joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10053fb0
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
or eax, 0xffffffff
mov dword [ebp - 4], ecx
push esi
test ebx, ebx
je 0x100540ba
push edi
nop word [eax + eax]
mov edx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
mov esi, edx
shr esi, 1
lea ecx, [edx + edx]
xor esi, ecx
lea ecx, [edx + edx]
and esi, 0x55555555
xor esi, ecx
mov edx, esi
shr edx, 2
lea ecx, [esi*4]
xor edx, ecx
lea ecx, [esi*4]
and edx, 0x33333333
xor edx, ecx
mov edi, edx
shr edx, 4
and edi, 0xff0f0f0f
shl edi, 4
or edi, edx
lea edx, [eax + eax]
mov esi, edx
xor esi, 0x4c11db7
bswap edi
mov ecx, edi
xor ecx, eax
cmovns esi, edx
add edi, edi
lea eax, [esi + esi]
mov ecx, eax
xor ecx, 0x4c11db7
xor esi, edi
cmovns ecx, eax
add edi, edi
lea eax, [ecx + ecx]
mov edx, eax
xor edx, 0x4c11db7
xor ecx, edi
cmovns edx, eax
add edi, edi
lea eax, [edx + edx]
mov ecx, eax
xor ecx, 0x4c11db7
xor edx, edi
cmovns ecx, eax
add edi, edi
lea eax, [ecx + ecx]
mov edx, eax
xor edx, 0x4c11db7
xor ecx, edi
cmovns edx, eax
add edi, edi
lea eax, [edx + edx]
mov ecx, eax
xor ecx, 0x4c11db7
xor edx, edi
cmovns ecx, eax
add edi, edi
lea eax, [ecx + ecx]
mov esi, eax
xor esi, 0x4c11db7
xor ecx, edi
lea ecx, [edi + edi]
cmovns esi, eax
lea edx, [esi + esi]
mov eax, edx
xor eax, 0x4c11db7
xor ecx, esi
mov ecx, dword [ebp - 4]
cmovns eax, edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, ebx
jb 0x10053fd0
pop edi
not eax
mov edx, eax
shr edx, 1
lea ecx, [eax + eax]
add eax, eax
xor edx, ecx
and edx, 0x55555555
xor edx, eax
mov esi, edx
shr esi, 2
lea eax, [edx*4]
xor esi, eax
lea eax, [edx*4]
and esi, 0x33333333
xor esi, eax
mov eax, esi
mov ecx, esi
shr eax, 4
shl ecx, 4
xor eax, ecx
shl esi, 4
and eax, 0xf0f0f0f
xor eax, esi
pop esi
bswap eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10058b50
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x4c
push 0
lea eax, [esi + 0x20]
push eax
call fcn.1002ae80
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov eax, 1
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
pop esi
pop ebp
ret
Function at 0x1006a4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor al, al
push esi
mov byte [ebp - 1], al
push edi
nop
mov edx, dword [ebp + 0x18]
movzx esi, al
mov dword [ebp - 0x18], esi
mov cl, byte [esi + edx]
mov al, cl
xor al, 1
mov byte [esi + edx], al
cmp cl, 1
je 0x1006a624
mov eax, dword [ebp + 0x10]
xor cl, cl
mov dword [ebp - 8], 0
mov edi, 0x10188ac0
mov ch, byte [esi + eax]
mov eax, esi
movzx edx, ch
mov dword [ebp - 0x14], edx
mov ebx, edx
shl eax, 4
mov byte [ebp - 2], ch
lea esi, [edx + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], esi
mov edx, esi
mov esi, dword [ebp + 0xc]
nop
cmp ch, cl
lea edi, [edi + 4]
mov eax, edx
cmovae eax, ebx
inc cl
add eax, dword [ebp - 0x10]
dec ebx
dec edx
mov eax, dword [esi + eax*4]
imul eax, dword [edi - 4]
add dword [ebp - 8], eax
cmp cl, 0x10
jb 0x1006a520
sar dword [ebp - 8], 0x12
xor ebx, ebx
mov edx, dword [ebp - 0x14]
xor al, al
mov esi, dword [ebp - 0xc]
mov edi, 0x10188a80
mov ah, byte [ebp - 2]
mov ecx, esi
lea edi, [edi + 4]
mov esi, dword [ebp + 0xc]
cmp ah, al
cmovae ecx, edx
inc al
add ecx, dword [ebp - 0x10]
dec edx
mov ecx, dword [esi + ecx*4]
imul ecx, dword [edi - 4]
mov esi, dword [ebp - 0xc]
dec esi
mov dword [ebp - 0xc], esi
add ebx, ecx
cmp al, 0x10
jb 0x1006a556
mov al, byte [ebp - 1]
mov edx, dword [ebp + 0x10]
inc al
mov esi, dword [ebp - 8]
movzx ecx, al
mov byte [ebp - 2], al
sar ebx, 0x12
push esi
mov al, byte [ecx + edx]
inc al
and al, 0xf
mov byte [ecx + edx], al
movzx eax, al
shl ecx, 4
add ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax + ecx*4], ebx
call fcn.10070b10
mov edi, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add dword [ecx + edi*8], eax
mov eax, esi
mov ecx, dword [ebp + 0x14]
sub eax, dword [ecx + edi*4 + 4]
push eax
call fcn.10070b10
mov ecx, dword [ebp + 8]
add esp, 8
add dword [ecx + edi*8 + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [eax + edi*4 + 4], esi
mov esi, dword [ebp + 0x1c]
inc dword [esi + edi*4 + 4]
cmp byte [ebp - 1], 4
jne 0x1006a616
push ebx
call fcn.10070b10
mov ecx, dword [ebp + 8]
add dword [ecx + edi*8 + 8], eax
mov eax, ebx
mov ecx, dword [ebp + 0x14]
sub eax, dword [ecx + edi*4 + 8]
push eax
call fcn.10070b10
mov ecx, dword [ebp + 8]
add esp, 8
add dword [ecx + edi*8 + 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [eax + edi*4 + 8], ebx
inc dword [esi + edi*4 + 8]
mov al, byte [ebp - 2]
mov byte [ebp - 1], al
cmp al, 5
jb 0x1006a4d0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1006adc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x464
mov eax, dword [0x10188068]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x45c], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x454], eax
xor esi, esi
mov eax, dword [ebp + 0x18]
push 0x400
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x404]
push esi
push eax
mov dword [ebp - 0x450], esi
call fcn.1002ae80
mov eax, dword [ebp + 0x10]
lea ebx, [esi + 2]
add eax, 0xfffffffe
add esp, 0xc
mov dword [ebp - 0x458], eax
cmp eax, ebx
jle 0x1006b008
mov edx, dword [ebp - 0x454]
mov eax, dword [ebp + 0xc]
push edi
lea ecx, [edx - 2]
lea edi, [eax + edx*2]
mov dword [ebp - 0x460], ecx
mov eax, dword [ebp - 0x458]
mov esi, 2
cmp ecx, esi
jle 0x1006ae8e
nop dword [eax]
cmp byte [edi + esi], 0
je 0x1006ae83
push edx
push esi
push ebx
push dword [ebp - 0x45c]
call fcn.1006a630
mov ecx, dword [ebp - 0x460]
add esp, 0x10
mov edx, dword [ebp - 0x454]
movzx eax, al
inc dword [ebp + eax*4 - 0x404]
inc dword [ebp - 0x450]
inc esi
cmp esi, ecx
jl 0x1006ae50
mov eax, dword [ebp - 0x458]
inc ebx
add edi, edx
cmp ebx, eax
jl 0x1006ae40
mov esi, dword [ebp - 0x450]
test esi, esi
je 0x1006b007
lea eax, [ebp - 0x404]
push 2
push eax
call fcn.1006a3d0
mov eax, 0x7fffffff
mov dword [ebp - 0x44c], 0x3020100
cdq
add esp, 8
idiv esi
mov edx, dword [ebp - 0x464]
xor edi, edi
mov dword [ebp - 0x448], 0x9070605
mov esi, eax
mov dword [ebp - 0x444], 0xe0d0b0a
add edx, 8
mov dword [ebp - 0x440], 0x1312110f
mov dword [ebp - 0x43c], 0x19171615
mov dword [ebp - 0x438], 0x1e1d1b1a
mov dword [ebp - 0x434], 0x2523221f
mov dword [ebp - 0x430], 0x2a292726
mov dword [ebp - 0x42c], 0x2f2e2d2b
mov dword [ebp - 0x428], 0x37363533
mov dword [ebp - 0x424], 0x3d3b3a39
mov dword [ebp - 0x420], 0x56553f3e
mov dword [ebp - 0x41c], 0x5e5b5a57
mov dword [ebp - 0x418], 0x6a67665f
mov dword [ebp - 0x414], 0x776f6e6b
mov dword [ebp - 0x410], 0x7f7e7b7a
mov dword [ebp - 0x40c], 0xbbafabaa
mov word [ebp - 0x408], 0xffbf
nop dword [eax]
movzx eax, byte [ebp + edi - 0x44b]
lea edx, [edx + 0x14]
movzx ecx, byte [ebp + edi - 0x44c]
mov eax, dword [ebp + eax*4 - 0x404]
imul eax, esi
mov ecx, dword [ebp + ecx*4 - 0x404]
imul ecx, esi
sar eax, 0xb
mov dword [edx - 0x18], eax
movzx eax, byte [ebp + edi - 0x44a]
sar ecx, 0xb
mov dword [edx - 0x1c], ecx
mov eax, dword [ebp + eax*4 - 0x404]
imul eax, esi
sar eax, 0xb
mov dword [edx - 0x14], eax
movzx eax, byte [ebp + edi - 0x449]
mov eax, dword [ebp + eax*4 - 0x404]
imul eax, esi
sar eax, 0xb
mov dword [edx - 0x10], eax
movzx eax, byte [ebp + edi - 0x448]
add edi, 5
mov eax, dword [ebp + eax*4 - 0x404]
imul eax, esi
sar eax, 0xb
mov dword [edx - 0xc], eax
cmp edi, 0x46
jl 0x1006af80
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10029ae5
mov esp, ebp
pop ebp
ret
Function at 0x100707b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, 1
xor edi, edi
mov ecx, dword [ebx]
sub ecx, dword [ebp + 8]
mov eax, ecx
sar eax, 0x1f
lea edx, [eax + ecx]
xor edx, eax
cmp dword [ebp + 0x10], esi
jle 0x100707f9
mov ecx, dword [ebx + esi*4]
sub ecx, dword [ebp + 8]
mov eax, ecx
sar eax, 0x1f
add ecx, eax
xor ecx, eax
mov eax, esi
cmp ecx, edx
cmovge eax, edi
inc esi
cmp ecx, edx
mov edi, eax
cmovge ecx, edx
mov edx, ecx
cmp esi, dword [ebp + 0x10]
jl 0x100707d4
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x100717f0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x10071812
push 0xb1
push str.d:desktopliveness_detection_sdk_2.4_6_liveness_detection_sdk_2.4liblibtomcrypthashes_sha2_sha512.c
push str.md___NULL
call fcn.10074ab0
add esp, 0xc
mov dword [esi + 0x48], 0
xor eax, eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0xf3bcc908
mov dword [esi + 0xc], 0x6a09e667
mov dword [esi + 0x10], 0x84caa73b
mov dword [esi + 0x14], 0xbb67ae85
mov dword [esi + 0x18], 0xfe94f82b
mov dword [esi + 0x1c], 0x3c6ef372
mov dword [esi + 0x20], 0x5f1d36f1
mov dword [esi + 0x24], 0xa54ff53a
mov dword [esi + 0x28], 0xade682d1
mov dword [esi + 0x2c], 0x510e527f
mov dword [esi + 0x30], 0x2b3e6c1f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0xfb41bd6b
mov dword [esi + 0x3c], 0x1f83d9ab
mov dword [esi + 0x40], 0x137e2179
mov dword [esi + 0x44], 0x5be0cd19
pop esi
pop ebp
ret
Function at 0x10072230
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x10072252
push 0xd0
push str.d:desktopliveness_detection_sdk_2.4_6_liveness_detection_sdk_2.4liblibtomcrypthashes_sha2_sha256.c
push str.md___NULL
call fcn.10074ab0
add esp, 0xc
mov dword [esi + 0x28], 0
xor eax, eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0x6a09e667
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0x3c6ef372
mov dword [esi + 0x14], 0xa54ff53a
mov dword [esi + 0x18], 0x510e527f
mov dword [esi + 0x1c], 0x9b05688c
mov dword [esi + 0x20], 0x1f83d9ab
mov dword [esi + 0x24], 0x5be0cd19
pop esi
pop ebp
ret
Function at 0x10073730
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x150
push ebx
push esi
xor esi, esi
add eax, 2
push edi
movzx edx, byte [eax - 2]
lea eax, [eax + 4]
movzx ecx, byte [eax - 5]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 4]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 3]
shl edx, 8
or edx, ecx
mov dword [ebp + esi*4 - 0x150], edx
inc esi
cmp esi, 0x10
jb 0x10073744
mov eax, dword [ebp + 8]
mov edx, 0x40
mov ecx, dword [eax + 8]
mov ebx, dword [eax + 0xc]
mov esi, dword [eax + 0x10]
mov edi, dword [eax + 0x14]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x148]
mov dword [ebp - 8], eax
nop dword [eax]
mov eax, dword [ecx + 0x2c]
lea ecx, [ecx + 4]
xor eax, dword [ecx + 0x14]
xor eax, dword [ecx - 0xc]
xor eax, dword [ecx - 4]
rol eax, 1
mov dword [ecx + 0x34], eax
sub edx, 1
jne 0x100737a0
mov eax, dword [ebp - 4]
nop dword [eax]
mov ecx, eax
mov eax, edi
xor eax, esi
rol ecx, 5
and eax, ebx
xor eax, edi
add ecx, eax
mov eax, dword [ebp - 8]
add ecx, dword [ebp + edx*4 - 0x150]
add eax, 0x5a827999
mov dword [ebp - 8], edi
add ecx, eax
mov edi, esi
inc edx
mov esi, ebx
mov eax, ecx
mov ebx, dword [ebp - 4]
rol esi, 0x1e
mov dword [ebp - 4], eax
cmp edx, 0x14
jb 0x100737c0
cmp edx, 0x28
jae 0x10073834
nop dword [eax]
mov eax, edi
rol ecx, 5
xor eax, esi
xor eax, ebx
add ecx, eax
mov eax, dword [ebp - 8]
add ecx, dword [ebp + edx*4 - 0x150]
add eax, 0x6ed9eba1
mov dword [ebp - 8], edi
add ecx, eax
mov edi, esi
inc edx
mov esi, ebx
mov eax, ecx
mov ebx, dword [ebp - 4]
rol esi, 0x1e
mov dword [ebp - 4], eax
cmp edx, 0x28
jb 0x10073800
cmp edx, 0x3c
jae 0x10073881
mov ecx, eax
nop dword [eax + eax]
rol ecx, 5
mov eax, esi
mov dword [ebp - 0xc], ecx
and eax, ebx
mov ecx, esi
or ecx, ebx
and ecx, edi
or ecx, eax
mov eax, dword [ebp - 0xc]
add ecx, dword [ebp + edx*4 - 0x150]
add eax, 0x8f1bbcdc
add ecx, dword [ebp - 8]
inc edx
mov dword [ebp - 8], edi
add eax, ecx
mov edi, esi
mov dword [ebp - 0xc], eax
mov esi, ebx
mov ecx, eax
mov ebx, dword [ebp - 4]
rol esi, 0x1e
mov dword [ebp - 4], eax
cmp edx, 0x3c
jb 0x10073840
mov ecx, eax
cmp edx, 0x50
jae 0x100738b9
mov eax, edi
rol ecx, 5
xor eax, esi
add ecx, 0xca62c1d6
xor eax, ebx
add eax, dword [ebp + edx*4 - 0x150]
inc edx
add eax, dword [ebp - 8]
mov dword [ebp - 8], edi
add ecx, eax
mov edi, esi
mov esi, ebx
mov ebx, dword [ebp - 4]
rol esi, 0x1e
mov dword [ebp - 4], ecx
cmp edx, 0x50
jb 0x10073888
mov eax, dword [ebp - 0x10]
add eax, ecx
mov ecx, dword [ebp + 8]
add dword [ecx + 0x14], edi
add dword [ecx + 0x10], esi
add dword [ecx + 0xc], ebx
pop edi
mov dword [ecx + 8], eax
mov eax, dword [ebp - 8]
add dword [ecx + 0x18], eax
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10086c00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov edi, 4
mov eax, dword [ebx + 0x14]
mov edx, edi
and eax, 3
sub edx, eax
test eax, eax
cmove edx, eax
add edx, dword [ebx + 0x14]
imul edx, dword [ebx + 0x18]
add edx, 0x436
push edx
call fcn.100fcb64
mov ecx, dword [ebx + 0x14]
and ecx, 3
sub edi, ecx
test ecx, ecx
cmove edi, ecx
add edi, dword [ebx + 0x14]
imul edi, dword [ebx + 0x18]
add edi, 0x436
push edi
mov edi, eax
push 0
push edi
call fcn.1002ae80
add esp, 0x10
mov ecx, ebx
push edi
call fcn.10086cb0
mov ebx, eax
test ebx, ebx
jle 0x10086c8f
push 0x1016164c
push dword [ebp + 8]
call fcn.100ff0ff
mov esi, eax
add esp, 8
test esi, esi
je 0x10086c8f
push esi
push 1
push ebx
push edi
call fcn.101007e2
push esi
call fcn.10046433
add esp, 0x14
push edi
call fcn.100fcb6d
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10097db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10109a56
mov eax, dword fs:[0]
push eax
sub esp, 0x178
mov eax, dword [0x10188068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp + 0x18]
push 0x41
mov dword [ebp - 0x184], eax
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.1002ae80
push 0x41
lea eax, [ebp - 0xac]
push 0
push eax
call fcn.1002ae80
mov esi, dword [ebp + 0x14]
add esp, 0x18
mov byte [ebp - 0x24], 0
xorps xmm0, xmm0
mov word [ebp - 0x13], 0
mov byte [ebp - 0x11], 0
movups xmmword [ebp - 0x23], xmm0
cmp esi, 0x40
jbe 0x10097e77
lea ecx, [ebp - 0x17c]
call fcn.100a9f20
push esi
push edi
lea ecx, [ebp - 0x17c]
mov dword [ebp - 4], 0
call fcn.100a9fb0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x17c]
call fcn.100aa360
lea ecx, [ebp - 0x17c]
mov dword [ebp - 4], 0xffffffff
lea edi, [ebp - 0x24]
mov esi, 0x14
call fcn.100a9f70
push esi
lea eax, [ebp - 0x68]
push edi
push eax
call fcn.1002afe0
push esi
lea eax, [ebp - 0xac]
push edi
push eax
call fcn.1002afe0
movaps xmm2, xmmword [str.6666666666666666ERBOSE]
add esp, 0x18
movaps xmm3, xmmword [0x10164a70]
xor eax, eax
movups xmm0, xmmword [ebp + eax - 0x68]
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmm0, xmmword [ebp + eax - 0xac]
movups xmmword [ebp + eax - 0x68], xmm1
movaps xmm1, xmm3
pxor xmm1, xmm0
movups xmm0, xmmword [ebp + eax - 0x58]
movups xmmword [ebp + eax - 0xac], xmm1
movaps xmm1, xmm2
pxor xmm1, xmm0
movups xmm0, xmmword [ebp + eax - 0x9c]
movups xmmword [ebp + eax - 0x58], xmm1
movaps xmm1, xmm3
pxor xmm1, xmm0
movups xmmword [ebp + eax - 0x9c], xmm1
add eax, 0x20
cmp eax, 0x40
jl 0x10097ea3
lea ecx, [ebp - 0x114]
call fcn.100a9f20
push 0x40
lea eax, [ebp - 0x68]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x114]
call fcn.100a9fb0
push dword [ebp + 0xc]
lea ecx, [ebp - 0x114]
push dword [ebp - 0x180]
call fcn.100a9fb0
mov esi, dword [ebp - 0x184]
lea ecx, [ebp - 0x114]
push esi
call fcn.100aa360
lea ecx, [ebp - 0x114]
call fcn.100aa320
push 0x40
lea eax, [ebp - 0xac]
push eax
lea ecx, [ebp - 0x114]
call fcn.100a9fb0
push 0x14
push esi
lea ecx, [ebp - 0x114]
call fcn.100a9fb0
push esi
lea ecx, [ebp - 0x114]
call fcn.100aa360
lea ecx, [ebp - 0x114]
call fcn.100a9f70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10029ae5
mov esp, ebp
pop ebp
ret
Function at 0x100984d0
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
cmp edx, 0x40000000
jl 0x100984eb
sub edx, 0x40000000
mov ecx, 0x40000000
jmp 0x100984ed
xor ecx, ecx
lea eax, [ecx + 0x10000000]
cmp eax, edx
jg 0x10098506
mov eax, 0xf0000000
sub eax, ecx
add edx, eax
or ecx, 0x20000000
shr ecx, 1
lea eax, [ecx + 0x4000000]
cmp eax, edx
jg 0x10098521
mov eax, 0xfc000000
sub eax, ecx
add edx, eax
or ecx, 0x8000000
shr ecx, 1
lea eax, [ecx + 0x1000000]
cmp eax, edx
jg 0x1009853c
mov eax, 0xff000000
sub eax, ecx
add edx, eax
or ecx, 0x2000000
shr ecx, 1
lea eax, [ecx + 0x400000]
cmp eax, edx
jg 0x10098557
mov eax, 0xffc00000
sub eax, ecx
add edx, eax
or ecx, 0x800000
shr ecx, 1
lea eax, [ecx + 0x100000]
cmp eax, edx
jg 0x10098572
mov eax, 0xfff00000
sub eax, ecx
add edx, eax
or ecx, 0x200000
shr ecx, 1
lea eax, [ecx + 0x40000]
cmp eax, edx
jg 0x1009858d
mov eax, 0xfffc0000
sub eax, ecx
add edx, eax
or ecx, 0x80000
shr ecx, 1
lea eax, [ecx + 0x10000]
cmp eax, edx
jg 0x100985a8
mov eax, 0xffff0000
sub eax, ecx
add edx, eax
or ecx, 0x20000
shr ecx, 1
lea eax, [ecx + 0x4000]
cmp eax, edx
jg 0x100985c3
mov eax, 0xffffc000
sub eax, ecx
add edx, eax
or ecx, 0x8000
shr ecx, 1
lea eax, [ecx + 0x1000]
cmp eax, edx
jg 0x100985de
mov eax, 0xfffff000
sub eax, ecx
add edx, eax
or ecx, 0x2000
shr ecx, 1
lea eax, [ecx + 0x400]
cmp eax, edx
jg 0x100985f9
mov eax, 0xfffffc00
sub eax, ecx
add edx, eax
or ecx, 0x800
shr ecx, 1
lea eax, [ecx + 0x100]
cmp eax, edx
jg 0x10098614
mov eax, 0xffffff00
sub eax, ecx
add edx, eax
or ecx, 0x200
shr ecx, 1
lea eax, [ecx + 0x40]
cmp eax, edx
jg 0x1009862c
mov eax, 0xffffffc0
sub eax, ecx
add edx, eax
or ecx, 0x80
shr ecx, 1
lea eax, [ecx + 0x10]
cmp eax, edx
jg 0x10098641
mov eax, 0xfffffff0
sub eax, ecx
add edx, eax
or ecx, 0x20
shr ecx, 1
lea eax, [ecx + 4]
cmp eax, edx
jg 0x10098656
mov eax, 0xfffffffc
sub eax, ecx
add edx, eax
or ecx, 8
shr ecx, 1
cmp ecx, edx
jge 0x10098666
or eax, 0xffffffff
sub eax, ecx
add edx, eax
or ecx, 2
shr ecx, 1
cmp ecx, edx
lea eax, [ecx + 1]
cmovge eax, ecx
pop ebp
ret
Function at 0x1009ef70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ecx]
mov edx, esi
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 0xc8]
push edi
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x18], ecx
movsx eax, word [eax + 6]
sub edx, eax
mov dword [ebp - 0x10], 0x24
lea eax, [esi - 1]
lea esi, [edx - 1]
mov edx, dword [ebp + 0x10]
cmp eax, esi
cmovl esi, eax
mov dword [ebp - 0x14], esi
xor eax, eax
mov dword [edx], 0
xor edx, edx
mov dword [edi], eax
xor ebx, ebx
mov dword [ebp + 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
cmp dword [ecx + 4], eax
jle 0x1009f084
nop dword [eax]
nop word [eax + eax]
mov eax, dword [ecx + 0xc8]
mov ecx, 1
movzx eax, word [eax + 4]
cmp cx, ax
jg 0x1009eff7
movsx ecx, ax
cmp ecx, esi
jge 0x1009f053
mov esi, dword [ebp - 0x1c]
add esi, dword [ebp - 4]
mov eax, ecx
sar eax, 2
add eax, edx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + eax*4]
sar eax, 5
cmp eax, dword [ebp - 0x10]
jle 0x1009f02d
movzx edx, byte [esi + ecx]
mov eax, 0x80
sub eax, edx
test eax, eax
jg 0x1009f028
lea eax, [edx - 0x80]
add dword [edi], eax
inc ebx
jmp 0x1009f045
movzx edx, byte [esi + ecx + 1]
movzx eax, byte [esi + ecx]
sub eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, dword [ebp + 0x10]
add dword [edx], eax
inc dword [ebp + 8]
mov edx, dword [ebp - 8]
add ecx, 2
cmp ecx, dword [ebp - 0x14]
jl 0x1009f001
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 4]
inc eax
mov dword [ebp - 0xc], eax
add edi, dword [ecx]
mov dword [ebp - 4], edi
test al, 3
je 0x1009f06d
xor eax, eax
jmp 0x1009f070
mov eax, dword [ecx + 0x3c]
mov edi, dword [ebp + 0x14]
add edx, eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], edx
cmp eax, dword [ecx + 4]
jl 0x1009efe0
cmp ebx, 1
mov eax, 1
mov ecx, ebx
cmovl ecx, eax
mov eax, dword [edi]
cdq
idiv ecx
mov ecx, dword [ebp + 8]
cmp ecx, 1
mov dword [edi], eax
mov eax, 1
cmovl ecx, eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cdq
idiv ecx
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, ebx
mov dword [edx], eax
lea eax, [ebx + ebx*2]
cmp eax, ecx
jg 0x1009f0cc
sub dword [ebp - 0x10], 0x10
mov ecx, dword [ebp - 0x18]
jns 0x1009efb0
cmp dword [edi], 0
jne 0x1009f0d7
mov dword [edi], 0x48
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x100a9f20
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx], vtable.SHA1.0
mov eax, ecx
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x60], 0
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
mov dword [ecx + 0x14], 0xc3d2e1f0
mov word [ecx + 0x64], 0
ret

Function at 0x100aa020
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x60]
mov byte [eax + esi + 0x20], 0x80
inc dword [esi + 0x60]
cmp eax, 0x37
mov eax, dword [esi + 0x60]
jle 0x100aa073
cmp eax, 0x40
jge 0x100aa050
nop dword [eax + eax]
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x60]
mov eax, dword [esi + 0x60]
cmp eax, 0x40
jl 0x100aa040
call fcn.100aa0d0
cmp dword [esi + 0x60], 0x38
jge 0x100aa090
nop dword [eax + eax]
mov eax, dword [esi + 0x60]
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x60]
cmp dword [esi + 0x60], 0x38
jl 0x100aa060
jmp 0x100aa090
cmp eax, 0x38
jge 0x100aa090
nop dword [eax + eax]
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x60]
mov eax, dword [esi + 0x60]
cmp eax, 0x38
jl 0x100aa080
movzx eax, byte [esi + 0x1f]
mov ecx, esi
mov byte [esi + 0x58], al
movzx eax, byte [esi + 0x1e]
mov byte [esi + 0x59], al
movzx eax, byte [esi + 0x1d]
mov byte [esi + 0x5a], al
movzx eax, byte [esi + 0x1c]
mov byte [esi + 0x5b], al
movzx eax, byte [esi + 0x1b]
mov byte [esi + 0x5c], al
movzx eax, byte [esi + 0x1a]
mov byte [esi + 0x5d], al
movzx eax, byte [esi + 0x19]
mov byte [esi + 0x5e], al
movzx eax, byte [esi + 0x18]
mov byte [esi + 0x5f], al
pop esi
jmp fcn.100aa0d0
Function at 0x100aa320
Capabilities:
Hash data using sha1

Disassembly:
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x60], 0
mov dword [ecx + 4], 0x67452301
mov dword [ecx + 8], 0xefcdab89
mov dword [ecx + 0xc], 0x98badcfe
mov dword [ecx + 0x10], 0x10325476
mov dword [ecx + 0x14], 0xc3d2e1f0
mov word [ecx + 0x64], 0
ret

Function at 0x100aa570
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov al, byte [ebp + 0xc]
mov byte [ebp + 0xc], al
mov al, byte [ebp + 0x10]
mov byte [ebp + 0xd], al
mov al, byte [ebp + 0x14]
mov byte [ebp + 0xe], al
mov al, byte [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
mov byte [ebp + 0xf], al
lea eax, [ebp - 4]
push 4
push eax
push 4
lea eax, [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
push eax
push dword [esi]
mov eax, dword [esi + 8]
call eax
add esp, 0x14
test eax, eax
jne 0x100aa5db
movzx ecx, ax
cmp byte [ebp + ecx - 4], 0xcc
jne 0x100aa5d6
inc eax
cmp ax, 4
jb 0x100aa5b1
movzx eax, word [ebp + 0x1c]
push eax
push dword [esi]
mov eax, dword [esi + 0xc]
call eax
add esp, 8
pop esi
mov esp, ebp
pop ebp
ret
mov eax, 0x46d
pop esi
mov esp, ebp
pop ebp
ret