0x2191f18
mov word [0x497db4], 0xc05
mov byte [0x497db6], 0x6b
mov cl, byte [eax + 0x497d90]
xor cl, 0x6b
mov byte [eax + 0x498508], cl
inc eax
cmp eax, 0x27
jb 0x41f0b2
mov eax, 0x498508
ret
Function at 0x41f0cd
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4985ec], 1
jne 0x41f119
or dword [0x4985ec], 1
mov dword [0x497db8], 0x240c0e39
mov dword [0x497dbc], 0x20050e1b
mov dword [0x497dc0], 0x132e120e
mov dword [0x497dc4], 0xd4b4243
mov dword [0x497dc8], 0xe07020a
mov dword [0x497dcc], 0x6b4b510f
xor eax, eax
mov cl, byte [eax + 0x497db8]
xor cl, 0x6b
mov byte [eax + 0x498530], cl
inc eax
cmp eax, 0x18
jb 0x41f11b
mov eax, 0x498530
ret

Function at 0x41f136
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4985e8], 1
jne 0x41f188
or dword [0x4985e8], 1
mov dword [0x497dd0], 0xe2f2338
mov dword [0x497dd4], 0xe1f0e07
mov dword [0x497dd8], 0x43120e20
mov dword [0x497ddc], 0xa0d4b42
mov dword [0x497de0], 0xf0e0702
mov word [0x497de4], 0x4b51
mov byte [0x497de6], 0x6b
xor eax, eax
mov cl, byte [eax + 0x497dd0]
xor cl, 0x6b
mov byte [eax + 0x498548], cl
inc eax
cmp eax, 0x17
jb 0x41f18a
mov eax, 0x498548
ret

Function at 0x41f2d7
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4985e4], 1
jne 0x41f323
or dword [0x4985e4], 1
mov dword [0x497de8], 0x240c0e39
mov dword [0x497dec], 0x20050e1b
mov dword [0x497df0], 0x132e120e
mov dword [0x497df4], 0xd4b4243
mov dword [0x497df8], 0xe07020a
mov dword [0x497dfc], 0x6b4b510f
xor eax, eax
mov cl, byte [eax + 0x497de8]
xor cl, 0x6b
mov byte [eax + 0x498560], cl
inc eax
cmp eax, 0x18
jb 0x41f325
mov eax, 0x498560
ret

Function at 0x41f340
Capabilities:
Encode data using xor

Disassembly:
test byte [0x4985e0], 1
jne 0x41f393
or dword [0x4985e0], 1
mov dword [0x497e00], 0xe2f2338
mov dword [0x497e04], 0xe1f0e07
mov dword [0x497e08], 0x1e070a3d
mov dword [0x497e0c], 0x4b42430e
mov dword [0x497e10], 0x7020a0d
mov dword [0x497e14], 0x4b510f0e
mov byte [0x497e18], 0x6b
xor eax, eax
mov cl, byte [eax + 0x497e00]
xor cl, 0x6b
mov byte [eax + 0x498578], cl
inc eax
cmp eax, 0x19
jb 0x41f395
mov eax, 0x498578
ret

Function at 0x41f66c
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test byte [0x4985dc], 1
jne 0x41f729
or dword [0x4985dc], 1
mov dword [0x497e20], 0x2f28292a
mov dword [0x497e24], 0x232c2d2e
mov dword [0x497e28], 0x27202122
mov dword [0x497e2c], 0x3b242526
mov dword [0x497e30], 0x3f38393a
mov dword [0x497e34], 0x333c3d3e
mov dword [0x497e38], 0x90a3132
mov dword [0x497e3c], 0xd0e0f08
mov dword [0x497e40], 0x102030c
mov dword [0x497e44], 0x5060700
mov dword [0x497e48], 0x191a1b04
mov dword [0x497e4c], 0x1d1e1f18
mov dword [0x497e50], 0x1112131c
mov dword [0x497e54], 0x58595a5b
mov dword [0x497e58], 0x5c5d5e5f
mov dword [0x497e5c], 0x44405253
mov byte [0x497e60], 0x6b
mov cl, byte [eax + 0x497e20]
xor cl, 0x6b
mov byte [eax + 0x498598], cl
inc eax
cmp eax, 0x41
jb 0x41f729
mov eax, 0x498598
ret
Function at 0x41f7d4
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, eax
xor edx, edx
push 3
lea eax, [ecx + 2]
pop ebx
div ebx
mov esi, dword [ebp + 0x10]
shl eax, 2
inc eax
cmp dword [esi], eax
jae 0x41f7fe
mov dword [esi], eax
xor al, al
jmp 0x41f8d6
mov eax, ecx
xor edx, edx
push 3
pop ecx
div ecx
mov esi, dword [ebp + 0xc]
mov ecx, dword [0x4929b8]
xor edx, edx
imul eax, eax, 3
test eax, eax
je 0x41f87a
dec eax
push 3
pop ebx
div ebx
inc eax
mov edx, eax
mov dword [ebp - 4], eax
imul edx, edx, 3
movzx eax, byte [edi]
shr eax, 2
mov al, byte [eax + ecx]
mov byte [esi], al
movzx eax, byte [edi + 1]
movzx ebx, byte [edi]
shr eax, 4
shl ebx, 4
add eax, ebx
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 1], al
movzx eax, byte [edi + 2]
movzx ebx, byte [edi + 1]
shr eax, 6
lea eax, [eax + ebx*4]
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 2], al
movzx eax, byte [edi + 2]
and eax, 0x3f
mov al, byte [eax + ecx]
mov byte [esi + 3], al
add esi, 4
add edi, 3
dec dword [ebp - 4]
jne 0x41f828
cmp edx, dword [ebp + 8]
jae 0x41f8c9
movzx eax, byte [edi]
inc edx
cmp edx, dword [ebp + 8]
jae 0x41f88e
movzx edi, byte [edi + 1]
jmp 0x41f890
xor edi, edi
mov ebx, eax
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + ecx]
mov byte [esi], bl
mov ebx, edi
shr ebx, 4
shl eax, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + ecx]
mov byte [esi + 1], al
cmp edx, dword [ebp + 8]
jae 0x41f8bd
and edi, 0xf
mov cl, byte [ecx + edi*4]
jmp 0x41f8bf
mov cl, 0x3d
mov byte [esi + 2], cl
mov byte [esi + 3], 0x3d
add esi, 4
mov eax, dword [ebp + 0x10]
mov byte [esi], 0
sub esi, dword [ebp + 0xc]
mov dword [eax], esi
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x421620
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor eax, eax
pop ebp
ret

