joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424870
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x61f6a8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [0x61f6a8]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x424795
pop edi
pop esi
ret
mov eax, dword [fcn.00419900]
test eax, eax
je 0x4247ba
cmp eax, fcn.00419900
je 0x4247ba
push 0x49
push str.....crypto_async_async.c
push edi
call eax
add esp, 0xc
pop edi
mov eax, 1
pop esi
ret
push edi
call fcn.0057bec0
add esp, 4
pop edi
mov eax, 1
pop esi
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push edi
call ebx
mov edi, eax
mov eax, dword [0x61f6ac]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x4248e0
push esi
call fcn.004247d0
mov edi, dword [esi]
add esp, 4
call fcn.0042dc50
mov eax, dword [fcn.00419900]
test eax, eax
je 0x4248c8
cmp eax, fcn.00419900
je 0x4248c8
push 0x180
push str.....crypto_async_async.c
push esi
call eax
add esp, 0xc
jmp 0x4248d1
push esi
call fcn.0057bec0
add esp, 4
mov ecx, dword [0x61f6ac]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
call ebx
mov edx, dword [0x61f6a8]
push edx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x424915
cmp dword [esi], 0
je 0x424915
cmp dword [esi + 4], 0
je 0x424915
call dword [sym.imp.KERNEL32.dll_ConvertFiberToThread]
mov dword [esi], 0
pop edi
pop esi
pop ebx
jmp 0x424760

Function at 0x4314a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi + 0x84], 0xffffffff
jne 0x4314b9
pop edi
xor eax, eax
pop ebx
pop ebp
ret
mov eax, dword [edi]
mov ecx, dword [eax]
push esi
mov esi, dword [ecx + 4]
mov dword [edx], esi
test ebx, ebx
je 0x43154c
mov eax, dword [edi + 0x84]
cmp eax, esi
jne 0x4314ee
test esi, esi
jle 0x431527
mov ecx, ebx
lea eax, [edi + 4]
mov edx, esi
mov bl, byte [eax + 0x60]
xor bl, byte [eax]
inc eax
mov byte [ecx], bl
inc ecx
dec edx
jne 0x4314e0
jmp 0x431524
mov ecx, esi
sub ecx, eax
mov byte [eax + edi + 0x64], 0x80
cmp ecx, 1
jle 0x43150d
dec ecx
push ecx
lea eax, [eax + edi + 0x65]
push 0
push eax
call fcn.0057e420
add esp, 0xc
test esi, esi
jle 0x431527
mov ecx, ebx
lea eax, [edi + 0x24]
mov edx, esi
mov bl, byte [eax + 0x40]
xor bl, byte [eax]
inc eax
mov byte [ecx], bl
inc ecx
dec edx
jne 0x431518
mov ebx, dword [ebp + 8]
mov edi, dword [edi]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x18]
push esi
push ebx
push ebx
push edi
call edx
add esp, 0x10
test eax, eax
jne 0x43154c
push esi
push ebx
call fcn.00527a20
add esp, 8
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
pop esi
pop edi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x432700
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
movzx edi, byte [ebp + 0xc]
mov eax, edi
and eax, 1
add esi, ecx
add edx, ecx
test ecx, ecx
je 0x432733
push ebx
lea ebx, [ebx]
movzx ebx, byte [edx - 1]
dec edx
xor ebx, edi
add eax, ebx
dec esi
mov byte [esi], al
shr eax, 8
dec ecx
jne 0x432720
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x433900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi + 4]
push edi
cmp eax, 0x1e
ja 0x433918
mov ecx, dword [eax*4 + 0x5d0b88]
jmp 0x43391a
xor ecx, ecx
test ecx, 0x2956
jne 0x43395f
mov edi, dword [ebp + 8]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [esi]
push eax
call fcn.00442560
add esp, 4
test eax, eax
je 0x433959
and dword [edi + 0xc], 0x80
mov ecx, dword [esi + 0xc]
and ecx, 0xffffff7f
or ecx, dword [edi + 0xc]
mov eax, 1
mov dword [edi + 0xc], ecx
pop edi
pop esi
pop ebp
ret
pop edi
xor eax, eax
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
lea edi, [ebx + 8]
push edi
mov ecx, esi
mov dword [ebx + 4], 0xc
call fcn.00455480
add esp, 4
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x433986
pop ebx
pop edi
xor eax, eax
pop esi
pop ebp
ret
mov edx, dword [edi]
mov edi, eax
mov ecx, edx
test edi, edi
jle 0x4339c8
movzx eax, byte [ecx]
cmp eax, 0x7f
ja 0x4339a8
test byte [eax*2 + str._________hHHHH__________________], 8
je 0x4339a8
dec edi
inc ecx
test edi, edi
jg 0x433990
test edi, edi
jle 0x4339c8
lea esi, [edi + ecx - 1]
movzx eax, byte [esi]
cmp eax, 0x7f
ja 0x4339c8
test byte [eax*2 + str._________hHHHH__________________], 8
je 0x4339c8
dec edi
dec esi
test edi, edi
jg 0x4339b0
xor esi, esi
test edi, edi
jle 0x433a28
mov edi, edi
mov bl, byte [ecx]
movzx eax, bl
test eax, 0xffffff80
je 0x4339e0
mov byte [edx], bl
jmp 0x433a1e
cmp eax, 0x7f
ja 0x433a1c
test byte [eax*2 + str._________hHHHH__________________], 8
je 0x433a0a
mov byte [edx], 0x20
inc edx
movzx eax, byte [ecx + 1]
inc ecx
inc esi
cmp eax, 0x7f
ja 0x433a21
test byte [eax*2 + str._________hHHHH__________________], 8
jne 0x4339f3
jmp 0x433a21
cmp eax, 0x7f
ja 0x433a1c
test byte [eax*2 + str._________hHHHH__________________], 2
je 0x433a1c
xor eax, 0x20
mov byte [edx], al
inc edx
inc ecx
inc esi
cmp esi, edi
jl 0x4339d0
mov ebx, dword [ebp + 8]
sub edx, dword [ebx + 8]
mov eax, 1
mov dword [ebx], edx
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x43fbf0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x68
call fcn.00596bf0
mov eax, dword [0x616930]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
test esi, esi
jne 0x43fc1b
mov esi, 0x61f844
push 0x60
lea eax, [esp + 0xc]
push 0
push eax
call fcn.0057e420
add esp, 0xc
mov dword [esp + 8], 0x67452301
mov dword [esp + 0xc], 0xefcdab89
mov dword [esp + 0x10], 0x98badcfe
mov dword [esp + 0x14], 0x10325476
mov dword [esp + 0x18], 0xc3d2e1f0
test ebx, ebx
je 0x43fc67
push edi
mov ecx, ebx
lea edx, [esp + 0xc]
call fcn.004524a0
add esp, 4
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.004525b0
lea edx, [esp + 0xc]
push 0x60
push edx
call fcn.00527a20
mov ecx, dword [esp + 0x78]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
Function at 0x43fca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x38
call fcn.00596bf0
mov eax, dword [0x616930]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
movzx ebx, byte [eax + 5]
mov dword [ebp - 0x34], eax
inc eax
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x28], edx
movzx edx, byte [eax]
mov dword [ebp - 0x10], ecx
mov edi, dword [ecx]
movzx ecx, byte [eax - 1]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 1]
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 2]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax + 3]
mov dword [ebp - 0x2c], eax
shl ebx, 8
or edx, ebx
movzx ebx, byte [eax + 6]
movzx eax, byte [eax + 5]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 8
mov byte [ebp - 0xb], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0xa], al
shl ebx, 0x10
or edx, ebx
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 9], al
mov eax, edx
shr eax, 8
mov byte [ebp - 7], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 6], al
mov eax, edx
shr eax, 0x18
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
mov byte [ebp - 0xc], cl
mov byte [ebp - 8], dl
mov byte [ebp - 5], al
test esi, esi
je 0x43fe54
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp + 8]
sub eax, esi
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x18]
test edi, edi
jne 0x43fdd8
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
push ecx
push edx
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.00528ca0
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x20]
mov ebx, eax
shr ebx, 8
mov byte [ebp - 0xb], bl
mov ebx, eax
mov ecx, eax
mov byte [ebp - 0xc], al
shr eax, 0x18
shr ebx, 0x10
mov byte [ebp - 9], al
mov eax, edx
mov byte [ebp - 0xa], bl
mov ebx, eax
shr ebx, 8
mov byte [ebp - 7], bl
mov ebx, eax
mov byte [ebp - 8], al
shr eax, 0x18
shr ebx, 0x10
add esp, 0x10
inc dword [ebp - 0x1c]
mov byte [ebp - 5], al
mov eax, dword [ebp - 0x14]
mov byte [ebp - 6], bl
mov bl, byte [ebp + edi - 0xc]
xor bl, byte [esi]
inc edi
mov byte [eax + esi], bl
inc esi
and edi, 7
cmp dword [ebp - 0x18], 0
jne 0x43fd77
cmp dword [ebp - 0x1c], 0
je 0x43fe3e
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov byte [eax], cl
mov eax, ecx
shr eax, 8
mov byte [esi], al
mov eax, ecx
shr eax, 0x10
mov byte [esi + 1], al
shr ecx, 0x18
mov byte [esi + 2], cl
mov byte [esi + 3], dl
mov ecx, edx
shr ecx, 8
mov byte [esi + 4], cl
mov ecx, dword [ebp - 0x10]
mov eax, edx
shr eax, 0x10
mov byte [esi + 5], al
shr edx, 0x18
mov byte [esi + 6], dl
mov dword [ecx], edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x10]
mov dword [edx], edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov dword [eax], edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0057af8a
mov esp, ebp
pop ebp
ret
Function at 0x446ac0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.00596bf0
cmp dword [ecx], 0x72
mov eax, dword [ebp + 0xc]
jne 0x446c16
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 8]
push ebx
mov ebx, eax
push edi
push ecx
mov ecx, dword [ebp + 0x10]
and eax, 1
shr ebx, 1
add eax, ebx
push eax
push edx
mov edx, dword [ebp + 0x18]
push 0x5ecbd0
mov dword [ebp - 4], eax
call fcn.004467f0
add esp, 0x14
test eax, eax
jne 0x446b0c
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [fcn.004196c0]
push esi
test eax, eax
je 0x446b2f
cmp eax, fcn.004196c0
je 0x446b2f
push 0x104
push str.....cryptokdf_tls1_prf.c
push edi
call eax
add esp, 0xc
jmp 0x446b4f
test edi, edi
je 0x446b55
cmp dword [0x61b870], 0
je 0x446b46
mov dword [0x61b870], 0
push edi
call fcn.0057c0af
add esp, 4
mov esi, eax
test esi, esi
jne 0x446b75
push 0x105
push str.....cryptokdf_tls1_prf.c
push 0x41
push 0x6f
push 0x34
call fcn.0040e790
add esp, 0x14
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 4]
add ebx, dword [ebp + 8]
push edi
push eax
push ecx
mov ecx, dword [ebp + 0x10]
push ebx
push 0x5df6e0
mov edx, esi
call fcn.004467f0
add esp, 0x14
test eax, eax
jne 0x446bb3
push 0x10a
push str.....cryptokdf_tls1_prf.c
push edi
call fcn.00419930
add esp, 0xc
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x446bd7
mov eax, dword [ebp + 0x18]
mov ecx, esi
sub ecx, eax
mov edx, edi
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec edx
jne 0x446bc0
test edi, edi
je 0x446bd7
push edi
push esi
call fcn.00527a20
add esp, 8
mov eax, dword [fcn.00419900]
test eax, eax
je 0x446c02
cmp eax, fcn.00419900
je 0x446c02
push 0x10f
push str.....cryptokdf_tls1_prf.c
push esi
call eax
add esp, 0xc
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.0057bec0
add esp, 4
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0x14]
push edi
push edx
mov edx, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 8]
push eax
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.004467f0
add esp, 0x14
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret
Function at 0x451410
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test edx, edx
je 0x451468
test esi, esi
je 0x451468
push edi
mov edi, dword [ecx + 0xc]
cmp esi, edi
jae 0x451429
mov edi, esi
xor eax, eax
push ebx
test edi, edi
je 0x45143c
mov bl, byte [eax + edx]
xor byte [ecx + eax + 0x10], bl
inc eax
cmp eax, edi
jb 0x451430
mov eax, dword [ecx + 0xc]
cmp esi, eax
jbe 0x451466
sub esi, eax
cmp esi, 0x10
jbe 0x45144f
mov esi, 0x10
xor eax, eax
test esi, esi
je 0x451466
mov edi, dword [ecx + 0xc]
add edi, eax
mov bl, byte [edi + edx]
xor byte [ecx + eax + 0x30], bl
inc eax
cmp eax, esi
jb 0x451455
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x451470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 4
call fcn.00596bf0
push esi
mov esi, ecx
lea ecx, [esi + 2]
mov dword [ebp - 4], 0x10
mov eax, edi
sub esi, edi
mov edx, 4
push ebx
movzx ebx, byte [esi + eax]
xor byte [eax], bl
movzx ebx, byte [ecx - 1]
xor byte [eax + 1], bl
movzx ebx, byte [ecx]
xor byte [eax + 2], bl
movzx ebx, byte [ecx + 1]
xor byte [eax + 3], bl
add eax, 4
add ecx, 4
dec edx
jne 0x451494
mov eax, dword [ebp + 8]
mov esi, dword [eax + 4]
pop ebx
cmp dword [esi + 8], edx
je 0x4514d6
push edi
lea ecx, [ebp - 4]
push ecx
push edi
lea ecx, [edx + 0x10]
call fcn.0040d8b0
add esp, 0xc
jmp 0x4514e8
push 0x10
push edi
lea edx, [ebp - 4]
push edx
push edi
mov ecx, esi
call fcn.0040dc60
add esp, 0x10
pop esi
test eax, eax
je 0x4514fc
cmp dword [ebp - 4], 0x10
jne 0x4514fc
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x452700
Capabilities:
Hash data using sha1

Disassembly:
push 0x60
push 0
push esi
call fcn.0057e420
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
ret
Function at 0x45f670
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [eax + 0xc]
push 0x5c
push 0
push esi
call fcn.0057e420
push 0x60
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
add esi, 0x5c
push 0
push esi
call fcn.0057e420
add esp, 0x18
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
pop ebp
ret

Function at 0x463750
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
cmp dword [ebp + 0xc], esi
jne 0x4637d1
mov al, byte [ecx]
cmp al, 0x6a
je 0x463765
cmp al, 0x6b
jne 0x4637d1
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x4637a7
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x463785
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x463785
cmp al, 0xbb
jne 0x463799
inc ecx
cmp ecx, esi
jl 0x463775
sub esi, ecx
test ecx, ecx
jne 0x4637aa
push 0x50
push str.....crypto_rsa_rsa_x931.c
push 0x8a
jmp 0x4637dd
push 0x48
push str.....crypto_rsa_rsa_x931.c
push 0x8a
jmp 0x4637dd
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x4637be
push 0x59
push str.....crypto_rsa_rsa_x931.c
push 0x8b
jmp 0x4637dd
mov eax, dword [ebp + 8]
push esi
push edx
push eax
call fcn.0057e070
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret
push 0x3d
push str.....crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.0040e790
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x46f190
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
lea eax, [ecx + 1]
pop ebp
ret

Function at 0x46f230
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
pop ebp
ret

Function at 0x46fb40
Capabilities:
Hash data using sha224

Disassembly:
push 0x70
push 0
push esi
call fcn.0057e420
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
mov eax, 1
ret

Function at 0x46fba0
Capabilities:
Hash data using sha256

Disassembly:
push 0x70
push 0
push esi
call fcn.0057e420
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
ret
Function at 0x475c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, edi
cmp edi, 4
jb 0x475ca6
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x475cae
sub esi, 4
add ecx, 4
add edx, 4
cmp esi, 4
jae 0x475c92
test esi, esi
je case.0x475d70.2
movzx eax, byte [edx]
movzx ebx, byte [ecx]
sub eax, ebx
jne 0x475cf5
cmp esi, 1
jbe case.0x475d70.2
movzx eax, byte [edx + 1]
movzx ebx, byte [ecx + 1]
sub eax, ebx
jne 0x475cf5
cmp esi, 2
jbe case.0x475d70.2
movzx eax, byte [edx + 2]
movzx ebx, byte [ecx + 2]
sub eax, ebx
jne 0x475cf5
cmp esi, 3
jbe case.0x475d70.2
movzx eax, byte [edx + 3]
movzx ecx, byte [ecx + 3]
sub eax, ecx
sar eax, 0x1f
or eax, 1
jle case.0x475d70.2
mov ebx, dword [ebp + 0xc]
xor edx, edx
test edi, edi
jle 0x475d1e
mov esi, dword [ebp + 8]
mov eax, ebx
sub esi, ebx
mov cl, byte [esi + eax]
cmp cl, byte [eax]
jne 0x475d1e
inc edx
inc eax
cmp edx, edi
jl 0x475d11
lea eax, [edi - 1]
test eax, eax
js 0x475d3f
mov esi, dword [ebp + 8]
lea ecx, [eax + ebx]
sub esi, ebx
lea ecx, [ecx]
cmp byte [ecx + esi], 0
jne 0x475d3f
cmp byte [ecx], 0xff
jne 0x475d3f
dec ecx
dec eax
jns 0x475d30
cmp edx, eax
jl case.0x475d70.2
jle 0x475d50
pop esi
lea eax, [edx*8]
pop ebx
pop ebp
ret
mov eax, dword [ebp + 8]
mov cl, byte [edx + eax]
mov bl, byte [edx + ebx]
mov al, bl
xor al, cl
mov byte [ebp + 0xb], cl
movzx ecx, al
dec ecx
cmp ecx, 0x7e
ja case.0x475d70.2
movzx ecx, byte [ecx + 0x475de0]
jmp dword [ecx*4 + 0x475dc0]
mov esi, 7
jmp 0x475da6
mov esi, 6
jmp 0x475da6
mov esi, 5
jmp 0x475da6
mov esi, 4
jmp 0x475da6
mov esi, 3
jmp 0x475da6
mov esi, 2
jmp 0x475da6
mov esi, 1
test byte [ebp + 0xb], al
jne case.0x475d70.2
and bl, al
cmp bl, al
jne case.0x475d70.2
lea eax, [esi + edx*8]
pop esi
pop ebx
pop ebp
ret
pop esi
or eax, 0xffffffff
pop ebx
pop ebp
ret
Function at 0x47b0d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
mov dword [ebp + 0xc], eax
test edx, edx
je 0x47b0ec
test byte [edx + 0x5c], 2
mov esi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x47b0f1
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
test ebx, ebx
jle 0x47b1b9
push edi
mov edi, dword [ebp + 8]
inc edi
mov edi, edi
movzx edx, byte [edi - 1]
cmp ebx, 3
jl 0x47b151
movzx eax, byte [edi]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + esi]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + esi]
mov byte [ecx + 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + esi]
mov byte [ecx + 2], al
and edx, 0x3f
mov dl, byte [edx + esi]
mov byte [ecx + 3], dl
jmp 0x47b199
shl edx, 0x10
cmp ebx, 2
jne 0x47b161
movzx eax, byte [edi]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + esi]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + esi]
mov byte [ecx + 1], al
cmp ebx, 1
jne 0x47b188
lea eax, [ebx + 0x3c]
jmp 0x47b192
shr edx, 6
and edx, 0x3f
movzx eax, byte [edx + esi]
mov byte [ecx + 2], al
mov byte [ecx + 3], 0x3d
add dword [ebp + 0xc], 4
sub ebx, 3
add ecx, 4
add edi, 3
test ebx, ebx
jg 0x47b100
mov eax, dword [ebp + 0xc]
pop edi
pop esi
mov byte [ecx], 0
pop ebx
pop ebp
ret
pop esi
mov byte [ecx], al
pop ebx
pop ebp
ret
Function at 0x48b760
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x294
call fcn.00596bf0
mov eax, dword [0x616930]
xor eax, esp
mov dword [esp + 0x290], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x60]
push ecx
mov dword [esp + 0x10], eax
call fcn.0046f230
add esp, 4
push edx
mov ecx, 0x20
lea esi, [esp + 0x64]
call fcn.0046fa20
add esp, 4
mov ecx, esi
lea edx, [esp + 0x1d8]
call fcn.0046f2d0
mov dl, byte [esp + 0x1f7]
and byte [esp + 0x1d8], 0xf8
and dl, 0x3f
mov eax, esi
or dl, 0x40
push eax
mov byte [esp + 0x1fb], dl
call fcn.0046f230
lea ecx, [esp + 0x1fc]
add esp, 4
push ecx
mov ecx, 0x20
call fcn.0046fa20
mov ecx, dword [ebp + 0xc]
add esp, 4
push ebx
call fcn.0046fa20
add esp, 4
mov ecx, esi
lea edx, [esp + 0x258]
call fcn.0046f2d0
lea esi, [esp + 0x258]
call fcn.00485d50
lea edx, [esp + 0x138]
push edx
mov ecx, esi
call fcn.004845f0
lea eax, [esp + 0x14]
add esp, 4
push eax
lea ecx, [esp + 0x18c]
call fcn.00481ea0
add esp, 4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x21c]
push edx
lea ecx, [esp + 0x140]
call fcn.00480110
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x170]
call fcn.00480110
push edi
lea ecx, [esp + 0x4c]
call fcn.0047fea0
lea edx, [esp + 0x24]
add esp, 0x14
push edx
lea ecx, [esp + 0x21c]
call fcn.0047fea0
mov al, byte [esp + 0x14]
lea ecx, [esp + 0x64]
add esp, 4
shl al, 7
xor byte [edi + 0x1f], al
push ecx
call fcn.0046f230
add esp, 4
push edi
mov ecx, 0x20
lea esi, [esp + 0x64]
call fcn.0046fa20
mov edx, dword [esp + 0x10]
add esp, 4
push edx
mov ecx, 0x20
call fcn.0046fa20
mov ecx, dword [ebp + 0xc]
add esp, 4
push ebx
call fcn.0046fa20
add esp, 4
mov ecx, esi
lea edx, [esp + 0x218]
call fcn.0046f2d0
lea esi, [esp + 0x218]
call fcn.00485d50
mov eax, esi
push eax
add edi, 0x20
push edi
lea edx, [esp + 0x260]
lea ecx, [esp + 0x1e0]
call fcn.00487b00
lea ecx, [esp + 0x68]
push 0xd8
push ecx
call fcn.00527a20
lea edx, [esp + 0x268]
push 0x40
push edx
call fcn.00527a20
lea eax, [esp + 0x1f0]
push 0x40
push eax
call fcn.00527a20
mov ecx, dword [esp + 0x2bc]
add esp, 0x20
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0057af8a
mov esp, ebp
pop ebp
ret