joyce8/EMBER2024-capa huggingface dataset:
Function at 0x621fc0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb98
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x464], edx
mov dword [ebp - 0x468], edx
mov dword [ebp - 0x45c], edx
mov dword [ebp - 0x460], edx
mov dword [ebp - 0x454], edx
mov dword [ebp - 0x458], edx
mov dword [ebp - 0x450], edx
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406b90
xor eax, eax
push ebp
push 0x622245
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
call fcn.00471a8c
test al, al
jne 0x622034
mov dword [ebp - 0x10], 0xffffffff
jmp 0x62221a
xor eax, eax
push ebp
push 0x622210
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, 2
call fcn.005100a8
mov esi, eax
mov dword [ebp - 0x244], 0x22c
lea edx, [ebp - 0x244]
mov eax, esi
call fcn.005100c8
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x6221f8
lea eax, [ebp - 0x450]
lea edx, [ebp - 0x220]
mov ecx, 0x104
call fcn.00406db8
mov eax, dword [ebp - 0x450]
lea edx, [ebp - 0xc]
call fcn.00472234
lea edx, [ebp - 0x454]
mov eax, dword [ebp - 0xc]
call fcn.004703d4
mov eax, dword [ebp - 0x454]
push eax
lea edx, [ebp - 0x458]
mov eax, 0x622264
call fcn.004703d4
mov eax, dword [ebp - 0x458]
pop edx
call fcn.0040757c
test eax, eax
jg 0x6221e5
lea edx, [ebp - 0x460]
xor eax, eax
call fcn.00403634
mov eax, dword [ebp - 0x460]
lea edx, [ebp - 0x45c]
call fcn.00472234
mov edx, dword [ebp - 0x45c]
mov eax, dword [ebp - 0xc]
call fcn.00470778
test al, al
jne 0x6221e5
push 0x62227c
mov eax, dword [0x69a164]
mov eax, dword [eax]
call eax
mov eax, dword [ebp - 0x23c]
push eax
push 0
push 0x410
call sub.kernel32.dll_OpenProcess
mov edi, eax
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, edi
call fcn.00512ee0
push 0x208
lea ecx, [ebp - 0x44c]
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.00512f10
test eax, eax
jne 0x62215e
lea eax, [ebp - 8]
xor edx, edx
call fcn.00406bfc
jmp 0x622193
lea eax, [ebp - 0x468]
lea edx, [ebp - 0x44c]
mov ecx, 0x104
call fcn.00406db8
mov eax, dword [ebp - 0x468]
lea edx, [ebp - 0x464]
call fcn.00471f60
mov eax, dword [ebp - 0x464]
lea edx, [ebp - 8]
call fcn.0047a824
push 0x622294
mov eax, dword [0x69a164]
mov eax, dword [eax]
call eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.00470668
test eax, eax
jne 0x6221e5
cmp dword [ebp - 8], 0
je 0x6221e5
cmp dword [ebp - 4], 0
je 0x6221e5
push 0
mov eax, dword [ebp - 0x23c]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 0x10], eax
push 0xc8
mov eax, dword [0x69a508]
mov eax, dword [eax]
call eax
lea edx, [ebp - 0x244]
mov eax, esi
call fcn.005100e8
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x622072
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x62221a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62224c
lea eax, [ebp - 0x468]
mov edx, 7
call fcn.00406ba0
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406ba0
ret
Function at 0x622bc8
Capabilities:
Check for time delay via gettickcount
Delete service
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28], edx
xor eax, eax
push ebp
push 0x622d69
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x622d19
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x622c16
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x622d53
xor eax, eax
push ebp
push 0x622d08
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0x622d78
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x622cea
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jbe 0x622cd3
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
lea eax, [ebp - 0x24]
push eax
push 1
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x69a06c]
mov eax, dword [eax]
call eax
test eax, eax
je 0x622cca
push 0x3e8
mov eax, dword [0x69a508]
mov eax, dword [eax]
call eax
jmp 0x622cb9
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x7530
jbe 0x622ca5
call fcn.0040541c
call fcn.0040541c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x622d53
cmp dword [ebp - 0x20], 3
jne 0x622cca
push 0x3e8
mov eax, dword [0x69a508]
mov eax, dword [eax]
call eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
jne 0x622c80
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_DeleteService
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x622cf1
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x622d70
lea eax, [ebp - 0x28]
call fcn.00406b98
ret
Function at 0x626230
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x6264cc
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x6e2b30], 0
je 0x626268
mov edx, dword [0x6e2b30]
mov eax, esi
call fcn.00625324
mov eax, dword [0x6e2b40]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x626299
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [0x6e2b40]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00625324
dec ebx
cmp ebx, 0xffffffff
jne 0x62627a
mov eax, dword [0x6e2b40]
mov edx, dword [eax]
call dword [edx + 0x44]
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.0047b694
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00471f60
mov edx, dword [ebp - 0xc]
mov eax, 0x6e2b50
call fcn.00406ba8
cmp byte [ebp - 1], 0
je 0x6264b1
mov eax, dword [0x699a40]
cmp byte [eax], 0
je 0x626349
push 0x6264e8
mov eax, dword [0x6e2b38]
mov edx, dword [eax]
call dword [edx + 0x14]
lea edx, [ebp - 0x18]
call fcn.004712c8
push dword [ebp - 0x18]
push 0x626524
mov eax, dword [0x6e2b3c]
mov edx, dword [eax]
call dword [edx + 0x14]
lea edx, [ebp - 0x1c]
call fcn.004712c8
push dword [ebp - 0x1c]
push 0x626540
push dword [0x6e2b2c]
push 0x626560
push dword [0x6e2b30]
push 0x62657c
push dword [0x6e2b50]
lea eax, [ebp - 0x14]
mov edx, 0xa
call fcn.0040705c
mov eax, dword [ebp - 0x14]
call fcn.00406c34
push eax
call sub.kernel32.dll_OutputDebugStringW
mov eax, dword [0x69732c]
call fcn.004a0f9c
mov eax, dword [0x697330]
call fcn.004a0f9c
call fcn.005367a0
mov ebx, dword [0x6e2b38]
call fcn.00404a2c
mov eax, ebx
call fcn.00404d4c
or edx, 0xffffffff
call fcn.00404ad8
xor edx, edx
push ebp
push 0x6263ac
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x6e2b38]
mov edx, dword [eax]
call dword [edx + 0x44]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6263b3
mov eax, dword [0x6e2b38]
call fcn.00404cbc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6264d3
lea eax, [ebp - 0x1c]
mov edx, 6
call fcn.00406ba0
ret
Function at 0x67c3bc
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff28
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0xcc]
mov edx, dword [0x46fc08]
call fcn.00407644
xor eax, eax
push ebp
push 0x67c4e4
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
mov cl, 1
mov dl, 1
mov eax, dword [0x544204]
call fcn.005451e4
mov ebx, eax
lea eax, [ebp - 4]
push eax
mov ecx, 0x67c504
mov edx, 0x67c538
mov eax, ebx
call fcn.0054901c
cmp dword [ebp - 4], 0
jne 0x67c432
lea eax, [ebp - 4]
push eax
mov ecx, 0x67c554
mov edx, 0x67c538
mov eax, ebx
call fcn.0054901c
mov eax, ebx
call fcn.00404490
mov dword [ebp - 0xd0], 0xffffffff
cmp dword [ebp - 4], 0
je 0x67c4af
xor eax, eax
push ebp
push 0x67c4a5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xb8]
mov edx, 0x67c584
call fcn.00406bfc
mov word [ebp - 0xc4], 0x2d
lea edx, [ebp - 0xcc]
mov eax, dword [ebp - 4]
call fcn.00478214
fstp qword [ebp - 0xd8]
wait
call fcn.0047566c
fsub qword [ebp - 0xd8]
call fcn.004036d0
mov dword [ebp - 0xd0], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x67c4af
mov eax, dword [ebp - 4]
call fcn.00406c34
push eax
call sub.kernel32.dll_OutputDebugStringW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67c4eb
lea eax, [ebp - 0xcc]
mov edx, dword [0x46fc08]
call fcn.0040771c
lea eax, [ebp - 4]
call fcn.00406b98
ret
Function at 0x67de9c
Capabilities:
Create process on windows
Print debug messages

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x67dea4
xor eax, eax
push ebp
push 0x67e09d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [0x6998d4]
mov eax, dword [eax]
mov edx, dword [eax + 0x30]
lea eax, [ebp - 0x1c]
mov ecx, 0x67e0b4
call fcn.00406f8c
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x517550]
call fcn.005183c8
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x67e06e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x67e104
lea eax, [ebp - 4]
push eax
mov ecx, 0x67e114
mov edx, 0x67e130
mov eax, dword [ebp - 0x18]
call fcn.005182dc
push 0x67e104
lea eax, [ebp - 8]
push eax
mov ecx, 0x67e158
mov edx, 0x67e130
mov eax, dword [ebp - 0x18]
call fcn.005182dc
push 0x67e104
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x67e174
mov edx, 0x67e130
mov eax, dword [ebp - 0x18]
call fcn.005182dc
push 0x67e198
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x67e1b4
mov edx, 0x67e1e8
mov eax, dword [ebp - 0x18]
call fcn.005182dc
lea eax, [ebp - 0x10]
call fcn.0067da14
push 0x67e200
push dword [ebp - 0x10]
push 0x67e228
push dword [ebp - 0x14]
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.0040705c
mov eax, dword [ebp - 0x20]
call fcn.00406c34
push eax
call sub.kernel32.dll_OutputDebugStringW
mov ecx, 3
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.0059dfac
lea edx, [ebp - 0x28]
call fcn.004712c8
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x67e23c
call fcn.00406f8c
mov eax, dword [ebp - 0x24]
call fcn.00406c34
push eax
call sub.kernel32.dll_OutputDebugStringW
mov ecx, 3
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.0059dfac
inc eax
jne 0x67e058
push 0x67e25c
call sub.kernel32.dll_OutputDebugStringW
push 0
push 0x67e280
push ebp
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x14]
call fcn.0067dda4
pop ecx
mov eax, dword [ebp - 0x34]
lea edx, [ebp - 0x30]
call fcn.005495d0
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0x67e290
call fcn.00406f8c
mov eax, dword [ebp - 0x2c]
call fcn.00406c34
push eax
mov eax, dword [0x6998d4]
mov eax, dword [eax]
mov edx, dword [eax + 0xa0]
lea eax, [ebp - 0x38]
mov ecx, 0x67e2bc
call fcn.00406f8c
mov eax, dword [ebp - 0x38]
call fcn.00406c34
push eax
push 0x67e2d0
push 0
call sub.shell32.dll_ShellExecuteW
mov edx, 0x67e130
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
call dword [ecx + 0x50]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x67e075
mov eax, dword [ebp - 0x18]
call fcn.00404490
ret
Function at 0x401c57
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x401c66
pop dword [ebp - 8]
mov eax, 0x18fed7eb
add eax, 0xe741447b
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xd7b2de61
add dword [ebp - 0x18], 0x769f66ea
mov dword [ebp - 0x14], 0x218e5398
sub dword [ebp - 0x14], 0xef5b0753
mov dword [ebp - 0x10], 0xc216b46a
add dword [ebp - 0x10], 0x8a358fc4
mov dword [ebp - 0xc], 0xb2a15d1b
add dword [ebp - 0xc], 0x4d5ea2e5
lea eax, [ebp - 0x18]
push eax
mov eax, 0xe9ee92df
add eax, 0x16519d75
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xc6e63931
add dword [ebp - 0x18], 0xad8c3025
mov dword [ebp - 0x14], 0xa47ee362
sub dword [ebp - 0x14], 0x631281ed
mov dword [ebp - 0x10], 0x61bc40f9
add dword [ebp - 0x10], 0x1b32b73
mov dword [ebp - 0xc], 0xdcb7164
sub dword [ebp - 0xc], 0xdcb7164
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x87b2defe
sub eax, 0x8772aed2
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x363ba
push 0
call eax
mov ecx, 0x6d5b9967
sub ecx, 0x6d5b5265
xor ebx, ebx
add ebx, eax
mov esi, 0x407000
add esi, dword [ebp - 8]
mov edi, 0x9161fe6
sub edi, 0x4929a5aa
mov edx, dword [esi]
xor dword [ebp - 4], 0xcf28972
add edx, edi
sub dword [ebp - 4], ecx
mov dword [ebx], edx
add ebx, 4
add esi, 0x308b58b6
sub esi, 0x308b58b2
loop 0x401d84
add eax, 0xddec324c
add eax, 0x2214dc8f
xor ebx, ebx
add ebx, eax
add eax, 0x420be5b5
add eax, 0xbdf41a50
mov ecx, 0x2294f327
add ecx, 0xddab0cd9
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x401fb2
Capabilities:
Delete file
Move file

Disassembly:
mov ecx, 0x404f28
jmp fcn.0040170c

Function at 0x401ff6
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push esi
mov esi, 0x404f28
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402013
push esi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
je 0x402018
push 1
pop eax
pop esi
ret
call fcn.00401fb2
pop esi
ret
Function at 0x10001000
Capabilities:
Hash data using sha256

Disassembly:
push 0x180
push 0
push esi
call fcn.100148d0
add esp, 0xc
mov dword [esi], 0xf3bcc908
mov dword [esi + 4], 0x6a09e667
mov dword [esi + 8], 0x84caa73b
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0xfe94f82b
mov dword [esi + 0x14], 0x3c6ef372
mov dword [esi + 0x18], 0x5f1d36f1
mov dword [esi + 0x1c], 0xa54ff53a
mov dword [esi + 0x20], 0xade682d1
mov dword [esi + 0x24], 0x510e527f
mov dword [esi + 0x28], 0x2b3e6c1f
mov dword [esi + 0x2c], 0x9b05688c
mov dword [esi + 0x30], 0xfb41bd6b
mov dword [esi + 0x34], 0x1f83d9ab
mov dword [esi + 0x38], 0x137e2179
mov dword [esi + 0x3c], 0x5be0cd19
xor eax, eax
ret
Function at 0x10001090
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, eax
call fcn.10001000
mov ecx, dword [ebp + 8]
add esi, 0x10
add ecx, 0x17
mov dword [ebp + 8], 2
movzx eax, byte [ecx - 0x17]
cdq
mov edi, eax
movzx eax, byte [ecx - 0x16]
mov ebx, edx
cdq
shld edx, eax, 8
shl eax, 8
or edi, eax
movzx eax, byte [ecx - 0x15]
or ebx, edx
cdq
shld edx, eax, 0x10
shl eax, 0x10
or edi, eax
movzx eax, byte [ecx - 0x14]
or ebx, edx
cdq
shld edx, eax, 0x18
shl eax, 0x18
or edi, eax
movzx eax, byte [ecx - 0x13]
or ebx, edx
cdq
or ebx, eax
movzx eax, byte [ecx - 0x12]
cdq
shl eax, 8
or ebx, eax
movzx eax, byte [ecx - 0x10]
cdq
shld edx, eax, 8
shl eax, 8
mov dword [ebp - 4], ebx
mov ebx, eax
movzx eax, byte [ecx - 0x11]
cdq
or ebx, eax
xor eax, eax
or eax, edi
xor dword [esi - 0x10], eax
shl ebx, 0x10
or ebx, dword [ebp - 4]
xor dword [esi - 0xc], ebx
movzx eax, byte [ecx - 0xf]
cdq
mov edi, eax
movzx eax, byte [ecx - 0xe]
mov ebx, edx
cdq
shld edx, eax, 8
shl eax, 8
or edi, eax
movzx eax, byte [ecx - 0xd]
or ebx, edx
cdq
shld edx, eax, 0x10
shl eax, 0x10
or edi, eax
movzx eax, byte [ecx - 0xc]
or ebx, edx
cdq
shld edx, eax, 0x18
shl eax, 0x18
or edi, eax
movzx eax, byte [ecx - 0xb]
or ebx, edx
cdq
or ebx, eax
movzx eax, byte [ecx - 0xa]
cdq
shl eax, 8
or ebx, eax
movzx eax, byte [ecx - 8]
cdq
shld edx, eax, 8
shl eax, 8
mov dword [ebp - 4], ebx
mov ebx, eax
movzx eax, byte [ecx - 9]
cdq
or ebx, eax
xor edx, edx
or edx, edi
xor dword [esi - 8], edx
shl ebx, 0x10
or ebx, dword [ebp - 4]
xor dword [esi - 4], ebx
movzx eax, byte [ecx - 7]
cdq
mov edi, eax
movzx eax, byte [ecx - 6]
mov ebx, edx
cdq
shld edx, eax, 8
shl eax, 8
or edi, eax
movzx eax, byte [ecx - 5]
or ebx, edx
cdq
shld edx, eax, 0x10
shl eax, 0x10
or edi, eax
movzx eax, byte [ecx - 4]
or ebx, edx
cdq
shld edx, eax, 0x18
shl eax, 0x18
or edi, eax
movzx eax, byte [ecx - 3]
or ebx, edx
cdq
or ebx, eax
movzx eax, byte [ecx - 2]
cdq
shl eax, 8
or ebx, eax
movzx eax, byte [ecx]
cdq
shld edx, eax, 8
shl eax, 8
mov dword [ebp - 4], ebx
mov ebx, eax
movzx eax, byte [ecx - 1]
cdq
or ebx, eax
xor eax, eax
or eax, edi
xor dword [esi], eax
shl ebx, 0x10
or ebx, dword [ebp - 4]
xor dword [esi + 4], ebx
movzx eax, byte [ecx + 1]
cdq
mov edi, eax
movzx eax, byte [ecx + 2]
mov ebx, edx
cdq
shld edx, eax, 8
shl eax, 8
or edi, eax
movzx eax, byte [ecx + 3]
or ebx, edx
cdq
shld edx, eax, 0x10
shl eax, 0x10
or edi, eax
movzx eax, byte [ecx + 4]
or ebx, edx
cdq
shld edx, eax, 0x18
shl eax, 0x18
or edi, eax
movzx eax, byte [ecx + 5]
or ebx, edx
cdq
or ebx, eax
movzx eax, byte [ecx + 6]
cdq
shl eax, 8
or ebx, eax
mov dword [ebp - 4], ebx
movzx eax, byte [ecx + 8]
cdq
shld edx, eax, 8
shl eax, 8
mov ebx, eax
movzx eax, byte [ecx + 7]
cdq
or ebx, eax
shl ebx, 0x10
or ebx, dword [ebp - 4]
xor edx, edx
xor dword [esi + 0xc], ebx
or edx, edi
xor dword [esi + 8], edx
add ecx, 0x20
add esi, 0x20
dec dword [ebp + 8]
jne 0x100010b0
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100092c0
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push esi
push edi
push 0x200
xor ebx, ebx
mov esi, eax
push ebx
push esi
mov edi, ecx
call fcn.100148d0
lea eax, [edi - 1]
add esp, 0xc
mov dword [esi], edi
cmp eax, 0xe
ja case.default.0x100092e6
jmp dword [eax*4 + 0x10009514]
mov dword [esi + 0x40], ebx
mov al, 1
pop edi
pop esi
pop ebx
ret
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], 0x67452301
mov dword [esi + 0x8c], 0xefcdab89
mov dword [esi + 0x90], 0x98badcfe
mov dword [esi + 0x94], 0x10325476
mov al, 1
pop edi
pop esi
pop ebx
ret
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0x88], 0x67452301
mov dword [esi + 0x8c], 0xefcdab89
mov dword [esi + 0x90], 0x98badcfe
mov dword [esi + 0x94], 0x10325476
mov dword [esi + 0x98], 0xc3d2e1f0
mov al, 1
pop edi
pop esi
pop ebx
ret
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0xa8], 0x1c
lea edi, [esi + 0x88]
mov ecx, 8
mov esi, 0x10015fe8
rep movsd dword es:[edi], dword [esi]
mov al, 1
pop edi
pop esi
pop ebx
ret
mov dword [esi + 0x80], ebx
mov dword [esi + 0x84], ebx
mov dword [esi + 0xa8], 0x20
lea edi, [esi + 0x88]
mov ecx, 8
mov esi, 0x10015fc8
rep movsd dword es:[edi], dword [esi]
mov al, 1
pop edi
pop esi
pop ebx
ret
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0x108], 0x30
lea edi, [esi + 0xc8]
mov ecx, 0x10
mov esi, 0x10015e88
rep movsd dword es:[edi], dword [esi]
mov al, 1
pop edi
pop esi
pop ebx
ret
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xc4], ebx
mov dword [esi + 0x108], 0x40
lea edi, [esi + 0xc8]
mov ecx, 0x10
mov esi, 0x10015e48
rep movsd dword es:[edi], dword [esi]
mov al, 1
pop edi
pop esi
pop ebx
ret
push 0x190
add esi, 0x40
push ebx
push esi
call fcn.100148d0
add esp, 0xc
mov dword [esi + 0x18c], 0x90
mov al, 1
pop edi
pop esi
pop ebx
ret
push 0x190
add esi, 0x40
push ebx
push esi
call fcn.100148d0
add esp, 0xc
mov dword [esi + 0x18c], 0x88
mov al, 1
pop edi
pop esi
pop ebx
ret
push 0x190
add esi, 0x40
push ebx
push esi
call fcn.100148d0
add esp, 0xc
mov dword [esi + 0x18c], 0x68
mov al, 1
pop edi
pop esi
pop ebx
ret
push 0x190
add esi, 0x40
push ebx
push esi
call fcn.100148d0
add esp, 0xc
mov dword [esi + 0x18c], 0x48
mov al, 1
pop edi
pop esi
pop ebx
ret
mov eax, edi
add esi, 0x40
call fcn.10009260
push esi
mov cl, al
call fcn.10001290
add esp, 4
test eax, eax
je 0x100094e9
push 0x40010
push 0x100161e0
push 0x10016218
push ebx
call dword [0x10015178]
call dword [0x100150bc]
mov al, 1
pop edi
pop esi
pop ebx
ret
cmp byte [0x10019583], bl
je 0x1000950d
push 0x40010
push 0x10016270
push 0x10016298
push ebx
call dword [0x10015178]
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x1000a840
Capabilities:
Encode data using xor

Disassembly:
mov edx, edi
push esi
mov esi, eax
or edx, ecx
or edx, esi
xor eax, eax
test edx, 3
jne 0x1000a872
add esi, ecx
mov edx, edi
cmp ecx, esi
jae 0x1000a888
jmp 0x1000a860
mov eax, dword [ecx]
bswap eax
add ecx, 4
mov dword [edx], eax
add edx, 4
cmp ecx, esi
jb 0x1000a860
pop esi
ret
test esi, esi
je 0x1000a888
push ebx
mov bl, byte [eax + ecx]
mov edx, eax
xor edx, 3
inc eax
mov byte [edx + edi], bl
cmp eax, esi
jb 0x1000a877
pop ebx
pop esi
ret

Function at 0x1000a890
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
mov edx, esi
push edi
mov edi, ecx
or edx, eax
or edx, edi
xor ecx, ecx
test edx, 7
jne 0x1000a8ce
add edi, eax
cmp eax, edi
jae 0x1000a8e2
mov ecx, dword [eax]
mov edx, dword [eax + 4]
bswap ecx
bswap edx
add eax, 8
mov dword [esi], edx
mov dword [esi + 4], ecx
add esi, 8
cmp eax, edi
jb 0x1000a8b1
pop edi
pop esi
pop ebx
pop ebp
ret
test edi, edi
je 0x1000a8e2
mov bl, byte [ecx + eax]
mov edx, ecx
xor edx, 7
inc ecx
mov byte [edx + esi], bl
cmp ecx, edi
jb 0x1000a8d2
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1000a8f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
not eax
test cl, 3
je 0x1000a920
mov edi, edi
test esi, esi
je 0x1000a920
movzx edx, byte [ecx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x100190c8]
inc ecx
dec esi
test cl, 3
jne 0x1000a900
mov edx, esi
and edx, 0xfffffff0
add edx, ecx
cmp ecx, edx
jae 0x1000aa67
push edi
xor eax, dword [ecx]
add ecx, 0x10
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100190c8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100190c8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100190c8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100190c8]
xor eax, dword [ecx - 0xc]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100190c8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100190c8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100190c8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100190c8]
xor eax, dword [ecx - 8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100190c8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100190c8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100190c8]
mov edi, eax
shr eax, 8
and edi, 0xff
xor eax, dword [edi*4 + 0x100190c8]
xor eax, dword [ecx - 4]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100190c8]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100190c8]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100190c8]
mov edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x100190c8]
cmp ecx, edx
jb 0x1000a930
pop edi
and esi, 0xf
lea edx, [ecx + esi]
cmp ecx, edx
jae 0x1000aa8b
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x100190c8]
inc ecx
cmp ecx, edx
jb 0x1000aa71
not eax
pop esi
pop ebp
ret
Function at 0x1000bb50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, eax
mov eax, dword [esi + 0x40]
and eax, 0x3f
mov byte [eax + esi], 0x80
inc eax
push edi
test al, 3
je 0x1000bb79
lea ebx, [ebx]
mov byte [eax + esi], 0
inc eax
test al, 3
jne 0x1000bb70
shr eax, 2
cmp eax, 0xe
jbe 0x1000bba6
cmp eax, 0x10
jae 0x1000bb94
mov ecx, 0x10
lea edi, [esi + eax*4]
sub ecx, eax
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [esi + 0x48]
push eax
mov ecx, esi
call fcn.1000b4d0
add esp, 4
xor eax, eax
jmp 0x1000bba8
jae 0x1000bbb6
mov ecx, 0xe
lea edi, [esi + eax*4]
sub ecx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov edx, dword [esi + 0x40]
mov eax, dword [esi + 0x40]
mov ecx, dword [esi + 0x44]
add edx, edx
shrd eax, ecx, 0x1d
add edx, edx
add edx, edx
shr ecx, 0x1d
bswap eax
bswap edx
lea edi, [esi + 0x48]
push edi
mov ecx, esi
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edx
call fcn.1000b4d0
add esp, 4
test ebx, ebx
je 0x1000bc27
mov ecx, edi
or ecx, ebx
xor eax, eax
test ecx, 3
jne 0x1000bc16
mov eax, edi
lea esi, [eax + 0x14]
mov edx, ebx
cmp eax, esi
jae 0x1000bc27
mov ecx, dword [eax]
bswap ecx
add eax, 4
mov dword [edx], ecx
add edx, 4
cmp eax, esi
jb 0x1000bc01
pop edi
pop esi
pop ebx
pop ebp
ret
mov cl, byte [edi + eax]
mov edx, eax
xor edx, 3
inc eax
mov byte [edx + ebx], cl
cmp eax, 0x14
jb 0x1000bc16
pop edi
pop esi
pop ebx
pop ebp
ret