joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ad10
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc0
push esi
mov esi, dword [esp + 0xc8]
lea eax, [esp + 4]
push 0
push eax
lea eax, [esp + 0x8c]
movups xmm0, xmmword [esi]
push eax
movups xmmword [esp + 0x90], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [esp + 0xa0], xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [esp + 0xb0], xmm0
movups xmm0, xmmword [esi + 0x30]
movups xmmword [esp + 0xc0], xmm0
call fcn.1000ae60
push 1
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1000ae60
push 2
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x64]
push eax
call fcn.1000ae60
push 3
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.1000ae60
push 4
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x7c]
push eax
call fcn.1000ae60
push 5
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x48]
push eax
call fcn.1000ae60
add esp, 0x48
lea eax, [esp + 4]
push 6
push eax
lea eax, [esp + 0x4c]
push eax
call fcn.1000ae60
push 7
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1000ae60
push 8
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x64]
push eax
call fcn.1000ae60
push 9
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.1000ae60
lea ecx, [esp + 0xb4]
add esp, 0x30
lea edx, [esp + 0x94]
sub ecx, esi
sub edx, esi
mov eax, 2
nop dword [eax]
lea esi, [esi + 0x20]
movups xmm0, xmmword [esi - 0x20]
movups xmm1, xmmword [ecx + esi - 0x20]
pxor xmm1, xmm0
movups xmmword [esi - 0x20], xmm1
movups xmm0, xmmword [esi - 0x10]
movups xmm1, xmmword [edx + esi - 0x20]
pxor xmm1, xmm0
movups xmmword [esi - 0x10], xmm1
sub eax, 1
jne 0x1000ae20
pop esi
add esp, 0xc0
ret
Function at 0x10017cc0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x3c], 0
mov dword [eax + 0x38], 0
mov dword [eax + 0x34], 0
mov dword [eax + 0x30], 0
mov dword [eax + 0x2c], 0
mov dword [eax + 0x28], 0
mov dword [eax + 0x24], 0
mov dword [eax + 0x20], 0
ret

Function at 0x10017e40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
movups xmm1, xmmword [eax]
movups xmm3, xmmword [eax + 0x10]
mov eax, dword [esp + 8]
movaps xmm2, xmm1
pslldq xmm2, 4
movaps xmm0, xmm2
pslldq xmm2, 4
pxor xmm0, xmm1
movaps xmmword [eax], xmm1
movaps xmm4, xmm2
movaps xmmword [eax + 0x10], xmm3
pxor xmm4, xmm0
pslldq xmm2, 4
pxor xmm4, xmm2
movaps xmm1, xmm3
pslldq xmm1, 4
aeskeygenassist xmm0, xmm3, 1
pshufd xmm0, xmm0, 0xff
pxor xmm4, xmm0
movaps xmm0, xmm1
pxor xmm0, xmm3
pslldq xmm1, 4
movaps xmm2, xmm1
movaps xmmword [eax + 0x20], xmm4
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
movaps xmm1, xmm4
pslldq xmm1, 4
aeskeygenassist xmm0, xmm4, 0
pshufd xmm0, xmm0, 0xaa
pxor xmm2, xmm0
movaps xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm4
movaps xmm3, xmm1
movaps xmmword [eax + 0x30], xmm2
pxor xmm3, xmm0
pslldq xmm1, 4
pxor xmm3, xmm1
movaps xmm1, xmm2
