joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a950
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b8
mov eax, dword [0x51df40]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x520c0c], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
jne 0x48a9ab
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x48a9a1
pop edi
pop esi
mov eax, 0xffffffbe
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
mov dword [0x520c0c], 1
mov ecx, dword [ebp + 0x14]
mov edx, 0x11
xorps xmm0, xmm0
mov dword [ebp - 0x1b8], 0
movlpd qword [ebp - 0x1a8], xmm0
movlpd qword [ebp - 0x1a0], xmm0
lea eax, [ecx - 1]
mov dword [ebp - 0x1b4], 0
neg eax
sbb eax, eax
add eax, 2
cmp ecx, 1
mov dword [ebp - 0x1b0], eax
mov eax, 6
cmove eax, edx
mov dword [ebp - 0x1ac], eax
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x1b8]
push eax
push edi
push esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
je 0x48aa2b
pop edi
pop esi
mov eax, 0xffffffae
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x198]
mov edi, 0xffffffae
test esi, esi
je 0x48aa85
nop word [eax + eax]
push dword [esi + 0xc]
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx], eax
test eax, eax
jns 0x48aa5c
mov edi, 0xffffffbe
jmp 0x48aa7a
push dword [esi + 0x10]
push dword [esi + 0x18]
push eax
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x48aa83
push dword [ebx]
call dword [sym.imp.WS2_32.dll_closesocket]
mov edi, 0xffffffbc
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x48aa40
jmp 0x48aa85
xor edi, edi
push dword [ebp - 0x198]
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
Function at 0x496d10
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x51df40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov edx, 1
nop dword [eax]
mov al, dl
mov dword [ebp + esi*4 - 0x804], edx
add al, al
mov dword [ebp + edx*4 - 0x404], esi
movzx ecx, al
movzx eax, dl
and dl, 0x80
xor ecx, eax
movzx eax, dl
neg eax
sbb eax, eax
inc esi
and eax, 0x1b
xor ecx, eax
mov edx, ecx
cmp esi, 0x100
jl 0x496d30
mov edx, 1
mov esi, 0x5230b0
nop
mov eax, edx
mov dword [esi], edx
and al, 0x80
movzx ecx, al
neg ecx
sbb ecx, ecx
add dl, dl
and ecx, 0x1b
movzx edx, dl
add esi, 4
xor edx, ecx
cmp esi, 0x5230d8
jl 0x496d70
mov ecx, 1
mov byte [0x520eb0], 0x63
mov byte [0x522013], 0
mov dword [ebp - 0x808], ecx
nop dword [eax + eax]
mov ecx, dword [ebp + ecx*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx ecx, cl
mov al, cl
xor ebx, ecx
add al, al
shr ecx, 7
movzx edx, al
or edx, ecx
xor ebx, edx
mov al, dl
add al, al
mov dword [ebp - 0x80c], ebx
movzx ebx, al
shr edx, 7
or ebx, edx
mov al, bl
add al, al
movzx ecx, al
mov eax, ebx
shr eax, 7
or ecx, eax
mov eax, dword [ebp - 0x80c]
xor ecx, 0x63
xor ecx, ebx
xor eax, ecx
mov ecx, dword [ebp - 0x808]
mov byte [ecx + 0x520eb0], al
mov byte [eax + 0x521fb0], cl
inc ecx
mov dword [ebp - 0x808], ecx
cmp ecx, 0x100
jl 0x496db0
xor edi, edi
mov dword [ebp - 0x808], 0xff
nop dword [eax + eax]
mov cl, byte [edi + 0x520eb0]
movzx esi, cl
mov eax, esi
movzx ebx, byte [edi + 0x521fb0]
and al, 0x80
