joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa54ed99
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea ecx, [ebp + 8]
call fcn.0a55028b
test al, al
je 0xa54ede6
push dword [ebp + 0x10]
lea ecx, [ebp + 8]
push dword [ebp + 0xc]
call fcn.0a54ffb0
mov edi, eax
test edi, edi
je 0xa54ede6
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0x14]
mov dword [edi], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, 1
jmp 0xa54ede8
xor al, al
pop edi
leave
ret

Function at 0xa54ee1b
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
lea esi, [ebx + 0x1c]
mov ecx, esi
call fcn.0a510041
cmp byte [ebx], 0
je 0xa54eea6
cmp byte [ebx + 1], 0
jne 0xa54eea6
cmp byte [ebp + 8], 0
push edi
mov byte [ebx + 1], 1
lea edi, [ebx + 0x18]
je 0xa54ee53
push edi
push 0x40
push 5
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebx + 4]
cmp byte [ebx + 0x15], 0
mov eax, dword [ecx]
mov dword [ebx + 0x10], eax
mov al, byte [ecx + 4]
mov byte [ebx + 0x14], al
setne al
add al, 0xe8
mov byte [ecx], al
mov eax, dword [ebx + 8]
sub eax, dword [ebx + 4]
sub eax, 5
cmp byte [ebp + 8], 0
mov dword [ecx + 1], eax
je 0xa54ee92
cmp byte [ebp + 0xc], 0
jne 0xa54ee92
push edi
push dword [edi]
push 5
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 5
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
push esi
call fcn.0a60f609
pop ecx
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0xa54eeba
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp + 0xc]
push 0x90
push dword [ebp + 8]
call fcn.0a613410
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
leave
ret
Function at 0xa54f005
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
lea esi, [ebx + 0x1c]
mov ecx, esi
call fcn.0a510041
cmp byte [ebx], 0
je 0xa54f073
cmp byte [ebx + 1], 0
je 0xa54f073
cmp byte [ebp + 8], 0
push edi
mov byte [ebx + 1], 0
lea edi, [ebx + 0x18]
je 0xa54f03d
push edi
push 0x40
push 5
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [ebp + 8], 0
mov ecx, dword [ebx + 4]
mov eax, dword [ebx + 0x10]
mov dword [ecx], eax
mov al, byte [ebx + 0x14]
mov byte [ecx + 4], al
je 0xa54f05f
push edi
push dword [edi]
push 5
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 5
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
push esi
call fcn.0a60f609
pop ecx
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0xa5501fc
Capabilities:
Print debug messages

Disassembly:
push 0xc
mov eax, 0xa645161
call fcn.0a61157a
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov esi, dword [ebp + 8]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], 1
call fcn.0a550121
mov ecx, eax
mov dword [ebp - 0x10], ecx
movzx eax, word [ecx + 0x14]
lea edi, [ecx + 0x18]
add edi, eax
xor eax, eax
mov dword [ebp - 0x14], edi
cmp ax, word [ecx + 6]
jae 0xa550281
mov eax, edi
test eax, eax
je 0xa550264
mov eax, dword [esi + 4]
cmp eax, dword [esi + 8]
je 0xa550256
mov dword [eax], edi
add dword [esi + 4], 4
jmp 0xa550272
lea ecx, [ebp - 0x14]
push ecx
push eax
mov ecx, esi
call fcn.0a51b941
jmp 0xa55026f
push 0xa465a74
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [ebp - 0x10]
add edi, 0x28
inc ebx
mov eax, edi
mov dword [ebp - 0x14], edi
cmp bx, word [ecx + 6]
jb 0xa550242
mov eax, esi
call fcn.0a611548
ret 4

Function at 0xa550a6e
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0xa642a58
call fcn.0a61157a
mov esi, ecx
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.0a550b8e
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push 0xa550a17
push ebx
push ebx
call fcn.0a61c996
add esp, 0x20
mov dword [esi], eax
test eax, eax
je 0xa550ab2
call fcn.0a611548
ret 4
push 6
mov dword [edi], ebx
call fcn.0a60f634
int3

Function at 0xa551ab8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
inc ebx
mov dword [ebp - 4], esi
lea eax, [esi + 0x10]
mov dword [esi + 8], edi
mov dword [esi + 0xc], edx
mov esi, eax
push dword [ebp + 0x14]
mov ecx, edx
xor eax, eax
push dword [ebp + 0x10]
shr ecx, 0x1e
xor eax, edx
xor ecx, edi
push eax
push ecx
call fcn.0a6120b0
mov edi, eax
mov eax, 0x138
add edi, ebx
mov dword [esi], edi
lea esi, [esi + 8]
adc edx, 0
inc ebx
mov dword [esi - 4], edx
cmp ebx, eax
jb 0xa551ad8
mov esi, dword [ebp - 4]
pop edi
mov dword [esi], eax
pop esi
pop ebx
leave
ret 0x10
Function at 0xa5521e6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 4], esi
test eax, eax
je 0xa55221e
cmp word [eax], si
je 0xa55221e
push esi
lea ecx, [ebp - 4]
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0xa552249
mov ecx, dword [ebp - 4]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
mov esi, eax
test ecx, ecx
je 0xa552247
cmp ecx, dword [ebp + 8]
je 0xa552247
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0xa5522c2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa94
mov eax, dword [0xa414e88]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x84]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
push 0x20
push ecx
push 0xffffffffffffffff
push eax
push ebx
push 0xfde9
call esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0xffffffffffffffff
push edi
push ebx
push 0xfde9
call esi
lea eax, [ebp - 0xa90]
push eax
push 0x20019
push ebx
push 0xa465d7c
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0xa552336
push 0xa465da8
jmp 0xa5523db
lea eax, [ebp - 0xa94]
mov dword [ebp - 0xa94], 0x208
push eax
lea eax, [ebp - 0x28c]
push eax
push ebx
push ebx
push 0xa465dc4
push dword [ebp - 0xa90]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa90]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0xa5523d6
mov eax, dword [ebp - 0xa94]
cmp eax, 1
jb 0xa5523d6
shr eax, 1
je 0xa55239d
cmp word [ebp + ebx*2 - 0x28c], 0x2f
jne 0xa552398
push 0x5c
pop ecx
mov word [ebp + ebx*2 - 0x28c], cx
inc ebx
cmp ebx, eax
jb 0xa552382
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x28c]
push eax
push 0xa465df4
lea eax, [ebp - 0xa8c]
push 0x800
push eax
call fcn.0a55219c
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0a551f88
add esp, 0x1c
jmp 0xa5523eb
push 0xa465dd8
push 2
call fcn.0a617240
pop ecx
push eax
call fcn.0a55242c
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0a61153a
leave
ret
Function at 0xa55247c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0xa414e88]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xb
mov ebx, ecx
lea edi, [ebp - 0x34]
pop ecx
mov esi, 0xa465e28
rep movsd dword es:[edi], dword [esi]
push 0x30
pop eax
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor edi, edi
mov word [ebp - 0xa], ax
jmp 0xa5524e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0xa5524ce
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0xa552515
inc ax
mov word [ebp - 0xa], ax
jmp 0xa5524e8
cmp eax, 0xe7
jne 0xa552515
push 0x2710
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0xa552515
push edi
push edi
push 3
push edi
push edi
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call esi
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0xa5524b1
mov byte [ebx], 1
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0a61153a
leave
ret
xor al, al
jmp 0xa552506

Function at 0xa58ccf8
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0xa58cd07
push 0x10
pop eax
pop ebp
ret
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor eax, eax
pop ebp
ret
Function at 0xa58d7ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0xa58d8bd
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0xa58d8bd
mov esi, dword [ebp + 0x14]
test esi, esi
je 0xa58d8bd
push dword [esi]
call fcn.0a5937ca
pop ecx
test eax, eax
jne 0xa58d8c0
mov edi, dword [esi + 4]
lea eax, [edi - 1]
cmp eax, 0x8f
ja 0xa58d8bd
mov eax, dword [ebp + 0x10]
xor edx, edx
div edi
test edx, edx
jne 0xa58d8bd
imul ecx, dword [esi], 0x68
mov eax, dword [ecx + 0xa457dd0]
mov dword [ebp - 4], eax
test eax, eax
je 0xa58d84e
mov eax, dword [ebp + 0x10]
lea ecx, [esi + 0x98]
div edi
push ecx
lea ecx, [esi + 8]
push ecx
push eax
push ebx
push dword [ebp + 8]
call dword [ebp - 4]
add esp, 0x14
jmp 0xa58d8c0
cmp dword [ebp + 0x10], 0
je 0xa58d8b9
mov eax, dword [ebp + 8]
lea ecx, [esi + 8]
test edi, edi
jle 0xa58d876
push 0xfffffffffffffff8
pop edx
mov edi, eax
sub edx, esi
mov al, byte [edi]
xor byte [ecx], al
inc edi
inc ecx
lea eax, [edx + ecx]
cmp eax, dword [esi + 4]
jl 0xa58d865
lea ecx, [esi + 8]
imul eax, dword [esi], 0x68
lea edx, [esi + 0x98]
push edx
push ebx
push ecx
call dword [eax + 0xa457db4]
add esp, 0xc
test eax, eax
jne 0xa58d8c0
mov edi, dword [esi + 4]
xor ecx, ecx
test edi, edi
jle 0xa58d8a7
mov al, byte [ecx + ebx]
mov byte [esi + ecx + 8], al
inc ecx
mov edi, dword [esi + 4]
cmp ecx, edi
jl 0xa58d898
mov eax, dword [ebp + 8]
lea ecx, [esi + 8]
add eax, edi
add ebx, edi
sub dword [ebp + 0x10], edi
mov dword [ebp + 8], eax
jne 0xa58d85a
xor eax, eax
jmp 0xa58d8c0
push 0x10
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xa58d8c5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0xa414e88]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], edi
test eax, eax
je 0xa58d9ed
test edi, edi
je 0xa58d9ed
test esi, esi
je 0xa58d9ed
push dword [esi]
call fcn.0a5937ca
pop ecx
test eax, eax
jne 0xa58d9f0
mov ecx, dword [esi + 4]
lea eax, [ecx - 1]
cmp eax, 0x8f
ja 0xa58d9ed
cmp ecx, 0x10
jg 0xa58d9ed
mov ebx, dword [ebp + 0x10]
xor edx, edx
mov eax, ebx
div ecx
test edx, edx
jne 0xa58d9ed
imul eax, dword [esi], 0x68
mov eax, dword [eax + 0xa457dd4]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0xa58d969
lea eax, [esi + 0x98]
push eax
lea eax, [esi + 8]
push eax
mov eax, ebx
div ecx
push eax
push dword [ebp - 0x18]
push edi
call dword [ebp - 0x1c]
add esp, 0x14
jmp 0xa58d9f0
test ebx, ebx
je 0xa58d9e9
lea ecx, [esi + 0x98]
imul eax, dword [esi], 0x68
push ecx
lea ecx, [ebp - 0x14]
push ecx
push edi
call dword [eax + 0xa457db8]
add esp, 0xc
test eax, eax
jne 0xa58d9f0
mov ecx, dword [esi + 4]
test ecx, ecx
jle 0xa58d9d4
mov ecx, dword [ebp - 0x18]
lea ebx, [esi + 8]
push 0xfffffffffffffff8
pop eax
sub eax, esi
mov edx, edi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
sub eax, edi
sub ecx, edi
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov cl, byte [eax + edx]
xor cl, byte [ebx]
mov al, byte [edx]
mov byte [ebx], al
mov eax, dword [ebp - 0x24]
mov byte [eax + edx], cl
inc edx
mov ecx, dword [esi + 4]
inc ebx
lea eax, [edi + ebx]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
jl 0xa58d9b0
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp + 0x10]
add dword [ebp - 0x18], ecx
add edi, ecx
sub ebx, ecx
mov dword [ebp - 0x20], edi
mov dword [ebp + 0x10], ebx
lea ecx, [esi + 0x98]
jne 0xa58d973
xor eax, eax
jmp 0xa58d9f0
push 0x10
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0a61153a
leave
ret

Function at 0xa58daf0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0xa58daff
push 0x10
pop eax
pop ebp
ret
xor ecx, ecx
mov dword [eax + 8], 0xf3bcc908
mov dword [eax + 0x48], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0xc], 0x6a09e667
mov dword [eax + 0x10], 0x84caa73b
mov dword [eax + 0x14], 0xbb67ae85
mov dword [eax + 0x18], 0xfe94f82b
mov dword [eax + 0x1c], 0x3c6ef372
mov dword [eax + 0x20], 0x5f1d36f1
mov dword [eax + 0x24], 0xa54ff53a
mov dword [eax + 0x28], 0xade682d1
mov dword [eax + 0x2c], 0x510e527f
mov dword [eax + 0x30], 0x2b3e6c1f
mov dword [eax + 0x34], 0x9b05688c
mov dword [eax + 0x38], 0xfb41bd6b
mov dword [eax + 0x3c], 0x1f83d9ab
mov dword [eax + 0x40], 0x137e2179
mov dword [eax + 0x44], 0x5be0cd19
xor eax, eax
pop ebp
ret
Function at 0xa58f029
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0xa58f038
push 0x10
pop eax
pop ebp
ret
xor ecx, ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret
Function at 0xa59158a
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0xa5916df
mov edi, dword [ebp + 0xc]
test edi, edi
je 0xa5916df
mov edx, dword [esi + 0x20]
cmp edx, 0x40
jae 0xa5916df
xor eax, eax
mov ecx, edx
shl ecx, 3
add dword [esi + 0x18], ecx
adc eax, dword [esi + 0x1c]
mov dword [esi + 0x1c], eax
mov byte [edx + esi + 0x24], 1
mov eax, dword [esi + 0x20]
inc eax
mov dword [esi + 0x20], eax
cmp eax, 0x38
ja 0xa5916c3
jae 0xa5915e9
mov byte [eax + esi + 0x24], 0
mov eax, dword [esi + 0x20]
inc eax
mov dword [esi + 0x20], eax
cmp eax, 0x38
jb 0xa5915d8
mov al, byte [esi + 0x1f]
mov byte [esi + 0x63], al
mov al, byte [esi + 0x1e]
mov byte [esi + 0x62], al
mov al, byte [esi + 0x1d]
mov byte [esi + 0x61], al
mov al, byte [esi + 0x1c]
mov byte [esi + 0x60], al
mov al, byte [esi + 0x1b]
mov byte [esi + 0x5f], al
mov al, byte [esi + 0x1a]
mov byte [esi + 0x5e], al
mov al, byte [esi + 0x19]
mov byte [esi + 0x5d], al
mov al, byte [esi + 0x18]
mov byte [esi + 0x5c], al
lea eax, [esi + 0x24]
push eax
push esi
call fcn.0a591998
mov al, byte [esi + 7]
mov byte [edi + 7], al
mov al, byte [esi + 6]
mov byte [edi + 6], al
mov al, byte [esi + 5]
mov byte [edi + 5], al
mov al, byte [esi + 4]
mov byte [edi + 4], al
mov al, byte [esi + 3]
mov byte [edi + 3], al
mov al, byte [esi + 2]
mov byte [edi + 2], al
mov al, byte [esi + 1]
mov byte [edi + 1], al
mov al, byte [esi]
mov byte [edi], al
mov al, byte [esi + 0xf]
mov byte [edi + 0xf], al
mov al, byte [esi + 0xe]
mov byte [edi + 0xe], al
mov al, byte [esi + 0xd]
mov byte [edi + 0xd], al
mov al, byte [esi + 0xc]
mov byte [edi + 0xc], al
mov al, byte [esi + 0xb]
mov byte [edi + 0xb], al
mov al, byte [esi + 0xa]
mov byte [edi + 0xa], al
mov al, byte [esi + 9]
mov byte [edi + 9], al
mov al, byte [esi + 8]
mov byte [edi + 8], al
mov al, byte [esi + 0x17]
mov byte [edi + 0x17], al
mov al, byte [esi + 0x16]
mov byte [edi + 0x16], al
mov al, byte [esi + 0x15]
mov byte [edi + 0x15], al
mov al, byte [esi + 0x14]
mov byte [edi + 0x14], al
mov al, byte [esi + 0x13]
mov byte [edi + 0x13], al
mov al, byte [esi + 0x12]
mov byte [edi + 0x12], al
mov al, byte [esi + 0x11]
mov byte [edi + 0x11], al
mov al, byte [esi + 0x10]
pop ecx
mov byte [edi + 0x10], al
xor eax, eax
pop ecx
jmp 0xa5916e2
mov byte [eax + esi + 0x24], 0
mov eax, dword [esi + 0x20]
inc eax
mov dword [esi + 0x20], eax
cmp eax, 0x40
jb 0xa5916b7
lea eax, [esi + 0x24]
push eax
push esi
call fcn.0a591998
and dword [esi + 0x20], 0
xor eax, eax
pop ecx
pop ecx
jmp 0xa5915d8
push 0x10
pop eax
pop edi
pop esi
pop ebp
ret
Function at 0xa591b00
Capabilities:
Hash data using tiger

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
push ebx
push esi
xor dword [ecx], eax
mov ebx, dword [ecx]
mov eax, dword [ebp + 0x18]
xor dword [ecx + 4], eax
mov ecx, dword [ecx + 4]
mov eax, ecx
shr eax, 0x10
movzx eax, al
mov dword [ebp + 0x10], ecx
movzx ecx, cl
push edi
mov esi, dword [eax*8 + 0xa4a0a40]
mov edx, dword [eax*8 + 0xa4a0a44]
xor esi, dword [ecx*8 + 0xa4a0240]
xor edx, dword [ecx*8 + 0xa4a0244]
mov ecx, ebx
mov edi, dword [ebp + 0x10]
mov eax, edi
shrd ecx, eax, 0x10
push 5
movzx eax, cl
mov ecx, ebx
xor esi, dword [eax*8 + 0xa49fa40]
xor edx, dword [eax*8 + 0xa49fa44]
movzx eax, bl
xor esi, dword [eax*8 + 0xa49f240]
xor edx, dword [eax*8 + 0xa49f244]
mov eax, dword [ebp + 8]
sub dword [eax], esi
sbb dword [eax + 4], edx
mov eax, edi
shr eax, 8
movzx edx, al
mov eax, edi
shrd ecx, eax, 0x18
movzx eax, cl
mov esi, dword [edx*8 + 0xa49fa40]
mov ecx, dword [edx*8 + 0xa49fa44]
mov edx, edi
mov edi, dword [ebp + 0xc]
xor esi, dword [eax*8 + 0xa4a0240]
xor ecx, dword [eax*8 + 0xa4a0244]
mov eax, edx
shrd ebx, eax, 8
shr edx, 0x18
movzx eax, bl
xor esi, dword [eax*8 + 0xa4a0a40]
xor ecx, dword [eax*8 + 0xa4a0a44]
xor esi, dword [edx*8 + 0xa49f240]
xor ecx, dword [edx*8 + 0xa49f244]
add dword [edi], esi
pop esi
adc dword [edi + 4], ecx
mov ecx, dword [ebp + 0x1c]
mov eax, dword [edi + 4]
sub ecx, esi
je 0xa591bf9
dec ecx
sub ecx, 1
je 0xa591bf6
dec ecx
sub ecx, 1
jne 0xa591c08
push 9
jmp 0xa591bf8
push 7
pop esi
mul esi
mov ecx, eax
mov eax, dword [edi]
mul esi
add ecx, edx
mov dword [edi], eax
mov dword [edi + 4], ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0xa592af3
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0xa414e88]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0xf8], eax
movzx edx, byte [esi + 0xa4a1c48]
mov eax, edx
shr edx, 3
and eax, 7
mov ecx, dword [eax*4 + 0xa4a1bc8]
movzx eax, byte [edx + edi]
and eax, ecx
cmp eax, ecx
sete al
mov byte [ebp + esi - 0x3c], al
inc esi
cmp esi, 0x38
jb 0xa592b17
mov ax, word [ebp + 0xc]
xor esi, esi
cmp ax, 1
jne 0xa592b57
push 0xf
pop ecx
sub ecx, esi
add ecx, ecx
jmp 0xa592b5a
lea ecx, [esi + esi]
and dword [ebp + ecx*4 - 0xf0], 0
and dword [ebp + ecx*4 - 0xf4], 0
xor eax, eax
movzx edx, byte [esi + 0xa4a1c80]
cmp edx, 0x1c
jae 0xa592b7e
mov bl, byte [ebp + edx - 0x3c]
jmp 0xa592b82
mov bl, byte [ebp + edx - 0x58]
mov byte [ebp + eax - 0x74], bl
inc eax
inc edx
cmp eax, 0x1c
jb 0xa592b73
cmp eax, 0x38
jae 0xa592bb5
movzx edx, byte [esi + 0xa4a1c80]
add edx, eax
cmp edx, 0x38
jae 0xa592ba6
mov bl, byte [ebp + edx - 0x3c]
jmp 0xa592baa
mov bl, byte [ebp + edx - 0x58]
mov byte [ebp + eax - 0x74], bl
inc eax
inc edx
cmp eax, 0x38
jb 0xa592b9b
xor edx, edx
movzx eax, byte [edx + 0xa4a1c90]
mov edi, edx
cmp byte [ebp + eax - 0x74], 0
je 0xa592bd5
mov eax, dword [edi*4 + 0xa4a1be8]
or dword [ebp + ecx*4 - 0xf4], eax
movzx eax, byte [edx + 0xa4a1ca8]
cmp byte [ebp + eax - 0x74], 0
je 0xa592bf1
mov eax, dword [edi*4 + 0xa4a1be8]
or dword [ebp + ecx*4 - 0xf0], eax
inc edx
cmp edx, 0x18
jb 0xa592bb7
mov ax, word [ebp + 0xc]
inc esi
cmp esi, 0x10
jb 0xa592b48
pop edi
pop esi
pop ebx
push dword [ebp - 0xf8]
lea eax, [ebp - 0xf4]
push eax
call fcn.0a5927ad
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0a61153a
leave
ret
Function at 0xa5949d9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
jne 0xa5949e7
push 0x10
pop eax
pop ebp
ret
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0a594aba
add esp, 0xc
test eax, eax
jne 0xa5949e5
pop ebp
jmp fcn.0a594a02
Function at 0xa59ba6d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0a59ba76

Function at 0xa59bd27
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 4
pop edx
movzx ecx, al
shr eax, 8
xor eax, dword [ecx*4 + 0xa4b41e0]
sub edx, 1
jne 0xa59bd30
pop ebp
ret

Function at 0xa5a10ee
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
and edi, 0x1f
cmp edi, 8
jb 0xa5a116b
mov ecx, dword [ebp + 0x10]
mov eax, edi
shr eax, 3
mov dword [ebp - 4], eax
mov eax, ecx
add ecx, 8
mov dword [ebp + 0x14], ecx
push dword [eax + 4]
push dword [eax]
push 0
push 0
call fcn.0a5a1298
add esp, 0x10
mov ecx, eax
xor ecx, esi
xor edx, ebx
mov eax, ecx
shld eax, edx, 0x1b
push 0x9e3779b1
shld edx, ecx, 0x1b
push 0x85ebca87
push edx
push eax
call fcn.0a6120b0
mov ecx, dword [ebp + 0x14]
mov esi, eax
add esi, 0xc2b2ae63
mov ebx, edx
adc ebx, 0x85ebca77
sub edi, 8
sub dword [ebp - 4], 1
jne 0xa5a1111
mov eax, ecx
jmp 0xa5a1171
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x14], eax
mov dword [ebp + 0xc], esi
mov ecx, eax
cmp edi, 4
jb 0xa5a11cc
add eax, 4
mov dword [ebp + 0x14], eax
mov eax, 0x9e3779b1
mul dword [ecx]
push 0xc2b2ae3d
mov esi, eax
mov eax, 0x85ebca87
mul dword [ecx]
push 0x27d4eb4f
xor eax, dword [ebp + 0xc]
add esi, edx
xor esi, ebx
mov ecx, eax
shld ecx, esi, 0x17
shld esi, eax, 0x17
push esi
push ecx
call fcn.0a6120b0
mov esi, eax
mov ebx, edx
mov eax, dword [ebp + 0x14]
add esi, 0x9e3779f9
mov dword [ebp + 0xc], esi
adc ebx, 0x165667b1
sub edi, 4
test edi, edi
je 0xa5a1216
movzx eax, byte [eax]
push 0x27d4eb2f
cdq
push 0x165667c5
push edx
push eax
call fcn.0a6120b0
xor esi, eax
xor ebx, edx
inc dword [ebp + 0x14]
mov eax, esi
push 0x9e3779b1
shld eax, ebx, 0xb
push 0x85ebca87
shld ebx, esi, 0xb
push ebx
push eax
call fcn.0a6120b0
mov esi, eax
mov eax, dword [ebp + 0x14]
mov ebx, edx
sub edi, 1
jne 0xa5a11d0
mov dword [ebp + 0xc], esi
push 0xc2b2ae3d
xor ecx, ecx
mov esi, ebx
push 0x27d4eb4f
xor ecx, ebx
shr esi, 1
xor esi, dword [ebp + 0xc]
push ecx
push esi
call fcn.0a6120b0
mov esi, eax
mov ecx, edx
shrd esi, ecx, 0x1d
push 0x165667b1
shr ecx, 0x1d
xor esi, eax
push 0x9e3779f9
xor ecx, edx
push ecx
push esi
call fcn.0a6120b0
mov ecx, edx
xor esi, esi
pop edi
xor eax, ecx
xor edx, esi
pop esi
pop ebx
leave
ret