joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10132a20
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
xor eax, eax
pop ebp
ret 4
Function at 0x10163b50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor eax, eax
push esi
mov dword [ebp - 4], eax
push edi
lea esp, [esp]
mov ebx, eax
mov edi, eax
shr ebx, 1
shr edi, 2
and ebx, 0x80000001
jns 0x10163b76
dec ebx
or ebx, 0xfffffffe
inc ebx
mov ecx, dword [ebp + 0x10]
lea edx, [edi*4]
mov esi, eax
and esi, 3
movzx ecx, byte [ecx + 1]
shl ecx, 4
add ecx, eax
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax + 3]
mov ecx, dword [ecx*4 + 0x10227ae8]
shl eax, 4
add eax, dword [ebp - 4]
xor ecx, dword [eax*4 + 0x1022fae8]
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax + 2]
shl eax, 4
add eax, dword [ebp - 4]
xor ecx, dword [eax*4 + 0x1022bae8]
mov eax, dword [ebp + 0x10]
movzx eax, byte [eax]
shl eax, 4
add eax, dword [ebp - 4]
xor ecx, dword [eax*4 + 0x10223ae8]
mov eax, edi
and eax, 0x80000001
jns 0x10163bde
dec eax
or eax, 0xfffffffe
inc eax
add eax, edx
add eax, ebx
lea eax, [esi + eax*2]
mov dword [eax*4 + 0x103daa70], ecx
lea eax, [edi + 1]
and eax, 0x80000001
jns 0x10163bfb
dec eax
or eax, 0xfffffffe
inc eax
add eax, edx
add eax, ebx
mov ebx, dword [ebp + 0xc]
lea ecx, [esi + eax*2]
mov eax, dword [ebp - 4]
mov eax, dword [ebx + eax*4]
mov dword [ecx*4 + 0x103daa70], eax
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x10
jl 0x10163b60
mov edi, dword [ebp + 8]
xor esi, esi
test edi, edi
jle 0x10163ca6
mov eax, dword [ebp + 0x14]
shl eax, 7
lea ebx, [eax + 0x10200978]
jmp 0x10163c40
mov eax, 0x103daa80
mov ecx, ebx
jmp 0x10163c50
movdqu xmm0, xmmword [eax - 0x10]
lea ecx, [ecx + 0x20]
movdqu xmm1, xmmword [ecx - 0x30]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x10], xmm1
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [ecx - 0x20]
pxor xmm1, xmm0
movdqu xmmword [eax], xmm1
add eax, 0x20
cmp eax, 0x103dab00
jl 0x10163c50
xor dword [0x103daa74], esi
push 0x103daa70
call fcn.10163f10
push 0x103daa70
call fcn.101633d0
inc esi
add esp, 8
cmp esi, edi
jl 0x10163c40
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x103daa70]
xor dword [ebx], eax
mov eax, dword [0x103daab0]
xor dword [ebx + 0x20], eax
mov eax, dword [0x103daa74]
xor dword [ebx + 4], eax
mov eax, dword [0x103daab4]
xor dword [ebx + 0x24], eax
mov eax, dword [0x103daa78]
xor dword [ebx + 8], eax
mov eax, dword [0x103daab8]
xor dword [ebx + 0x28], eax
mov eax, dword [0x103daa7c]
xor dword [ebx + 0xc], eax
mov eax, dword [0x103daabc]
xor dword [ebx + 0x2c], eax
mov eax, dword [0x103daa80]
xor dword [ebx + 0x10], eax
mov eax, dword [0x103daac0]
xor dword [ebx + 0x30], eax
mov eax, dword [0x103daa84]
xor dword [ebx + 0x14], eax
mov eax, dword [0x103daac4]
xor dword [ebx + 0x34], eax
mov eax, dword [0x103daa88]
xor dword [ebx + 0x18], eax
mov eax, dword [0x103daac8]
xor dword [ebx + 0x38], eax
mov eax, dword [0x103daa8c]
xor dword [ebx + 0x1c], eax
mov eax, dword [0x103daacc]
xor dword [ebx + 0x3c], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10164d30