aeskeygenassist xmm0, xmm2, 2
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
pslldq xmm1, 4
movaps xmm0, xmm1
movaps xmmword [eax + 0x40], xmm3
pxor xmm0, xmm2
pslldq xmm1, 4
movaps xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
movaps xmm1, xmm3
aeskeygenassist xmm0, xmm3, 0
pshufd xmm0, xmm0, 0xaa
pxor xmm2, xmm0
pslldq xmm1, 4
movaps xmm0, xmm1
movaps xmmword [eax + 0x50], xmm2
pxor xmm0, xmm3
pslldq xmm1, 4
movaps xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
movaps xmm1, xmm2
aeskeygenassist xmm0, xmm2, 4
pshufd xmm0, xmm0, 0xff
pxor xmm3, xmm0
pslldq xmm1, 4
movaps xmm0, xmm1
movaps xmmword [eax + 0x60], xmm3
pxor xmm0, xmm2
pslldq xmm1, 4
movaps xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm0, xmm0, 0xaa
movaps xmm1, xmm3
pxor xmm2, xmm0
pslldq xmm1, 4
movaps xmm0, xmm1
movaps xmmword [eax + 0x70], xmm2
pxor xmm0, xmm3
pslldq xmm1, 4
movaps xmm4, xmm1
pslldq xmm1, 4
pxor xmm4, xmm0
pxor xmm4, xmm1
movaps xmm1, xmm2
aeskeygenassist xmm0, xmm2, 8
pshufd xmm0, xmm0, 0xff
pxor xmm4, xmm0
pslldq xmm1, 4
movaps xmm0, xmm1
movaps xmmword [eax + 0x80], xmm4
pxor xmm0, xmm2
pslldq xmm1, 4
movaps xmm3, xmm1
movaps xmm2, xmm4
pxor xmm3, xmm0
pslldq xmm1, 4
pxor xmm3, xmm1
pslldq xmm2, 4
aeskeygenassist xmm0, xmm4, 0
pshufd xmm0, xmm0, 0xaa
pxor xmm3, xmm0
movaps xmm0, xmm2
pslldq xmm2, 4
pxor xmm0, xmm4
movaps xmm1, xmm2
movaps xmmword [eax + 0x90], xmm3
pxor xmm1, xmm0
pslldq xmm2, 4
aeskeygenassist xmm0, xmm3, 0x10
pxor xmm1, xmm2
pshufd xmm0, xmm0, 0xff
pxor xmm1, xmm0
movaps xmmword [eax + 0xa0], xmm1
ret
Function at 0x10018050
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov edx, dword [esp + 0x10]
test edx, edx
jle 0x100180c3
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
sub esi, ecx
nop word [eax + eax]
lea ecx, [ecx + 0x10]
movups xmm0, xmmword [ecx - 0x10]
aesenc xmm0, xmmword [eax]
aesenc xmm0, xmmword [eax + 0x10]
aesenc xmm0, xmmword [eax + 0x20]
aesenc xmm0, xmmword [eax + 0x30]
aesenc xmm0, xmmword [eax + 0x40]
aesenc xmm0, xmmword [eax + 0x50]
aesenc xmm0, xmmword [eax + 0x60]
aesenc xmm0, xmmword [eax + 0x70]
aesenc xmm0, xmmword [eax + 0x80]
aesenc xmm0, xmmword [eax + 0x90]
movups xmmword [esi + ecx - 0x10], xmm0
sub edx, 1
jne 0x10018070
pop esi
ret

Function at 0x100180d0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov edx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x14]
test edx, edx
jle 0x1001814d
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x10]
sub edi, ecx
nop dword [eax]
movaps xmm0, xmmword [esi]
lea esi, [esi + 0x10]
lea ecx, [ecx + 0x10]
movups xmm1, xmmword [ecx - 0x10]
pxor xmm1, xmm0
aesenc xmm1, xmmword [eax]
aesenc xmm1, xmmword [eax + 0x10]
aesenc xmm1, xmmword [eax + 0x20]
aesenc xmm1, xmmword [eax + 0x30]
aesenc xmm1, xmmword [eax + 0x40]
aesenc xmm1, xmmword [eax + 0x50]
aesenc xmm1, xmmword [eax + 0x60]
aesenc xmm1, xmmword [eax + 0x70]
aesenc xmm1, xmmword [eax + 0x80]
aesenc xmm1, xmmword [eax + 0x90]
movups xmmword [edi + ecx - 0x10], xmm1
sub edx, 1
jne 0x100180f0
pop edi
pop esi
ret

Function at 0x1001dc20
Capabilities:
Hash data using djb2

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
lea eax, [ebp*4]
push eax
call fcn.1001e4f0
mov ebx, dword [esp + 0x20]
xor ecx, ecx
add esp, 4
mov dword [esp + 0xc], ecx
mov esi, eax
mov dword [esp + 0x10], esi
cmp dword [ebx], ecx
jbe 0x1001dce0
push edi
mov eax, dword [ebx + 4]
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x1001dcd2
nop dword [eax]
mov ebp, dword [edi]
xor edx, edx
mov eax, dword [edi + 8]
mov esi, 0x1505
mov dword [edi + 8], 0
mov dword [esp + 0x18], eax
mov ebx, dword [ebp + 4]
test ebx, ebx
je 0x1001dc93
mov ebp, dword [ebp + 8]
movzx ecx, byte [edx + ebp]
mov eax, esi
shl eax, 5
inc edx
add esi, eax
add esi, ecx
cmp edx, ebx
jb 0x1001dc81
mov ebp, dword [esp + 0x24]
mov eax, esi
xor edx, edx
mov esi, dword [esp + 0x14]
div ebp
mov ecx, dword [esi + edx*4]
test ecx, ecx
jne 0x1001dcad
mov dword [esi + edx*4], edi
jmp 0x1001dcc0
mov eax, dword [ecx + 8]
test eax, eax
je 0x1001dcbd
mov ecx, eax
mov eax, dword [ecx + 8]
test eax, eax
jne 0x1001dcb4
mov dword [ecx + 8], edi
mov eax, dword [esp + 0x18]
mov edi, eax
test eax, eax
jne 0x1001dc60
mov ecx, dword [esp + 0x10]
mov ebx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, dword [ebx]
jb 0x1001dc53
pop edi
push dword [ebx + 4]
call fcn.1001e430
add esp, 4
mov dword [ebx + 4], esi
mov dword [ebx], ebp
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x1001dd00
Capabilities:
Hash data using djb2

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
push esi
push edi
mov esi, 0x1505
mov edi, dword [eax + 4]
test edi, edi
je 0x1001dd33
push ebx
mov ebx, dword [eax + 8]
nop dword [eax + eax]
movzx edx, byte [ebx + ecx]
mov eax, esi
shl eax, 5
inc ecx
add esi, eax
add esi, edx
cmp ecx, edi
jb 0x1001dd20
pop ebx
mov eax, esi
xor edx, edx
div dword [esp + 0x10]
pop edi
mov eax, edx
pop esi
ret

Function at 0x1001ded0
Capabilities:
Hash data using djb2

Disassembly:
sub esp, 0xc
lea eax, [esp + 0x14]
mov dword [esp], 0
push esi
mov dword [esp + 8], 4
mov esi, 0x1505
mov dword [esp + 0xc], eax
xor edx, edx
movzx ecx, byte [esp + edx + 0x18]
mov eax, esi
shl eax, 5
inc edx
add esi, eax
add esi, ecx
cmp edx, 4
jb 0x1001def2
mov eax, esi
xor edx, edx
mov esi, dword [esp + 0x14]
div dword [esi]
mov esi, dword [esi + 4]
mov esi, dword [esi + edx*4]
test esi, esi
jne 0x1001df21
xor eax, eax
pop esi
add esp, 0xc
ret
lea eax, [esp + 4]
push eax
push dword [esi]
call fcn.1001bef0
add esp, 8
test al, al
jne 0x1001df42
mov esi, dword [esi + 8]
test esi, esi
jne 0x1001df21
xor eax, eax
pop esi
add esp, 0xc
ret
mov eax, dword [esi + 4]
pop esi
add esp, 0xc
ret

Function at 0x1001eec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xe0
push ebx
mov ebx, dword [esp + 0xe8]
push ebp
push esi
push edi
mov eax, dword [ebx + 0x3c]
xor edi, edi
mov ebp, dword [eax + ebx + 0x78]
mov eax, dword [ebp + ebx + 0x20]
add ebp, ebx
add eax, ebx
mov dword [esp + 0x10], eax
mov ecx, dword [ebp + 0x24]
add ecx, ebx
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp + 0x1c]
add ecx, ebx
mov dword [esp + 0x18], ecx
cmp dword [ebp + 0x18], edi
jbe 0x1001efc4
mov eax, dword [eax + edi*4]
xor esi, esi
add eax, ebx
mov cl, byte [eax]
test cl, cl
je 0x1001ef25
lea edx, [esp + 0x30]
sub edx, eax
cmp esi, 0x5a
jae 0x1001ef25
mov byte [edx + eax], cl
inc esi
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001ef14
mov eax, dword [esp + 0xf8]
movq xmm0, qword [eax + 0x14]
mov ax, word [eax + 0x1c]
movq qword [esp + esi + 0x30], xmm0
mov word [esp + esi + 0x38], ax
lea eax, [esp + 0x94]
push eax
call fcn.10033f10
lea eax, [esi + 0xa]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0xa0]
push eax
call fcn.10035170
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.10033da0
mov edx, dword [esp + 0x110]
lea ecx, [esp + 0x34]
add esp, 0x18
mov esi, 0x10
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1001efb5
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1001ef88
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
movzx eax, word [eax + edi*2]
pop edi
pop esi
pop ebp
mov eax, dword [ecx + eax*4]
add eax, ebx
pop ebx
add esp, 0xe0
ret
inc edi
cmp edi, dword [ebp + 0x18]
jae 0x1001efc4
mov eax, dword [esp + 0x10]
jmp 0x1001ef01
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xe0
ret
Function at 0x1001efe0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0x30]
sub esp, 0x1d8
push ebx
push ebp
mov ebp, dword [eax + 0xc]
add ebp, 0x14
push esi
push edi
mov ebx, dword [ebp]
cmp ebx, ebp
je 0x1001f0e0
mov edi, dword [ebx + 0x28]
lea esi, [esp + 0xe4]
nop dword [eax + eax]
movsx eax, byte [edi]
push eax
call fcn.10046e60
add esp, 4
mov byte [esi], al
lea esi, [esi + 1]
lea edi, [edi + 2]
test al, al
jne 0x1001f010
xor esi, esi
cmp byte [esp + 0xe4], al
je 0x1001f04e
cmp esi, 0x5a
jae 0x1001f04e
mov al, byte [esp + esi + 0xe4]
mov byte [esp + esi + 0x24], al
inc esi
cmp byte [esp + esi + 0xe4], 0
jne 0x1001f033
mov edi, dword [esp + 0x1ec]
movq xmm0, qword [edi + 0x14]
mov ax, word [edi + 0x1c]
movq qword [esp + esi + 0x24], xmm0
mov word [esp + esi + 0x2c], ax
lea eax, [esp + 0x88]
push eax
call fcn.10033f10
add esi, 0xa
lea eax, [esp + 0x28]
push esi
push eax
lea eax, [esp + 0x94]
push eax
call fcn.10035170
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.10033da0
add esp, 0x18
lea ecx, [esp + 0x10]
mov edx, edi
mov esi, 0x10
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1001f0cf
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1001f0b0
mov eax, dword [ebx + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1d8
ret
mov ebx, dword [ebx]
cmp ebx, ebp
jne 0x1001f001
nop dword [eax]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1d8
ret

Function at 0x10021af0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
cmp dword [eax + 4], 0
jne 0x10021afd
xor eax, eax
ret
push ebx
push 1
push eax
call fcn.1001c7b0
mov ebx, eax
add esp, 8
xor eax, eax
test ebx, ebx
je 0x10021b7c
cmp dword [ebx + 4], eax
jbe 0x10021b23
mov ecx, dword [ebx + 8]
xor byte [ecx + eax], 0x5c
inc eax
cmp eax, dword [ebx + 4]
jb 0x10021b16
cmp dword [ebx + 4], 4
jae 0x10021b36
push ebx
call fcn.1001bed0
add esp, 4
xor eax, eax
pop ebx
ret
mov eax, dword [ebx + 8]
push esi
push edi
movzx ecx, byte [eax + 2]
movzx eax, byte [eax + 3]
push ecx
add eax, 4
push eax
push ebx
call fcn.1001c400
mov ecx, dword [esp + 0x1c]
mov edi, eax
push 0
mov edx, dword [ecx + 4]
mov ecx, dword [esp + 0x24]
add edx, dword [ecx + 4]
push edx
push edi
call fcn.1001c400
push ebx
mov esi, eax
call fcn.1001bed0
push edi
call fcn.1001bed0
add esp, 0x20
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x10024c90
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
cmp dword [esi + 4], 0x40
jbe 0x10024caa
call fcn.10025630
mov ebx, eax
push ebx
jmp 0x10024cb2
call fcn.1001be30
mov ebx, eax
push esi
call fcn.1001be30
add esp, 8
mov ebp, eax
push 0
push 0x40
push ebx
call fcn.1001c640
push 0
push 0x40
push ebp
call fcn.1001c640
mov edi, dword [ebp + 8]
lea edx, [ebx + 8]
mov ecx, dword [edx]
add esp, 0x18
xor eax, eax
lea esi, [edi + 0x3f]
mov dword [esp + 0x18], esi
lea esi, [ecx + 0x3f]
mov dword [esp + 0x10], esi
cmp edi, esi
lea esi, [ebp + 8]
ja 0x10024cf8
cmp dword [esp + 0x18], ecx
jae 0x10024d20
cmp edi, edx
ja 0x10024d02
cmp dword [esp + 0x18], edx
jae 0x10024d20
cmp edi, esi
ja 0x10024d0c
cmp dword [esp + 0x18], esi
jae 0x10024d20
cmp ecx, edx
ja 0x10024d16
cmp dword [esp + 0x10], edx
jae 0x10024d20
cmp ecx, esi
ja 0x10024d34
cmp dword [esp + 0x10], esi
jb 0x10024d34
mov ecx, dword [edx]
xor byte [ecx + eax], 0x36
mov ecx, dword [esi]
xor byte [ecx + eax], 0x5c
inc eax
cmp eax, 0x40
jl 0x10024d20
jmp 0x10024d84
movaps xmm2, xmmword [str.6666666666666666ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
movaps xmm3, xmmword [0x1004ba20]
movups xmm0, xmmword [ecx + eax]
movaps xmm1, xmm2
pxor xmm0, xmm2
movups xmmword [ecx + eax], xmm0
movups xmm0, xmmword [edi + eax]
pxor xmm0, xmm3
movups xmmword [edi + eax], xmm0
movups xmm0, xmmword [ecx + eax + 0x10]
pxor xmm1, xmm0
movups xmmword [ecx + eax + 0x10], xmm1
movups xmm0, xmmword [edi + eax + 0x10]
movaps xmm1, xmm3
pxor xmm1, xmm0
movups xmmword [edi + eax + 0x10], xmm1
add eax, 0x20
cmp eax, 0x40
jl 0x10024d42
push dword [esp + 0x1c]
push ebx
call fcn.1001bc60
push ebx
call fcn.10025630
mov edi, eax
push edi
push ebp
call fcn.1001bc60
push ebp
call fcn.10025630
push ebx
mov esi, eax
call fcn.1001bed0
push ebp
call fcn.1001bed0
push edi
call fcn.1001bed0
add esp, 0x24
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10024ed0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
xor ebp, ebp
xor eax, eax
push edi
test esi, esi
je 0x10025047
mov edi, dword [esp + 0x20]
nop word [eax + eax]
xor edx, edx
cmp eax, esi
jae 0x10024f04
cmp byte [eax + edi], 0x20
jne 0x10024f02
inc eax
inc edx
cmp eax, esi
jb 0x10024ef6
cmp eax, esi
je 0x10024f69
mov ecx, esi
sub ecx, eax
cmp ecx, 2
jb 0x10024f1c
cmp byte [eax + edi], 0xd
jne 0x10024f1c
cmp byte [eax + edi + 1], 0xa
je 0x10024f64
mov cl, byte [eax + edi]
cmp cl, 0xa
je 0x10024f64
test edx, edx
jne 0x1002502d
cmp cl, 0x3d
jne 0x10024f3b
inc ebx
cmp ebx, 2
ja 0x1002502d
cmp cl, 0x7f
ja 0x1002502d
movzx ecx, cl
mov cl, byte [ecx + 0x1004ba70]
cmp cl, 0x7f
je 0x1002502d
cmp cl, 0x40
jae 0x10024f63
test ebx, ebx
jne 0x1002502d
inc ebp
inc eax
cmp eax, esi
jb 0x10024ef0
test ebp, ebp
je 0x10025047
mov edx, dword [esp + 0x14]
lea ecx, [ebp*2]
add ecx, ebp
lea ecx, [ecx*2 + 7]
shr ecx, 3
sub ecx, ebx
test edx, edx
je 0x10025037
cmp dword [esp + 0x18], ecx
jb 0x10025037
xor ecx, ecx
xor ebx, ebx
mov dword [esp + 0x24], ecx
mov ebp, 3
mov esi, edx
test eax, eax
je 0x1002501e
nop
mov cl, byte [edi]
cmp cl, 0xd
je 0x10025014
cmp cl, 0xa
je 0x10025014
cmp cl, 0x20
je 0x10025014
movzx ecx, cl
mov dl, byte [ecx + 0x1004ba70]
xor ecx, ecx
cmp dl, 0x40
sete cl
shl ebx, 6
sub ebp, ecx
movzx ecx, dl
mov edx, dword [esp + 0x24]
and ecx, 0x3f
inc edx
or ebx, ecx
mov dword [esp + 0x24], edx
cmp edx, 4
jne 0x10025014
xor ecx, ecx
mov dword [esp + 0x24], ecx
test ebp, ebp
je 0x10024fff
mov ecx, ebx
shr ecx, 0x10
mov byte [esi], cl
inc esi
cmp ebp, 1
jbe 0x1002500c
mov ecx, ebx
shr ecx, 8
mov byte [esi], cl
inc esi
cmp ebp, 2
jbe 0x10025014
mov byte [esi], bl
inc esi
inc edi
sub eax, 1
jne 0x10024fb0
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
sub esi, edx
pop edi
mov dword [eax], esi
xor eax, eax
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 2
pop ebx
ret
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov eax, 1
pop ebx
ret
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [eax], 0
xor eax, eax
pop ebx
ret
Function at 0x10025060
Capabilities:
Encode data using base64

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x1c]
test ebp, ebp
jne 0x10025075
mov eax, dword [esp + 0x14]
mov dword [eax], ebp
xor eax, eax
pop ebp
pop ecx
ret
mov eax, 0xaaaaaaab
mul ebp
xor eax, eax
shr edx, 1
push esi
lea esi, [edx + edx*2]
cmp ebp, esi
setne al
add eax, edx
cmp eax, 0x3fffffff
jbe 0x100250a5
mov eax, dword [esp + 0x18]
pop esi
pop ebp
mov dword [eax], 0xffffffff
mov eax, 1
pop ecx
ret
lea ecx, [eax*4 + 1]
push edi
cmp dword [esp + 0x18], ecx
jb 0x100251cb
mov edi, dword [esp + 0x14]
test edi, edi
je 0x100251cb
xor eax, eax
mov ecx, edi
push ebx
mov ebx, dword [esp + 0x24]
test esi, esi
je 0x10025159
lea edx, [esi - 1]
mov eax, 0xaaaaaaab
mul edx
mov ebp, edx
shr ebp, 1
inc ebp
lea eax, [ebp*2]
add eax, ebp
mov dword [esp + 0x10], eax
movzx edx, byte [ebx]
movzx esi, byte [ebx + 1]
mov eax, edx
movzx edi, byte [ebx + 2]
add ebx, 3
shr eax, 2
shl edx, 4
movzx eax, byte [eax + 0x1004ba30]
mov byte [ecx], al
mov eax, esi
shr eax, 4
add eax, edx
and eax, 0x3f
movzx eax, byte [eax + 0x1004ba30]
mov byte [ecx + 1], al
mov eax, edi
shr eax, 6
and edi, 0x3f
lea eax, [eax + esi*4]
and eax, 0x3f
movzx eax, byte [eax + 0x1004ba30]
mov byte [ecx + 2], al
movzx eax, byte [edi + 0x1004ba30]
mov byte [ecx + 3], al
add ecx, 4
sub ebp, 1
jne 0x100250f0
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
cmp eax, ebp
jae 0x100251b6
movzx esi, byte [ebx]
inc eax
mov dword [esp + 0x28], eax
cmp eax, ebp
jae 0x1002516f
movzx edx, byte [ebx + 1]
jmp 0x10025171
xor edx, edx
mov eax, esi
shl esi, 4
shr eax, 2
movzx eax, byte [eax + 0x1004ba30]
mov byte [ecx], al
mov eax, edx
shr eax, 4
add eax, esi
and eax, 0x3f
movzx eax, byte [eax + 0x1004ba30]
mov byte [ecx + 1], al
cmp dword [esp + 0x28], ebp
jae 0x100251ab
and edx, 0xf
mov al, byte [edx*4 + 0x1004ba30]
mov byte [ecx + 2], al
jmp 0x100251af
mov byte [ecx + 2], 0x3d
mov byte [ecx + 3], 0x3d
add ecx, 4
mov eax, dword [esp + 0x20]
mov edx, ecx
pop ebx
sub edx, edi
pop edi
mov dword [eax], edx
xor eax, eax
pop esi
mov byte [ecx], 0
pop ebp
pop ecx
ret
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword [eax], ecx
mov eax, 1
pop ecx
ret

Function at 0x10025c50
Capabilities:
Encrypt data using curve25519

Disassembly:
mov ecx, dword [esp + 4]
mov al, byte [ecx + 0x1f]
and byte [ecx], 0xf8
and al, 0x3f
or al, 0x40
mov byte [ecx + 0x1f], al
ret
Function at 0x100323a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, 0x1f
push edi
mov edi, dword [esp + 0x18]
add esi, 2
mov edx, edi
sub ebx, edi
nop dword [eax]
mov cl, byte [ebx + edx]
lea edx, [edx + 4]
mov al, byte [edx - 4]
lea esi, [esi + 4]
and cl, 3
and al, 3
shl cl, 2
xor cl, al
mov byte [esi - 6], cl
mov ecx, dword [ebx + edx - 4]
mov eax, dword [edx - 4]
shr ecx, 2
and cl, 3
shr eax, 2
shl cl, 2
and al, 3
xor cl, al
mov byte [esi - 5], cl
mov ecx, dword [ebx + edx - 4]
mov eax, dword [edx - 4]
shr ecx, 4
and cl, 3
shr eax, 4
shl cl, 2
and al, 3
xor cl, al
mov byte [esi - 4], cl
mov ecx, dword [ebx + edx - 4]
mov eax, dword [edx - 4]
shr ecx, 6
and cl, 3
shr eax, 6
shl cl, 2
and al, 3
xor cl, al
mov byte [esi - 3], cl
sub ebp, 1
jne 0x100323c0
mov ebx, dword [esp + 0x1c]
mov al, byte [edi + 0x7c]
mov edx, dword [esp + 0x14]
and al, 3
mov cl, byte [ebx + 0x7c]
and cl, 3
shl cl, 2
xor cl, al
mov byte [edx + 0x7c], cl
mov ecx, dword [ebx + 0x7c]
mov eax, dword [edi + 0x7c]
shr ecx, 2
and cl, 3
shr eax, 2
shl cl, 2
and al, 3
xor cl, al
mov byte [edx + 0x7d], cl
mov ecx, dword [ebx + 0x7c]
mov eax, dword [edi + 0x7c]
shr ecx, 4
pop edi
and cl, 3
shr eax, 4
pop esi
shl cl, 2
and al, 3
xor cl, al
pop ebp
mov byte [edx + 0x7e], cl
pop ebx
ret

Function at 0x10032940
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x28
mov ecx, dword [esp + 0x2c]
xor edx, edx
push ebx
push ebp
push esi
lea eax, [ecx + 8]
mov ebp, 0x100669d0
push edi
mov ebx, 0x100669d4
mov dword [esp + 0x14], eax
xor edi, edi
sub ebp, ecx
sub ebx, ecx
mov esi, eax
mov eax, ebx
nop dword [eax + eax]
add edx, dword [edi*4 + 0x100669d0]
lea esi, [esi + 0x10]
mov ebx, dword [esi - 0x18]
movzx ecx, byte [esi - 0x18]
sub ebx, edx
sub cl, dl
shr ebx, 0x1f
add ebx, dword [edi*4 + 0x100669d4]
mov edx, dword [esi - 0x14]
sub edx, ebx
mov byte [esp + edi + 0x18], cl
movzx ecx, byte [esi - 0x14]
sub cl, bl
shr edx, 0x1f
add edx, dword [esi + ebp - 0x10]
mov ebx, dword [esi - 0x10]
mov byte [esp + edi + 0x19], cl
sub ebx, edx
movzx ecx, byte [esi - 0x10]
sub cl, dl
shr ebx, 0x1f
add ebx, dword [eax + esi - 0x10]
mov edx, dword [esi - 0xc]
mov byte [esp + edi + 0x1a], cl
sub edx, ebx
movzx ecx, byte [esi - 0xc]
sub cl, bl
shr edx, 0x1f
mov byte [esp + edi + 0x1b], cl
add edi, 4
cmp edi, 0x20
jl 0x10032970
mov eax, dword [esp + 0x14]
lea esi, [edx - 1]
xor edi, edi
movzx edx, byte [esp + edi + 0x19]
lea eax, [eax + 0x10]
xor edx, dword [eax - 0x14]
movzx ecx, byte [esp + edi + 0x18]
and edx, esi
xor dword [eax - 0x14], edx
movzx edx, byte [esp + edi + 0x1a]
xor edx, dword [eax - 0x10]
xor ecx, dword [eax - 0x18]
and edx, esi
xor dword [eax - 0x10], edx
and ecx, esi
movzx edx, byte [esp + edi + 0x1b]
add edi, 4
xor edx, dword [eax - 0xc]
xor dword [eax - 0x18], ecx
and edx, esi
xor dword [eax - 0xc], edx
cmp edi, 0x20
jl 0x100329e2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x10032f70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebp, 5
mov ebx, dword [edi + 0x7c]
lea esi, [edi + 0x74]
xor ebx, 0x7f
dec ebx
shr ebx, 0x1f
nop word [eax + eax]
mov ecx, dword [esi - 0x10]
lea esi, [esi - 0x18]
mov eax, dword [esi + 0xc]
xor ecx, 0xff
xor eax, 0xff
mov edx, dword [esi + 0x1c]
dec eax
dec ecx
shr eax, 0x1f
xor edx, 0xff
shr ecx, 0x1f
dec edx
and ecx, eax
shr edx, 0x1f
mov eax, dword [esi + 0x10]
xor eax, 0xff
dec eax
shr eax, 0x1f
and ecx, eax
mov eax, dword [esi + 0x14]
xor eax, 0xff
dec eax
shr eax, 0x1f
and ecx, eax
mov eax, dword [esi + 0x18]
xor eax, 0xff
dec eax
shr eax, 0x1f
and ecx, eax
and ecx, edx
and ebx, ecx
sub ebp, 1
jne 0x10032f90
mov ecx, dword [edi]
sub ecx, 0xed
not ecx
shr ecx, 0x1f
and ecx, ebx
neg ecx
mov eax, ecx
movzx edx, cl
and eax, 0x7f
sub dword [edi + 0x7c], eax
mov eax, 0x1e
nop
sub dword [edi + eax*4], edx
dec eax
test eax, eax
jg 0x10033010
and ecx, 0xed
sub dword [edi], ecx
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x10033f10
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x18], 0
mov dword [eax + 0x14], 0
ret