joyce8/EMBER2024-capa huggingface dataset:
Function at 0x363b3b0
Capabilities:
Inspect section memory permissions
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
mov ecx, 0x100
push esi
push edi
mov dword [ebp], 0x10101c20
mov dword [ebp + 4], 0
mov dword [ebp + 8], 0
mov dword [ebp + 0xc], 0xff
call fcn.03707780
xor ecx, ecx
mov esi, eax
call fcn.03707920
mov dword [ebp + 4], esi
lea ecx, [esp + 0x14]
mov dword [ebp + 8], 0
push 0x100f8e04
mov byte [esi], 0
mov dword [esp + 0x24], 0x10000
mov dword [esp + 0x28], 0x100f8e08
mov dword [esp + 0x2c], 0x20000
mov dword [esp + 0x30], 0x100f8e10
mov dword [esp + 0x34], 0x100000
mov dword [esp + 0x38], 0x100f8e20
mov dword [esp + 0x3c], 0x40000
mov dword [esp + 0x40], 0x100f8e2c
mov dword [esp + 0x44], 0x80000
mov dword [esp + 0x48], 0x100f8e38
mov dword [esp + 0x4c], 0x80000000
mov dword [esp + 0x50], 0x100f8e44
mov dword [esp + 0x54], 0x40000000
mov dword [esp + 0x58], 0x100f8e54
mov dword [esp + 0x5c], 0x20000000
mov dword [esp + 0x60], 0x100f8e64
mov dword [esp + 0x64], 0x10000000
mov dword [esp + 0x68], 0x100f8e74
mov dword [esp + 0x6c], 0x10
mov dword [esp + 0x70], 0x100f9234
mov dword [esp + 0x74], 8
mov dword [esp + 0x78], 0x100f9248
mov dword [esp + 0x7c], 4
mov dword [esp + 0x80], 0x100f925c
mov dword [esp + 0x84], 2
mov dword [esp + 0x88], 0x100f9270
mov dword [esp + 0x8c], 1
mov dword [esp + 0x90], 0x100f9284
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.0362a340
mov esi, dword [esp + 0x14]
lea ecx, [ebp + 4]
push esi
call fcn.0362a340
test esi, esi
je 0x363b525
mov ecx, esi
call fcn.03707920
mov edi, dword [esp + 0x194]
xor esi, esi
mov edi, edi
mov eax, dword [esp + esi*8 + 0x20]
test edi, eax
je 0x363b55b
not eax
and edi, eax
cmp dword [ebp + 8], 0
je 0x363b54f
push 0x100f8f38
lea ecx, [ebp + 4]
call fcn.0363c870
push dword [esp + esi*8 + 0x24]
lea ecx, [ebp + 4]
call fcn.0363c870
inc esi
cmp esi, 0xe
jb 0x363b530
cmp dword [ebp + 8], 0
jne 0x363b5b4
push 0x100f8f3c
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.0362a340
mov esi, dword [esp + 0x14]
lea ecx, [ebp + 4]
push esi
call fcn.0362a340
test esi, esi
je 0x363b5f2
mov ecx, esi
call fcn.03707920
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x180
ret 4
test edi, edi
je 0x363b5f2
push edi
lea eax, [esp + 0x94]
push 0x100f7c90
push eax
call dword [0x100f5304]
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x363b5e2
push 0x100f8f38
lea ecx, [ebp + 4]
call fcn.0363c870
lea eax, [esp + 0x90]
push eax
lea ecx, [ebp + 4]
call fcn.0363c870
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x180
ret 4
Function at 0x363b610
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x168
push ebx
push ebp
mov ebp, ecx
mov ecx, 0x100
push esi
push edi
mov dword [ebp], 0x10101c20
mov dword [ebp + 4], 0
mov dword [ebp + 8], 0
mov dword [ebp + 0xc], 0xff
call fcn.03707780
xor ecx, ecx
mov esi, eax
call fcn.03707920
mov dword [ebp + 4], esi
lea ecx, [esp + 0x14]
mov dword [ebp + 8], 0
push 0x100f8e04
mov byte [esi], 0
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x100f9294
mov dword [esp + 0x2c], 2
mov dword [esp + 0x30], 0x100f92a4
mov dword [esp + 0x34], 4
mov dword [esp + 0x38], 0x100f92b4
mov dword [esp + 0x3c], 8
mov dword [esp + 0x40], 0x100f92c4
mov dword [esp + 0x44], 0x10
mov dword [esp + 0x48], 0x100f92d4
mov dword [esp + 0x4c], 0x20
mov dword [esp + 0x50], 0x100f92e4
mov dword [esp + 0x54], 0x40
mov dword [esp + 0x58], 0x100f92f8
mov dword [esp + 0x5c], 0x80
mov dword [esp + 0x60], 0x100f9310
mov dword [esp + 0x64], 0x100
mov dword [esp + 0x68], 0x100f9328
mov dword [esp + 0x6c], 0x200
mov dword [esp + 0x70], 0x100f9334
mov dword [esp + 0x74], 0x400
mov dword [esp + 0x78], 0x100f9344
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.0362a340
mov esi, dword [esp + 0x14]
lea ecx, [ebp + 4]
push esi
call fcn.0362a340
test esi, esi
je 0x363b746
mov ecx, esi
call fcn.03707920
mov edi, dword [esp + 0x17c]
xor esi, esi
nop
mov eax, dword [esp + esi*8 + 0x20]
test edi, eax
je 0x363b77b
not eax
and edi, eax
cmp dword [ebp + 8], 0
je 0x363b76f
push 0x100f8f38
lea ecx, [ebp + 4]
call fcn.0363c870
push dword [esp + esi*8 + 0x24]
lea ecx, [ebp + 4]
call fcn.0363c870
inc esi
cmp esi, 0xb
jb 0x363b750
cmp dword [ebp + 8], 0
jne 0x363b7d4
push 0x100f8f3c
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.0362a340
mov esi, dword [esp + 0x14]
lea ecx, [ebp + 4]
push esi
call fcn.0362a340
test esi, esi
je 0x363b80c
mov ecx, esi
call fcn.03707920
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x168
ret 4
test edi, edi
je 0x363b80c
push edi
lea eax, [esp + 0x7c]
push 0x100f7c90
push eax
call dword [0x100f5304]
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x363b7ff
push 0x100f8f38
lea ecx, [ebp + 4]
call fcn.0363c870
lea eax, [esp + 0x78]
push eax
lea ecx, [ebp + 4]
call fcn.0363c870
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x168
ret 4
Function at 0x363c3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x210
push ebx
push ebp
mov ebp, ecx
mov ecx, 0x100
push esi
push edi
mov dword [ebp], 0x10101c20
mov dword [ebp + 4], 0
mov dword [ebp + 8], 0
mov dword [ebp + 0xc], 0xff
call fcn.03707780
xor ecx, ecx
mov esi, eax
call fcn.03707920
mov dword [ebp + 4], esi
lea ecx, [esp + 0x14]
mov dword [ebp + 8], 0
push 0x100f8e04
mov byte [esi], 0
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x100ffc54
mov dword [esp + 0x2c], 2
mov dword [esp + 0x30], 0x100ffc64
mov dword [esp + 0x34], 4
mov dword [esp + 0x38], 0x100ffc7c
mov dword [esp + 0x3c], 8
mov dword [esp + 0x40], 0x100ffc90
mov dword [esp + 0x44], 0x10
mov dword [esp + 0x48], 0x100ffca4
mov dword [esp + 0x4c], 0x20
mov dword [esp + 0x50], 0x100ffcb8
mov dword [esp + 0x54], 0x40
mov dword [esp + 0x58], 0x100ffcd0
mov dword [esp + 0x5c], 0x80
mov dword [esp + 0x60], 0x100ffce4
mov dword [esp + 0x64], 0x100
mov dword [esp + 0x68], 0x100ffcf8
mov dword [esp + 0x6c], 0x200
mov dword [esp + 0x70], 0x100ffd10
mov dword [esp + 0x74], 0x400
mov dword [esp + 0x78], 0x100ffd2c
mov dword [esp + 0x7c], 0x800
mov dword [esp + 0x80], 0x100ffd48
mov dword [esp + 0x84], 0x1000
mov dword [esp + 0x88], 0x100ffd60
mov dword [esp + 0x8c], 0x4000
mov dword [esp + 0x90], 0x100ffd78
mov dword [esp + 0x94], 0x8000
mov dword [esp + 0x98], 0x100ffd94
mov dword [esp + 0x9c], 0x10000
mov dword [esp + 0xa0], 0x100ffdb0
mov dword [esp + 0xa4], 0x1000000
mov dword [esp + 0xa8], 0x100ffdd4
mov dword [esp + 0xac], 0x2000000
mov dword [esp + 0xb0], 0x100ffdf0
mov dword [esp + 0xb4], 0x4000000
mov dword [esp + 0xb8], 0x100ffe14
mov dword [esp + 0xbc], 0x8000000
mov dword [esp + 0xc0], 0x100ffe30
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.0362a340
mov esi, dword [esp + 0x14]
lea ecx, [ebp + 4]
push esi
call fcn.0362a340
test esi, esi
je 0x363c5a9
mov ecx, esi
call fcn.03707920
mov ecx, dword [esp + 0x224]
xor esi, esi
mov ebx, ecx
mov eax, dword [esp + esi*8 + 0x20]
test ecx, eax
je 0x363c5e6
not eax
and ebx, eax
cmp dword [ebp + 8], 0
je 0x363c5d3
push 0x100f8f38
lea ecx, [ebp + 4]
call fcn.0363c870
push dword [esp + esi*8 + 0x24]
lea ecx, [ebp + 4]
call fcn.0363c870
mov ecx, dword [esp + 0x224]
inc esi
cmp esi, 0x14
jb 0x363c5b4
cmp dword [ebp + 8], 0
mov esi, dword [0x100f5304]
jne 0x363c674
push 0x100f8f3c
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
call fcn.0362a340
mov esi, dword [esp + 0x14]
lea ecx, [ebp + 4]
push esi
call fcn.0362a340
test esi, esi
je 0x363c636
mov ecx, esi
call fcn.03707920
mov esi, dword [0x100f5304]
push dword [esp + 0x224]
lea eax, [esp + 0x124]
push 0x100f8fcc
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x120]
lea ecx, [ebp + 4]
push eax
call fcn.0363c870
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x210
ret 4
test ebx, ebx
je 0x363c63c
push ebx
lea eax, [esp + 0x24]
push 0x100f7c90
push eax
call esi
add esp, 0xc
cmp dword [ebp + 8], 0
je 0x363c69b
push 0x100f8f38
lea ecx, [ebp + 4]
call fcn.0363c870
lea eax, [esp + 0x20]
push eax
lea ecx, [ebp + 4]
call fcn.0363c870
jmp 0x363c63c
Function at 0x364f5b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call fcn.0366dab0
push dword [esi + 0x54]
call dword [0x100f5268]
test eax, eax
je 0x364f5cc
mov edi, dword [esi + 0x4c]
jmp 0x364f5cf
mov edi, dword [esi + 0x40]
mov ebx, dword [esp + 0x10]
lea eax, [ebx + 4]
add eax, edi
push eax
call dword [0x100f5290]
test eax, eax
jne 0x364f66e
cmp dword [edi + ebx + 0x38], 0xffffffff
jne 0x364f5f5
cmp dword [edi + ebx + 0x3c], 0xffffffff
je 0x364f604
mov eax, dword [esi + 0x4c]
mov ecx, esi
add eax, dword [edi + ebx + 0x38]
push eax
call fcn.0366dec0
cmp dword [edi + ebx + 0x28], 0xffffffff
jne 0x364f612
cmp dword [edi + ebx + 0x2c], 0xffffffff
je 0x364f621
mov eax, dword [esi + 0x4c]
mov ecx, esi
add eax, dword [edi + ebx + 0x28]
push eax
call fcn.0366dec0
cmp dword [edi + ebx + 0x18], 0xffffffff
jne 0x364f62f
cmp dword [edi + ebx + 0x1c], 0xffffffff
je 0x364f641
push dword [edi + ebx + 0x1c]
mov ecx, esi
push dword [edi + ebx + 0x18]
call fcn.03653ed0
add esp, 8
cmp dword [edi + ebx + 0x20], 0xffffffff
jne 0x364f64f
cmp dword [edi + ebx + 0x24], 0xffffffff
je 0x364f661
push dword [edi + ebx + 0x24]
mov ecx, esi
push dword [edi + ebx + 0x20]
call fcn.03655720
add esp, 8
mov eax, dword [esi + 0x4c]
mov ecx, esi
add eax, ebx
push eax
call fcn.0366dec0
mov ecx, esi
pop edi
pop esi
pop ebx
jmp fcn.0366db90

Function at 0x364f930
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call fcn.0366dab0
push dword [esi + 0x54]
call dword [0x100f5268]
test eax, eax
je 0x364f94c
mov edi, dword [esi + 0x4c]
jmp 0x364f94f
mov edi, dword [esi + 0x40]
mov ebx, dword [esp + 0x10]
lea eax, [ebx + 4]
add eax, edi
push eax
call dword [0x100f5290]
test eax, eax
jne 0x364f9a6
cmp dword [edi + ebx + 0x20], 0xffffffff
jne 0x364f971
cmp dword [edi + ebx + 0x24], 0xffffffff
je 0x364f980
mov eax, dword [esi + 0x4c]
mov ecx, esi
add eax, dword [edi + ebx + 0x20]
push eax
call fcn.0366dec0
mov eax, dword [edi + ebx + 0x10]
or eax, dword [edi + ebx + 0x14]
je 0x364f999
mov eax, dword [esi + 0x4c]
mov ecx, esi
add eax, dword [edi + ebx + 0x10]
push eax
call fcn.0366dec0
mov eax, dword [esi + 0x4c]
mov ecx, esi
add eax, ebx
push eax
call fcn.0366dec0
mov ecx, esi
pop edi
pop esi
pop ebx
jmp fcn.0366db90
Function at 0x3653ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.0366dab0
mov eax, dword [esp + 0x34]
push dword [esi + 0x54]
mov edi, dword [esp + 0x34]
mov ebx, dword [0x100f5268]
mov dword [esp + 0x2c], eax
call ebx
test eax, eax
je 0x3653efe
mov eax, dword [esi + 0x4c]
jmp 0x3653f01
mov eax, dword [esi + 0x40]
add eax, edi
push eax
call dword [0x100f5290]
test eax, eax
jne 0x3653ff6
push dword [esi + 0x54]
call ebx
test eax, eax
je 0x3653f20
mov eax, dword [esi + 0x4c]
jmp 0x3653f23
mov eax, dword [esi + 0x40]
mov ebp, dword [eax + edi + 8]
mov eax, dword [eax + edi + 0xc]
push dword [esi + 0x54]
mov dword [esp + 0x14], eax
call ebx
test eax, eax
je 0x3653f3d
mov eax, dword [esi + 0x4c]
jmp 0x3653f40
mov eax, dword [esi + 0x40]
mov ecx, dword [eax + edi + 0x10]
mov eax, dword [eax + edi + 0x14]
push dword [esi + 0x54]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call ebx
test eax, eax
je 0x3653f5e
mov ecx, dword [esi + 0x4c]
jmp 0x3653f61
mov ecx, dword [esi + 0x40]
mov eax, dword [ecx + ebp + 0x10]
sub esp, 0x10
mov ecx, dword [ecx + ebp + 0x14]
mov edx, esp
mov dword [edx], esi
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
push dword [esi + 0x54]
call ebx
test eax, eax
je 0x3653f84
mov eax, dword [esi + 0x4c]
jmp 0x3653f87
mov eax, dword [esi + 0x40]
lea ecx, [eax + edi]
call fcn.03659150
mov ecx, dword [esp + 0x10]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov dword [eax + 8], ebp
mov dword [eax + 0xc], ecx
push dword [esi + 0x54]
call ebx
test eax, eax
je 0x3653fae
mov eax, dword [esi + 0x4c]
jmp 0x3653fb1
mov eax, dword [esi + 0x40]
lea ecx, [eax + edi]
call fcn.03659150
mov ecx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax], esi
mov dword [eax + 0xc], ecx
push dword [esi + 0x54]
call ebx
test eax, eax
je 0x3653fdc
mov eax, dword [esi + 0x4c]
jmp 0x3653fdf
mov eax, dword [esi + 0x40]
lea ecx, [eax + edi]
call fcn.03659150
mov eax, dword [esi + 0x4c]
mov ecx, esi
add eax, dword [esp + 0x30]
push eax
call fcn.0366dec0
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
jmp fcn.0366db90
Function at 0x3655720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov esi, ecx
call fcn.0366dab0
mov eax, dword [esp + 0x34]
push dword [esi + 0x54]
mov edi, dword [esp + 0x34]
mov ebx, dword [0x100f5268]
mov dword [esp + 0x2c], eax
call ebx
test eax, eax
je 0x365574e
mov eax, dword [esi + 0x4c]
jmp 0x3655751
mov eax, dword [esi + 0x40]
add eax, edi
push eax
call dword [0x100f5290]
test eax, eax
jne 0x3655846
push dword [esi + 0x54]
call ebx
test eax, eax
je 0x3655770
mov eax, dword [esi + 0x4c]
jmp 0x3655773
mov eax, dword [esi + 0x40]
mov ebp, dword [eax + edi + 8]
mov eax, dword [eax + edi + 0xc]
push dword [esi + 0x54]
mov dword [esp + 0x14], eax
call ebx
test eax, eax
je 0x365578d
mov eax, dword [esi + 0x4c]
jmp 0x3655790
mov eax, dword [esi + 0x40]
mov ecx, dword [eax + edi + 0x10]
mov eax, dword [eax + edi + 0x14]
push dword [esi + 0x54]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
call ebx
test eax, eax
je 0x36557ae
mov ecx, dword [esi + 0x4c]
jmp 0x36557b1
mov ecx, dword [esi + 0x40]
mov eax, dword [ecx + ebp + 0x10]
sub esp, 0x10
mov ecx, dword [ecx + ebp + 0x14]
mov edx, esp
mov dword [edx], esi
mov dword [edx + 8], eax
mov dword [edx + 0xc], ecx
push dword [esi + 0x54]
call ebx
test eax, eax
je 0x36557d4
mov eax, dword [esi + 0x4c]
jmp 0x36557d7
mov eax, dword [esi + 0x40]
lea ecx, [eax + edi]
call fcn.03659610
mov ecx, dword [esp + 0x10]
sub esp, 0x10
mov eax, esp
mov dword [eax], esi
mov dword [eax + 8], ebp
mov dword [eax + 0xc], ecx
push dword [esi + 0x54]
call ebx
test eax, eax
je 0x36557fe
mov eax, dword [esi + 0x4c]
jmp 0x3655801
mov eax, dword [esi + 0x40]
lea ecx, [eax + edi]
call fcn.03659610
mov ecx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax], esi
mov dword [eax + 0xc], ecx
push dword [esi + 0x54]
call ebx
test eax, eax
je 0x365582c
mov eax, dword [esi + 0x4c]
jmp 0x365582f
mov eax, dword [esi + 0x40]
lea ecx, [eax + edi]
call fcn.03659610
mov eax, dword [esi + 0x4c]
mov ecx, esi
add eax, dword [esp + 0x30]
push eax
call fcn.0366dec0
mov ecx, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
jmp fcn.0366db90

Function at 0x365a5e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov esi, ecx
call fcn.0366dab0
push dword [esi + 0x54]
call dword [0x100f5268]
test eax, eax
je 0x365a5ff
mov eax, dword [esi + 0x4c]
jmp 0x365a602
mov eax, dword [esi + 0x40]
mov ebx, dword [esp + 0x28]
lea edi, [eax + ebx]
push edi
call dword [0x100f5290]
test eax, eax
jne 0x365a66c
mov ecx, esi
call fcn.0366dab0
cmp dword [edi + 0x28], 0xffffffff
jne 0x365a627
cmp dword [edi + 0x2c], 0xffffffff
je 0x365a658
push dword [edi + 0x2c]
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0
push dword [edi + 0x28]
mov dword [esp + 0x20], 0xffffffff
push esi
mov dword [esp + 0x28], 0xffffffff
call fcn.0365a8a0
lea ecx, [esp + 0x10]
call fcn.036566e0
mov eax, dword [esi + 0x4c]
mov ecx, esi
add eax, ebx
push eax
call fcn.0366dec0
mov ecx, esi
call fcn.0366db90
mov ecx, esi
pop edi
pop esi
pop ebx
add esp, 0x18
jmp fcn.0366db90
Function at 0x366e3d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [0x100f5084]
mov eax, dword [esi + 0x80]
mov dword [esi + 0x78], 0
mov dword [esi + 0x7c], 0
test eax, eax
je 0x366e407
push 0x8000
push 0
push eax
call edi
mov dword [esi + 0x80], 0
lea ebx, [esi + 0x84]
mov esi, dword [ebx]
test esi, esi
je 0x366e428
push 0x8000
lea eax, [esi]
mov esi, dword [esi + 4]
push 0
push dword [eax + 8]
call edi
test esi, esi
jne 0x366e413
mov ecx, ebx
pop edi
pop esi
pop ebx
jmp fcn.03668ef0
Function at 0x3671810
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x128
cmp dword [esp + 0x130], 0
push ebp
mov dword [esp + 0x1c], ecx
jle 0x3671a0d
mov eax, dword [esp + 0x130]
push ebx
push esi
push edi
add eax, 2
xor esi, esi
jmp 0x3671840
movzx edx, byte [eax - 2]
movzx ecx, byte [eax - 1]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 1]
shl edx, 8
add eax, 4
or edx, ecx
mov dword [esp + esi*4 + 0x38], edx
inc esi
cmp esi, 0x10
jl 0x3671840
mov dword [esp + 0x30], eax
lea ebx, [esp + 0x70]
mov ebp, 0x30
mov edx, dword [ebx]
lea ebx, [ebx + 4]
mov esi, dword [ebx - 0x38]
mov edi, edx
mov ecx, edx
rol edi, 0xf
rol ecx, 0xd
xor edi, ecx
shr edx, 0xa
xor edi, edx
mov ecx, esi
mov edx, esi
ror ecx, 7
rol edx, 0xe
xor edx, ecx
shr esi, 3
xor edx, esi
add edi, edx
add edi, dword [ebx - 0x3c]
add edi, dword [ebx - 0x18]
mov dword [ebx + 4], edi
dec ebp
jne 0x3671878
mov ebp, dword [esp + 0x28]
mov eax, dword [ebp + 0x88]
mov ecx, dword [ebp + 0x8c]
mov esi, dword [ebp + 0x9c]
mov ebx, dword [ebp + 0x98]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x34], eax
mov eax, dword [ebp + 0x90]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x94]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0xa0]
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xa4]
mov ebp, dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], esi
jmp 0x3671914
mov esi, dword [esp + 0x14]
mov edi, ebx
mov ecx, ebx
rol ecx, 7
and esi, ebx
ror edi, 0xb
mov edx, ebx
xor edi, ecx
not edx
and edx, dword [esp + 0x18]
mov ecx, ebx
ror ecx, 6
xor edx, esi
xor edi, ecx
mov esi, ebp
ror esi, 0xd
mov ecx, ebp
rol ecx, 0xa
add edi, edx
add edi, dword [eax + 0x100f69d0]
xor esi, ecx
add edi, dword [esp + eax + 0x38]
mov ecx, ebp
add edi, dword [esp + 0x1c]
add eax, 4
ror ecx, 2
xor esi, ecx
mov ecx, dword [esp + 0x20]
mov edx, ecx
and ecx, dword [esp + 0x10]
xor edx, dword [esp + 0x10]
and edx, ebp
xor edx, ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], ecx
add esi, edx
mov ecx, dword [esp + 0x14]
mov edx, ebp
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x24]
mov dword [esp + 0x18], ecx
lea ebp, [esi + edi]
mov ecx, dword [esp + 0x10]
add ebx, edi
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x20], edx
cmp eax, 0x100
jl 0x3671910
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x10]
add ecx, ebp
mov ebp, dword [esp + 0x28]
mov dword [ebp + 0x88], ecx
mov ecx, dword [esp + 0x24]
add dword [ebp + 0x94], ecx
add dword [ebp + 0x90], eax
mov ecx, dword [esp + 0x14]
add dword [ebp + 0x9c], ecx
mov eax, dword [esp + 0x18]
add dword [ebp + 0xa0], eax
mov ecx, dword [esp + 0x1c]
add dword [ebp + 0x8c], edx
add dword [ebp + 0x98], ebx
add dword [ebp + 0xa4], ecx
dec dword [esp + 0x140]
mov eax, dword [esp + 0x30]
jne 0x3671836
pop edi
pop esi
pop ebx
pop ebp
add esp, 0x128
ret 8
Function at 0x3671d80
Capabilities:
Hash data using sha256

Disassembly:
sub esp, 0xcc
push esi
push edi
mov esi, edx
mov dword [esp + 0xb0], 0x6a09e667
push esi
mov edi, ecx
mov dword [esp + 0xb8], 0xbb67ae85
mov dword [esp + 0xbc], 0x3c6ef372
mov dword [esp + 0xc0], 0xa54ff53a
mov dword [esp + 0xc4], 0x510e527f
mov dword [esp + 0xc8], 0x9b05688c
mov dword [esp + 0xcc], 0x1f83d9ab
mov dword [esp + 0xd0], 0x5be0cd19
mov dword [esp + 0x30], 0
mov dword [esp + 0x2c], 0
call dword [0x100f523c]
add eax, eax
lea ecx, [esp + 0x28]
push eax
push esi
call fcn.03671a20
push 0x20
lea eax, [esp + 0xc]
push eax
call dword [0x1011f44c]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x2c]
call fcn.03671ab0
lea edx, [esp + 8]
mov ecx, edi
call fcn.03671c70
mov eax, edi
pop edi
pop esi
add esp, 0xcc
ret
Function at 0x36a1260
Capabilities:
Inspect section memory permissions

Disassembly:
sub esp, 0x44
mov eax, dword [esp + 0x48]
push ebx
push ebp
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
push edi
mov dword [esp + 0x14], ecx
movzx ebx, word [ecx + 0x14]
add ebx, 0x3c
add ebx, ecx
cmp dword [esp + 0x5c], 0
je 0x36a12a9
mov edx, dword [ecx + 0xe8]
test edx, edx
je 0x36a12a9
mov esi, dword [ecx + 0x50]
cmp edx, esi
jae 0x36a12a9
mov eax, dword [ecx + 0xec]
add eax, edx
mov dword [esp + 0x5c], 1
cmp eax, esi
jb 0x36a12b1
mov dword [esp + 0x5c], 0
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [ecx + 6]
jae 0x36a13f0
mov esi, dword [0x100f5094]
jmp 0x36a12d0
mov edi, dword [ebx - 0x18]
add edi, dword [esp + 0x58]
mov eax, dword [ebx]
mov ebp, dword [ebx - 0x1c]
test al, 0x40
jne 0x36a131d
test al, al
jns 0x36a131d
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], edi
push eax
push 4
push ebp
push edi
mov dword [esp + 0x38], ebp
call esi
push ebp
push edi
mov dword [esp + 0x28], eax
call dword [0x1011f44c]
cmp dword [esp + 0x20], 0
je 0x36a131d
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
call esi
mov ecx, dword [ebx]
mov eax, ecx
test eax, 0xe0000000
jne 0x36a133a
test al, 0x20
je 0x36a1331
or eax, 0x60000000
test al, 0xc0
je 0x36a133a
or eax, 0xc0000000
cmp dword [esp + 0x5c], 0
je 0x36a1350
test ecx, 0x20000000
je 0x36a1350
mov eax, ecx
and eax, 0x7fffffff
mov esi, eax
mov dword [esp + 0x30], 1
shr esi, 0x1c
mov edx, 0
not esi
mov dword [esp + 0x34], 0x10
and esi, 1
mov dword [esp + 0x40], 2
mov ecx, 0x40
mov dword [esp + 0x44], 0x20
setne dl
test esi, esi
mov esi, 0x80
cmovne ecx, esi
mov esi, dword [0x100f5094]
mov dword [esp + 0x3c], ecx
lea edx, [edx*4 + 4]
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x38], edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x48], edx
mov edx, eax
push ecx
mov ecx, eax
shr edx, 0x1e
shr eax, 0x1d
and edx, 1
shr ecx, 0x1f
and eax, 1
lea ecx, [ecx + edx*2]
lea eax, [eax + ecx*2]
push dword [esp + eax*4 + 0x34]
push ebp
push edi
call esi
mov eax, dword [esp + 0x14]
add ebx, 0x28
mov edx, dword [esp + 0x10]
inc edx
mov dword [esp + 0x10], edx
movzx eax, word [eax + 6]
cmp edx, eax
jl 0x36a12d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret 8