mov dword [ebp - 0x80c], ebx
movzx edx, al
neg edx
sbb edx, edx
add cl, cl
and edx, 0x1b
movzx eax, cl
xor edx, eax
mov eax, edx
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, esi
shl eax, 8
xor eax, edx
mov dword [edi*4 + 0x520fb0], eax
rol eax, 8
mov dword [edi*4 + 0x5213b0], eax
rol eax, 8
mov dword [edi*4 + 0x5217b0], eax
rol eax, 8
mov dword [edi*4 + 0x521bb0], eax
test ebx, ebx
je 0x496f19
mov eax, dword [ebp + ebx*4 - 0x404]
mov esi, 0xff
add eax, dword [ebp - 0x3d8]
cdq
idiv esi
mov eax, dword [ebp + ebx*4 - 0x404]
add eax, dword [ebp - 0x3d0]
mov ecx, dword [ebp + edx*4 - 0x804]
cdq
idiv esi
mov eax, dword [ebp + ebx*4 - 0x404]
mov ebx, 0xff
add eax, dword [ebp - 0x3e0]
mov esi, dword [ebp + edx*4 - 0x804]
cdq
idiv ebx
mov eax, dword [ebp - 0x80c]
mov eax, dword [ebp + eax*4 - 0x404]
add eax, dword [ebp - 0x3cc]
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv dword [ebp - 0x808]
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x496f21
xor ecx, ecx
xor esi, esi
xor ebx, ebx
xor eax, eax
shl ecx, 8
xor ecx, esi
shl ecx, 8
xor ecx, ebx
shl ecx, 8
xor ecx, eax
mov dword [edi*4 + 0x5220b0], ecx
rol ecx, 8
mov dword [edi*4 + 0x5224b0], ecx
rol ecx, 8
mov dword [edi*4 + 0x5228b0], ecx
rol ecx, 8
mov dword [edi*4 + 0x522cb0], ecx
inc edi
cmp edi, 0x100
jl 0x496e40
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
Function at 0x497780
Capabilities:
Encode data using add xor sub operations

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x51df40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x11c]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x118
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push dword [ebp + 0x10]
lea eax, [ebp - 0x11c]
mov dword [ebx + 4], 0
push esi
push eax
lea edi, [ebx + 8]
call fcn.004979a0
add esp, 0x18
mov dword [ebp - 0x120], eax
test eax, eax
jne 0x49796f
mov edx, dword [ebp - 0x11c]
lea eax, [ebp - 0x114]
mov ecx, dword [ebp - 0x118]
mov dword [ebx], edx
lea ecx, [ecx + edx*4]
lea ecx, [eax + ecx*4]
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
sub ecx, 0x10
mov dword [edi + 0xc], eax
add edi, 0x10
mov esi, dword [ebx]
dec esi
test esi, esi
jle 0x497959
nop dword [eax + eax]
movzx eax, byte [ecx + 3]
dec esi
movzx edx, byte [eax + 0x520eb0]
movzx eax, byte [ecx + 2]
mov edx, dword [edx*4 + 0x522cb0]
movzx eax, byte [eax + 0x520eb0]
xor edx, dword [eax*4 + 0x5228b0]
movzx eax, byte [ecx + 1]
movzx eax, byte [eax + 0x520eb0]
xor edx, dword [eax*4 + 0x5224b0]
movzx eax, byte [ecx]
movzx eax, byte [eax + 0x520eb0]
xor edx, dword [eax*4 + 0x5220b0]
mov dword [edi], edx
movzx eax, byte [ecx + 7]
movzx edx, byte [eax + 0x520eb0]
movzx eax, byte [ecx + 6]
mov edx, dword [edx*4 + 0x522cb0]
movzx eax, byte [eax + 0x520eb0]
xor edx, dword [eax*4 + 0x5228b0]
movzx eax, byte [ecx + 5]
movzx eax, byte [eax + 0x520eb0]
xor edx, dword [eax*4 + 0x5224b0]
movzx eax, byte [ecx + 4]
movzx eax, byte [eax + 0x520eb0]
xor edx, dword [eax*4 + 0x5220b0]
mov dword [edi + 4], edx
movzx eax, byte [ecx + 0xb]
movzx edx, byte [eax + 0x520eb0]
movzx eax, byte [ecx + 0xa]
