joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429531
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x4b8a8c
call fcn.0047f6fc
push ecx
push esi
push edi
mov edi, ecx
push 8
call fcn.004a2b48
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
xor esi, esi
cmp ecx, esi
mov dword [ebp - 4], esi
je 0x429560
push dword [ebp + 0xc]
call fcn.0041b32d
jmp 0x429562
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0x10], esi
mov dword [edi], eax
mov dword [edi + 4], esi
je 0x4295cf
push 8
call fcn.004a2b48
pop ecx
mov ecx, eax
mov dword [ebp + 0x10], ecx
cmp ecx, esi
mov dword [ebp - 4], 1
je 0x429592
push dword [ebp + 8]
call fcn.0041b32d
mov esi, eax
push dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
push esi
call fcn.00428e5d
pop ecx
pop ecx
push dword [esi + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4295b8
test al, 0x10
je 0x4295b8
push 1
pop eax
jmp 0x4295ba
xor eax, eax
test esi, esi
mov dword [edi + 4], eax
je 0x4295cf
mov ecx, esi
call fcn.0041b553
push esi
call fcn.004a2b71
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 0xc

Function at 0x42a2d2
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edx, dword [esp + 4]
push esi
xor eax, eax
mov esi, dword [edx + 4]
mov edx, dword [edx]
test edx, edx
jle 0x42a2f7
push edi
mov edi, edx
mov dl, byte [esi]
imul eax, eax, 0x11
and edx, 0xff
add eax, edx
inc esi
dec edi
jne 0x42a2e5
pop edi
xor edx, edx
pop esi
div dword [ecx + 4]
mov eax, edx
ret 4
Function at 0x433af6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x10], 4
mov eax, dword [esi]
mov ecx, eax
shr ecx, 0x18
mov byte [ebp - 0xc], cl
mov ecx, eax
shr eax, 8
mov byte [ebp - 4], al
mov al, byte [esi]
mov byte [ebp + 8], al
push dword [ebp + 8]
shr ecx, 0x10
mov byte [ebp - 8], cl
call fcn.00433c13
push dword [ebp - 4]
movzx edi, al
call fcn.00433c7a
push dword [ebp - 8]
movzx eax, al
xor edi, eax
call fcn.00433c43
push dword [ebp - 0xc]
movzx eax, al
xor edi, eax
call fcn.00433cb1
push dword [ebp + 8]
movzx eax, al
xor edi, eax
shl edi, 8
call fcn.00433c7a
push dword [ebp - 4]
movzx ebx, al
call fcn.00433c43
push dword [ebp - 8]
movzx eax, al
xor ebx, eax
call fcn.00433cb1
push dword [ebp - 0xc]
movzx eax, al
xor ebx, eax
call fcn.00433c13
push dword [ebp + 8]
movzx eax, al
xor ebx, eax
or edi, ebx
shl edi, 8
call fcn.00433c43
push dword [ebp - 4]
movzx ebx, al
call fcn.00433cb1
push dword [ebp - 8]
movzx eax, al
xor ebx, eax
call fcn.00433c13
push dword [ebp - 0xc]
movzx eax, al
xor ebx, eax
call fcn.00433c7a
push dword [ebp + 8]
movzx eax, al
xor ebx, eax
or edi, ebx
shl edi, 8
call fcn.00433cb1
push dword [ebp - 4]
movzx ebx, al
call fcn.00433c13
push dword [ebp - 8]
movzx eax, al
xor ebx, eax
call fcn.00433c7a
push dword [ebp - 0xc]
movzx eax, al
xor ebx, eax
call fcn.00433c43
movzx eax, al
xor ebx, eax
add esp, 0x40
or edi, ebx
mov dword [esi], edi
add esi, 4
dec dword [ebp - 0x10]
jne 0x433b09
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433ce8
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0xffffff4c
lea esi, [ecx + 2]
sub ebx, edi
lea eax, [edi + 0xb4]
lea ecx, [edi + 0xc1]
mov dl, byte [ecx - 1]
xor dl, byte [esi - 2]
mov byte [eax - 4], dl
mov dl, byte [esi - 1]
xor dl, byte [ecx]
add ecx, 4
mov byte [eax], dl
mov dl, byte [ecx - 3]
xor dl, byte [esi]
add esi, 4
mov byte [eax + 4], dl
mov dl, byte [ecx - 2]
xor dl, byte [esi - 3]
inc eax
mov byte [eax + 7], dl
lea edx, [ebx + eax]
cmp edx, 4
jl 0x433d0a
lea esi, [edi + 0xb0]
push edi
push esi
call fcn.00433f1e
pop ecx
lea eax, [edi + 0x10]
pop ecx
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], 9
xor eax, eax
movzx ecx, byte [eax + esi]
mov cl, byte [ecx + 0x502720]
mov byte [eax + esi], cl
inc eax
cmp eax, 0x10
jl 0x433d58
push esi
call fcn.00433df6
push esi
call fcn.00433e43
push dword [ebp + 8]
push esi
call fcn.00433f1e
add dword [ebp + 8], 0x10
add esp, 0x10
dec dword [ebp + 0xc]
jne 0x433d56
xor eax, eax
movzx ecx, byte [eax + esi]
mov cl, byte [ecx + 0x502720]
mov byte [eax + esi], cl
inc eax
cmp eax, 0x10
jl 0x433d8e
push esi
call fcn.00433df6
lea eax, [edi + 0xa0]
push eax
push esi
call fcn.00433f1e
add esp, 0xc
lea ecx, [edi + 0xb4]
lea eax, [edi + 0xd0]
mov dl, byte [ecx - 4]
mov byte [eax - 0x10], dl
mov byte [eax], dl
mov dl, byte [ecx]
inc ecx
mov byte [eax - 0xf], dl
mov byte [eax + 1], dl
mov dl, byte [ecx + 3]
mov byte [eax - 0xe], dl
mov byte [eax + 2], dl
mov dl, byte [ecx + 7]
mov byte [eax - 0xd], dl
mov byte [eax + 3], dl
lea edx, [ecx + ebx]
add eax, 4
cmp edx, 4
jl 0x433dc3
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x433e43
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xfffffffffffffffc
lea esi, [eax + 4]
pop edi
sub edi, eax
mov al, byte [esi - 4]
mov byte [ebp - 4], al
mov al, byte [esi]
mov byte [ebp - 0xc], al
mov al, byte [esi + 4]
push dword [ebp - 0xc]
mov byte [ebp - 8], al
mov al, byte [esi + 8]
mov byte [ebp + 8], al
call fcn.00433f06
push dword [ebp - 4]
mov bl, al
call fcn.00433ef6
push dword [ebp - 8]
xor bl, al
xor bl, byte [ebp + 8]
xor bl, byte [ebp - 8]
mov byte [esi - 4], bl
call fcn.00433f06
push dword [ebp - 0xc]
mov bl, al
call fcn.00433ef6
push dword [ebp + 8]
xor bl, al
xor bl, byte [ebp + 8]
xor bl, byte [ebp - 4]
mov byte [esi], bl
call fcn.00433f06
push dword [ebp - 8]
mov bl, al
call fcn.00433ef6
push dword [ebp + 8]
xor bl, al
xor bl, byte [ebp - 0xc]
xor bl, byte [ebp - 4]
mov byte [esi + 4], bl
call fcn.00433ef6
push dword [ebp - 4]
mov bl, al
call fcn.00433f06
xor bl, al
add esp, 0x20
xor bl, byte [ebp - 8]
xor bl, byte [ebp - 0xc]
inc esi
mov byte [esi + 7], bl
lea eax, [edi + esi]
cmp eax, 4
jl 0x433e57
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433f1e
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov ecx, dword [esp + 8]
push esi
push 0xfffffffffffffffc
pop esi
lea eax, [edx + 4]
sub esi, edx
mov edx, dword [ecx]
shr edx, 0x18
xor byte [eax - 4], dl
mov edx, dword [ecx]
shr edx, 0x10
xor byte [eax], dl
mov edx, dword [ecx]
shr edx, 8
xor byte [eax + 4], dl
mov dl, byte [ecx]
xor byte [eax + 8], dl
inc eax
add ecx, 4
lea edx, [esi + eax]
cmp edx, 4
jl 0x433f2f
pop esi
ret

Function at 0x433f60
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0xffffff4c
add ecx, 2
sub edi, esi
lea eax, [esi + 0xb4]
mov dword [ebp - 4], edi
mov dl, byte [ecx - 2]
mov byte [eax - 4], dl
mov dl, byte [ecx - 1]
mov byte [eax], dl
mov dl, byte [ecx]
mov byte [eax + 4], dl
mov dl, byte [ecx + 1]
mov byte [eax + 8], dl
inc eax
add ecx, 4
lea edx, [edi + eax]
cmp edx, 4
jl 0x433f7f
lea eax, [esi + 0xa0]
push ebx
lea edi, [esi + 0xb0]
push eax
push edi
call fcn.00433f1e
pop ecx
lea ebx, [esi + 0x90]
pop ecx
mov dword [ebp + 8], 9
xor eax, eax
movzx ecx, byte [eax + edi]
mov cl, byte [ecx + 0x502820]
mov byte [eax + edi], cl
inc eax
cmp eax, 0x10
jl 0x433fc6
push edi
call fcn.004340b5
push edi
call fcn.00434102
push ebx
push edi
call fcn.00433f1e
add esp, 0x10
sub ebx, 0x10
dec dword [ebp + 8]
jne 0x433fc4
xor eax, eax
pop ebx
movzx ecx, byte [eax + edi]
mov cl, byte [ecx + 0x502820]
mov byte [eax + edi], cl
inc eax
cmp eax, 0x10
jl 0x433ffa
push edi
call fcn.004340b5
push esi
push edi
call fcn.00433f1e
lea edi, [esi + 0xd0]
add esp, 0xc
lea ecx, [esi + 0xb4]
mov eax, edi
mov dl, byte [eax - 0x10]
xor dl, byte [ecx - 4]
mov byte [eax], dl
mov dl, byte [eax - 0xf]
xor dl, byte [ecx]
add eax, 4
mov byte [eax - 3], dl
mov dl, byte [eax - 0x12]
xor dl, byte [ecx + 4]
mov byte [eax - 2], dl
mov dl, byte [eax - 0x11]
xor dl, byte [ecx + 8]
inc ecx
mov byte [eax - 1], dl
mov edx, dword [ebp - 4]
add edx, ecx
cmp edx, 4
jl 0x43402b
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov cl, byte [eax + ecx]
mov byte [esi + eax + 0xc0], cl
inc eax
cmp eax, 0x10
jl 0x43405d
and dword [esi + 0xe0], 0
cmp dword [ebp + 0x10], 0
je 0x4340b1
movzx eax, byte [esi + 0xdf]
cmp eax, 1
jl 0x43408e
cmp eax, 0x10
jle 0x434091
push 0x10
pop eax
push 0xf
pop ecx
cmp eax, ecx
jg 0x4340ab
mov edx, ecx
sub edx, eax
mov dl, byte [edx + esi + 0xd0]
mov byte [edi + ecx], dl
dec ecx
cmp ecx, eax
jge 0x434098
mov dword [esi + 0xe0], eax
pop edi
pop esi
leave
ret
Function at 0x434102
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0xc], 0xfffffffc
push esi
sub dword [ebp - 0xc], eax
push edi
lea esi, [eax + 4]
mov al, byte [esi - 4]
mov byte [ebp - 8], al
mov al, byte [esi]
mov byte [ebp - 4], al
mov al, byte [esi + 4]
mov byte [ebp + 8], al
mov al, byte [esi + 8]
mov byte [ebp - 0x10], al
mov edi, dword [ebp - 0x10]
push edi
call fcn.00433c13
push dword [ebp + 8]
mov bl, al
call fcn.00433c7a
push dword [ebp - 4]
xor bl, al
call fcn.00433c43
push dword [ebp - 8]
xor bl, al
call fcn.00433cb1
xor bl, al
push edi
mov byte [esi - 4], bl
call fcn.00433c7a
push dword [ebp + 8]
mov bl, al
call fcn.00433c43
push dword [ebp - 4]
xor bl, al
call fcn.00433cb1
push dword [ebp - 8]
xor bl, al
call fcn.00433c13
xor bl, al
push edi
mov byte [esi], bl
call fcn.00433c43
push dword [ebp + 8]
mov bl, al
call fcn.00433cb1
push dword [ebp - 4]
xor bl, al
call fcn.00433c13
push dword [ebp - 8]
xor bl, al
call fcn.00433c7a
xor bl, al
push edi
mov byte [esi + 4], bl
call fcn.00433cb1
push dword [ebp + 8]
mov bl, al
call fcn.00433c13
push dword [ebp - 4]
xor bl, al
call fcn.00433c7a
push dword [ebp - 8]
xor bl, al
call fcn.00433c43
xor bl, al
mov eax, dword [ebp - 0xc]
add esp, 0x40
mov byte [esi + 8], bl
inc esi
add eax, esi
cmp eax, 4
jl 0x43411b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x434296
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 0xffffff0c
add ecx, 2
sub edi, esi
lea eax, [esi + 0xf4]
mov dword [ebp - 4], edi
mov dl, byte [ecx - 2]
mov byte [eax - 4], dl
mov dl, byte [ecx - 1]
mov byte [eax], dl
mov dl, byte [ecx]
mov byte [eax + 4], dl
mov dl, byte [ecx + 1]
mov byte [eax + 8], dl
inc eax
add ecx, 4
lea edx, [edi + eax]
cmp edx, 4
jl 0x4342b5
lea eax, [esi + 0xe0]
push ebx
lea edi, [esi + 0xf0]
push eax
push edi
call fcn.00433f1e
pop ecx
lea ebx, [esi + 0xd0]
pop ecx
mov dword [ebp + 8], 0xd
xor eax, eax
movzx ecx, byte [eax + edi]
mov cl, byte [ecx + 0x502820]
mov byte [eax + edi], cl
inc eax
cmp eax, 0x10
jl 0x4342fc
push edi
call fcn.004340b5
push edi
call fcn.00434102
push ebx
push edi
call fcn.00433f1e
add esp, 0x10
sub ebx, 0x10
dec dword [ebp + 8]
jne 0x4342fa
xor eax, eax
pop ebx
movzx ecx, byte [eax + edi]
mov cl, byte [ecx + 0x502820]
mov byte [eax + edi], cl
inc eax
cmp eax, 0x10
jl 0x434330
push edi
call fcn.004340b5
push esi
push edi
call fcn.00433f1e
lea edi, [esi + 0x110]
add esp, 0xc
lea ecx, [esi + 0xf4]
mov eax, edi
mov dl, byte [eax - 0x10]
xor dl, byte [ecx - 4]
mov byte [eax], dl
mov dl, byte [eax - 0xf]
xor dl, byte [ecx]
add eax, 4
mov byte [eax - 3], dl
mov dl, byte [eax - 0x12]
xor dl, byte [ecx + 4]
mov byte [eax - 2], dl
mov dl, byte [eax - 0x11]
xor dl, byte [ecx + 8]
inc ecx
mov byte [eax - 1], dl
mov edx, dword [ebp - 4]
add edx, ecx
cmp edx, 4
jl 0x434361
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov cl, byte [eax + ecx]
mov byte [esi + eax + 0x100], cl
inc eax
cmp eax, 0x10
jl 0x434393
and dword [esi + 0x120], 0
cmp dword [ebp + 0x10], 0
je 0x4343e7
movzx eax, byte [esi + 0x11f]
cmp eax, 1
jl 0x4343c4
cmp eax, 0x10
jle 0x4343c7
push 0x10
pop eax
push 0xf
pop ecx
cmp eax, ecx
jg 0x4343e1
mov edx, ecx
sub edx, eax
mov dl, byte [edx + esi + 0x110]
mov byte [edi + ecx], dl
dec ecx
cmp ecx, eax
jge 0x4343ce
mov dword [esi + 0x120], eax
pop edi
pop esi
leave
ret

Function at 0x4343eb
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x50], 0
and dword [eax + 0x54], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x434e8e
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x40
xor edi, edi
pop esi
mov dword [ebp - 0x20], 0x6a09e667
cmp ebx, esi
mov dword [ebp - 0x1c], 0xbb67ae85
mov dword [ebp - 0x18], 0x3c6ef372
mov dword [ebp - 0x14], 0xa54ff53a
mov dword [ebp - 0x10], 0x510e527f
mov dword [ebp - 0xc], 0x9b05688c
mov dword [ebp - 8], 0x1f83d9ab
mov dword [ebp - 4], 0x5be0cd19
jl 0x434ef8
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
lea eax, [eax + esi - 0x40]
push eax
call fcn.00434fde
add esi, 0x40
pop ecx
add edi, 0x40
cmp esi, ebx
pop ecx
jle 0x434edb
mov esi, ebx
sub esi, edi
test esi, esi
jle 0x434f13
mov eax, dword [ebp + 8]
push esi
add edi, eax
lea eax, [ebp - 0x60]
push edi
push eax
call fcn.00480a30
add esp, 0xc
mov byte [ebp + esi - 0x60], 0x80
inc esi
cmp esi, 0x38
jle 0x434f4c
push 0x40
pop ecx
cmp esi, ecx
jge 0x434f3b
sub ecx, esi
lea edi, [ebp + esi - 0x60]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.00434fde
pop ecx
xor esi, esi
pop ecx
push 0x38
pop ecx
cmp esi, ecx
jge 0x434f69
sub ecx, esi
lea edi, [ebp + esi - 0x60]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, ebx
and byte [ebp - 0x28], 0
sar eax, 0x15
mov byte [ebp - 0x24], al
mov eax, ebx
sar eax, 0xd
mov byte [ebp - 0x23], al
mov eax, ebx
sar eax, 5
and byte [ebp - 0x27], 0
and byte [ebp - 0x26], 0
and byte [ebp - 0x25], 0
mov byte [ebp - 0x22], al
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x60]
shl bl, 3
push eax
mov byte [ebp - 0x21], bl
call fcn.00434fde
mov eax, dword [ebp + 0x10]
pop ecx
pop ecx
add eax, 2
push 8
lea ecx, [ebp - 0x20]
pop edi
mov esi, dword [ecx]
mov edx, esi
shr edx, 0x18
mov byte [eax - 2], dl
mov edx, esi
shr edx, 0x10
mov byte [eax - 1], dl
mov edx, esi
shr edx, 8
mov byte [eax], dl
mov dl, byte [ecx]
mov byte [eax + 1], dl
add ecx, 4
add eax, 4
dec edi
jne 0x434fb2
pop edi
pop esi
pop ebx
leave
ret
Function at 0x434fde
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x10
lea ecx, [ebp - 0x118]
add eax, 2
pop esi
movzx edi, byte [eax]
xor edx, edx
mov dh, byte [eax - 2]
mov dl, byte [eax - 1]
add eax, 4
shl edx, 8
or edx, edi
movzx edi, byte [eax - 3]
shl edx, 8
or edx, edi
mov dword [ecx], edx
add ecx, 4
dec esi
jne 0x434ff9
push 0x30
lea esi, [ebp - 0xe0]
pop edi
push dword [esi - 0x34]
call fcn.00435189
push dword [esi]
mov ebx, eax
call fcn.004351af
add ebx, eax
pop ecx
add ebx, dword [esi - 0x38]
add esi, 4
pop ecx
add ebx, dword [esi - 0x18]
dec edi
mov dword [esi + 4], ebx
jne 0x435026
mov esi, dword [ebp + 0xc]
and dword [ebp - 8], 0
mov eax, dword [esi]
mov ebx, dword [esi + 0x10]
mov dword [ebp + 8], eax
mov eax, dword [esi + 4]
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x1c]
mov dword [ebp - 0x18], eax
push ebx
call fcn.0043515c
mov ecx, dword [ebp - 0xc]
mov edi, eax
mov eax, ebx
and ecx, ebx
not eax
and eax, dword [ebp - 4]
push dword [ebp + 8]
xor eax, ecx
add edi, eax
mov eax, dword [ebp - 8]
add edi, dword [eax + 0x50294c]
add edi, dword [ebp + eax - 0x118]
add edi, dword [ebp - 0x18]
call fcn.0043512f
mov edx, dword [ebp + 0xc]
pop ecx
and edx, dword [ebp + 8]
pop ecx
mov ecx, dword [ebp + 0xc]
add dword [ebp - 8], 4
xor ecx, dword [ebp + 8]
and ecx, dword [ebp - 0x10]
xor ecx, edx
add eax, ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ebx
add eax, edi
lea ebx, [edi + ecx]
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 8], 0x100
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp + 0xc], ecx
mov dword [ebp + 8], eax
jl 0x43507d
add dword [esi], eax
mov eax, ecx
add dword [esi + 4], eax
mov eax, dword [ebp - 0x10]
add dword [esi + 8], eax
mov eax, dword [ebp - 0x14]
add dword [esi + 0xc], eax
mov eax, dword [ebp - 0xc]
add dword [esi + 0x14], eax
mov eax, dword [ebp - 4]
add dword [esi + 0x18], eax
mov eax, dword [ebp - 0x18]
add dword [esi + 0x10], ebx
add dword [esi + 0x1c], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4351d5
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov ebx, 0x80
xor edi, edi
cmp edx, ebx
mov dword [ebp - 0x40], 0xf3bcc908
mov dword [ebp - 0x3c], 0x6a09e667
mov dword [ebp - 0x38], 0x84caa73b
mov dword [ebp - 0x34], 0xbb67ae85
mov dword [ebp - 0x30], 0xfe94f82b
mov dword [ebp - 0x2c], 0x3c6ef372
mov dword [ebp - 0x28], 0x5f1d36f1
mov dword [ebp - 0x24], 0xa54ff53a
mov dword [ebp - 0x20], 0xade682d1
mov dword [ebp - 0x1c], 0x510e527f
mov dword [ebp - 0x18], 0x2b3e6c1f
mov dword [ebp - 0x14], 0x9b05688c
mov dword [ebp - 0x10], 0xfb41bd6b
mov dword [ebp - 0xc], 0x1f83d9ab
mov dword [ebp - 8], 0x137e2179
mov dword [ebp - 4], 0x5be0cd19
jl 0x435280
mov esi, ebx
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp + 8]
lea eax, [eax + esi - 0x80]
push eax
call fcn.004353d8
add esi, ebx
pop ecx
add edi, ebx
cmp esi, dword [ebp + 0xc]
pop ecx
jle 0x435261
mov edx, dword [ebp + 0xc]
mov esi, edx
sub esi, edi
test esi, esi
jle 0x4352a1
mov eax, dword [ebp + 8]
push esi
add edi, eax
lea eax, [ebp - 0xc8]
push edi
push eax
call fcn.00480a30
mov edx, dword [ebp + 0xc]
add esp, 0xc
mov byte [ebp + esi - 0xc8], bl
inc esi
cmp esi, 0x70
jle 0x4352e4
cmp esi, ebx
jge 0x4352cd
mov ecx, ebx
lea edi, [ebp + esi - 0xc8]
sub ecx, esi
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.004353d8
mov edx, dword [ebp + 0xc]
pop ecx
pop ecx
xor esi, esi
push 0x70
pop ecx
cmp esi, ecx
jge 0x435304
sub ecx, esi
lea edi, [ebp + esi - 0xc8]
mov esi, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
and byte [ebp - 0x58], 0
sar eax, 0x15
mov byte [ebp - 0x4c], al
mov eax, edx
sar eax, 0xd
mov byte [ebp - 0x4b], al
mov eax, edx
sar eax, 5
and byte [ebp - 0x57], 0
and byte [ebp - 0x56], 0
and byte [ebp - 0x55], 0
and byte [ebp - 0x54], 0
and byte [ebp - 0x53], 0
and byte [ebp - 0x52], 0
and byte [ebp - 0x51], 0
and byte [ebp - 0x50], 0
and byte [ebp - 0x4f], 0
and byte [ebp - 0x4e], 0
and byte [ebp - 0x4d], 0
mov byte [ebp - 0x4a], al
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xc8]
shl dl, 3
push eax
mov byte [ebp - 0x49], dl
call fcn.004353d8
mov eax, dword [ebp + 0x10]
pop ecx
pop ecx
lea edi, [ebp - 0x40]
lea esi, [eax + 2]
mov dword [ebp + 0xc], 8
mov ebx, dword [edi + 4]
mov eax, dword [edi]
mov ecx, ebx
push 0x18
shr ecx, 0x18
mov byte [esi - 2], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi - 1], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi], cl
mov cl, bl
mov byte [esi + 1], cl
pop ecx
mov edx, ebx
mov dword [ebp - 0x44], ebx
call fcn.00483a10
push 0x10
mov byte [esi + 2], al
mov eax, dword [edi]
pop ecx
mov edx, ebx
call fcn.00483a10
push 8
mov byte [esi + 3], al
mov eax, dword [edi]
pop ecx
mov edx, ebx
call fcn.00483a10
mov byte [esi + 4], al
mov al, byte [edi]
mov byte [esi + 5], al
add edi, 8
add esi, 8
dec dword [ebp + 0xc]
jne 0x435374
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4358bc
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
mov edx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov ebx, 0x80
xor edi, edi
cmp edx, ebx
mov dword [ebp - 0x40], 0xc1059ed8
mov dword [ebp - 0x3c], 0xcbbb9d5d
mov dword [ebp - 0x38], 0x367cd507
mov dword [ebp - 0x34], 0x629a292a
mov dword [ebp - 0x30], 0x3070dd17
mov dword [ebp - 0x2c], 0x9159015a
mov dword [ebp - 0x28], 0xf70e5939
mov dword [ebp - 0x24], 0x152fecd8
mov dword [ebp - 0x20], 0xffc00b31
mov dword [ebp - 0x1c], 0x67332667
mov dword [ebp - 0x18], 0x68581511
mov dword [ebp - 0x14], 0x8eb44a87
mov dword [ebp - 0x10], 0x64f98fa7
mov dword [ebp - 0xc], 0xdb0c2e0d
mov dword [ebp - 8], 0xbefa4fa4
mov dword [ebp - 4], 0x47b5481d
jl 0x435967
mov esi, ebx
lea eax, [ebp - 0x40]
push eax
mov eax, dword [ebp + 8]
lea eax, [eax + esi - 0x80]
push eax
call fcn.004353d8
add esi, ebx
pop ecx
add edi, ebx
cmp esi, dword [ebp + 0xc]
pop ecx
jle 0x435948
mov edx, dword [ebp + 0xc]
mov esi, edx
sub esi, edi
test esi, esi
jle 0x435988
mov eax, dword [ebp + 8]
push esi
add edi, eax
lea eax, [ebp - 0xc8]
push edi
push eax
call fcn.00480a30
mov edx, dword [ebp + 0xc]
add esp, 0xc
mov byte [ebp + esi - 0xc8], bl
inc esi
cmp esi, 0x70
jle 0x4359cb
cmp esi, ebx
jge 0x4359b4
mov ecx, ebx
lea edi, [ebp + esi - 0xc8]
sub ecx, esi
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.004353d8
mov edx, dword [ebp + 0xc]
pop ecx
pop ecx
xor esi, esi
push 0x70
pop ecx
cmp esi, ecx
jge 0x4359eb
sub ecx, esi
lea edi, [ebp + esi - 0xc8]
mov esi, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
and ecx, 3
rep stosb byte es:[edi], al
mov eax, edx
and byte [ebp - 0x58], 0
sar eax, 0x15
mov byte [ebp - 0x4c], al
mov eax, edx
sar eax, 0xd
mov byte [ebp - 0x4b], al
mov eax, edx
sar eax, 5
and byte [ebp - 0x57], 0
and byte [ebp - 0x56], 0
and byte [ebp - 0x55], 0
and byte [ebp - 0x54], 0
and byte [ebp - 0x53], 0
and byte [ebp - 0x52], 0
and byte [ebp - 0x51], 0
and byte [ebp - 0x50], 0
and byte [ebp - 0x4f], 0
and byte [ebp - 0x4e], 0
and byte [ebp - 0x4d], 0
mov byte [ebp - 0x4a], al
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xc8]
shl dl, 3
push eax
mov byte [ebp - 0x49], dl
call fcn.004353d8
mov eax, dword [ebp + 0x10]
pop ecx
pop ecx
lea edi, [ebp - 0x40]
lea esi, [eax + 2]
mov dword [ebp + 0xc], 6
mov ebx, dword [edi + 4]
mov eax, dword [edi]
mov ecx, ebx
push 0x18
shr ecx, 0x18
mov byte [esi - 2], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi - 1], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi], cl
mov cl, bl
mov byte [esi + 1], cl
pop ecx
mov edx, ebx
mov dword [ebp - 0x44], ebx
call fcn.00483a10
push 0x10
mov byte [esi + 2], al
mov eax, dword [edi]
pop ecx
mov edx, ebx
call fcn.00483a10
push 8
mov byte [esi + 3], al
mov eax, dword [edi]
pop ecx
mov edx, ebx
call fcn.00483a10
mov byte [esi + 4], al
mov al, byte [edi]
mov byte [esi + 5], al
add edi, 8
add esi, 8
dec dword [ebp + 0xc]
jne 0x435a5b
pop edi
pop esi
pop ebx
leave
ret