Function at 0x421710
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x1c]
mov edx, 0x40
cmp eax, edx
jb 0x421729
lea eax, [edx - 0x30]
pop esi
pop ebp
ret
lea ecx, [eax*8]
add dword [esi], ecx
push ebx
mov ebx, 0
adc dword [esi + 4], ebx
push edi
mov byte [eax + esi + 0x20], 0x80
mov edi, 1
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
mov ecx, 0x38
cmp eax, ecx
jbe 0x421782
cmp eax, edx
jae 0x42176e
lea esp, [esp]
mov byte [eax + esi + 0x20], bl
add dword [esi + 0x1c], edi
mov eax, dword [esi + 0x1c]
cmp eax, edx
jb 0x421760
lea edx, [esi + 0x20]
push esi
call fcn.00421120
add esp, 4
mov dword [esi + 0x1c], ebx
mov ecx, 0x38
cmp dword [esi + 0x1c], ecx
jae 0x42179f
jmp 0x421790
mov edx, dword [esi + 0x1c]
mov byte [esi + edx + 0x20], bl
add dword [esi + 0x1c], edi
cmp dword [esi + 0x1c], ecx
jb 0x421790
movzx eax, byte [esi + 7]
movzx ecx, byte [esi + 6]
movzx edx, byte [esi + 5]
mov byte [esi + 0x58], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x59], cl
movzx ecx, byte [esi + 3]
mov byte [esi + 0x5a], dl
movzx edx, byte [esi + 2]
mov byte [esi + 0x5b], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x5c], cl
movzx ecx, byte [esi]
mov byte [esi + 0x5d], dl
lea edx, [esi + 0x20]
push esi
mov byte [esi + 0x5e], al
mov byte [esi + 0x5f], cl
call fcn.00421120
movzx edx, byte [esi + 0xb]
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
movzx ecx, byte [esi + 0xa]
mov byte [eax + 1], cl
movzx edx, byte [esi + 9]
mov byte [eax + 2], dl
movzx ecx, byte [esi + 8]
mov byte [eax + 3], cl
movzx edx, byte [esi + 0xf]
mov byte [eax + 4], dl
movzx ecx, byte [esi + 0xe]
mov byte [eax + 5], cl
movzx edx, byte [esi + 0xd]
mov byte [eax + 6], dl
movzx ecx, byte [esi + 0xc]
mov byte [eax + 7], cl
movzx edx, byte [esi + 0x13]
mov byte [eax + 8], dl
movzx ecx, byte [esi + 0x12]
mov byte [eax + 9], cl
movzx edx, byte [esi + 0x11]
mov byte [eax + 0xa], dl
movzx ecx, byte [esi + 0x10]
mov byte [eax + 0xb], cl
movzx edx, byte [esi + 0x17]
mov byte [eax + 0xc], dl
movzx ecx, byte [esi + 0x16]
mov byte [eax + 0xd], cl
movzx edx, byte [esi + 0x15]
mov byte [eax + 0xe], dl
movzx ecx, byte [esi + 0x14]
mov byte [eax + 0xf], cl
movzx edx, byte [esi + 0x1b]
mov byte [eax + 0x10], dl
movzx ecx, byte [esi + 0x1a]
mov byte [eax + 0x11], cl
movzx edx, byte [esi + 0x19]
add esp, 4
mov byte [eax + 0x12], dl
movzx ecx, byte [esi + 0x18]
pop edi
pop ebx
mov byte [eax + 0x13], cl
xor eax, eax
pop esi
pop ebp
ret
Function at 0x421eb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x23c], 0
jne 0x422004
mov eax, dword [esi + 0x240]
cmp eax, 0x10
jge 0x422004
test eax, eax
js 0x422004
mov eax, dword [esi + 0x234]
push eax
call fcn.00425ec0
add esp, 4
test eax, eax
jne 0x422009
mov ecx, dword [esi + 0x240]
mov eax, dword [ebp + 0x10]
lea edx, [ecx + eax]
cmp edx, 0xc
jbe 0x421f0a
or dword [esi + 0x238], 1
push ebx
push edi
xor edi, edi
test ecx, ecx
jne 0x421f65
mov ecx, eax
and ecx, 0xfffffff0
mov dword [ebp + 8], ecx
jbe 0x421f5e
lea ebx, [esi + 0x1f4]
xor eax, eax
mov edx, dword [ebp + 0xc]
lea ecx, [eax + edi]
mov ecx, dword [ecx + edx]
xor dword [ebx + eax], ecx
add eax, 4
cmp eax, 0x10
jb 0x421f24
push ebx
push esi
call fcn.00425e30
add esp, 8
add dword [esi + 0x248], 0x80
adc dword [esi + 0x24c], 0
add edi, 0x10
cmp edi, dword [ebp + 8]
jb 0x421f22
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
add ebx, edi
jmp 0x421f68
mov ebx, dword [ebp + 0xc]
cmp edi, eax
jae 0x421ffd
sub eax, edi
mov dword [ebp + 8], eax
mov ecx, 1
lea ebx, [ebx]
mov al, byte [ebx]
mov edx, dword [esi + 0x240]
mov byte [esi + edx + 0x224], al
add dword [esi + 0x240], ecx
add ebx, ecx
cmp dword [esi + 0x240], 0x10
jne 0x421ff3
lea edi, [esi + 0x1f4]
mov eax, edi
mov ecx, 4
lea ecx, [ecx]
movzx edx, byte [eax + 0x30]
xor byte [eax], dl
movzx edx, byte [eax + 0x31]
xor byte [eax + 1], dl
movzx edx, byte [eax + 0x32]
xor byte [eax + 2], dl
movzx edx, byte [eax + 0x33]
xor byte [eax + 3], dl
add eax, 4
dec ecx
jne 0x421fb0
push edi
push esi
call fcn.00425e30
xor eax, eax
add esp, 8
add dword [esi + 0x248], 0x80
mov dword [esi + 0x240], eax
adc dword [esi + 0x24c], eax
mov ecx, 1
sub dword [ebp + 8], ecx
jne 0x421f80
pop edi
pop ebx
xor eax, eax
pop esi
pop ebp
ret
mov eax, 0x10
pop esi
pop ebp
ret
Function at 0x425350
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret