joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10142fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x30
call fcn.101949d0
mov eax, dword [0x1029f280]
xor eax, esp
mov dword [esp + 0x2c], eax
push ebx
push ebp
push esi
push edi
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x48]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x50]
movzx ecx, byte [edx]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x1c], eax
mov bl, byte [edx + 3]
mov esi, dword [eax]
movzx eax, byte [edx + 1]
shl eax, 8
or ecx, eax
mov ebp, dword [esp + 0x4c]
movzx eax, byte [edx + 2]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x20], edx
movzx eax, bl
shl eax, 0x18
or ecx, eax
mov byte [esp + 0x37], bl
movzx eax, byte [edx + 5]
shl eax, 8
movzx edi, byte [edx + 4]
mov dl, byte [edx + 7]
or edi, eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], ecx
movzx ecx, dl
shl ecx, 8
movzx eax, byte [eax + 6]
or ecx, eax
mov dword [esp + 0x14], 0
mov eax, ecx
mov byte [esp + 0x3a], cl
shl eax, 0x10
or edi, eax
mov byte [esp + 0x3b], dl
mov eax, dword [esp + 0x10]
mov ebx, edi
mov dword [esp + 0x24], eax
mov byte [esp + 0x34], al
shr eax, 8
mov byte [esp + 0x35], al
mov eax, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x36], al
mov eax, ebx
shr eax, 8
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], edi
mov byte [esp + 0x38], bl
mov byte [esp + 0x39], al
test ebp, ebp
je 0x10143169
mov edi, dword [esp + 0x44]
sub dword [esp + 0x18], edi
dec ebp
test esi, esi
jne 0x1014310e
push dword [esp + 0x30]
lea eax, [esp + 0x28]
push eax
call fcn.10142c80
mov ecx, dword [esp + 0x2c]
add esp, 8
mov ebx, dword [esp + 0x28]
mov eax, ecx
shr eax, 8
mov edx, dword [esp + 0x14]
mov byte [esp + 0x35], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x36], al
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x37], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x39], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x3a], al
mov eax, ebx
shr eax, 0x18
inc edx
mov dword [esp + 0x10], ecx
mov byte [esp + 0x34], cl
mov byte [esp + 0x38], bl
mov byte [esp + 0x3b], al
mov dword [esp + 0x14], edx
jmp 0x10143112
mov edx, dword [esp + 0x14]
mov al, byte [esp + esi + 0x34]
inc esi
mov ecx, dword [esp + 0x18]
and esi, 7
xor al, byte [edi]
mov byte [ecx + edi], al
inc edi
mov ecx, dword [esp + 0x10]
test ebp, ebp
jne 0x101430a3
test edx, edx
je 0x10143169
mov edx, dword [esp + 0x20]
mov eax, ecx
shr eax, 8
mov byte [edx + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 2], al
mov eax, ebx
shr eax, 8
mov byte [edx + 5], al
mov eax, ebx
mov byte [edx], cl
shr ecx, 0x18
shr eax, 0x10
mov byte [edx + 4], bl
shr ebx, 0x18
mov byte [edx + 3], cl
mov byte [edx + 6], al
mov byte [edx + 7], bl
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x3c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10193ea5
add esp, 0x30
ret
Function at 0x10143540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x30
call fcn.101949d0
mov eax, dword [0x1029f280]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
push ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x4c]
push ebp
push esi
push edi
mov edi, dword [esp + 0x54]
mov esi, dword [eax]
mov dword [esp + 0x18], eax
mov ebp, dword [esp + 0x4c]
mov bh, byte [edi]
movzx eax, byte [edi + 1]
mov bl, byte [edi + 4]
movzx ecx, bh
shl ecx, 8
or ecx, eax
mov dword [esp + 0x1c], edi
movzx eax, byte [edi + 2]
shl eax, 8
mov dword [esp + 0x28], ecx
shl ecx, 0x10
or ecx, eax
movzx edx, bl
movzx eax, byte [edi + 3]
or ecx, eax
shl edx, 8
movzx eax, byte [edi + 5]
or edx, eax
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x1c]
mov edi, edx
shl edi, 0x10
mov byte [esp + 0x39], dl
mov dword [esp + 0x14], 0
movzx ecx, byte [eax + 6]
movzx eax, byte [eax + 7]
shl ecx, 8
or ecx, eax
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x28]
or edi, ecx
mov ecx, dword [esp + 0x34]
mov edx, edi
mov byte [esp + 0x35], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x36], al
mov eax, edx
shr eax, 8
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edi
mov byte [esp + 0x34], bh
mov byte [esp + 0x37], cl
mov byte [esp + 0x3a], al
mov byte [esp + 0x3b], dl
test ebp, ebp
je 0x101436dc
mov edi, dword [esp + 0x44]
sub dword [esp + 0x10], edi
dec ebp
test esi, esi
jne 0x10143685
push dword [esp + 0x30]
lea eax, [esp + 0x24]
push eax
call fcn.10014040
mov ecx, dword [esp + 0x28]
add esp, 8
mov edx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x34], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x35], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x36], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x38], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x39], al
mov eax, edx
shr eax, 8
inc dword [esp + 0x14]
mov byte [esp + 0x37], cl
mov byte [esp + 0x3a], al
mov byte [esp + 0x3b], dl
mov al, byte [esp + esi + 0x34]
inc esi
mov ebx, dword [esp + 0x10]
and esi, 7
xor al, byte [edi]
mov byte [ebx + edi], al
inc edi
mov ebx, dword [esp + 0x14]
test ebp, ebp
jne 0x10143625
test ebx, ebx
je 0x101436dc
mov ebx, dword [esp + 0x1c]
mov eax, ecx
shr eax, 0x18
mov byte [ebx], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 1], al
mov eax, ecx
shr eax, 8
mov byte [ebx + 2], al
mov eax, edx
shr eax, 0x18
mov byte [ebx + 4], al
mov eax, edx
shr eax, 0x10
mov byte [ebx + 5], al
mov eax, edx
shr eax, 8
mov byte [ebx + 3], cl
mov byte [ebx + 6], al
mov byte [ebx + 7], dl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10193ea5
add esp, 0x30
ret
Function at 0x10145990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x30
call fcn.101949d0
mov eax, dword [0x1029f280]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
push ebx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x4c]
push ebp
push esi
push edi
mov edi, dword [esp + 0x54]
mov esi, dword [eax]
mov dword [esp + 0x18], eax
mov ebp, dword [esp + 0x4c]
mov bh, byte [edi]
movzx eax, byte [edi + 1]
mov bl, byte [edi + 4]
movzx ecx, bh
shl ecx, 8
or ecx, eax
mov dword [esp + 0x1c], edi
movzx eax, byte [edi + 2]
shl eax, 8
mov dword [esp + 0x28], ecx
shl ecx, 0x10
or ecx, eax
movzx edx, bl
movzx eax, byte [edi + 3]
or ecx, eax
shl edx, 8
movzx eax, byte [edi + 5]
or edx, eax
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x1c]
mov edi, edx
shl edi, 0x10
mov byte [esp + 0x39], dl
mov dword [esp + 0x14], 0
movzx ecx, byte [eax + 6]
movzx eax, byte [eax + 7]
shl ecx, 8
or ecx, eax
mov byte [esp + 0x38], bl
mov eax, dword [esp + 0x28]
or edi, ecx
mov ecx, dword [esp + 0x34]
mov edx, edi
mov byte [esp + 0x35], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x36], al
mov eax, edx
shr eax, 8
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], edi
mov byte [esp + 0x34], bh
mov byte [esp + 0x37], cl
mov byte [esp + 0x3a], al
mov byte [esp + 0x3b], dl
test ebp, ebp
je 0x10145b2c
mov edi, dword [esp + 0x44]
sub dword [esp + 0x10], edi
dec ebp
test esi, esi
jne 0x10145ad5
push dword [esp + 0x30]
lea eax, [esp + 0x24]
push eax
call fcn.10145380
mov ecx, dword [esp + 0x28]
add esp, 8
mov edx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x34], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x35], al
mov eax, ecx
shr eax, 8
mov byte [esp + 0x36], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x38], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x39], al
mov eax, edx
shr eax, 8
inc dword [esp + 0x14]
mov byte [esp + 0x37], cl
mov byte [esp + 0x3a], al
mov byte [esp + 0x3b], dl
mov al, byte [esp + esi + 0x34]
inc esi
mov ebx, dword [esp + 0x10]
and esi, 7
xor al, byte [edi]
mov byte [ebx + edi], al
inc edi
mov ebx, dword [esp + 0x14]
test ebp, ebp
jne 0x10145a75
test ebx, ebx
je 0x10145b2c
mov ebx, dword [esp + 0x1c]
mov eax, ecx
shr eax, 0x18
mov byte [ebx], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 1], al
mov eax, ecx
shr eax, 8
mov byte [ebx + 2], al
mov eax, edx
shr eax, 0x18
mov byte [ebx + 4], al
mov eax, edx
shr eax, 0x10
mov byte [ebx + 5], al
mov eax, edx
shr eax, 8
mov byte [ebx + 3], cl
mov byte [ebx + 6], al
mov byte [ebx + 7], dl
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10193ea5
add esp, 0x30
ret
Function at 0x10146010
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.101949d0
mov eax, dword [esp + 0x2c]
push esi
mov esi, dword [eax]
test esi, esi
jns 0x10146030
mov dword [eax], 0xffffffff
pop esi
add esp, 0x14
ret
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x30]
test esi, esi
je 0x1014605c
mov ecx, dword [esp + 0x38]
test edi, edi
je 0x1014605c
mov al, byte [esi + ecx]
dec edi
xor al, byte [ebp]
inc esi
mov byte [ebx], al
inc ebp
inc ebx
and esi, 0xf
jne 0x10146047
mov edx, dword [esp + 0x40]
cmp edi, 0x10
jb 0x101460f5
mov ecx, dword [esp + 0x38]
mov eax, ebx
sub eax, ecx
mov dword [esp + 0x14], eax
mov eax, ebp
sub eax, ecx
mov dword [esp + 0x18], eax
mov eax, edi
shr eax, 4
mov dword [esp + 0x10], eax
shl eax, 4
add ebx, eax
add ebp, eax
mov dword [esp + 0x1c], ebx
mov ebx, dword [esp + 0x14]
mov dword [esp + 0x20], ebp
mov ebp, dword [esp + 0x18]
jmp 0x101460a4
mov ecx, dword [esp + 0x38]
push dword [esp + 0x34]
push ecx
push ecx
call edx
add esp, 0xc
cmp esi, 0x10
jae 0x101460d7
mov eax, dword [esp + 0x38]
mov edx, 0xf
sub edx, esi
add eax, esi
shr edx, 2
inc edx
mov ecx, dword [eax + ebp]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [ebx + eax - 4], ecx
sub edx, 1
jne 0x101460c5
mov edx, dword [esp + 0x40]
sub edi, 0x10
add ebx, 0x10
add ebp, 0x10
xor esi, esi
sub dword [esp + 0x10], 1
jne 0x101460a0
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
test edi, edi
je 0x10146127
push dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
push eax
push eax
call edx
mov eax, dword [esp + 0x44]
add esp, 0xc
sub ebp, eax
sub ebx, eax
lea ecx, [esi + eax]
add esi, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
sub edi, 1
jne 0x10146115
mov eax, dword [esp + 0x3c]
pop edi
pop ebp
pop ebx
mov dword [eax], esi
pop esi
add esp, 0x14
ret
Function at 0x101468d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.101949d0
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x38]
or eax, dword [ebp + 0x3c]
je 0x101468ef
mov eax, 0xfffffffe
pop ebp
pop ecx
ret
push esi
mov esi, dword [esp + 0x18]
xor ecx, ecx
mov eax, esi
add eax, dword [ebp + 0x30]
adc ecx, dword [ebp + 0x34]
cmp ecx, 0x20000000
ja 0x101469c0
jb 0x10146914
test eax, eax
jne 0x101469c0
push ebx
mov dword [ebp + 0x34], ecx
mov ecx, dword [ebp + 0x170]
mov dword [ebp + 0x30], eax
mov dword [esp + 0x14], ecx
push edi
mov edi, dword [esp + 0x1c]
test ecx, ecx
je 0x10146963
nop
test esi, esi
je 0x101469b2
mov al, byte [edi]
dec esi
xor byte [ecx + ebp + 0x40], al
inc edi
inc ecx
and ecx, 0xf
mov dword [esp + 0x18], ecx
jne 0x10146930
lea eax, [ebp + 0x60]
push eax
mov eax, dword [ebp + 0x168]
lea ebx, [ebp + 0x40]
push ebx
call eax
mov eax, dword [esp + 0x20]
add esp, 8
mov dword [esp + 0x18], eax
jmp 0x10146966
lea ebx, [ebp + 0x40]
mov eax, esi
lea ecx, [ebp + 0x60]
and eax, 0xfffffff0
mov dword [esp + 0x10], eax
je 0x1014698b
push eax
mov eax, dword [ebp + 0x164]
push edi
push ecx
push ebx
call eax
add edi, dword [esp + 0x20]
add esp, 0x10
sub esi, dword [esp + 0x10]
test esi, esi
je 0x101469ae
mov ecx, esi
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [ebx], al
lea ebx, [ebx + 1]
sub esi, 1
jne 0x10146991
pop edi
pop ebx
pop esi
mov dword [ebp + 0x170], ecx
xor eax, eax
pop ebp
pop ecx
ret
mov ecx, dword [esp + 0x18]
pop edi
pop ebx
pop esi
mov dword [ebp + 0x170], ecx
xor eax, eax
pop ebp
pop ecx
ret
pop esi
or eax, 0xffffffff
pop ebp
pop ecx
ret
Function at 0x101479d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esi + 0x30], 0
lea ebp, [esi + 0x40]
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x170], 0
mov dword [esi + 0x16c], 0
cmp ebx, 0xc
jne 0x10147a35
mov eax, dword [esp + 0x18]
lea edi, [ebx - 0xb]
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0x1000000
jmp 0x10147b32
mov edi, dword [esp + 0x18]
lea edx, [esi + 0x60]
mov dword [ebp], 0
mov dword [ebp + 4], 0
mov dword [esi + 0x48], 0
mov dword [esp + 0x1c], ebx
mov dword [esi + 0x4c], 0
cmp ebx, 0x10
jb 0x10147acd
mov eax, ebx
lea ecx, [esi + 0x41]
shr eax, 4
mov dword [esp + 0x14], eax
nop dword [eax]
lea edx, [edi + 2]
mov eax, ecx
mov ebp, 4
nop word [eax + eax]
movzx ecx, byte [edx - 2]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 5]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 4]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 2], cl
sub ebp, 1
jne 0x10147a80
lea eax, [esi + 0x60]
push eax
mov eax, dword [esi + 0x168]
lea ebp, [esi + 0x40]
push ebp
call eax
add esp, 8
lea ecx, [esi + 0x41]
add edi, 0x10
sub ebx, 0x10
sub dword [esp + 0x14], 1
jne 0x10147a70
lea edx, [esi + 0x60]
test ebx, ebx
je 0x10147aef
mov ecx, ebp
mov al, byte [edi]
lea edi, [edi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub ebx, 1
jne 0x10147ad3
mov eax, dword [esi + 0x168]
push edx
push ebp
call eax
add esp, 8
mov eax, dword [esp + 0x1c]
xor ecx, ecx
shld ecx, eax, 3
shl eax, 3
bswap eax
xor dword [esi + 0x4c], eax
lea eax, [esi + 0x60]
push eax
mov eax, dword [esi + 0x168]
bswap ecx
xor dword [esi + 0x48], ecx
push ebp
call eax
mov edi, dword [esi + 0x4c]
add esp, 8
mov eax, dword [ebp]
mov ecx, dword [ebp + 4]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov eax, dword [esi + 0x48]
mov ecx, dword [esi + 0x4c]
mov dword [esi + 8], eax
bswap edi
mov dword [esi + 0xc], ecx
mov dword [ebp], 0
lea eax, [esi + 0x20]
mov dword [ebp + 4], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
push dword [esi + 0x178]
push eax
mov eax, dword [esi + 0x174]
push esi
call eax
add esp, 0xc
inc edi
bswap edi
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10148380
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.101949d0
mov eax, dword [0x1029f280]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x44]
mov edx, dword [esp + 0x3c]
push ebx
push ebp
mov ebp, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
push edi
mov edi, dword [esp + 0x50]
mov al, byte [esi]
mov ebx, dword [esi + 0x28]
mov ecx, dword [esi + 0x2c]
mov byte [esp + 0x13], al
lea eax, [esi + 0x10]
test byte [esp + 0x13], 0x40
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
jne 0x101483df
push ecx
push eax
push esi
call ebx
mov edx, dword [esp + 0x20]
add esp, 0xc
movzx eax, byte [esp + 0x13]
mov ebx, 0xf
and eax, 7
xor ecx, ecx
sub ebx, eax
mov byte [esi], al
mov dword [esp + 0x28], ebx
cmp ebx, 0xf
jae 0x10148413
nop dword [eax + eax]
movzx eax, byte [esi + ebx]
or ecx, eax
mov byte [esi + ebx], 0
inc ebx
shl ecx, 8
cmp ebx, 0xf
jb 0x10148400
movzx eax, byte [esi + 0xf]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, edi
je 0x10148437
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10193ea5
add esp, 0x30
ret
mov ebx, edi
shr ebx, 4
test ebx, ebx
je 0x10148473
lea eax, [esi + 0x10]
push eax
push esi
push dword [esp + 0x20]
push ebx
push edx
push ebp
call dword [esp + 0x38]
shl ebx, 4
add esp, 0x18
add dword [esp + 0x14], ebx
add ebp, ebx
sub edi, ebx
je 0x101484cd
shr ebx, 4
push ebx
push esi
call fcn.10148da0
mov ebx, dword [esp + 0x1c]
add esp, 8
jmp 0x1014847d
mov ebx, dword [esp + 0x14]
mov eax, edi
test eax, eax
je 0x101484cd
push dword [esp + 0x18]
lea eax, [esp + 0x30]
push eax
push esi
call dword [esp + 0x28]
add esp, 0xc
test edi, edi
je 0x101484b8
lea ecx, [esp + 0x2c]
mov eax, ecx
lea edx, [esi + 0x10]
sub ebp, eax
sub ebx, eax
nop
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [ebx + ecx - 1], al
xor byte [edx - 1], al
sub edi, 1
jne 0x101484a0
mov ebp, dword [esp + 0x18]
lea ebx, [esi + 0x10]
mov edi, dword [esp + 0x1c]
push ebp
push ebx
push ebx
call edi
add esp, 0xc
jmp 0x101484d8
mov edi, dword [esp + 0x1c]
lea ebx, [esi + 0x10]
mov ebp, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
cmp ecx, 0x10
jae 0x101484f7
mov eax, 0x10
sub eax, ecx
push eax
lea eax, [ecx + esi]
push 0
push eax
call fcn.101960f0
add esp, 0xc
push ebp
lea eax, [esp + 0x30]
push eax
push esi
call edi
mov eax, dword [esp + 0x38]
add esp, 0xc
xor dword [ebx], eax
mov eax, dword [esp + 0x30]
xor dword [ebx + 4], eax
mov eax, dword [esp + 0x34]
xor dword [esi + 0x18], eax
mov eax, dword [esp + 0x38]
xor dword [esi + 0x1c], eax
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x3c]
pop edi
mov byte [esi], al
xor eax, eax
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10193ea5
add esp, 0x30
ret
Function at 0x1014a3c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.101949d0
mov edx, dword [esp + 0x1c]
xor ecx, ecx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x28]
test edx, edx
je 0x1014a517
push ebx
push ebp
mov ebp, dword [esp + 0x28]
cmp edx, 8
jb 0x1014a4fa
lea eax, [ebp - 1]
lea ebx, [edi - 1]
add eax, edx
add ebx, edx
cmp edi, eax
ja 0x1014a407
cmp ebx, ebp
jae 0x1014a4fa
lea eax, [edx - 1]
add eax, esi
cmp edi, eax
ja 0x1014a418
cmp ebx, esi
jae 0x1014a4fa
cmp edx, 0x40
jb 0x1014a4bc
mov ebx, edx
mov eax, edx
and ebx, 0x3f
mov edx, esi
sub eax, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
mov ebx, esi
lea eax, [edi + 0x20]
sub ebx, ebp
mov dword [esp + 0x10], eax
mov ebp, edi
mov eax, dword [esp + 0x28]
sub ebp, eax
sub edx, edi
mov edi, dword [esp + 0x10]
mov dword [esp + 0x14], edx
lea edx, [eax + 0x10]
movups xmm0, xmmword [edx - 0x10]
mov eax, dword [esp + 0x14]
lea edx, [edx + 0x40]
movups xmm1, xmmword [ecx + esi]
lea edi, [edi + 0x40]
xorps xmm1, xmm0
movups xmmword [edi - 0x60], xmm1
movups xmm0, xmmword [edx - 0x40]
movups xmm1, xmmword [ebx + edx - 0x40]
xorps xmm1, xmm0
movups xmmword [edx + ebp - 0x40], xmm1
movups xmm1, xmmword [eax + edi - 0x40]
mov eax, dword [esp + 0x28]
movups xmm0, xmmword [edx - 0x30]
xorps xmm1, xmm0
movups xmmword [edi - 0x40], xmm1
movups xmm1, xmmword [ecx + esi + 0x30]
add ecx, 0x40
movups xmm0, xmmword [edx - 0x20]
xorps xmm1, xmm0
movups xmmword [edi - 0x30], xmm1
cmp ecx, dword [esp + 0x18]
jb 0x1014a454
cmp dword [esp + 0x1c], 8
mov edx, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
jb 0x1014a4f2
jmp 0x1014a4c8
mov eax, dword [esp + 0x28]
mov ebx, esi
sub ebx, ebp
mov ebp, edi
sub ebp, eax
mov dword [esp + 0x2c], edx
and dword [esp + 0x2c], 0xfffffff8
add eax, ecx
movq xmm1, qword [eax + ebx]
lea eax, [eax + 8]
movq xmm0, qword [eax - 8]
add ecx, 8
xorps xmm1, xmm0
movq qword [eax + ebp - 8], xmm1
cmp ecx, dword [esp + 0x2c]
jb 0x1014a4d3
cmp ecx, edx
jae 0x1014a515
mov ebp, dword [esp + 0x28]
sub esi, ebp
lea eax, [ecx + ebp]
sub edi, ebp
sub edx, ecx
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [edi + eax - 1], cl
sub edx, 1
jne 0x1014a503
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x10
ret
Function at 0x1014a630
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.101949d0
mov ecx, dword [esp + 0xc]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
lea ebp, [ecx + 0x40]
mov esi, dword [ecx + 0x14]
cmp edi, esi
jbe 0x1014a6da
mov edx, dword [ecx + 0x18]
cmp edi, edx
jb 0x1014a68d
mov eax, edi
sub eax, edx
add eax, 4
and eax, 0xfffffffc
add eax, edx
push 0x71
mov dword [ecx + 0x18], eax
push str.cryptomodesocb128.c
shl eax, 4
push eax
push dword [ebp]
call fcn.10069f10
add esp, 0x10
test eax, eax
jne 0x1014a68a
pop edi
pop esi
pop ebp
add esp, 8
ret
mov dword [ebp], eax
mov eax, esi
shl eax, 4
mov dword [esp + 0x10], eax
mov eax, edi
mov edi, dword [esp + 0x10]
sub eax, esi
mov dword [esp + 0xc], eax
push ebx
mov eax, dword [ebp]
add eax, edi
mov bl, byte [eax]
lea esi, [eax + 0x10]
push esi
shr bl, 7
push 1
neg bl
push eax
and bl, 0x87
call fcn.1014a330
xor byte [esi + 0xf], bl
add esp, 0xc
add edi, 0x10
sub dword [esp + 0x10], 1
jne 0x1014a6a3
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
pop ebx
mov dword [eax + 0x14], edi
shl edi, 4
add edi, dword [ebp]
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 8
ret
Function at 0x1014e3c0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x1014e3d4
mov dword [esp + 0x18], fcn.1014cc00
jmp fcn.10145e50
mov dword [esp + 0x18], fcn.1014be90
jmp fcn.10145b50
Function at 0x101509a0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.10140ef0
add esp, 4
test eax, eax
jne 0x101509b4
pop esi
ret
lea eax, [esi + 0x5c]
pop esi
mov dword [esp + 4], eax
jmp fcn.10075d10
Function at 0x10156a20
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0xa8
push 0
lea eax, [esi + 0x40]
push eax
call fcn.101960f0
mov edx, dword [esp + 0x18]
add esp, 0xc
mov dword [esi], 0xf3bcc908
mov dword [esi + 4], 0x6a09e667
mov dword [esi + 8], 0x84caa73b
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0xfe94f82b
mov dword [esi + 0x14], 0x3c6ef372
mov dword [esi + 0x18], 0x5f1d36f1
mov dword [esi + 0x1c], 0xa54ff53a
mov dword [esi + 0x20], 0xade682d1
mov dword [esi + 0x24], 0x510e527f
mov dword [esi + 0x28], 0x2b3e6c1f
mov dword [esi + 0x2c], 0x9b05688c
mov dword [esi + 0x30], 0xfb41bd6b
mov dword [esi + 0x34], 0x1f83d9ab
mov dword [esi + 0x38], 0x137e2179
mov dword [esi + 0x3c], 0x5be0cd19
movzx eax, byte [edx]
mov dword [esi + 0xe4], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
xor ecx, 0xf3bcc908
mov dword [esi], ecx
xor eax, 0x6a09e667
mov dword [esi + 4], eax
mov ecx, dword [edx + 8]
mov eax, dword [edx + 0xc]
xor ecx, 0x84caa73b
mov dword [esi + 8], ecx
xor eax, 0xbb67ae85
mov dword [esi + 0xc], eax
mov ecx, dword [edx + 0x10]
mov eax, dword [edx + 0x14]
xor ecx, 0xfe94f82b
mov dword [esi + 0x10], ecx
xor eax, 0x3c6ef372
mov dword [esi + 0x14], eax
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x1c]
xor ecx, 0x5f1d36f1
mov dword [esi + 0x18], ecx
xor eax, 0xa54ff53a
mov dword [esi + 0x1c], eax
mov ecx, dword [edx + 0x20]
mov eax, dword [edx + 0x24]
xor ecx, 0xade682d1
mov dword [esi + 0x20], ecx
xor eax, 0x510e527f
mov dword [esi + 0x24], eax
mov ecx, dword [edx + 0x28]
mov eax, dword [edx + 0x2c]
xor ecx, 0x2b3e6c1f
xor eax, 0x9b05688c
mov dword [esi + 0x28], ecx
mov dword [esi + 0x2c], eax
mov ecx, dword [edx + 0x30]
mov eax, dword [edx + 0x34]
xor ecx, 0xfb41bd6b
xor eax, 0x1f83d9ab
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
mov ecx, dword [edx + 0x38]
mov eax, dword [edx + 0x3c]
xor ecx, 0x137e2179
xor eax, 0x5be0cd19
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
pop esi
ret
Function at 0x101591d0
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x58
push 0
lea eax, [esi + 0x20]
push eax
call fcn.101960f0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
movzx eax, byte [ecx]
mov dword [esi + 0x74], eax
mov eax, dword [ecx]
xor eax, 0x6a09e667
mov dword [esi], eax
mov eax, dword [ecx + 4]
xor eax, 0xbb67ae85
mov dword [esi + 4], eax
mov eax, dword [ecx + 8]
xor eax, 0x3c6ef372
mov dword [esi + 8], eax
mov eax, dword [ecx + 0xc]
xor eax, 0xa54ff53a
mov dword [esi + 0xc], eax
mov eax, dword [ecx + 0x10]
xor eax, 0x510e527f
mov dword [esi + 0x10], eax
mov eax, dword [ecx + 0x14]
xor eax, 0x9b05688c
mov dword [esi + 0x14], eax
mov eax, dword [ecx + 0x18]
xor eax, 0x1f83d9ab
mov dword [esi + 0x18], eax
mov eax, dword [ecx + 0x1c]
xor eax, 0x5be0cd19
mov dword [esi + 0x1c], eax
pop esi
ret