joyce8/EMBER2024-capa huggingface dataset:
Function at 0x94b250
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x24]
push dword [esi]
call fcn.00948e00
add esp, 4
test eax, eax
jne 0x94b3b6
mov ecx, dword [esi + 4]
mov eax, 0x16
cmp ecx, 0x80
ja 0x94b3b6
mov edx, dword [esi + 8]
cmp edx, 0x80
jg 0x94b3b6
cmp ecx, edx
jg 0x94b3b6
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
cmp edi, 0x11
jb 0x94b324
test ecx, ecx
jne 0x94b324
imul eax, dword [esi], 0x58
mov ebp, dword [eax + 0xc2101c]
cmp ebp, edi
jae 0x94b32c
mov eax, edi
sub eax, ebp
mov dword [esp + 4], eax
jne 0x94b2c4
xor eax, eax
jmp 0x94b322
lea eax, [esi + 0x210]
mov dword [esp], eax
lea eax, [esi + 0x8c]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
test ebp, ebp
mov eax, 0
je 0x94b2f7
mov ecx, dword [ebx + eax]
xor dword [esi + eax + 0x8c], ecx
add eax, 4
cmp eax, ebp
jb 0x94b2e6
imul eax, dword [esi], 0x58
push dword [esp]
mov ecx, dword [esp + 0x10]
push ecx
push ecx
call dword [eax + 0xc21028]
add esp, 0xc
test eax, eax
jne 0x94b3b6
mov eax, dword [esp + 8]
add ebx, ebp
add eax, ebp
cmp eax, dword [esp + 4]
jb 0x94b2d9
sub edi, eax
test edi, edi
je 0x94b3b4
lea eax, [esi + 0x210]
mov dword [esp + 8], eax
lea eax, [esi + 0x8c]
mov dword [esp + 4], eax
lea eax, [esi + 0xc]
mov dword [esp], eax
mov eax, dword [esi + 4]
mov ebp, dword [esi + 8]
cmp eax, ebp
jne 0x94b390
xor ecx, ecx
test eax, eax
je 0x94b368
movzx eax, byte [esi + ecx + 0x8c]
xor byte [esi + ecx + 0xc], al
inc ecx
cmp ecx, dword [esi + 8]
jb 0x94b356
imul eax, dword [esi], 0x58
push dword [esp + 8]
push dword [esp + 8]
push dword [esp + 8]
call dword [eax + 0xc21028]
add esp, 0xc
test eax, eax
jne 0x94b3b6
mov dword [esi + 4], 0
xor eax, eax
mov ebp, dword [esi + 8]
sub ebp, eax
lea eax, [esi + eax + 0xc]
cmp edi, ebp
cmovb ebp, edi
push ebp
push ebx
push eax
call fcn.0097cbc0
add esp, 0xc
mov eax, dword [esi + 4]
add ebx, ebp
add eax, ebp
sub edi, ebp
mov dword [esi + 4], eax
jne 0x94b349
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x94b3c0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
push dword [esi]
call fcn.00948e00
add esp, 4
test eax, eax
jne 0x94b4b1
mov edx, dword [esi + 4]
mov eax, 0x16
cmp edx, 0x80
ja 0x94b4b1
mov ecx, dword [esi + 8]
cmp ecx, 0x80
jg 0x94b4b1
cmp edx, ecx
jg 0x94b4b1
xor eax, eax
cmp edx, ecx
jne 0x94b40e
xor ecx, ecx
jmp 0x94b43b
lea ecx, [edx + 1]
mov dword [esi + 4], ecx
mov byte [esi + edx + 0xc], pe_nt_image_headers32
mov ecx, 1
mov edi, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x94b437
lea edx, [edi + 1]
mov dword [esi + 4], edx
mov byte [esi + edi + 0xc], 0
mov edi, dword [esi + 4]
mov edx, dword [esi + 8]
cmp edi, edx
jl 0x94b426
test edx, edx
je 0x94b45d
shl ecx, 7
add ecx, esi
movzx edx, byte [eax + ecx + 0x10c]
xor dl, byte [esi + eax + 0x8c]
xor byte [esi + eax + 0xc], dl
inc eax
cmp eax, dword [esi + 8]
jb 0x94b444
imul eax, dword [esi], 0x58
lea ebx, [esi + 0x210]
lea ecx, [esi + 0xc]
push ebx
push ecx
push ecx
call dword [eax + 0xc21028]
add esp, 0xc
test eax, eax
jne 0x94b4b1
mov edi, dword [esp + 0x18]
imul eax, dword [esi], 0x58
push ebx
call dword [eax + 0xc21030]
add esp, 4
xor eax, eax
cmp dword [esi + 8], 0
mov ecx, 0
je 0x94b4af
mov edx, dword [esp + 0x14]
xor ecx, ecx
cmp ecx, dword [edi]
jae 0x94b4af
movzx ebx, byte [esi + ecx + 0xc]
mov byte [edx + ecx], bl
inc ecx
cmp ecx, dword [esi + 8]
jb 0x94b49d
mov dword [edi], ecx
pop esi
pop edi
pop ebx
ret
Function at 0x957300
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x30]
mov ecx, eax
neg ecx
cmovl ecx, eax
and ecx, 0xff80
add ecx, 0xffffef80
cmp ecx, 0x6f7f
ja 0x957446
mov eax, fcn.009575a0
xor esi, esi
mov dword [esp + 8], ecx
and eax, 1
inc eax
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edi, dword [esi*4 + 0xb61720]
mov ebp, dword [esi*4 + str.4__D88H4_000008___4_0h__H_H0T0________00LD__D____H0LP0L_H___8______]
mov dword [esp + 0x18], esi
xor ecx, fcn.009575a0
sete al
mov ecx, eax
not ecx
and ecx, 0x821
lea edx, [eax + ecx*2 - 0x77039822]
mov eax, 1
xor edx, dword [esi*4 + 0xb61bc0]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x957426
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x9573ab
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x9573cd
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x9573c2
jmp 0x957426
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x95741c
lea ecx, [ebp - 4]
shr ecx, 2
je 0x957414
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x9573ea
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov esi, dword [esp + 0x18]
inc esi
cmp esi, 0x94
jne 0x95733d
mov eax, dword [esp + 8]
shr eax, 5
mov eax, dword [eax + 0xb611d0]
jmp 0x957448
xor eax, eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x957450
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x30]
mov ecx, eax
neg ecx
cmovl ecx, eax
and ecx, 0xffff007f
lea eax, [ecx - 1]
cmp eax, 0x74
ja 0x957588
mov eax, fcn.0097bba0
xor esi, esi
mov dword [esp + 8], ecx
imul eax, eax
and eax, 3
mov dword [esp + 0x10], eax
xor eax, eax
cmp dword [esp + 0x10], 3
mov edi, dword [esi*4 + 0xb61e10]
mov ebp, dword [esi*4 + str.___L__0H8]
mov dword [esp + 0x18], esi
sete al
mov ecx, eax
not ecx
and ecx, 0x281
lea edx, [eax + ecx*2 - 0x498912c8]
mov eax, 1
xor edx, dword [esi*4 + 0xb61fd0]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x95756d
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x9574f2
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x957514
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x957509
jmp 0x95756d
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x957563
lea ecx, [ebp - 4]
shr ecx, 2
je 0x95755b
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x957531
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov esi, dword [esp + 0x18]
inc esi
cmp esi, 0x36
jne 0x957489
mov eax, dword [esp + 8]
mov eax, dword [eax*4 + 0xb61548]
jmp 0x95758a
xor eax, eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x958550
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [0xbcbae0]
mov edi, edx
mov esi, ecx
mov ebx, esp
xor eax, esp
mov dword [esp + 0x30], eax
push 0x30
push 0
push ebx
call fcn.0097bba0
add esp, 0xc
lea ebp, [esi + 0x20]
mov eax, 0x10
test eax, eax
je 0x95858a
inc byte [esi + eax - 1]
lea eax, [eax - 1]
je 0x95857d
push ebx
push esi
push 1
push ebp
call fcn.0096cd00
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x95862d
mov ecx, 0x10
lea eax, [esp + 0x10]
test ecx, ecx
je 0x9585b7
inc byte [esi + ecx - 1]
lea ecx, [ecx - 1]
je 0x9585aa
push eax
push esi
push 1
push ebp
call fcn.0096cd00
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x95862d
mov eax, 0x10
lea ecx, [esp + 0x20]
test eax, eax
je 0x9585e0
inc byte [esi + eax - 1]
lea eax, [eax - 1]
je 0x9585d3
push ecx
push esi
push 1
push ebp
call fcn.0096cd00
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x95862d
xor eax, eax
movzx ecx, byte [edi + eax]
xor byte [esp + eax], cl
inc eax
cmp eax, 0x30
jne 0x9585f5
push 0x100
lea eax, [esp + 4]
push eax
push ebp
call fcn.0096bc10
add esp, 0xc
mov ebx, eax
test eax, eax
jne 0x95862d
push 0x10
lea eax, [esp + 0x24]
push eax
push esi
call fcn.0097cbc0
add esp, 0xc
xor ebx, ebx
push 0x30
lea eax, [esp + 4]
push eax
call fcn.0095bff0
add esp, 8
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00980459
mov eax, ebx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x95a760
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, edx
mov edi, ecx
push edx
call fcn.0097f4b0
add esp, 4
test byte [edi + 0x118], 0x20
mov ebx, eax
je 0x95a7a3
add edi, 0xf8
mov ecx, edi
mov edx, esi
push ebx
call fcn.0095abb0
add esp, 4
test eax, eax
je 0x95a8f5
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x95a782
jmp 0x95a8ee
mov ebp, fcn.0095f030
add edi, 0x70
and ebp, 1
inc ebp
cmp dword [edi + 4], 3
jne 0x95a8e3
mov eax, ebp
movzx ecx, byte [0xbc912b]
xor eax, fcn.0095f030
sete al
not al
and al, 5
movzx eax, al
bt ecx, eax
jb 0x95a8bb
mov al, byte [0xbc912b]
mov ecx, ebp
mov dl, 1
xor ecx, fcn.0095f030
sete cl
not cl
and cl, 5
xor cl, 7
shl dl, cl
or dl, al
lock cmpxchg byte [0xbc912b], dl
jne 0x95a7df
mov ecx, ebp
movzx eax, al
xor ecx, fcn.0095f030
sete cl
not cl
and cl, 5
xor cl, 7
movzx ecx, cl
bt eax, ecx
jae 0x95a83f
mov eax, ebp
movzx ecx, byte [0xbc912b]
xor eax, fcn.0095f030
sete al
not al
and al, 5
movzx eax, al
bt ecx, eax
jae 0x95a820
jmp 0x95a8bb
mov eax, ebp
movzx ecx, byte [0xbc912b]
xor eax, fcn.0095f030
sete al
not al
and al, 5
movzx eax, al
bt ecx, eax
jb 0x95a89f
mov eax, ebp
xor ecx, ecx
xor eax, fcn.0095f030
mov eax, dword [0xbc9120]
sete cl
xor ecx, 0xb501b52d
add ecx, 0xa0
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbc9120], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
xor dword [0xbc9124], edx
mov dl, 1
shl dl, cl
or byte [0xbc912b], dl
mov eax, ebp
xor eax, fcn.0095f030
mov al, 0xfe
sete cl
not cl
and cl, 5
xor cl, 7
rol al, cl
and byte [0xbc912b], al
push 3
push dword [edi + 8]
push 0xbc9120
call fcn.0097f460
add esp, 0xc
test eax, eax
jne 0x95a8e3
lea ecx, [edi + 0xc]
mov edx, esi
push ebx
call fcn.0095abd0
add esp, 4
test eax, eax
je 0x95a8f5
mov edi, dword [edi + 0x18]
test edi, edi
jne 0x95a7af
mov eax, dword [esp + 0x14]
or byte [eax], 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x95ee00
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [0xbcbae0]
mov ecx, dword [esp + 0x58]
mov esi, 0xffffaf00
xor eax, esp
test ecx, ecx
mov dword [esp + 0x40], eax
je 0x95ef05
mov eax, dword [ecx]
test eax, eax
je 0x95ef05
mov ebp, dword [ecx + 8]
test ebp, ebp
je 0x95ef05
mov edi, dword [esp + 0x60]
movzx eax, byte [eax + 9]
mov ebx, dword [esp + 0x5c]
cmp eax, edi
jae 0x95ee92
push ecx
mov ebp, ecx
call fcn.0095ec50
add esp, 4
mov esi, eax
test eax, eax
jne 0x95eef8
push edi
push ebx
push ebp
call fcn.0095ecc0
add esp, 0xc
mov esi, eax
test eax, eax
jne 0x95eef8
mov ebx, esp
push ebx
push ebp
call fcn.0095ed30
add esp, 8
mov esi, eax
test eax, eax
jne 0x95eef8
mov eax, dword [ebp]
mov ebp, dword [ebp + 8]
movzx edi, byte [eax + 8]
movzx eax, byte [eax + 9]
lea esi, [ebp + eax]
push eax
push 0x36
push ebp
call fcn.0097bba0
add esp, 0xc
mov eax, dword [esp + 0x58]
mov eax, dword [eax]
movzx eax, byte [eax + 9]
push eax
push 0x5c
push esi
call fcn.0097bba0
add esp, 0xc
test edi, edi
je 0x95eed2
xor eax, eax
movzx ecx, byte [ebx + eax]
xor byte [ebp + eax], cl
movzx ecx, byte [ebx + eax]
xor byte [esi + eax], cl
inc eax
cmp eax, edi
jne 0x95eebe
mov edi, dword [esp + 0x58]
push edi
call fcn.0095ec50
add esp, 4
mov esi, eax
test eax, eax
jne 0x95eef8
mov eax, dword [edi]
movzx eax, byte [eax + 9]
push eax
push ebp
push edi
call fcn.0095ecc0
add esp, 0xc
mov esi, eax
mov eax, esp
push 0x40
push eax
call fcn.0095bff0
add esp, 8
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00980459
mov eax, esi
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x95f0a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc02b]
cmp ecx, 5
jbe 0x95f208
cmp eax, 0x9e
je 0x95f0e8
cmp eax, 0x9f
jne case.0x95f20d.49197
mov eax, 0xb62780
jmp case.0x95f20d.49195
mov eax, 0xb62708
jmp case.0x95f20d.49195
mov eax, 0xb62730
jmp case.0x95f20d.49195
mov eax, 0xb62758
jmp case.0x95f20d.49195
mov eax, 0xb627a8
mov ecx, 0x95f240
xor esi, esi
mov dword [esp + 8], eax
and ecx, 1
inc ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edi, dword [esi*4 + 0xb62890]
mov ebp, dword [esi*4 + str.00____]
mov dword [esp + 0x18], esi
xor ecx, 0x95f240
sete al
mov ecx, eax
xor ecx, 0x29f47007
lea edx, [ecx + eax*2 + 0xbe0]
mov eax, 1
xor edx, dword [esi*4 + 0xb62870]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x95f1e7
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x95f16c
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x95f18e
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x95f183
jmp 0x95f1e7
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x95f1dd
lea ecx, [ebp - 4]
shr ecx, 2
je 0x95f1d5
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x95f1ab
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov esi, dword [esp + 0x18]
inc esi
cmp esi, 6
jne 0x95f100
mov eax, dword [esp + 8]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp case.0x95f20d.49195
mov eax, 0xb626e0
jmp dword [ecx*4 + 0xb628e8]
Function at 0x95f850
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
cmp dword [esp + 0x40], 0
mov eax, 0xf3bcc908
mov ecx, 0xc1059ed8
mov ebp, 0xcbbb9d5d
mov ebx, 0x8eb44a87
mov edi, 0x64f98fa7
mov esi, 0xdb0c2e0d
mov edx, 0xbefa4fa4
cmove ecx, eax
mov eax, 0x6a09e667
mov dword [esp + 0x24], ecx
cmove ebp, eax
mov eax, 0x84caa73b
mov ecx, 0x367cd507
cmove ecx, eax
mov eax, 0xbb67ae85
mov dword [esp + 0x20], ecx
mov ecx, 0x629a292a
cmove ecx, eax
mov eax, 0xfe94f82b
mov dword [esp + 0x1c], ecx
mov ecx, 0x3070dd17
cmove ecx, eax
mov eax, 0x3c6ef372
mov dword [esp + 0x18], ecx
mov ecx, 0x9159015a
cmove ecx, eax
mov eax, 0x5f1d36f1
mov dword [esp + 0x14], ecx
mov ecx, 0xf70e5939
cmove ecx, eax
mov eax, 0xa54ff53a
mov dword [esp + 0x10], ecx
mov ecx, 0x152fecd8
cmove ecx, eax
mov eax, 0xade682d1
mov dword [esp + 0xc], ecx
mov ecx, 0xffc00b31
cmove ecx, eax
mov eax, 0x510e527f
mov dword [esp + 8], ecx
mov ecx, 0x67332667
cmove ecx, eax
mov eax, 0x68581511
mov dword [esp + 4], ecx
mov ecx, 0x2b3e6c1f
cmove eax, ecx
mov ecx, 0x47b5481d
mov dword [esp], eax
mov eax, 0x9b05688c
cmove ebx, eax
mov eax, 0xfb41bd6b
cmove edi, eax
mov eax, 0x1f83d9ab
cmove esi, eax
mov eax, 0x137e2179
cmove edx, eax
mov eax, 0x5be0cd19
cmove ecx, eax
mov eax, dword [esp + 0x3c]
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x14], ebp
mov ebp, dword [esp + 0x24]
mov dword [eax + 0x10], ebp
mov ebp, dword [esp + 0x1c]
mov dword [eax + 0x1c], ebp
mov ebp, dword [esp + 0x20]
mov dword [eax + 0x18], ebp
mov ebp, dword [esp + 0x14]
mov dword [eax + 0x24], ebp
mov ebp, dword [esp + 0x18]
mov dword [eax + 0x20], ebp
mov ebp, dword [esp + 0xc]
mov dword [eax + 0x2c], ebp
mov ebp, dword [esp + 0x10]
mov dword [eax + 0x28], ebp
mov ebp, dword [esp + 4]
mov dword [eax + 0x34], ebp
mov ebp, dword [esp + 8]
mov dword [eax + 0x30], ebp
mov dword [eax + 0x3c], ebx
mov ebx, dword [esp]
mov dword [eax + 0x38], ebx
mov dword [eax + 0x44], esi
mov dword [eax + 0x40], edi
mov dword [eax + 0x48], edx
mov edx, dword [esp + 0x40]
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], edx
xor eax, eax
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x960a80
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
cmp dword [esp + 0x24], 0
mov ecx, 0x6a09e667
mov eax, 0xc1059ed8
mov ebx, 0xf70e5939
mov esi, 0x68581511
mov ebp, 0xffc00b31
mov edx, 0x64f98fa7
cmove eax, ecx
mov ecx, 0xbb67ae85
mov dword [esp + 8], eax
mov eax, 0x367cd507
cmove eax, ecx
mov ecx, 0x3c6ef372
mov edi, dword [esp + 8]
mov dword [esp + 4], eax
mov eax, 0x3070dd17
cmove eax, ecx
mov ecx, 0xa54ff53a
mov dword [esp], eax
mov eax, 0x9b05688c
cmove ebx, ecx
mov ecx, 0x510e527f
cmove esi, eax
mov eax, 0x1f83d9ab
cmove ebp, ecx
mov ecx, 0xbefa4fa4
cmove edx, eax
mov eax, 0x5be0cd19
cmove ecx, eax
mov eax, dword [esp + 0x20]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], edi
mov edi, dword [esp + 4]
mov dword [eax + 0xc], edi
mov edi, dword [esp]
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], ebp
mov dword [eax + 0x1c], esi
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x24]
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], edx
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x9627a0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push eax
mov eax, dword [esp + 0x18]
mov byte [esp + 3], 0
test eax, eax
je 0x9627cc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
xor esi, esi
movzx ebx, byte [edx + esi]
mov bh, byte [ecx + esi]
inc esi
xor bh, bl
or byte [esp + 3], bh
cmp esi, eax
jne 0x9627ba
mov al, byte [esp + 3]
movzx eax, al
add esp, 4
pop esi
pop ebx
ret
Function at 0x96b230
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, edx
mov edi, ecx
lea eax, [edx + 1]
push eax
push 0
push ecx
call fcn.0097bba0
add esp, 0xc
test esi, esi
je 0x96b2ec
mov dword [esp + 4], edi
mov dword [esp + 8], esi
movzx eax, byte [esp + 0x20]
mov ecx, dword [esp + 0x24]
xor edi, edi
mov esi, dword [esp + 4]
mov dword [esp], eax
cmp byte [esp + 0x20], 0
mov edx, dword [esp + 8]
je 0x96b29f
xor ebx, ebx
mov eax, ebx
imul eax, edx
add eax, edi
push eax
push ecx
mov ebp, edx
call fcn.00962f90
mov edx, ebp
add esp, 8
mov ecx, ebx
inc ebx
shl eax, cl
mov ecx, dword [esp + 0x24]
or byte [esi + edi], al
cmp ebx, dword [esp]
jne 0x96b279
inc edi
cmp edi, edx
jne 0x96b26c
mov edi, dword [esp + 4]
mov esi, dword [esp + 8]
mov edx, 1
xor ebx, ebx
mov ah, byte [edi]
mov ch, byte [edi + edx]
mov al, ch
xor ch, bl
mov cl, ch
and al, bl
mov bl, ah
not cl
mov byte [esp], al
and cl, 1
mov al, cl
shl cl, 7
mul ah
mov ah, bl
mov ebx, eax
or cl, ah
and bl, ch
xor ch, al
or bl, byte [esp]
mov byte [edi + edx], ch
mov byte [edi + edx - 1], cl
inc edx
mov ah, ch
cmp edx, esi
jbe 0x96b2b5
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x96d6c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, 0x96f630
mov dword [esp + 8], ecx
xor ecx, ecx
and eax, 1
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
xor edx, edx
mov edi, dword [ecx*4 + 0xb63530]
mov ebp, dword [ecx*4 + 0xb63660]
mov dword [esp + 0x18], ecx
xor eax, 0x96f630
mov eax, 1
sete dl
xor edx, 0xeee237f5
add edx, 0x1000
xor edx, dword [ecx*4 + 0xb63790]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x96d7bd
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x96d742
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x96d764
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x96d759
jmp 0x96d7bd
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x96d7b3
lea ecx, [ebp - 4]
shr ecx, 2
je 0x96d7ab
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x96d781
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x4c
jne 0x96d6da
mov ebx, dword [esp + 8]
xor edi, edi
test ebx, ebx
je 0x96d806
mov esi, 0xb63118
mov eax, 0xbc9658
mov ecx, dword [esi + 4]
cmp ecx, dword [ebx + 4]
jne 0x96d7f8
push ecx
push dword [ebx + 8]
push eax
call fcn.0097f460
add esp, 0xc
test eax, eax
je 0x96d804
mov eax, dword [esi + 0x14]
add esi, 0x14
test eax, eax
jne 0x96d7df
jmp 0x96d806
mov edi, esi
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x96e1d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, 0x96f930
mov edx, 3
xor esi, esi
mov dword [esp + 8], ecx
sub edx, eax
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edi, dword [esi*4 + 0xb63b70]
mov ebp, dword [esi*4 + 0xb63c10]
mov dword [esp + 0x18], esi
xor ecx, 0x96f930
sete al
mov ecx, eax
xor ecx, 0x54c24529
lea edx, [ecx + eax*2 + 0x52c]
mov eax, 1
xor edx, dword [esi*4 + 0xb63ad0]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x96e2d4
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x96e259
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x96e27b
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x96e270
jmp 0x96e2d4
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x96e2ca
lea ecx, [ebp - 4]
shr ecx, 2
je 0x96e2c2
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x96e298
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov esi, dword [esp + 0x18]
inc esi
cmp esi, 0x27
jne 0x96e1ed
mov ebx, dword [esp + 8]
xor edi, edi
test ebx, ebx
je 0x96e31d
mov esi, 0xb62eb0
mov eax, 0xbca0b8
mov ecx, dword [esi + 4]
cmp ecx, dword [ebx + 4]
jne 0x96e30f
push ecx
push dword [ebx + 8]
push eax
call fcn.0097f460
add esp, 0xc
test eax, eax
je 0x96e31b
mov eax, dword [esi + 0x18]
add esi, 0x18
test eax, eax
jne 0x96e2f6
jmp 0x96e31d
mov edi, esi
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x9719c0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
xor eax, eax
ret

Function at 0x973050
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
xor eax, eax
ret