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call fcn.10164d60
add esp, 4
lea edx, [eax*2 + 1]
imul edx, eax
mov ecx, edx
add edx, edx
and ecx, 0x80000000
je 0x10164d5a
xor edx, 0x4c11db7
mov eax, edx
pop ebp
ret

Function at 0x10164e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
sub esp, 0x10
test edx, edx
je 0x10164f89
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor eax, eax
push edi
mov ecx, esi
xor edi, edi
and ecx, 7
je 0x10164e9b
mov ebx, dword [ebp + 8]
mov edx, esi
shr edx, 3
mov eax, ecx
mov cl, 8
sub cl, al
mov dl, byte [edx + ebx]
shr dl, cl
movzx edi, dl
mov edx, dword [ebp + 0x14]
shr esi, 3
lea ecx, [edx + 7]
shr ecx, 3
mov dword [ebp + 0xc], esi
xor esi, esi
mov dword [ebp - 0x10], ecx
test ecx, ecx
jle 0x10164f86
lea ebx, [ecx - 1]
mov dword [ebp - 8], ebx
lea ecx, [esi + 8]
lea ecx, [ecx]
cmp esi, ebx
je 0x10164ed9
mov ecx, dword [ebp + 0x10]
shl edi, 8
movzx ecx, byte [esi + ecx]
xor cx, di
add eax, 8
movzx edi, cx
jmp 0x10164f00
mov ebx, edx
mov edx, dword [ebp + 0x10]
and ebx, 7
cmove ebx, ecx
mov cl, 8
mov dl, byte [esi + edx]
sub cl, bl
shr dl, cl
mov ecx, ebx
shl di, cl
movzx edx, dl
or dx, di
add eax, ebx
mov ebx, dword [ebp - 8]
movzx edi, dx
xor edx, edx
cmp esi, ebx
setne dl
mov dword [ebp - 0xc], edx
lea ebx, [ebx]
xor ecx, ecx
cmp eax, 8
setge cl
test edx, ecx
jne 0x10164f2e
xor edx, edx
cmp esi, ebx
sete dl
xor ecx, ecx
test eax, eax
setg cl
test ecx, edx
je 0x10164f74
cmp eax, 8
mov ecx, 8
mov edx, eax
mov ebx, edi
cmovg edx, ecx
mov cl, al
sub cl, dl
mov dword [ebp - 4], edx
shr bx, cl
mov ecx, 8
sub ecx, edx
mov edx, 0xff00
shl bl, cl
mov ecx, dword [ebp - 4]
sar edx, cl
mov ecx, dword [ebp + 8]
and bl, dl
mov edx, dword [ebp + 0xc]
mov byte [edx + ecx], bl
inc edx
sub eax, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov edx, dword [ebp - 0xc]
jmp 0x10164f10
mov edx, dword [ebp + 0x14]
inc esi
mov ecx, 8
cmp esi, dword [ebp - 0x10]
jl 0x10164ec0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10165450
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x103dab10], 1
jne 0x1016560a
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 4], ecx
test edx, edx
jle 0x1016560a
push ebx
push esi
cmp edx, 4
jb 0x10165576
mov eax, edx
and eax, 0x80000003
jns 0x1016548a
dec eax
or eax, 0xfffffffc
inc eax
mov ebx, dword [ebp + 8]
mov esi, edx
movdqa xmm6, xmmword [0x10200ba0]
sub esi, eax
movdqa xmm7, xmmword [0x10200bd0]
mov eax, 0x20
movd xmm3, eax
mov eax, 0x10
movd xmm4, eax
mov eax, 8
movd xmm5, eax
mov eax, ebx
mov edi, edi
movdqu xmm0, xmmword [eax]
add ecx, 4
lea eax, [eax + 0x20]
movdqa xmm1, xmm0
psllq xmm0, xmm3
psrlq xmm1, xmm3
por xmm1, xmm0
movdqa xmm2, xmm1
pand xmm2, xmm7
psllq xmm2, xmm4
psrlq xmm1, xmm4
pand xmm1, xmm6
por xmm2, xmm1
movdqa xmm0, xmm2
pand xmm0, xmmword [0x10200bc0]
psrlq xmm2, xmm5
psllq xmm0, xmm5
pand xmm2, xmmword [0x10200bb0]
por xmm0, xmm2
movdqu xmmword [eax - 0x20], xmm0
movdqu xmm0, xmmword [eax - 0x10]
movdqa xmm1, xmm0
psllq xmm0, xmm3
psrlq xmm1, xmm3
por xmm1, xmm0
movdqa xmm2, xmm1
pand xmm2, xmm7
psllq xmm2, xmm4
psrlq xmm1, xmm4
pand xmm1, xmm6
por xmm2, xmm1
movdqa xmm0, xmm2
pand xmm0, xmmword [0x10200bc0]
psrlq xmm2, xmm5
psllq xmm0, xmm5
pand xmm2, xmmword [0x10200bb0]
por xmm0, xmm2
movdqu xmmword [eax - 0x10], xmm0
cmp ecx, esi
jl 0x101654c0
mov dword [ebp - 4], ecx
jmp 0x10165579
mov ebx, dword [ebp + 8]
cmp ecx, edx
jge 0x10165608
push edi
mov esi, dword [ebx + ecx*8 + 4]
xor edx, edx
or edx, dword [ebx + ecx*8]
mov edi, esi
mov eax, esi
mov ebx, edx
shrd edi, ebx, 0x10
mov ecx, edx
shld ecx, eax, 0x10
shld edx, esi, 0x10
shr ebx, 0x10
xor ebx, ecx
shl eax, 0x10
xor edi, eax
shl esi, 0x10
and edi, 0xffff
and ebx, 0xffff
xor edi, esi
xor ebx, edx
mov edx, edi
mov esi, ebx
shrd edx, esi, 8
mov eax, edi
mov ecx, ebx
shld ecx, eax, 8
shr esi, 8
xor esi, ecx
shl eax, 8
mov ecx, dword [ebp - 4]
and esi, 0xff00ff
shld ebx, edi, 8
xor edx, eax
xor esi, ebx
shl edi, 8
mov ebx, dword [ebp + 8]
and edx, 0xff00ff
xor edx, edi
mov dword [ebx + ecx*8], edx
mov dword [ebx + ecx*8 + 4], esi
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, dword [ebp + 0xc]
jl 0x10165582
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101754d0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, 4
lea edx, [esi + 2]
sub esi, eax
movzx ecx, byte [esi + eax]
lea eax, [eax + 4]
lea edx, [edx + 4]
movzx ecx, byte [ecx + str.cw]
mov byte [eax - 4], cl
movzx ecx, byte [edx - 5]
movzx ecx, byte [ecx + str.cw]
mov byte [eax - 3], cl
movzx ecx, byte [edx - 4]
movzx ecx, byte [ecx + str.cw]
mov byte [eax - 2], cl
movzx ecx, byte [edx - 3]
movzx ecx, byte [ecx + str.cw]
mov byte [eax - 1], cl
dec edi
jne 0x101754e5
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x10175530
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, 8
lea edx, [esi + 2]
sub esi, eax
movzx ecx, byte [esi + eax]
lea eax, [eax + 4]
lea edx, [edx + 4]
movzx ecx, byte [ecx + str.cw]
mov byte [eax - 4], cl
movzx ecx, byte [edx - 5]
movzx ecx, byte [ecx + str.cw]
mov byte [eax - 3], cl
movzx ecx, byte [edx - 4]
movzx ecx, byte [ecx + str.cw]
mov byte [eax - 2], cl
movzx ecx, byte [edx - 3]
movzx ecx, byte [ecx + str.cw]
mov byte [eax - 1], cl
dec edi
jne 0x10175545
pop edi
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10175850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc24
mov eax, dword [0x103c4120]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
test edx, edx
je 0x10175a22
push esi
xor esi, esi
mov ecx, dword [edx + 4]
movzx eax, byte [edx + esi + 0x408]
shl ecx, 5
add ecx, edx
xor byte [ecx + esi + 8], al
mov ecx, dword [edx + 4]
movzx eax, byte [edx + esi + 0x409]
shl ecx, 5
add ecx, edx
xor byte [ecx + esi + 9], al
mov ecx, dword [edx + 4]
movzx eax, byte [edx + esi + 0x40a]
shl ecx, 5
add ecx, edx
xor byte [ecx + esi + 0xa], al
mov ecx, dword [edx + 4]
movzx eax, byte [edx + esi + 0x40b]
shl ecx, 5
add ecx, edx
xor byte [ecx + esi + 0xb], al
add esi, 4
cmp esi, 0x20
jl 0x10175871
mov eax, dword [edx + 4]
inc eax
and eax, 0x8000001f
jns 0x101758d9
dec eax
or eax, 0xffffffe0
inc eax
mov dword [edx + 4], eax
jne 0x10175a11
lea eax, [edx + 8]
push 0x400
push eax
mov dword [ebp - 0xc14], eax
lea eax, [ebp - 0xc04]
push eax
call fcn.101c6b90
mov ecx, dword [ebp + 0xc]
add esp, 0xc
cmp ecx, 1
jl 0x101759f2
lea eax, [ebp - 0x804]
mov dword [ebp - 0xc0c], ecx
push ebx
mov dword [ebp - 0xc08], eax
push edi
lea ecx, [eax - 0x400]
mov dword [ebp - 0xc20], 0x20
mov dword [ebp - 0xc24], ecx
mov edi, eax
jmp 0x10175940
lea edx, [edi - 0x400]
mov dword [ebp - 0xc18], ecx
mov dword [ebp - 0xc10], edx
mov dword [ebp - 0xc1c], 0x20
lea esp, [esp]
xor eax, eax
mov byte [edi], 0
xor bl, bl
mov esi, ecx
lea esp, [esp]
movzx edx, byte [edx + eax]
lea esi, [esi + 0x20]
movzx ecx, byte [esi - 0x20]
inc eax
shl edx, 8
add bl, byte [edx + ecx + 0x102086e0]
mov edx, dword [ebp - 0xc10]
mov byte [edi], bl
cmp eax, 0x20
jl 0x10175970
mov ecx, dword [ebp - 0xc18]
inc edi
inc ecx
dec dword [ebp - 0xc1c]
mov dword [ebp - 0xc18], ecx
jne 0x10175960
dec dword [ebp - 0xc20]
mov ecx, dword [ebp - 0xc24]
jne 0x10175940
cmp dword [0x103daf68], 0
je 0x101759d9
push 0x400
push dword [ebp - 0xc08]
push dword [ebp - 0xc14]
call fcn.101c6b90
add esp, 0xc
dec dword [ebp - 0xc0c]
mov eax, edi
mov dword [ebp - 0xc08], eax
jne 0x10175920
mov ecx, dword [ebp + 0xc]
pop edi
pop ebx
shl ecx, 0xa
lea eax, [ebp - 0xc04]
add eax, ecx
push 0x400
push eax
push dword [ebp - 0xc14]
call fcn.101c6b90
add esp, 0xc
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x65
xor ecx, ebp
call fcn.101c6a5b
mov esp, ebp
pop ebp
ret
Function at 0x10176240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov ecx, ebx
push esi
mov esi, dword [ebp + 0xc]
or ecx, esi
or ecx, eax
push edi
mov edi, dword [ebp + 0x14]
or ecx, edi
test ecx, 7
jne 0x10176315
add esi, ebx
lea ecx, [eax + edi]
mov ebx, ecx
xor edx, edx
sub ebx, eax
xor edi, edi
add ebx, 7
shr ebx, 3
cmp eax, ecx
cmova ebx, edx
test ebx, ebx
je 0x10176330
cmp ebx, 4
jb 0x101762f1
cmp dword [0x103db484], 2
jl 0x101762f1
lea ecx, [eax - 8]
lea ecx, [ecx + ebx*8]
lea edx, [esi - 8]
lea edx, [edx + ebx*8]
cmp esi, ecx
ja 0x101762a8
cmp edx, eax
jae 0x101762f1
mov ecx, ebx
mov edx, ebx
and ecx, 3
sub edx, ecx
jmp 0x101762c0
movdqu xmm0, xmmword [eax]
add edi, 4
pshufb xmm0, xmmword [0x101f95d0]
movdqu xmmword [esi], xmm0
movdqu xmm0, xmmword [eax + 0x10]
add eax, 0x20
pshufb xmm0, xmmword [0x101f95d0]
movdqu xmmword [esi + 0x10], xmm0
add esi, 0x20
cmp edi, edx
jb 0x101762c0
cmp edi, ebx
jae 0x10176330
sub esi, eax
mov edx, dword [eax]
lea eax, [eax + 8]
mov ecx, dword [eax - 4]
inc edi
bswap edx
mov dword [esi + eax - 4], edx
bswap ecx
mov dword [esi + eax - 8], ecx
cmp edi, ebx
jb 0x101762f7
pop edi
pop esi
pop ebx
pop ebp
ret
add edi, esi
cmp esi, edi
jae 0x10176330
sub eax, esi
lea ecx, [ecx]
mov cl, byte [eax + esi]
mov edx, esi
xor edx, 7
inc esi
mov byte [edx + ebx], cl
cmp esi, edi
jb 0x10176320
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1019b8d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
mov ecx, 0x811c9dc5
push esi
push edi
xor edi, edi
xor esi, esi
test ebx, ebx
je 0x1019b909
mov eax, dword [ebp + 8]
push 0
push 0x1000193
movzx eax, byte [esi + eax]
cdq
xor edx, edi
xor eax, ecx
push edx
push eax
call fcn.101c8330
inc esi
mov ecx, eax
mov edi, edx
cmp esi, ebx
jb 0x1019b8e6
mov edx, edi
mov eax, ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1019e5f0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x1019e601
mov eax, 0x10
pop ebp
ret
mov dword [eax + 0x48], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0xf3bcc908
mov dword [eax + 0xc], 0x6a09e667
mov dword [eax + 0x10], 0x84caa73b
mov dword [eax + 0x14], 0xbb67ae85
mov dword [eax + 0x18], 0xfe94f82b
mov dword [eax + 0x1c], 0x3c6ef372
mov dword [eax + 0x20], 0x5f1d36f1
mov dword [eax + 0x24], 0xa54ff53a
mov dword [eax + 0x28], 0xade682d1
mov dword [eax + 0x2c], 0x510e527f
mov dword [eax + 0x30], 0x2b3e6c1f
mov dword [eax + 0x34], 0x9b05688c
mov dword [eax + 0x38], 0xfb41bd6b
mov dword [eax + 0x3c], 0x1f83d9ab
mov dword [eax + 0x40], 0x137e2179
mov dword [eax + 0x44], 0x5be0cd19
xor eax, eax
pop ebp
ret
Function at 0x1019fe60
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x1019fe71
mov eax, 0x10
pop ebp
ret
mov dword [eax + 0x48], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0xc1059ed8
mov dword [eax + 0xc], 0xcbbb9d5d
mov dword [eax + 0x10], 0x367cd507
mov dword [eax + 0x14], 0x629a292a
mov dword [eax + 0x18], 0x3070dd17
mov dword [eax + 0x1c], 0x9159015a
mov dword [eax + 0x20], 0xf70e5939
mov dword [eax + 0x24], 0x152fecd8
mov dword [eax + 0x28], 0xffc00b31
mov dword [eax + 0x2c], 0x67332667
mov dword [eax + 0x30], 0x68581511
mov dword [eax + 0x34], 0x8eb44a87
mov dword [eax + 0x38], 0x64f98fa7
mov dword [eax + 0x3c], 0xdb0c2e0d
mov dword [eax + 0x40], 0xbefa4fa4
mov dword [eax + 0x44], 0x47b5481d
xor eax, eax
pop ebp
ret

Function at 0x101a0040
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x101a0051
mov eax, 0x10
pop ebp
ret
mov dword [eax + 0x28], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret
Function at 0x101a0170
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x101a0181
lea eax, [esi + 0x10]
pop esi
pop ebp
ret
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x101a0191
mov ecx, dword [esi + 0x28]
cmp ecx, 0x40
jb 0x101a019a
pop edi
mov eax, 0x10
pop esi
pop ebp
ret
lea eax, [ecx*8]
add dword [esi], eax
adc dword [esi + 4], 0
mov byte [ecx + esi + 0x2c], 0x80
inc dword [esi + 0x28]
mov eax, dword [esi + 0x28]
cmp eax, 0x38
jbe 0x101a01e4
cmp eax, 0x40
jae 0x101a01d0
lea esp, [esp]
mov byte [esi + eax + 0x2c], 0
inc dword [esi + 0x28]
mov eax, dword [esi + 0x28]
cmp eax, 0x40
jb 0x101a01c0
lea eax, [esi + 0x2c]
push eax
push esi
call fcn.101a03f0
add esp, 8
mov dword [esi + 0x28], 0
cmp dword [esi + 0x28], 0x38
jae 0x101a0201
lea ebx, [ebx]
mov eax, dword [esi + 0x28]
mov byte [eax + esi + 0x2c], 0
inc dword [esi + 0x28]
cmp dword [esi + 0x28], 0x38
jb 0x101a01f0
movzx eax, byte [esi + 7]
mov byte [esi + 0x64], al
movzx eax, byte [esi + 6]
mov byte [esi + 0x65], al
movzx eax, byte [esi + 5]
mov byte [esi + 0x66], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x67], al
movzx eax, byte [esi + 3]
mov byte [esi + 0x68], al
movzx eax, byte [esi + 2]
mov byte [esi + 0x69], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x6a], al
movzx eax, byte [esi]
mov byte [esi + 0x6b], al
lea eax, [esi + 0x2c]
push eax
push esi
call fcn.101a03f0
movzx eax, byte [esi + 0xb]
add esp, 8
mov byte [edi], al
movzx eax, byte [esi + 0xa]
mov byte [edi + 1], al
movzx eax, byte [esi + 9]
mov byte [edi + 2], al
movzx eax, byte [esi + 8]
mov byte [edi + 3], al
movzx eax, byte [esi + 0xf]
mov byte [edi + 4], al
movzx eax, byte [esi + 0xe]
mov byte [edi + 5], al
movzx eax, byte [esi + 0xd]
mov byte [edi + 6], al
movzx eax, byte [esi + 0xc]
mov byte [edi + 7], al
movzx eax, byte [esi + 0x13]
mov byte [edi + 8], al
movzx eax, byte [esi + 0x12]
mov byte [edi + 9], al
movzx eax, byte [esi + 0x11]
mov byte [edi + 0xa], al
movzx eax, byte [esi + 0x10]
mov byte [edi + 0xb], al
movzx eax, byte [esi + 0x17]
mov byte [edi + 0xc], al
movzx eax, byte [esi + 0x16]
mov byte [edi + 0xd], al
movzx eax, byte [esi + 0x15]
mov byte [edi + 0xe], al
movzx eax, byte [esi + 0x14]
mov byte [edi + 0xf], al
movzx eax, byte [esi + 0x1b]
mov byte [edi + 0x10], al
movzx eax, byte [esi + 0x1a]
mov byte [edi + 0x11], al
movzx eax, byte [esi + 0x19]
mov byte [edi + 0x12], al
movzx eax, byte [esi + 0x18]
mov byte [edi + 0x13], al
movzx eax, byte [esi + 0x1f]
mov byte [edi + 0x14], al
movzx eax, byte [esi + 0x1e]
mov byte [edi + 0x15], al
movzx eax, byte [esi + 0x1d]
mov byte [edi + 0x16], al
movzx eax, byte [esi + 0x1c]
mov byte [edi + 0x17], al
movzx eax, byte [esi + 0x23]
mov byte [edi + 0x18], al
movzx eax, byte [esi + 0x22]
mov byte [edi + 0x19], al
movzx eax, byte [esi + 0x21]
mov byte [edi + 0x1a], al
movzx eax, byte [esi + 0x20]
mov byte [edi + 0x1b], al
movzx eax, byte [esi + 0x27]
mov byte [edi + 0x1c], al
movzx eax, byte [esi + 0x26]
mov byte [edi + 0x1d], al
movzx eax, byte [esi + 0x25]
mov byte [edi + 0x1e], al
movzx eax, byte [esi + 0x24]
mov byte [edi + 0x1f], al
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x101a2700
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0x101a2711
mov eax, 0x10
pop ebp
ret
mov dword [eax + 0x28], 0
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0xc1059ed8
mov dword [eax + 0xc], 0x367cd507
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0xf70e5939
mov dword [eax + 0x18], 0xffc00b31
mov dword [eax + 0x1c], 0x68581511
mov dword [eax + 0x20], 0x64f98fa7
mov dword [eax + 0x24], 0xbefa4fa4
xor eax, eax
pop ebp
ret

Function at 0x101a29b0
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x101a29c1
lea eax, [esi + 0x10]
pop esi
pop ebp
ret
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x101a29d1
mov ecx, dword [esi + 0x1c]
cmp ecx, 0x40
jb 0x101a29da
pop edi
mov eax, 0x10
pop esi
pop ebp
ret
lea eax, [ecx*8]
add dword [esi], eax
adc dword [esi + 4], 0
mov byte [ecx + esi + 0x20], 0x80
inc dword [esi + 0x1c]
mov eax, dword [esi + 0x1c]
cmp eax, 0x38
jbe 0x101a2a24
cmp eax, 0x40
jae 0x101a2a10
lea esp, [esp]
mov byte [esi + eax + 0x20], 0
inc dword [esi + 0x1c]
mov eax, dword [esi + 0x1c]
cmp eax, 0x40
jb 0x101a2a00
lea eax, [esi + 0x20]
push eax
push esi
call fcn.101a2be0
add esp, 8
mov dword [esi + 0x1c], 0
cmp dword [esi + 0x1c], 0x38
jae 0x101a2a41
lea ebx, [ebx]
mov eax, dword [esi + 0x1c]
mov byte [eax + esi + 0x20], 0
inc dword [esi + 0x1c]
cmp dword [esi + 0x1c], 0x38
jb 0x101a2a30
movzx eax, byte [esi + 7]
mov byte [esi + 0x58], al
movzx eax, byte [esi + 6]
mov byte [esi + 0x59], al
movzx eax, byte [esi + 5]
mov byte [esi + 0x5a], al
movzx eax, byte [esi + 4]
mov byte [esi + 0x5b], al
movzx eax, byte [esi + 3]
mov byte [esi + 0x5c], al
movzx eax, byte [esi + 2]
mov byte [esi + 0x5d], al
movzx eax, byte [esi + 1]
mov byte [esi + 0x5e], al
movzx eax, byte [esi]
mov byte [esi + 0x5f], al
lea eax, [esi + 0x20]
push eax
push esi
call fcn.101a2be0
movzx eax, byte [esi + 0xb]
add esp, 8
mov byte [edi], al
movzx eax, byte [esi + 0xa]
mov byte [edi + 1], al
movzx eax, byte [esi + 9]
mov byte [edi + 2], al
movzx eax, byte [esi + 8]
mov byte [edi + 3], al
movzx eax, byte [esi + 0xf]
mov byte [edi + 4], al
movzx eax, byte [esi + 0xe]
mov byte [edi + 5], al
movzx eax, byte [esi + 0xd]
mov byte [edi + 6], al
movzx eax, byte [esi + 0xc]
mov byte [edi + 7], al
movzx eax, byte [esi + 0x13]
mov byte [edi + 8], al
movzx eax, byte [esi + 0x12]
mov byte [edi + 9], al
movzx eax, byte [esi + 0x11]
mov byte [edi + 0xa], al
movzx eax, byte [esi + 0x10]
mov byte [edi + 0xb], al
movzx eax, byte [esi + 0x17]
mov byte [edi + 0xc], al
movzx eax, byte [esi + 0x16]
mov byte [edi + 0xd], al
movzx eax, byte [esi + 0x15]
mov byte [edi + 0xe], al
movzx eax, byte [esi + 0x14]
mov byte [edi + 0xf], al
movzx eax, byte [esi + 0x1b]
mov byte [edi + 0x10], al
movzx eax, byte [esi + 0x1a]
mov byte [edi + 0x11], al
movzx eax, byte [esi + 0x19]
mov byte [edi + 0x12], al
movzx eax, byte [esi + 0x18]
mov byte [edi + 0x13], al
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x101a4ca0
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0x7c
push 0
push esi
call fcn.101c6a70
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
xor eax, eax
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
pop esi
pop ebp
ret
Function at 0x101ab610
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push 0xf0
push 0
push esi
call fcn.101c6a70
add esp, 0xc
mov dword [esi], 0xf3bcc908
mov dword [esi + 4], 0x6a09e667
mov dword [esi + 8], 0x84caa73b
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0xfe94f82b
mov dword [esi + 0x14], 0x3c6ef372
mov dword [esi + 0x18], 0x5f1d36f1
mov dword [esi + 0x1c], 0xa54ff53a
mov dword [esi + 0x20], 0xade682d1
mov dword [esi + 0x24], 0x510e527f
mov dword [esi + 0x28], 0x2b3e6c1f
mov dword [esi + 0x2c], 0x9b05688c
mov dword [esi + 0x30], 0xfb41bd6b
mov dword [esi + 0x34], 0x1f83d9ab
mov dword [esi + 0x38], 0x137e2179
mov dword [esi + 0x3c], 0x5be0cd19
pop esi
pop ebp
ret