mov edx, dword [edx*4 + 0x522cb0]
movzx eax, byte [eax + 0x520eb0]
xor edx, dword [eax*4 + 0x5228b0]
movzx eax, byte [ecx + 9]
movzx eax, byte [eax + 0x520eb0]
xor edx, dword [eax*4 + 0x5224b0]
movzx eax, byte [ecx + 8]
movzx eax, byte [eax + 0x520eb0]
xor edx, dword [eax*4 + 0x5220b0]
mov dword [edi + 8], edx
movzx eax, byte [ecx + 0xf]
movzx edx, byte [eax + 0x520eb0]
movzx eax, byte [ecx + 0xe]
mov edx, dword [edx*4 + 0x522cb0]
movzx eax, byte [eax + 0x520eb0]
xor edx, dword [eax*4 + 0x5228b0]
movzx eax, byte [ecx + 0xd]
movzx eax, byte [eax + 0x520eb0]
xor edx, dword [eax*4 + 0x5224b0]
movzx eax, byte [ecx + 0xc]
sub ecx, 0x10
movzx eax, byte [eax + 0x520eb0]
xor edx, dword [eax*4 + 0x5220b0]
mov dword [edi + 0xc], edx
add edi, 0x10
test esi, esi
jg 0x497820
mov eax, dword [ecx]
mov dword [edi], eax
mov eax, dword [ecx + 4]
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
mov eax, dword [ecx + 0xc]
mov dword [edi + 0xc], eax
lea eax, [ebp - 0x11c]
push 0x118
push eax
call fcn.004a0f10
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, dword [ebp - 0x120]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
Function at 0x49a570
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x18]
sub esp, 0xc
test ecx, ecx
jne 0x49a588
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, 0xaaaaaaab
mul ecx
xor eax, eax
shr edx, 1
push edi
lea edi, [edx + edx*2]
cmp ecx, edi
setne al
add eax, edx
cmp eax, 0x3fffffff
jbe 0x49a5b8
mov eax, dword [ebp + 0x10]
pop edi
mov dword [eax], 0xffffffff
mov eax, 0xffffffd6
mov esp, ebp
pop ebp
ret
lea edx, [eax*4 + 1]
cmp dword [ebp + 0xc], edx
jb 0x49a6fb
mov eax, dword [ebp + 8]
test eax, eax
je 0x49a6fb
push ebx
xor edx, edx
push esi
mov esi, eax
test edi, edi
je 0x49a675
lea ecx, [edi - 1]
mov eax, 0xaaaaaaab
mov edi, dword [ebp + 0x14]
mul ecx
mov eax, edx
shr eax, 1
inc eax
mov dword [ebp - 8], eax
lea eax, [eax + eax*2]
mov dword [ebp - 0xc], eax
nop dword [eax]
mov al, byte [edi + 2]
mov bl, byte [edi]
mov bh, byte [edi + 1]
add edi, 3
mov byte [ebp - 1], al
mov al, bl
shr al, 2
movzx eax, al
push eax
call fcn.004a93a0
mov byte [esi], al
mov al, bh
shr al, 4
shl bl, 4
add bl, al
and bl, 0x3f
movzx eax, bl
push eax
call fcn.004a93a0
mov bl, byte [ebp - 1]
mov byte [esi + 1], al
mov al, bl
shr al, 6
shl bh, 2
add al, bh
and al, 0x3f
movzx eax, al
push eax
call fcn.004a93a0
mov byte [esi + 2], al
and bl, 0x3f
movzx eax, bl
push eax
call fcn.004a93a0
mov byte [esi + 3], al
add esp, 0x10
add esi, 4
sub dword [ebp - 8], 1
jne 0x49a600
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp - 0xc]
jmp 0x49a678
mov edi, dword [ebp + 0x14]
cmp edx, ecx
jae 0x49a6e5
mov al, byte [edi]
inc edx
mov byte [ebp - 1], al
mov dword [ebp - 0xc], edx
cmp edx, ecx
jae 0x49a68f
movzx ebx, byte [edi + 1]
jmp 0x49a691
xor ebx, ebx
shr al, 2
movzx eax, al
push eax
call fcn.004a93a0
mov cl, byte [ebp - 1]
mov byte [esi], al
mov eax, ebx
shr eax, 4
shl cl, 4
add al, cl
and al, 0x3f
movzx eax, al
push eax
call fcn.004a93a0
mov byte [esi + 1], al
add esp, 8
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x18]
jae 0x49a6d9
and bl, 0xf
shl bl, 2
movzx eax, bl
push eax
call fcn.004a93a0
add esp, 4
jmp 0x49a6db
mov al, 0x3d
mov byte [esi + 2], al
mov byte [esi + 3], 0x3d
add esi, 4
mov eax, dword [ebp + 0x10]
mov ecx, esi
sub ecx, dword [ebp + 8]
mov dword [eax], ecx
xor eax, eax
mov byte [esi], 0
pop esi
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
pop edi
mov dword [eax], edx
mov eax, 0xffffffd6
mov esp, ebp
pop ebp
ret
Function at 0x49f190
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x51df40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x320], edi
cmp ebx, 0x180
jbe 0x49f1d3
pop edi
pop esi
mov eax, 0xffffffc8
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
push 0x1a0
lea eax, [ebp - 0x204]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
lea eax, [ebp - 0x31c]
push eax
call fcn.00497760
mov eax, ebx
mov byte [ebp - 0x1f1], bl
shr eax, 0x18
mov byte [ebp - 0x1f4], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0x1f3], al
mov eax, ebx
shr eax, 8
push ebx
mov byte [ebp - 0x1f2], al
lea eax, [ebp - 0x1ec]
push esi
push eax
mov byte [ebp - 0x1ed], 0x30
call sub.VCRUNTIME140.dll_memcpy
lea esi, [ebx + 0x19]
mov byte [ebp + ebx - 0x1ec], 0x80
add esp, 0x1c
mov dword [ebp - 0x328], esi
xor eax, eax
mov byte [ebp + eax - 0x64], al
inc eax
cmp eax, 0x20
jl 0x49f244
push 0x100
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x31c]
push eax
call fcn.004979a0
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x49f36b
mov dword [ebp - 0x324], eax
lea ebx, [eax + 0x10]
nop dword [eax]
xorps xmm0, xmm0
mov edi, esi
movups xmmword [ebp - 0x14], xmm0
test esi, esi
je 0x49f2f4
lea esi, [ebp - 0x204]
lea eax, [ebp - 0x14]
sub esi, eax
xor eax, eax
nop word [eax + eax]
lea edx, [ebp - 0x14]
add edx, eax
inc eax
mov cl, byte [esi + edx]
xor byte [edx], cl
cmp eax, 0x10
jl 0x49f2a0
add esi, 0x10
mov eax, edi
cmp edi, 0x10
cmovae eax, ebx
sub edi, eax
lea eax, [ebp - 0x14]
push eax
push eax
lea eax, [ebp - 0x31c]
push 1
push eax
call fcn.00497270
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x49f365
lea ebx, [eax + 0x10]
test edi, edi
jne 0x49f298
movups xmm0, xmmword [ebp - 0x14]
mov eax, dword [ebp - 0x324]
mov esi, dword [ebp - 0x328]
inc byte [ebp - 0x201]
movups xmmword [ebp + eax - 0x44], xmm0
add eax, 0x10
mov dword [ebp - 0x324], eax
cmp eax, 0x30
jl 0x49f280
push 0x100
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x31c]
push eax
call fcn.004979a0
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x49f365
mov esi, dword [ebp - 0x320]
xor edi, edi
lea eax, [ebp - 0x24]
push eax
push eax
lea eax, [ebp - 0x31c]
push 1
push eax
call fcn.00497270
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x49f365
movups xmm0, xmmword [ebp - 0x24]
add edi, 0x10
movups xmmword [esi], xmm0
add esi, 0x10
cmp edi, 0x30
jl 0x49f337
mov edi, dword [ebp - 0x320]
lea eax, [ebp - 0x31c]
push eax
call fcn.00497740
lea eax, [ebp - 0x204]
push 0x1a0
push eax
call fcn.004a0f10
lea eax, [ebp - 0x44]
push 0x30
push eax
call fcn.004a0f10
lea eax, [ebp - 0x64]
push 0x20
push eax
call fcn.004a0f10
lea eax, [ebp - 0x14]
push 0x10
push eax
call fcn.004a0f10
add esp, 0x24
test ebx, ebx
je 0x49f3bb
push 0x30
push edi
call fcn.004a0f10
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
Function at 0x49f3d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x51df40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea esi, [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 0x30
mov eax, esi
mov dword [ebp - 0x3c], esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edx, dword [ebp - 0x38]
mov edi, 1
add esp, 0xc
xor ebx, ebx
sub edi, edx
lea ecx, [edx + 0x20]
lea eax, [edx + 0xf]
mov dword [ebp - 0x40], ecx
add byte [eax], 1
jne 0x49f420
dec eax
lea ecx, [edi + eax]
test ecx, ecx
jg 0x49f413
push esi
push edx
lea ecx, [edx + 0x20]
push 1
push ecx
call fcn.00497270
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x49f497
mov esi, dword [ebp - 0x3c]
add ebx, 0x10
mov edx, dword [ebp - 0x38]
add esi, 0x10
mov dword [ebp - 0x3c], esi
lea eax, [edx + 0xf]
cmp ebx, 0x30
jl 0x49f413
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0x34]
xor ecx, ecx
sub edx, eax
lea eax, [ebp - 0x34]
add eax, ecx
add ecx, 0x10
movups xmm0, xmmword [eax]
movups xmm1, xmmword [edx + eax]
pxor xmm1, xmm0
movups xmmword [eax], xmm1
cmp ecx, 0x30
jl 0x49f457
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x34]
push 0x100
push eax
push ecx
call fcn.004979a0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x49f497
mov eax, dword [ebp - 0x38]
movups xmm0, xmmword [ebp - 0x14]
movups xmmword [eax], xmm0
lea eax, [ebp - 0x34]
push 0x30
push eax
call fcn.004a0f10
mov ecx, dword [ebp - 4]
add esp, 8
mov eax, esi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004d3ed5
mov esp, ebp
pop ebp
ret
Function at 0x4a6a40
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x10
test ecx, ecx
je 0x4a6a5b
cmp ecx, 1
je 0x4a6a5b
mov eax, 0xffffff8c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
test ecx, ecx
push ebx
mov edx, 0x367cd507
mov dword [ebp - 4], 0xc1059ed8
push esi
mov dword [eax], 0
mov ebx, 0xa54ff53a
mov dword [eax + 4], 0
mov esi, 0x1f83d9ab
mov eax, 0xbb67ae85
mov ecx, 0x5be0cd19
cmovne eax, edx
mov edx, 0x3070dd17
mov dword [ebp - 8], eax
mov eax, 0x3c6ef372
cmovne eax, edx
mov edx, 0x9b05688c
mov dword [ebp - 0xc], eax
mov eax, 0xf70e5939
cmovne ebx, eax
mov eax, 0xffc00b31
push edi
mov edi, 0x510e527f
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp + 0xc]
cmovne edi, eax
mov eax, 0x64f98fa7
cmovne esi, eax
mov eax, 0x68581511
cmovne edx, eax
test ebx, ebx
mov ebx, dword [ebp + 8]
mov eax, 0xbefa4fa4
cmovne ecx, eax
mov eax, 0x6a09e667
cmovne eax, dword [ebp - 4]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp - 0x10]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], edi
mov dword [eax + 0x1c], edx
mov dword [eax + 0x20], esi
mov dword [eax + 0x24], ecx
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [eax + 0x68], ecx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4a83c0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x2c
test ecx, ecx
je 0x4a83db
cmp ecx, 1
je 0x4a83db
mov eax, 0xffffff8b
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov dword [eax + 0xc], 0
test ecx, ecx
jne 0x4a846a
mov edx, 0x137e2179
mov dword [ebp - 0x20], 0x2b3e6c1f
mov esi, 0x5be0cd19
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], esi
mov edi, 0xfb41bd6b
mov ebx, 0x1f83d9ab
mov dword [ebp - 0x24], 0x9b05688c
mov dword [ebp - 0x1c], 0x510e527f
mov ecx, 0xade682d1
mov dword [ebp - 0x14], 0x5f1d36f1
mov edx, 0xfe94f82b
mov dword [ebp - 0x18], 0xa54ff53a
mov esi, 0xf3bcc908
mov dword [ebp - 0x10], 0x3c6ef372
mov dword [ebp - 8], 0x84caa73b
mov dword [ebp - 0xc], 0xbb67ae85
mov dword [ebp - 4], 0x6a09e667
jmp 0x4a84d2
mov edx, 0xbefa4fa4
mov dword [ebp - 0x20], 0x68581511
mov esi, 0x47b5481d
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], esi
mov edi, 0x64f98fa7
mov ebx, 0xdb0c2e0d
mov dword [ebp - 0x24], 0x8eb44a87
mov ecx, 0xffc00b31
mov dword [ebp - 0x1c], 0x67332667
mov dword [ebp - 0x14], 0xf70e5939
mov edx, 0x3070dd17
mov dword [ebp - 0x18], 0x152fecd8
mov esi, 0xc1059ed8
mov dword [ebp - 0x10], 0x9159015a
mov dword [ebp - 8], 0x367cd507
mov dword [ebp - 0xc], 0x629a292a
mov dword [ebp - 4], 0xcbbb9d5d
mov dword [eax + 0x10], esi
mov esi, dword [ebp - 4]
mov dword [eax + 0x14], esi
mov esi, dword [ebp - 8]
mov dword [eax + 0x18], esi
mov esi, dword [ebp - 0xc]
mov dword [eax + 0x1c], esi
mov esi, dword [ebp - 0x2c]
mov dword [eax + 0x20], edx
mov edx, dword [ebp - 0x10]
mov dword [eax + 0x24], edx
mov edx, dword [ebp - 0x14]
mov dword [eax + 0x28], edx
mov edx, dword [ebp - 0x18]
mov dword [eax + 0x2c], edx
mov edx, dword [ebp - 0x28]
mov dword [eax + 0x30], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [eax + 0x34], ecx
mov ecx, dword [ebp - 0x20]
mov dword [eax + 0x38], ecx
mov ecx, dword [ebp - 0x24]
mov dword [eax + 0x3c], ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x40], edi
mov dword [eax + 0x44], ebx
mov dword [eax + 0x48], edx
mov dword [eax + 0x4c], esi
pop edi
pop esi
mov dword [eax + 0xd0], ecx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a9600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov byte [ebp - 1], 0
test esi, esi
je 0x4a9637
mov edx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
sub edi, edx
nop dword [eax]
mov al, byte [edi + edx]
lea edx, [edx + 1]
mov cl, byte [edx - 1]
xor cl, al
or cl, byte [ebp - 1]
mov byte [ebp - 1], cl
sub esi, 1
jne 0x4a9620
pop edi
movzx eax, byte [ebp - 1]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4a9cc0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx + 4]
cmp eax, dword [edi + 4]
je 0x4a9ce1
pop edi
mov eax, 0xfffffffc
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebx]
mov eax, dword [edi]
sar eax, 1
sar edx, 1
and eax, 1
and edx, 1
push esi
mov esi, dword [ebp + 0x10]
xor eax, edx
mov ecx, eax
mov dword [ebp - 0xc], edx
and ecx, edx
mov dword [ebp - 8], ecx
mov dword [esi], ecx
mov esi, dword [ebx + 4]
mov dword [ebp - 4], esi
test esi, esi
je 0x4a9db1
mov ecx, 1
sub ecx, edx
mov dword [ebp - 0x10], ecx
nop dword [eax]
mov ecx, dword [ebx + 8]
mov ebx, 1
sub ebx, eax
mov esi, dword [ecx + esi*4 - 4]
mov ecx, dword [edi + 8]
mov edi, dword [ebp - 4]
mov edi, dword [ecx + edi*4 - 4]
mov edx, edi
xor edx, esi
sub edi, esi
mov ecx, edx
and edx, esi
not ecx
and edi, ecx
mov ecx, dword [ebp + 0x10]
or edi, edx
mov edx, dword [ebp - 4]
shr edi, 0x1f
and ebx, edi
or eax, edi
and ebx, dword [ebp - 0xc]
or ebx, dword [ebp - 8]
mov dword [ecx], ebx
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx + 8]
mov esi, dword [ecx + edx*4 - 4]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 8]
mov edi, dword [ecx + edx*4 - 4]
mov edx, edi
xor edx, esi
sub edi, esi
mov ecx, edx
and edx, esi
mov esi, dword [ebp + 0x10]
not ecx
and edi, ecx
mov ecx, 1
sub ecx, eax
or edi, edx
and ecx, dword [ebp - 0x10]
shr edi, 0x1f
and ecx, edi
or eax, edi
mov edi, dword [ebp + 0xc]
or ecx, ebx
mov ebx, dword [ebp + 8]
mov dword [esi], ecx
mov esi, dword [ebp - 4]
sub esi, 1
mov dword [ebp - 8], ecx
mov dword [ebp - 4], esi
jne 0x4a9d20
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4aab00
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, 0x4f2ad0
mov edx, edi
test eax, eax
je 0x4aab81
cmp dword [0x4f2ad0], 0
je 0x4aab81
mov ebx, dword [eax + 4]
cmp dword [edx + 4], ebx
jne 0x4aab77
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [eax + 8]
sub esi, 4
jb 0x4aab42
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x4aab47
add edx, 4
add eax, 4
sub esi, 4
jae 0x4aab31
cmp esi, 0xfffffffc
je 0x4aab8b
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x4aab74
cmp esi, 0xfffffffd
je 0x4aab8b
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x4aab74
cmp esi, 0xfffffffe
je 0x4aab8b
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x4aab74
cmp esi, 0xffffffff
je 0x4aab8b
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x4aab8b
mov eax, dword [ebp + 8]
add edi, 0x14
mov edx, edi
cmp dword [edi], 0
jne 0x4aab20
pop edi
pop esi
mov eax, 0xffffffd2
pop ebx
pop ebp
ret
test edi, edi
je 0x4aab81
mov eax, dword [ebp + 0xc]
mov ecx, dword [edi + 0x10]
pop edi
pop esi
mov dword [eax], ecx
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x4aaca0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, 0x4f2980
mov edx, edi
test eax, eax
je 0x4aad21
cmp dword [0x4f2980], 0
je 0x4aad21
mov ebx, dword [eax + 4]
cmp dword [edx + 4], ebx
jne 0x4aad17
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [eax + 8]
sub esi, 4
jb 0x4aace2
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x4aace7
add edx, 4
add eax, 4
sub esi, 4
jae 0x4aacd1
cmp esi, 0xfffffffc
je 0x4aad28
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x4aad14
cmp esi, 0xfffffffd
je 0x4aad28
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x4aad14
cmp esi, 0xfffffffe
je 0x4aad28
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x4aad14
cmp esi, 0xffffffff
je 0x4aad28
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x4aad28
mov eax, dword [ebp + 8]
add edi, 0x18
mov edx, edi
cmp dword [edi], 0
jne 0x4aacc0
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret