joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010a0f0
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, edx
mov edx, dword [esi + 8]
and edx, 0x3f
mov byte [edx + esi + 0x40], 0x80
inc edx
cmp edx, 0x38
jbe 0x1010a13a
cmp edx, 0x40
je 0x1010a126
mov eax, 0x40
lea ecx, [esi + 0x40]
sub eax, edx
add ecx, edx
push eax
push 0
push ecx
call fcn.10152e30
add esp, 0xc
mov eax, dword [esi]
lea ebx, [esi + 0x40]
lea ebp, [esi + 0x20]
mov edx, ebx
push 1
mov ecx, ebp
call eax
xor edx, edx
jmp 0x1010a140
lea ebx, [esi + 0x40]
lea ebp, [esi + 0x20]
mov eax, 0x38
sub eax, edx
push eax
lea eax, [esi + 0x40]
add eax, edx
push 0
push eax
call fcn.10152e30
mov ecx, dword [esi + 8]
add esp, 0xc
mov eax, dword [esi + 0xc]
mov edx, ebx
shld eax, ecx, 3
shl ecx, 3
bswap eax
bswap ecx
mov dword [esi + 0x78], eax
mov eax, dword [esi]
mov dword [esi + 0x7c], ecx
mov ecx, ebp
push 1
call eax
mov edx, ebp
mov ebx, 4
mov ecx, dword [edx + 4]
lea edi, [edi + 8]
mov eax, dword [edx]
lea edx, [edx + 8]
bswap eax
mov dword [edi - 8], eax
bswap ecx
mov dword [edi - 4], ecx
sub ebx, 1
jne 0x1010a180
pop edi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x24], 0xbb67ae85
mov dword [esi + 0x28], 0x3c6ef372
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0x510e527f
mov dword [esi + 0x34], 0x9b05688c
mov dword [esi + 0x38], 0x1f83d9ab
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
mov dword [ebp], 0x6a09e667
pop ebp
pop ebx
ret
Function at 0x1010a6c0
Capabilities:
Hash data using sha256

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10183e8d
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0xc8
mov eax, dword [0x101e6040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebx + 8]
push 0x101f4218
mov dword [ebp - 0x44], 0x101f4218
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
cmp byte [0x101e7b10], 0
je 0x1010a72b
call fcn.1010a1e0
mov edi, dword [ebx + 0xc]
test edi, edi
je 0x1010a899
nop word [eax + eax]
movaps xmm0, xmmword [0x101e7af0]
lea ecx, [ebp - 0xd0]
movaps xmmword [ebp - 0x90], xmm0
mov edx, 0x101e7af0
movaps xmm0, xmmword [0x101e7b00]
mov dword [ebp - 0xd0], 0x10109b20
mov dword [ebp - 0xb0], 0x6a09e667
mov dword [ebp - 0xac], 0xbb67ae85
mov dword [ebp - 0xa8], 0x3c6ef372
mov dword [ebp - 0xa4], 0xa54ff53a
mov dword [ebp - 0xa0], 0x510e527f
mov dword [ebp - 0x9c], 0x9b05688c
mov dword [ebp - 0x98], 0x1f83d9ab
mov dword [ebp - 0x94], 0x5be0cd19
mov dword [ebp - 0xc8], 0x20
mov dword [ebp - 0xc4], 0
movaps xmmword [ebp - 0x80], xmm0
call fcn.1010a0f0
movups xmm0, xmmword [0x101e7af0]
lea edx, [ebp - 0x40]
mov dword [ebp - 0xd0], 0x10109b20
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0xb0], 0x6a09e667
movups xmmword [ebp - 0x8c], xmm0
mov dword [ebp - 0xac], 0xbb67ae85
movups xmm0, xmmword [0x101e7b00]
mov dword [ebp - 0xa8], 0x3c6ef372
mov dword [ebp - 0xa4], 0xa54ff53a
mov dword [ebp - 0xa0], 0x510e527f
mov dword [ebp - 0x9c], 0x9b05688c
mov dword [ebp - 0x98], 0x1f83d9ab
mov dword [ebp - 0x94], 0x5be0cd19
mov dword [ebp - 0x90], 0xf672abd1
mov dword [ebp - 0xc8], 0x24
mov dword [ebp - 0xc4], 0
movups xmmword [ebp - 0x7c], xmm0
call fcn.1010a0f0
lea edx, [ebp - 0x40]
xor ecx, ecx
sub edx, esi
nop dword [eax]
test edi, edi
je 0x1010a899
mov al, byte [edx + esi]
inc ecx
mov byte [esi], al
dec edi
inc esi
cmp ecx, 0x20
jb 0x1010a880
test edi, edi
jne 0x1010a740
push 0x101f4218
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10151433
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
Function at 0x1010cc30
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10183eed
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x74
mov eax, dword [0x101e6040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x18], 0
movq qword [ebp - 0x20], xmm0
lea ecx, [ebp - 0x20]
push 0x104
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
call fcn.100ad480
mov esi, dword [ebp - 0x20]
push 0x208
push 0
push esi
call fcn.10152e30
lea eax, [esi + 0x208]
add esp, 0xc
mov dword [ebp - 0x1c], eax
push 0x104
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x1010ccd8
xor esi, esi
jmp 0x1010ce2f
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
xor eax, eax
mov dword [ebp - 0x3c], 7
movups xmmword [ebp - 0x50], xmm0
mov word [ebp - 0x50], ax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x80]
push 0xb
push str.Crypt32.dll
movups xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
call fcn.100030f0
mov ecx, esi
mov byte [ebp - 4], 2
xorps xmm0, xmm0
mov dword [ebp - 0x58], 0
movups xmmword [ebp - 0x68], xmm0
mov dword [ebp - 0x54], 0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1010cd30
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x68]
call fcn.100030f0
lea eax, [ebp - 0x68]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x38]
call fcn.10002a50
mov byte [ebp - 4], 4
cmp dword [ebp - 0x58], 2
jb 0x1010cda9
cmp dword [ebp - 0x54], 7
lea eax, [ebp - 0x68]
cmova eax, dword [ebp - 0x68]
movzx esi, word [eax]
mov eax, esi
lea ecx, [eax - 0x61]
add eax, 0xffffffe0
movzx edx, ax
cmp cx, 0x19
mov eax, esi
cmova edx, eax
movzx eax, dx
add eax, 0xffffffbf
cmp ax, 0x19
ja 0x1010cda9
cmp dword [ebp - 0x54], 7
lea eax, [ebp - 0x68]
cmova eax, dword [ebp - 0x68]
cmp word [eax + 2], 0x3a
jne 0x1010cda9
cmp dword [ebp - 0x58], 2
jbe 0x1010cdcd
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x1010cdcd
cmp dword [ebp - 0x24], 7
lea eax, [ebp - 0x38]
cmova eax, dword [ebp - 0x38]
cmp word [eax + ecx*2 - 2], 0x5c
je 0x1010cdcd
push 0x5c
lea ecx, [ebp - 0x38]
call fcn.1006acb0
cmp dword [ebp - 0x6c], 7
lea eax, [ebp - 0x80]
push dword [ebp - 0x70]
cmova eax, dword [ebp - 0x80]
lea ecx, [ebp - 0x38]
push eax
call fcn.1006b0c0
cmp dword [ebp - 0x24], 7
lea eax, [ebp - 0x38]
push dword [ebp - 0x28]
cmova eax, dword [ebp - 0x38]
lea ecx, [ebp - 0x50]
push eax
call fcn.10008d20
lea ecx, [ebp - 0x38]
call fcn.100031a0
lea ecx, [ebp - 0x68]
call fcn.100031a0
lea ecx, [ebp - 0x80]
call fcn.100031a0
cmp dword [ebp - 0x3c], 7
lea eax, [ebp - 0x50]
cmova eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea ecx, [ebp - 0x50]
mov esi, eax
call fcn.100031a0
lea ecx, [ebp - 0x20]
call fcn.100ad420
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10151433
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
Function at 0x1010ce60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 4], 0
jne 0x1010cf11
push esi
xor esi, esi
mov ecx, esi
mov eax, esi
shr ecx, 1
mov edx, ecx
xor edx, 0xedb88320
test al, 1
cmove edx, ecx
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov eax, edx
shr eax, 1
mov ecx, eax
xor ecx, 0xedb88320
test dl, 1
cmove ecx, eax
mov eax, ecx
shr eax, 1
mov edx, eax
xor edx, 0xedb88320
test cl, 1
cmove edx, eax
mov ecx, edx
shr ecx, 1
mov eax, ecx
xor eax, 0xedb88320
test dl, 1
cmove eax, ecx
mov dword [edi + esi*4], eax
inc esi
cmp esi, 0x100
jb 0x1010ce70
pop esi
pop edi
ret
Function at 0x1010e590
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x54
mov eax, dword [0x101e6040]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edx
mov esi, dword [edi + 0x18]
mov ebx, esi
mov ebp, dword [edi + 0x1c]
and esi, 0x3f
shld ebp, ebx, 3
shl ebx, 3
mov byte [edi + esi + 0x20], 0x80
inc esi
cmp esi, 0x38
je 0x1010e612
jbe 0x1010e5fa
cmp esi, 0x40
jae 0x1010e5e4
mov eax, 0x40
lea ecx, [edi + 0x20]
sub eax, esi
add ecx, esi
push eax
push 0
push ecx
call fcn.10152e30
add esp, 0xc
lea eax, [edi + 0x20]
mov ecx, edi
push 1
push eax
lea edx, [esp + 0x20]
xor esi, esi
call fcn.1010cf20
add esp, 8
mov eax, 0x38
sub eax, esi
push eax
lea eax, [edi + 0x20]
add eax, esi
push 0
push eax
call fcn.10152e30
add esp, 0xc
lea eax, [edi + 0x20]
mov ecx, edi
push 1
bswap ebp
bswap ebx
push eax
lea edx, [esp + 0x20]
mov dword [edi + 0x58], ebp
mov dword [edi + 0x5c], ebx
call fcn.1010cf20
mov eax, dword [edi]
add esp, 8
mov ecx, dword [esp + 0x14]
mov dword [ecx], eax
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
mov eax, dword [edi + 8]
mov dword [ecx + 8], eax
mov eax, dword [edi + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [edi + 0x10]
mov dword [ecx + 0x10], eax
mov ecx, dword [esp + 0x5c]
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi], 0x67452301
mov dword [edi + 4], 0xefcdab89
mov dword [edi + 8], 0x98badcfe
mov dword [edi + 0xc], 0x10325476
mov dword [edi + 0x10], 0xc3d2e1f0
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10151433
add esp, 0x54
ret
Function at 0x1010eb10
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
cmp dword [ebp + 0xc], 0
mov edx, dword [ebp + 0x10]
push esi
mov esi, ecx
push edi
movups xmm2, xmmword [esi + 8]
lea edi, [esi + 0x18]
jbe 0x1010eb8a
nop word [eax + eax]
mov ecx, dword [ebp + 8]
mov eax, ecx
add ecx, 0x10
mov dword [ebp + 8], ecx
mov ecx, dword [esi + 4]
movups xmm3, xmmword [eax]
mov eax, ecx
dec ecx
add eax, eax
movups xmm1, xmmword [edi + eax*8]
xorps xmm1, xmm3
test ecx, ecx
jle 0x1010eb68
mov eax, ecx
shl eax, 4
add eax, edi
movups xmm0, xmmword [eax]
dec ecx
lea eax, [eax - 0x10]
aesdec xmm1, xmm0
test ecx, ecx
jg 0x1010eb58
cmp byte [esi + 1], 0
movups xmm0, xmmword [edi]
aesdeclast xmm1, xmm0
je 0x1010eb79
xorps xmm1, xmm2
mov eax, edx
movaps xmm2, xmm3
add edx, 0x10
sub dword [ebp + 0xc], 1
movups xmmword [eax], xmm1
jne 0x1010eb30
pop edi
movups xmmword [esi + 8], xmm2
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1010f520
Capabilities:
Create thread

Disassembly:
sub esp, 8
mov eax, dword [0x101e6040]
xor eax, esp
mov dword [esp + 4], eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x104], 0
jne 0x1010f590
xor ebx, ebx
cmp dword [esi], ebx
jbe 0x1010f590
mov ebp, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea edi, [esi + 4]
nop dword [eax]
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x1010f470
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1010f61f
mov dword [edi], eax
inc dword [esi + 0x104]
mov eax, dword [0x101ef1b4]
test eax, eax
je 0x1010f588
push eax
push dword [edi]
call ebp
inc ebx
add edi, 4
cmp ebx, dword [esi]
jb 0x1010f550
cmp dword [esi + 0x108], 0x40
jb 0x1010f5cc
push dword [esi + 0x31c]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push dword [esi + 0x108]
push dword [esi + 0x318]
call dword [sym.imp.KERNEL32.dll_ReleaseSemaphore]
push 0xffffffffffffffff
push dword [esi + 0x31c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0xffffffff
je 0x1010f619
mov ecx, dword [esi + 0x30c]
mov eax, dword [esp + 0x1c]
pop edi
mov dword [esi + ecx*8 + 0x10c], eax
mov ecx, dword [esi + 0x30c]
mov eax, dword [esp + 0x1c]
mov dword [esi + ecx*8 + 0x110], eax
mov eax, dword [esi + 0x30c]
inc dword [esi + 0x108]
inc eax
mov ecx, dword [esp + 0x10]
and eax, 0x3f
mov dword [esi + 0x30c], eax
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10151433
add esp, 8
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
call fcn.100ace80
int3

Function at 0x10110fb0
Capabilities:
Hash data using sha256

Disassembly:
cmp dword [0x101f4230], 2
push esi
push edi
mov edi, edx
mov esi, ecx
jl 0x10110fc4
call fcn.1010fd90
push 0xf0
push 0
push esi
call fcn.10152e30
mov dword [esi + 0x100], 0
add esp, 0xc
mov byte [esi + 0x104], 0
mov eax, dword [esi + 0xf4]
mov dword [eax], 0x6a09e667
mov eax, dword [esi + 0xf4]
mov dword [eax + 4], 0xbb67ae85
mov eax, dword [esi + 0xf4]
mov dword [eax + 8], 0x3c6ef372
mov eax, dword [esi + 0xf4]
mov dword [eax + 0xc], 0xa54ff53a
mov eax, dword [esi + 0xf4]
mov dword [eax + 0x10], 0x510e527f
mov eax, dword [esi + 0xf4]
mov dword [eax + 0x14], 0x9b05688c
mov eax, dword [esi + 0xf4]
mov dword [eax + 0x18], 0x1f83d9ab
mov eax, dword [esi + 0xf4]
mov dword [eax + 0x1c], 0x5be0cd19
mov eax, dword [esi + 0xf4]
xor dword [eax], 0x2080020
mov eax, dword [esi + 0xf4]
xor dword [eax + 8], edi
mov ecx, dword [esi + 0xf4]
mov eax, dword [esp + 0xc]
or eax, 0x2000
shl eax, 0x10
xor dword [ecx + 0xc], eax
pop edi
pop esi
ret
Function at 0x101134f0
Capabilities:
Hash data using murmur3

Disassembly:
sub esp, 0xc
push esi
mov eax, edx
mov esi, ecx
mov dword [esp + 0xc], eax
push edi
lea edi, [esi + eax]
mov dword [esp + 0xc], edi
cmp eax, 0x10
jb 0x10113597
lea eax, [edi - 0x10]
mov edx, 0x24234428
push ebx
mov dword [esp + 0xc], eax
mov ebx, 0x85ebca77
mov edi, dword [esp + 0xc]
mov eax, 0x61c8864f
push ebp
xor ebp, ebp
nop dword [eax + eax]
imul ecx, dword [esi], 0x7a143589
sub edx, ecx
imul ecx, dword [esi + 4], 0x7a143589
rol edx, 0xd
imul edx, edx, 0x9e3779b1
sub ebx, ecx
imul ecx, dword [esi + 8], 0x7a143589
rol ebx, 0xd
imul ebx, ebx, 0x9e3779b1
sub ebp, ecx
imul ecx, dword [esi + 0xc], 0x7a143589
rol ebp, 0xd
add esi, 0x10
imul ebp, ebp, 0x9e3779b1
sub eax, ecx
rol eax, 0xd
imul eax, eax, 0x9e3779b1
cmp esi, edi
jbe 0x10113530
mov edi, dword [esp + 0x14]
rol eax, 0x12
rol ebp, 0xc
add eax, ebp
rol ebx, 7
add eax, ebx
rol edx, 1
pop ebp
add eax, edx
pop ebx
jmp 0x1011359c
mov eax, 0x165667b1
add eax, dword [esp + 0x10]
lea ecx, [esi + 4]
cmp ecx, edi
ja 0x101135cb
nop word [eax + eax]
imul ecx, dword [esi], 0x3d4d51c3
add esi, 4
sub eax, ecx
lea ecx, [esi + 4]
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
cmp ecx, edi
jbe 0x101135b0
cmp esi, edi
jae 0x101135e9
nop
movzx ecx, byte [esi]
inc esi
imul ecx, ecx, 0x165667b1
add ecx, eax
rol ecx, 0xb
imul eax, ecx, 0x9e3779b1
cmp esi, edi
jb 0x101135d0
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul ecx, ecx, 0x85ebca77
pop edi
pop esi
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
add esp, 0xc
ret

Function at 0x101137a0
Capabilities:
Hash data using murmur3

Disassembly:
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x18]
add edi, dword [esi + 0x28]
lea edx, [esi + 0x18]
cmp dword [esi + 4], 0
je 0x101137d2
mov eax, dword [esi + 0x14]
mov ecx, dword [esi + 0xc]
rol ecx, 7
rol eax, 0x12
add eax, ecx
mov ecx, dword [esi + 8]
rol ecx, 1
add eax, ecx
mov ecx, dword [esi + 0x10]
rol ecx, 0xc
add eax, ecx
jmp 0x101137da
mov eax, dword [esi + 0x10]
add eax, 0x165667b1
add eax, dword [esi]
lea esi, [edx + 4]
cmp esi, edi
ja 0x101137fe
imul ecx, dword [edx], 0x3d4d51c3
add esi, 4
add edx, 4
sub eax, ecx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
cmp esi, edi
jbe 0x101137e3
cmp edx, edi
jae 0x1011381b
movzx ecx, byte [edx]
inc edx
imul ecx, ecx, 0x165667b1
add ecx, eax
rol ecx, 0xb
imul eax, ecx, 0x9e3779b1
cmp edx, edi
jb 0x10113802
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul ecx, ecx, 0x85ebca77
pop edi
pop esi
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae3d
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret
Function at 0x101255b0
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx], edx
sub edx, 1
je 0x10125616
sub edx, 3
je 0x10125607
sub edx, 6
jne 0x1012561d
mov dword [ecx + 0x10], 0x10109b20
mov dword [ecx + 0x18], edx
mov dword [ecx + 0x1c], edx
mov dword [ecx + 0x30], 0x6a09e667
mov dword [ecx + 0x34], 0xbb67ae85
mov dword [ecx + 0x38], 0x3c6ef372
mov dword [ecx + 0x3c], 0xa54ff53a
mov dword [ecx + 0x40], 0x510e527f
mov dword [ecx + 0x44], 0x9b05688c
mov dword [ecx + 0x48], 0x1f83d9ab
mov dword [ecx + 0x4c], 0x5be0cd19
ret
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 0xc], 0xffffffff
ret
mov dword [ecx + 4], 0xffffffff
ret
Function at 0x1012ac00
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push ebp
push edi
mov edi, dword [esp + 0x10]
mov ebx, edx
mov ebp, ecx
mov edx, dword [edi + 0x9c]
cmp edx, 0xffffffff
jne 0x1012ac1c
pop edi
pop ebp
or eax, edx
pop ebx
ret
lea eax, [edx + ebx]
cmp eax, 0x40
jbe 0x1012ac88
push esi
lea esi, [edi + 0x40]
cmp edx, 0x40
ja 0x1012ac6e
mov dword [esi + 4], 0
mov ecx, edi
mov dword [esi], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
mov edx, dword [edi + 0x9c]
push esi
call fcn.10143a50
add esp, 4
push esi
mov edx, ebx
mov ecx, ebp
call fcn.10143a50
add dword [edi + 0x9c], ebx
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebp
pop ebx
ret
push ebx
lea eax, [edx + edi]
push ebp
push eax
call fcn.101528b0
add dword [edi + 0x9c], ebx
add esp, 0xc
xor eax, eax
pop edi
pop ebp
pop ebx
ret

Function at 0x1012acb0
Capabilities:
Hash data using sha1

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
mov ebp, ecx
mov ebx, edx
mov ecx, dword [edi + 0x9c]
lea esi, [edi + 0x40]
cmp ecx, 0xffffffff
je 0x1012ad7f
cmp ecx, 0x40
jbe 0x1012aceb
mov edx, esi
mov ecx, edi
call fcn.10143ac0
mov dword [edi + 0x9c], 0x14
mov ecx, 0x14
mov eax, 0x40
sub eax, ecx
push eax
lea eax, [ecx + edi]
push 0
push eax
call fcn.10152e30
movups xmm0, xmmword [edi]
mov edx, 0x40
mov ecx, edi
movaps xmm2, xmmword [str.6666666666666666]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [edi], xmm1
push esi
movups xmm0, xmmword [edi + 0x10]
movaps xmm1, xmm2
xorps xmm0, xmm2
movups xmmword [edi + 0x10], xmm0
movups xmm0, xmmword [edi + 0x20]
xorps xmm1, xmm0
movups xmmword [edi + 0x20], xmm1
movups xmm0, xmmword [edi + 0x30]
xorps xmm0, xmm2
movups xmmword [edi + 0x30], xmm0
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
call fcn.10143a50
add esp, 0x10
mov dword [edi + 0x9c], 0xffffffff
test ebx, ebx
je 0x1012ad90
push esi
mov edx, ebx
mov ecx, ebp
call fcn.10143a50
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1012ada0
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x18
mov eax, dword [0x101e6040]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push edi
mov edi, dword [esp + 0x28]
mov ebx, edx
mov ebp, ecx
cmp dword [edi + 0x9c], 0xffffffff
je 0x1012adcf
push edi
xor edx, edx
xor ecx, ecx
call fcn.1012acb0
add esp, 4
push esi
lea esi, [edi + 0x40]
mov edx, esi
lea ecx, [esp + 0x10]
call fcn.10143ac0
movups xmm0, xmmword [edi]
mov edx, 0x40
mov ecx, edi
movaps xmm2, xmmword [0x101d3670]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [edi], xmm1
push esi
movups xmm0, xmmword [edi + 0x10]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [edi + 0x10], xmm1
movups xmm0, xmmword [edi + 0x20]
xorps xmm0, xmm2
movups xmmword [edi + 0x20], xmm0
movups xmm0, xmmword [edi + 0x30]
xorps xmm2, xmm0
movups xmmword [edi + 0x30], xmm2
mov dword [esi + 4], 0
mov dword [esi], 0
mov dword [esi + 8], 0x67452301
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x18], 0xc3d2e1f0
call fcn.10143a50
push esi
mov edx, 0x14
lea ecx, [esp + 0x18]
call fcn.10143a50
add esp, 8
lea ecx, [esp + 0x10]
mov edx, esi
call fcn.10143ac0
pop esi
test ebx, ebx
je 0x1012ae83
push ebx
lea eax, [esp + 0x10]
push eax
push ebp
call fcn.101528b0
add esp, 0xc
mov ecx, dword [esp + 0x20]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.10151433
add esp, 0x18
ret
Function at 0x1012d360
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x88
mov eax, dword [0x101e6040]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x8c]
push ebx
mov ebx, dword [esp + 0x94]
push ebp
push esi
mov ebp, eax
mov esi, ecx
mov ecx, dword [esp + 0xa0]
shr ebp, 4
mov dword [esp + 0xc], ecx
push edi
mov edi, edx
test ebx, ebx
je 0x1012d4ab
test ecx, ecx
je 0x1012d4ab
test eax, eax
je 0x1012d3be
test esi, esi
je 0x1012d4ab
test edi, edi
je 0x1012d4ab
cmp ebp, 1
jb 0x1012d41a
push ecx
mov edx, ebx
lea ecx, [esp + 0x18]
call fcn.1012cae0
mov eax, dword [edi]
add esp, 4
xor eax, dword [esp + 0x14]
mov dword [esi], eax
mov eax, dword [edi + 4]
xor eax, dword [esp + 0x18]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
xor eax, dword [esp + 0x1c]
mov dword [esi + 8], eax
mov eax, dword [edi + 0xc]
xor eax, dword [esp + 0x20]
mov dword [esi + 0xc], eax
mov eax, 0x10
nop dword [eax]
dec eax
add byte [eax + ebx], 1
jne 0x1012d40b
test eax, eax
jne 0x1012d400
mov ecx, dword [esp + 0x10]
add edi, 0x10
add esi, 0x10
sub ebp, 1
jne 0x1012d3c3
mov ebp, dword [esp + 0x9c]
and ebp, 0xf
je 0x1012d4ab
push ecx
mov edx, ebx
lea ecx, [esp + 0x18]
call fcn.1012cae0
add esp, 4
xor edx, edx
test ebp, ebp
je 0x1012d4ab
cmp ebp, 8
jb 0x1012d490
lea ecx, [ebp - 1]
lea eax, [esp + ebp + 0x13]
add ecx, esi
cmp esi, eax
ja 0x1012d459
lea eax, [esp + 0x14]
cmp ecx, eax
jae 0x1012d490
lea eax, [ebp - 1]
add eax, edi
cmp esi, eax
ja 0x1012d466
cmp ecx, edi
jae 0x1012d490
mov ecx, ebp
and ecx, 0xfffffff8
nop dword [eax + eax]
movq xmm1, qword [edx + edi]
movq xmm0, qword [esp + edx + 0x14]
xorps xmm1, xmm0
movq qword [esi + edx], xmm1
add edx, 8
mov eax, edx
cmp edx, ecx
jb 0x1012d470
cmp eax, ebp
jae 0x1012d4ab
lea eax, [esp + 0x14]
sub edi, eax
sub esi, eax
lea ecx, [esp + 0x14]
add ecx, edx
inc edx
mov al, byte [ecx + edi]
xor al, byte [ecx]
mov byte [ecx + esi], al
cmp edx, ebp
jb 0x1012d498
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10151433
add esp, 0x88
ret
Function at 0x1012d570
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ecx
mov dword [esp + 0xc], edx
push edi
mov ecx, dword [esi + 0x14]
mov edi, dword [esi + 0x18]
lea eax, [ecx + ebp]
cmp eax, edi
jbe 0x1012d590
mov ebp, edi
sub ebp, ecx
xor ebx, ebx
test ebp, ebp
je 0x1012d600
mov eax, dword [esi + 0x20]
mov edi, ebp
sub eax, dword [esi + 0x1c]
sub edi, ebx
cmp edi, eax
cmovae edi, eax
mov eax, dword [esi + 0x24]
add eax, dword [esi + 0x1c]
push edi
push eax
lea eax, [ebx + edx]
push eax
call fcn.101528b0
mov ecx, dword [esi + 0x1c]
add esp, 0xc
add ecx, edi
add ebx, edi
cmp dword [esi + 0x28], 0
mov dword [esi + 0x1c], ecx
jne 0x1012d600
mov eax, dword [esi + 0x20]
cmp ecx, eax
jb 0x1012d5eb
mov ecx, dword [esi]
lea eax, [esi + 0x30]
push dword [esi + 0x24]
push eax
mov eax, dword [ecx + 8]
call eax
add esp, 8
mov dword [esi + 0x20], eax
mov dword [esi + 0x1c], 0
test eax, eax
je 0x1012d5f9
mov edx, dword [esp + 0x10]
cmp ebx, ebp
jb 0x1012d596
jmp 0x1012d600
mov dword [esi + 0x28], 1
movzx ecx, word [esi + 0x2c]
xor edx, edx
test ebx, ebx
je 0x1012d62d
mov edi, dword [esp + 0x10]
nop
movzx eax, byte [edi + edx]
inc edx
xor eax, ecx
shr cx, 8
movzx eax, al
xor cx, word [eax*4 + 0x101c4c58]
movzx ecx, cx
cmp edx, ebx
jb 0x1012d610
mov word [esi + 0x2c], cx
mov edx, dword [esi + 0x14]
add edx, ebx
cmp dword [esi + 4], 0
mov dword [esi + 0x14], edx
je 0x1012d672
mov eax, dword [esi]
mov ecx, dword [eax + 0x14]
lea eax, [ecx - 1]
add eax, edx
xor edx, edx
div ecx
mov ecx, dword [esi + 0xc]
mov edi, eax
cmp ecx, edi
je 0x1012d672
push dword [esi + 8]
lea eax, [ecx + 1]
mov ecx, dword [esi + 4]
push dword [esi + 0x10]
mov dword [esi + 0xc], eax
push eax
call ecx
mov ecx, dword [esi + 0xc]
add esp, 0xc
cmp ecx, edi
jne 0x1012d656
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret