joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5f4870
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x657dd8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, dword [esp + 0x34]
mov esi, ecx
push str.sendChangeCipherSpec
push edi
lea ecx, [esp + 0x10]
call fcn.004f0370
mov ecx, dword [esi + 0x3e0]
mov dword [esp + 0x1c], 0
test ecx, ecx
mov byte [esp + 0x34], 1
jne 0x5f48e8
mov eax, dword [edi]
push str.No_current_output_security_params.
mov ecx, edi
call dword [eax + 0x14]
lea ecx, [esp + 8]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004f03e0
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 0x14
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x5f48fc
cmp eax, 0xbb8
jae 0x5f48fc
mov eax, 0xbb8
mov edx, dword [esp + 0x30]
push ebx
push edi
push edx
mov edx, dword [esi + 0x44]
push eax
mov eax, dword [esp + 0x34]
push eax
mov eax, dword [esi + 0x40]
push edx
push eax
push 0x14
lea edx, [esp + 0x54]
push 1
push edx
call fcn.005f4240
lea ecx, [esp + 0xc]
mov bl, al
mov dword [esp + 0x20], 0xffffffff
call fcn.004f03e0
mov ecx, dword [esp + 0x18]
mov al, bl
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 0x14

Function at 0x5f4ce0
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x657e70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
push edi
push esi
lea ecx, [esp + 0x20]
call fcn.004eea40
mov edi, dword [esp + 0x44]
push str.sendCloseNotify
push edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], 0
call fcn.004f0370
mov ebp, dword [esp + 0x38]
push edi
push 1
mov ecx, ebp
mov byte [esp + 0x38], 1
call fcn.006224d0
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
push edi
push eax
push ecx
push ebp
push 0
push 1
mov ecx, esi
call fcn.005f4750
lea ecx, [esp + 0x10]
mov bl, al
mov byte [esp + 0x30], 0
call fcn.004f03e0
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], 0xffffffff
call fcn.004eea90
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10

Function at 0x5f4d90
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x657e88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push esi
lea ecx, [esp + 0xc]
call fcn.004eea40
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push ecx
mov ecx, dword [esi + 0x44]
push edx
mov edx, dword [esi + 0x40]
push eax
mov eax, dword [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x38]
push edx
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x3c], 0
call fcn.005f43d0
lea ecx, [esp + 8]
mov bl, al
mov dword [esp + 0x1c], 0xffffffff
call fcn.004eea90
mov ecx, dword [esp + 0x14]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0x18
Function at 0x5f4e20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x657eb0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
push edi
mov edi, dword [esp + 0x58]
mov esi, ecx
push str.sendClientHello
push edi
lea ecx, [esp + 0x14]
call fcn.004f0370
mov eax, dword [esi + 0x3c8]
mov dword [esp + 0x3c], 0
test eax, eax
jne 0x5f4e95
mov eax, dword [edi]
push str.No_client_hello_to_send_
mov ecx, edi
call dword [eax + 0x14]
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0xffffffff
call fcn.004f03e0
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 0x18
lea ecx, [esp + 0x18]
call fcn.004dfe70
mov dl, byte [esi + 0x81]
mov al, byte [esi + 0xb3]
mov ebx, dword [esp + 0x48]
lea ecx, [esp + 0x18]
push edi
push ecx
push edx
lea ecx, [esi + 0x12c]
push eax
mov eax, dword [esp + 0x54]
lea edx, [esi + 0x334]
push ecx
mov ecx, dword [esi + 0x3c8]
push edx
push ebx
push eax
push esi
mov byte [esp + 0x60], 1
call fcn.005f2840
test al, al
jne 0x5f4f28
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x54]
push edi
push ecx
push 0x28
push edx
mov ecx, esi
call fcn.005f4c00
lea ecx, [esp + 0x18]
mov byte [esp + 0x3c], 0
call fcn.004e0890
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0xffffffff
call fcn.004f03e0
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
add esp, 0x34
ret 0x18
mov al, byte [edi + 0x123]
test al, al
je 0x5f4f83
lea eax, [esp + 0x18]
mov ecx, edi
push eax
push str.handshakeHashData_out
call fcn.004ef410
lea ecx, [esp + 0x18]
call fcn.005a8750
push eax
push str.hashedDataLen
mov ecx, edi
call fcn.004effe0
lea ecx, [esp + 0x18]
call fcn.005a8750
push eax
lea ecx, [esp + 0x1c]
call fcn.004dda10
push eax
push 0x6b7a10
push str.sha1
push str.handshakeDataSha1
mov ecx, edi
call fcn.004ef320
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esi + 0x2e8]
call fcn.004de6c0
test bl, bl
je 0x5f4f9f
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x40]
jmp 0x5f4fa9
mov ecx, 1
mov eax, 3
mov edx, dword [esp + 0x54]
push edi
push edx
mov edx, dword [esp + 0x58]
push edx
mov edx, dword [esp + 0x58]
push edx
push ecx
push eax
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call fcn.005f45e0
lea ecx, [esp + 0x18]
mov bl, al
mov byte [esp + 0x3c], 0
call fcn.004e0890
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0xffffffff
call fcn.004f03e0
mov ecx, dword [esp + 0x34]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 0x18
Function at 0x5f5000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x657ee0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x88]
push str.buildCertificatesMessage
push edi
lea ecx, [esp + 0x18]
call fcn.004f0370
mov al, byte [edi + 0x122]
mov esi, dword [esp + 0x80]
xor ebx, ebx
test al, al
mov dword [esp + 0x78], ebx
je 0x5f5063
cmp esi, ebx
je 0x5f5057
push edi
mov ecx, esi
call fcn.005afcc0
jmp 0x5f5063
mov eax, dword [edi]
push str.The_client_cert_chain_is_NULL.
mov ecx, edi
call dword [eax + 0x18]
mov ebp, dword [esp + 0x84]
mov ecx, ebp
call fcn.004dd9e0
lea ecx, [esp + 0x38]
call fcn.004dfe70
lea ecx, [esp + 0x1c]
mov byte [esp + 0x78], 1
call fcn.004dfe70
test esi, esi
mov byte [esp + 0x78], 2
je 0x5f509a
mov ecx, esi
call fcn.005afc30
mov ebx, eax
mov al, byte [edi + 0x121]
test al, al
jne 0x5f50ae
mov al, byte [edi + 0x122]
test al, al
je 0x5f50bb
push ebx
push str.numCerts
mov ecx, edi
call fcn.004effe0
lea ecx, [esp + 0x54]
call fcn.004dfe70
xor esi, esi
mov byte [esp + 0x78], 3
test ebx, ebx
jbe 0x5f5144
lea ecx, [esp + 0x54]
push edi
push ecx
mov ecx, dword [esp + 0x88]
push esi
call fcn.005afc90
test al, al
je 0x5f513f
lea ecx, [esp + 0x54]
call fcn.005a8750
mov dword [esp + 0x88], eax
lea ecx, [esp + 0x1c]
shr eax, 0x10
push eax
call fcn.004e0da0
mov edx, dword [esp + 0x88]
lea ecx, [esp + 0x1c]
shr edx, 8
push edx
call fcn.004e0da0
mov eax, dword [esp + 0x88]
lea ecx, [esp + 0x1c]
push eax
call fcn.004e0da0
lea ecx, [esp + 0x54]
push ecx
lea ecx, [esp + 0x20]
call fcn.004de6c0
lea ecx, [esp + 0x54]
call fcn.004dd9e0
inc esi
cmp esi, ebx
jb 0x5f50cf
lea ecx, [esp + 0x1c]
call fcn.005a8750
mov esi, eax
lea ecx, [esp + 0x38]
mov edx, esi
shr edx, 0x10
push edx
call fcn.004e0da0
mov eax, esi
lea ecx, [esp + 0x38]
shr eax, 8
push eax
call fcn.004e0da0
push esi
lea ecx, [esp + 0x3c]
call fcn.004e0da0
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x3c]
call fcn.004de6c0
push 0xb
mov ecx, ebp
call fcn.004e0da0
lea ecx, [esp + 0x38]
call fcn.005a8750
mov esi, eax
mov al, byte [edi + 0x122]
test al, al
je 0x5f51b0
push esi
push str.CertificateSize
mov ecx, edi
call fcn.004f00d0
mov edx, esi
mov ecx, ebp
shr edx, 0x10
push edx
call fcn.004e0da0
mov eax, esi
mov ecx, ebp
shr eax, 8
push eax
call fcn.004e0da0
push esi
mov ecx, ebp
call fcn.004e0da0
lea ecx, [esp + 0x38]
push ecx
mov ecx, ebp
call fcn.004de6c0
lea ecx, [esp + 0x54]
mov byte [esp + 0x78], 2
call fcn.004e0890
lea ecx, [esp + 0x1c]
mov byte [esp + 0x78], 1
call fcn.004e0890
lea ecx, [esp + 0x38]
mov byte [esp + 0x78], 0
call fcn.004e0890
lea ecx, [esp + 0x10]
mov dword [esp + 0x78], 0xffffffff
call fcn.004f03e0
mov ecx, dword [esp + 0x70]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x6c
ret 0xc
Function at 0x5f7100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6580c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [esp + 0x30]
push edi
mov edi, ecx
mov al, byte [esi + 0x122]
lea ecx, [esp + 0xc]
push eax
push str.processTlsRecord
push esi
call fcn.004f03a0
mov eax, dword [edi + 0x470]
xor ebx, ebx
cmp eax, 0x14
mov dword [esp + 0x20], ebx
jne 0x5f7169
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push esi
push ecx
push edx
mov ecx, edi
call fcn.005e12c0
mov bl, al
mov eax, dword [esp + 0x30]
mov byte [eax + 4], 1
jmp 0x5f71f5
cmp eax, 0x15
jne 0x5f7189
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push esi
push ecx
push edx
push eax
mov ecx, edi
call fcn.005e1810
mov bl, al
jmp 0x5f71f5
cmp eax, 0x16
jne 0x5f71a9
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push esi
push ecx
push edx
push eax
mov ecx, edi
call fcn.005f6e70
mov bl, al
jmp 0x5f71f5
cmp eax, 0x17
jne 0x5f71d5
mov eax, dword [edi + 0x448]
cmp eax, ebx
jne 0x5f71be
lea eax, [edi + 0x42c]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push esi
push eax
push ecx
push edx
mov ecx, edi
call fcn.005e13c0
mov bl, al
jmp 0x5f71f5
mov eax, dword [esi]
push str.Invalid_TLS_record_type.
mov ecx, esi
call dword [eax + 0x14]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
push esi
push ecx
push 0xa
push edx
mov ecx, edi
call fcn.005f4c00
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.004f03e0
mov ecx, dword [esp + 0x18]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 0x10
Function at 0x5f93e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x6581c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
lea ecx, [esi + 0x14]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
call fcn.004dfe70
lea ecx, [esi + 0x30]
mov dword [esp + 0x14], ebx
call fcn.004dfe70
lea ecx, [esi + 0x4c]
mov byte [esp + 0x14], 1
call fcn.004dfe70
mov ecx, dword [esp + 0xc]
mov byte [esi + 0x68], bl
mov dword [esi], vtable.TlsRawRecord.0
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x5fb960
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ecx
mov al, byte [0x726a0c]
push esi
test al, al
jne 0x5fba88
mov al, byte [0x726a0d]
test al, al
jne 0x5fba66
mov eax, dword [0x726a10]
test eax, eax
jne 0x5fba88
push 0x100
mov byte [0x726a0d], 1
call fcn.004f1d70
add esp, 4
mov dword [esp + 4], eax
test eax, eax
je 0x5fba88
push ebp
push edi
xor ebp, ebp
mov esi, eax
mov eax, ebp
xor edx, edx
mov ecx, 7
test al, 1
je 0x5fb9c5
mov edi, 1
shl edi, cl
or edx, edi
shr eax, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x5fb9b8
shl edx, 0x18
mov dword [esi], edx
mov edi, 8
mov edx, dword [esi]
mov ecx, edx
and ecx, 0x80000000
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
and ecx, 0x4c11db7
xor ecx, eax
dec edi
mov dword [esi], ecx
jne 0x5fb9d7
mov edx, ecx
xor eax, eax
mov ecx, 0x1f
test dl, 1
je 0x5fba0c
mov edi, 1
shl edi, cl
or eax, edi
shr edx, 1
dec ecx
cmp ecx, 0xffffffff
jg 0x5fb9fe
mov dword [esi], eax
inc ebp
add esi, 4
cmp ebp, 0xff
jbe 0x5fb9af
mov eax, dword [0x726a10]
pop edi
test eax, eax
pop ebp
jne 0x5fba48
mov ecx, dword [esp + 4]
mov byte [0x726a0c], 1
mov dword [0x726a10], ecx
mov byte [0x726a0d], 0
pop esi
pop ecx
ret
mov edx, dword [esp + 4]
push edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov byte [0x726a0c], 1
mov byte [0x726a0d], 0
pop esi
pop ecx
ret
xor esi, esi
test al, al
je 0x5fba88
push 2
call fcn.004ee360
add esp, 4
inc esi
cmp esi, 0xc8
ja 0x5fba88
mov al, byte [0x726a0d]
test al, al
jne 0x5fba6c
pop esi
pop ecx
ret
Function at 0x5fd090
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x6586f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x78
mov eax, dword [esp + 0x9c]
push ebx
mov ecx, eax
mov edx, eax
shr ecx, 0x18
mov byte [esp + 4], cl
mov ecx, eax
shr ecx, 8
push ebp
push esi
shr edx, 0x10
mov byte [esp + 0xe], cl
push edi
lea ecx, [esp + 0x6c]
mov byte [esp + 0x11], dl
mov byte [esp + 0x13], al
call fcn.004dfe70
mov edx, dword [esp + 0xa4]
mov eax, dword [esp + 0xa0]
push edx
push eax
lea ecx, [esp + 0x74]
mov dword [esp + 0x98], 0
call fcn.004e1260
lea ecx, [esp + 0x10]
push 4
push ecx
lea ecx, [esp + 0x74]
call fcn.004e1260
lea ecx, [esp + 0x50]
call fcn.004dfe70
lea ecx, [esp + 0x34]
mov byte [esp + 0x90], 1
call fcn.004dfe70
lea ecx, [esp + 0x18]
mov byte [esp + 0x90], 2
call fcn.004dfe70
mov ebx, dword [esp + 0xb0]
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0x98]
lea edx, [esp + 0x18]
push edx
push ebx
push eax
push ecx
lea ecx, [esp + 0x7c]
mov byte [esp + 0xa0], 3
call fcn.005a8750
push eax
lea ecx, [esp + 0x80]
call fcn.004dda10
push eax
call fcn.005dd180
add esp, 0x18
lea edx, [esp + 0x18]
lea ecx, [esp + 0x34]
push edx
call fcn.004de6c0
lea ecx, [esp + 0x18]
call fcn.005a8750
mov edi, eax
mov eax, dword [esp + 0xb4]
cmp edi, eax
jbe 0x5fd1a4
mov edi, eax
lea ecx, [esp + 0x18]
call fcn.004dda10
mov ebp, eax
test ebp, ebp
je 0x5fd26a
mov ecx, dword [esp + 0xa8]
mov eax, 1
cmp ecx, eax
mov dword [esp + 0x14], eax
jbe 0x5fd259
mov ecx, dword [esp + 0x9c]
mov edx, dword [esp + 0x98]
lea eax, [esp + 0x50]
push eax
push ebx
push ecx
push edx
lea ecx, [esp + 0x44]
call fcn.005a8750
push eax
lea ecx, [esp + 0x48]
call fcn.004dda10
push eax
call fcn.005dd180
add esp, 0x18
lea ecx, [esp + 0x50]
call fcn.004dda10
test eax, eax
je 0x5fd26a
test edi, edi
jbe 0x5fd221
mov ecx, ebp
sub eax, ebp
mov esi, edi
mov dl, byte [eax + ecx]
xor byte [ecx], dl
inc ecx
dec esi
jne 0x5fd218
lea ecx, [esp + 0x34]
call fcn.004dd9e0
lea eax, [esp + 0x50]
lea ecx, [esp + 0x34]
push eax
call fcn.004de6c0
lea ecx, [esp + 0x50]
call fcn.004dd9e0
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xa8]
inc eax
cmp eax, ecx
mov dword [esp + 0x14], eax
jb 0x5fd1cf
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0xbc]
call fcn.004de6c0
lea ecx, [esp + 0x18]
mov byte [esp + 0x90], 2
call fcn.004e0890
lea ecx, [esp + 0x34]
mov byte [esp + 0x90], 1
call fcn.004e0890
lea ecx, [esp + 0x50]
mov byte [esp + 0x90], 0
call fcn.004e0890
lea ecx, [esp + 0x6c]
mov dword [esp + 0x90], 0xffffffff
call fcn.004e0890
mov ecx, dword [esp + 0x88]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x84
ret
Function at 0x5febd0
Capabilities:
Hash data using sha256

Disassembly:
push 0xffffffffffffffff
push 0x658918
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.004f5830
xor edi, edi
mov dword [esi], vtable._ckSha2.0
mov dword [esp + 0x18], edi
call fcn.004efba0
mov byte [0x7191d4], al
call fcn.005fdce0
mov edx, dword [esp + 0x20]
cmp edx, edi
jle 0x5fecd3
cmp edx, 0x180
jg 0x5fec9a
je 0x5fec79
mov eax, edx
sub eax, 0xa0
je 0x5fec58
sub eax, 0x60
jne 0x5fecd3
mov eax, 0x689b3c
lea ecx, [esi + 0xc]
mov ebx, dword [eax]
add eax, 4
mov dword [ecx], ebx
add ecx, 4
cmp eax, 0x689b5c
jl 0x5fec3f
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
jmp 0x5fecd3
mov eax, 0x689a28
lea ecx, [esi + 0xc]
mov ebx, dword [eax]
add eax, 4
mov dword [ecx], ebx
add ecx, 4
cmp eax, 0x689a3c
jl 0x5fec60
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
jmp 0x5fecd3
mov eax, 0x726cf8
lea ecx, [esi + 0x38]
mov ebx, dword [eax]
add eax, 8
mov dword [ecx], ebx
mov ebx, dword [eax - 4]
mov dword [ecx + 4], ebx
add ecx, 8
cmp eax, 0x726d38
jl 0x5fec81
jmp 0x5fecc1
cmp edx, 0x200
jne 0x5fecd3
mov eax, 0x726a38
lea ecx, [esi + 0x38]
mov ebx, dword [eax]
add eax, 8
mov dword [ecx], ebx
mov ebx, dword [eax - 4]
mov dword [ecx + 4], ebx
add ecx, 8
cmp eax, 0x726a78
jl 0x5fecaa
mov dword [esi + 0x78], edi
mov dword [esi + 0x80], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x84], edi
mov ecx, dword [esp + 0x10]
mov dword [esi + 8], edx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x5ff440
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [ecx + 8]
push esi
cmp eax, 0x180
jg 0x5ff4c4
je 0x5ff4a3
sub eax, 0xa0
je 0x5ff480
sub eax, 0x60
jne 0x5ff4fe
mov eax, 0x689b3c
lea edx, [ecx + 0xc]
mov esi, dword [eax]
add eax, 4
mov dword [edx], esi
add edx, 4
cmp eax, 0x689b5c
jl 0x5ff465
xor eax, eax
pop esi
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
ret
mov eax, 0x689a28
lea edx, [ecx + 0xc]
mov esi, dword [eax]
add eax, 4
mov dword [edx], esi
add edx, 4
cmp eax, 0x689a3c
jl 0x5ff488
xor eax, eax
pop esi
mov dword [ecx + 0x2c], eax
mov dword [ecx + 0x30], eax
ret
mov eax, 0x726cf8
lea edx, [ecx + 0x38]
mov esi, dword [eax]
add eax, 8
mov dword [edx], esi
mov esi, dword [eax - 4]
mov dword [edx + 4], esi
add edx, 8
cmp eax, 0x726d38
jl 0x5ff4ab
jmp 0x5ff4ea
cmp eax, 0x200
jne 0x5ff4fe
mov eax, 0x726a38
lea edx, [ecx + 0x38]
mov esi, dword [eax]
add eax, 8
mov dword [edx], esi
mov esi, dword [eax - 4]
mov dword [edx + 4], esi
add edx, 8
cmp eax, 0x726a78
jl 0x5ff4d3
xor eax, eax
mov dword [ecx + 0x78], eax
mov dword [ecx + 0x80], eax
mov dword [ecx + 0x7c], eax
mov dword [ecx + 0x84], eax
pop esi
ret
Function at 0x60a470
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, 0xffffffdc
lea eax, [edi + 0x24]
sub esi, edi
mov dl, byte [eax + 0x20]
mov byte [eax], dl
mov cl, byte [eax - 0x10]
xor cl, dl
mov byte [eax + 0x10], cl
inc eax
lea edx, [esi + eax]
cmp edx, 0x10
jl 0x60a480
xor ecx, ecx
lea esi, [edi + 0x14]
mov byte [esp + 0xc], cl
mov edx, 0xffffffec
mov eax, esi
sub edx, edi
mov ebx, dword [esp + 0xc]
and ebx, 0xff
mov bl, byte [ebx + str._.C]
xor byte [eax], bl
mov bl, byte [eax]
inc eax
mov byte [esp + 0xc], bl
lea ebx, [edx + eax]
cmp ebx, 0x30
jl 0x60a4a8
mov bl, byte [esp + 0xc]
add bl, cl
inc ecx
cmp ecx, 0x12
mov byte [esp + 0xc], bl
jl 0x60a49f
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x60a4e0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov al, byte [ecx + 0x13]
mov edx, 0xfffffffc
push ebx
mov byte [esp + 4], al
push esi
lea eax, [ecx + 4]
sub edx, ecx
mov esi, dword [esp + 8]
mov bl, byte [eax]
xor ecx, ecx
and esi, 0xff
mov cl, byte [eax + 0x40]
xor ecx, esi
mov cl, byte [ecx + str._.C]
xor bl, cl
mov byte [eax], bl
mov cl, bl
inc eax
mov byte [esp + 8], cl
lea ecx, [edx + eax]
cmp ecx, 0x10
jl 0x60a4f4
pop esi
pop ebx
pop ecx
ret

Function at 0x60e0d0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x658fe8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x24]
push esi
test ebp, ebp
push edi
jge 0x60e109
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov edi, dword [esp + 0x34]
test edi, edi
jne 0x60e126
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov eax, dword [esp + 0x38]
push str.getEntropy
push eax
lea ecx, [esp + 0x18]
call fcn.004f0370
mov dword [esp + 0x24], 0
xor bl, bl
call fcn.004ee6d0
mov esi, eax
test esi, esi
jne 0x60e174
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.004f03e0
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
push edi
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x60e183
mov bl, 1
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.004f03e0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x60e2a0
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
xor eax, eax
and edx, 0xff
push ebx
push esi
push edi
mov byte [ecx + edx*8 + 0xcf], 0
mov al, byte [ecx + 0x198]
lea esi, [edx*8 - 1]
lea edi, [ecx + 8]
mov byte [eax + ecx + 0xd0], 6
mov bl, byte [ecx + edx*8 + 0xcf]
or bl, 0x80
mov byte [ecx + edx*8 + 0xcf], bl
mov bl, byte [ecx + 0x198]
inc bl
mov byte [esp + 0xc], bl
mov eax, dword [esp + 0xc]
and eax, 0xff
cmp eax, esi
jge 0x60e315
inc bl
mov byte [eax + ecx + 0xd0], 0
mov byte [esp + 0xc], bl
mov eax, dword [esp + 0xc]
and eax, 0xff
cmp eax, esi
jl 0x60e2fa
mov al, byte [esp + 0x18]
test al, al
jbe 0x60e344
mov esi, edi
mov ebx, edx
lea ecx, [esi + 0xc8]
push ecx
call fcn.00610250
mov ecx, dword [esi]
add esp, 4
xor ecx, eax
mov dword [esi], ecx
mov eax, dword [esi + 4]
xor eax, edx
mov dword [esi + 4], eax
add esi, 8
dec ebx
jne 0x60e321
push edi
call fcn.0060e380
mov ecx, dword [esp + 0x20]
add esp, 4
test cl, cl
jbe 0x60e36e
mov eax, dword [esp + 0x14]
mov edx, edi
sub edx, eax
and ecx, 0xff
mov esi, ecx
mov cl, byte [edx + eax]
mov byte [eax], cl
inc eax
dec esi
jne 0x60e365
pop edi
pop esi
pop ebx
pop ecx
ret 0xc
Function at 0x610260
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov al, byte [edi + 0x198]
test al, al
jbe 0x610358
mov cl, byte [esp + 0x24]
mov ebx, dword [esp + 0x20]
shl cl, 3
sub cl, al
mov byte [esp + 0x14], cl
mov edx, dword [esp + 0x14]
and edx, 0xff
cmp edx, ebx
jbe 0x61029c
mov cl, bl
mov byte [esp + 0x14], cl
and eax, 0xff
xor dl, dl
test cl, cl
lea esi, [eax + edi + 0xd0]
mov byte [esp + 0x10], dl
jbe 0x6102d4
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
sub ebp, esi
and eax, 0xff
mov dl, al
mov ecx, esi
mov esi, eax
mov byte [esp + 0x10], dl
mov al, byte [ecx + ebp]
mov byte [ecx], al
inc ecx
dec esi
jne 0x6102cb
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x1c]
and eax, 0xff
add esi, eax
sub ebx, eax
mov al, byte [edi + 0x198]
mov dword [esp + 0x1c], esi
add al, dl
mov edx, dword [esp + 0x24]
mov ecx, edx
mov byte [edi + 0x198], al
and ecx, 0xff
and eax, 0xff
mov dword [esp + 0x20], ebx
lea esi, [ecx*8]
cmp eax, esi
jne 0x61035c
test dl, dl
jbe 0x610343
lea esi, [edi + 8]
mov ebp, ecx
lea ecx, [esi + 0xc8]
push ecx
call fcn.00610250
mov ecx, dword [esi]
add esp, 4
xor ecx, eax
mov dword [esi], ecx
mov eax, dword [esi + 4]
xor eax, edx
mov dword [esi + 4], eax
add esi, 8
dec ebp
jne 0x610320
lea edx, [edi + 8]
push edx
call fcn.0060e380
add esp, 4
mov byte [edi + 0x198], 0
jmp 0x61035c
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
and eax, 0xff
mov dword [esp + 0x14], eax
lea ecx, [eax*8]
cmp ebx, ecx
jb 0x6103da
jmp 0x61037a
mov eax, dword [esp + 0x14]
mov cl, byte [esp + 0x24]
test cl, cl
jbe 0x6103af
mov ebp, dword [esp + 0x1c]
lea esi, [edi + 8]
mov ebx, eax
push ebp
call fcn.00610250
mov ecx, dword [esi]
add esp, 4
xor ecx, eax
add ebp, 8
mov dword [esi], ecx
mov eax, dword [esi + 4]
xor eax, edx
mov dword [esi + 4], eax
add esi, 8
dec ebx
jne 0x61038b
mov ebx, dword [esp + 0x20]
lea eax, [edi + 8]
push eax
call fcn.0060e380
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
add esp, 4
lea eax, [ecx*8]
sub ebx, eax
add edx, eax
cmp ebx, eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], edx
jae 0x610376
xor cl, cl
test ebx, ebx
jbe 0x610403
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dl, byte [eax + esi]
inc cl
mov byte [esp + 0x10], cl
mov byte [eax + edi + 0xd0], dl
mov eax, dword [esp + 0x10]
and eax, 0xff
cmp eax, ebx
jb 0x6103e6
mov al, byte [edi + 0x198]
add al, cl
mov byte [edi + 0x198], al
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0xc
Function at 0x6127c0
Capabilities:
Hash data using ripemd320
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx + 0x54], 0x67452301
mov dword [ecx + 8], eax
mov dword [ecx + 0x58], 0xefcdab89
mov dword [ecx + 0x5c], 0x98badcfe
mov dword [ecx + 0x60], 0x10325476
mov dword [ecx + 0x64], 0xc3d2e1f0
mov dword [ecx + 0x68], 0x76543210
mov dword [ecx + 0x6c], 0xfedcba98
mov dword [ecx + 0x70], 0x89abcdef
mov dword [ecx + 0x74], 0x1234567
mov dword [ecx + 0x78], 0x3c2d1e0f
mov dword [ecx + 0x50], eax
mov dword [ecx + 0xc], eax
ret