joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1006e3f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x10144d38], eax
je 0x1006e414
mov eax, 0x10dd
jmp 0x1006e5bc
cmp dword [0x10144d3c], 0
je 0x1006e427
mov eax, dword [0x10144d3c]
jmp 0x1006e5bc
cmp dword [ebp + 0xc], 0
jne 0x1006e437
mov eax, 0x57
jmp 0x1006e5bc
cmp dword [ebp + 8], 0
jne 0x1006e447
mov eax, 6
jmp 0x1006e5bc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x1006e470
mov dword [ebp - 8], 6
mov ecx, dword [ebp - 8]
mov dword [0x10144d3c], ecx
mov edx, dword [ebp + 8]
mov dword [0x10144d40], edx
mov eax, dword [ebp - 8]
jmp 0x1006e5bc
push 0x18
call fcn.1006fad0
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1006e4cb
mov dword [ebp - 8], 8
mov ecx, dword [ebp - 8]
mov dword [0x10144d3c], ecx
cmp dword [ebp - 4], 0
je 0x1006e4ba
mov edx, dword [ebp - 4]
mov dword [ebp - 0x20], edx
push 0x18
mov eax, dword [ebp - 0x20]
push eax
call fcn.10070690
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
mov dword [0x10144d40], ecx
mov eax, dword [ebp - 8]
jmp 0x1006e5bc
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.1006e3d0
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.1006e3d0
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 0xc]
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0xc], 0
je 0x1006e50b
cmp dword [ebp - 0xc], 0x1e
jbe 0x1006e527
mov dword [ebp - 8], 9
cmp dword [0x10144d30], 0
je 0x1006e522
jmp 0x1006e499
jmp 0x1006e490
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x1006e54e
mov dword [ebp - 8], 9
cmp dword [0x10144d30], 0
je 0x1006e549
jmp 0x1006e499
jmp 0x1006e490
mov dword [ebp - 0x18], 0
lea edx, [ebp - 0x18]
push edx
push 0x40
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x1006e579
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1006e490
mov edx, dword [ebp - 4]
mov dword [edx + 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x10144d48]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x10144d48], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x1006e5d0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x10144d38], eax
je 0x1006e5ed
mov eax, 0x10dd
jmp 0x1006e6d0
mov eax, dword [0x10144d48]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1006e66c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call sub.KERNEL32.dll_VirtualProtect
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1006e648
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1006e648
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.1006d470
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
push 0x18
mov edx, dword [ebp - 0xc]
push edx
call fcn.10070690
add esp, 8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x1006e5f5
mov dword [0x10144d48], 0
call fcn.1006dd50
mov ecx, dword [0x10144d44]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x1006e6ba
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call sub.KERNEL32.dll_ResumeThread
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push 8
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.10070690
add esp, 8
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x1006e684
mov dword [0x10144d44], 0
mov dword [0x10144d38], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1006ebb0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10144d3c], 0
je 0x1006ebc9
mov eax, dword [0x10144d3c]
jmp 0x1006ec68
call sub.KERNEL32.dll_GetCurrentThread
cmp dword [ebp + 8], eax
jne 0x1006ebda
xor eax, eax
jmp 0x1006ec68
push 8
call fcn.1006fad0
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1006ec32
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1006ec1b
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
push 8
mov edx, dword [ebp - 0x10]
push edx
call fcn.10070690
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x10144d3c], eax
mov dword [0x10144d40], 0
mov eax, dword [ebp - 8]
jmp 0x1006ec68
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x1006ec4a
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 8], eax
jmp 0x1006ebfa
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10144d44]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10144d44], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x100986d0
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
call fcn.1009e500
mov byte [ebp - 1], al
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1009870e
cmp dword [ebp + 8], 0
je 0x100986fc
lea eax, [ebp + 8]
push eax
call fcn.100988d0
add esp, 4
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x1009870e
mov eax, 4
jmp 0x1009883e
call fcn.1009e300
movzx edx, al
test edx, edx
jne 0x1009873c
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1009872d
mov dword [ebp - 0xc], 4
jmp 0x10098734
mov dword [ebp - 0xc], 3
mov eax, dword [ebp - 0xc]
jmp 0x1009883e
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100987e5
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x30], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
push 0
push 0
lea ecx, [ebp - 0x34]
push ecx
push 0x10098880
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
lea ecx, [ebp - 8]
call fcn.1009b390
lea ecx, [ebp - 8]
call fcn.10098910
movzx edx, al
test edx, edx
jne 0x100987a7
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 8]
call fcn.100988f0
mov eax, dword [ebp - 0x10]
jmp 0x1009883e
push 0
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.100885c0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
test eax, eax
je 0x100987d2
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 8]
call fcn.100988f0
mov eax, dword [ebp - 0x14]
jmp 0x1009883e
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 8]
call fcn.100988f0
mov eax, dword [ebp - 0x18]
jmp 0x1009883e
call fcn.1009e450
movzx ecx, al
test ecx, ecx
jne 0x1009881e
mov edx, dword [ebp + 0x10]
or edx, 0x200000
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp + 8]
push edx
lea eax, [ebp - 0x20]
push eax
call fcn.10098850
add esp, 0x10
jmp 0x1009883e
call fcn.1009e360
mov dword [ebp - 0x24], eax
lea ecx, [ebp + 0x10]
push ecx
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
push ecx
call fcn.10098850
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x100a1400
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100a1427
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.10089a10
add esp, 4
or eax, 0xffffffff
jmp 0x100a1429
xor eax, eax
pop ebp
ret
Function at 0x100a88db
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp 0x100b6880
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff0
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x101450c0], 1
jge 0x100b68ef
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
je 0x100b68c5
mov edx, dword [ebx + 8]
movzx eax, word [edx]
movzx ecx, word [ebx + 0xc]
cmp eax, ecx
je 0x100b68c5
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x100b68a2
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x100b68db
mov eax, dword [ebx + 8]
mov dword [ebp - 4], eax
jmp 0x100b68e2
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
jmp 0x100b69df
movzx ecx, word [ebx + 0xc]
movd xmm0, ecx
movaps xmmword [ebp - 0x30], xmm0
pshuflw xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
pshufd xmm0, xmmword [ebp - 0x30], 0
movaps xmmword [ebp - 0x30], xmm0
mov edx, dword [ebx + 8]
and edx, 0xfff
cmp edx, 0xff0
ja 0x100b69b0
mov eax, dword [ebx + 8]
movups xmm0, xmmword [eax]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pxor xmm0, xmmword [ebp - 0x20]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pcmpeqw xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x40]
pcmpeqw xmm0, xmmword [ebp - 0x30]
movaps xmmword [ebp - 0x40], xmm0
movaps xmm0, xmmword [ebp - 0x20]
por xmm0, xmmword [ebp - 0x40]
movaps xmmword [ebp - 0x20], xmm0
movaps xmm0, xmmword [ebp - 0x20]
pmovmskb ecx, xmm0
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x100b69a5
bsf edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, dword [ebx + 8]
mov dword [ebx + 8], eax
mov ecx, dword [ebx + 8]
movzx edx, word [ecx]
movzx eax, word [ebx + 0xc]
cmp edx, eax
jne 0x100b6999
mov ecx, dword [ebx + 8]
mov dword [ebp - 0xc], ecx
jmp 0x100b69a0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
jmp 0x100b69df
mov edx, dword [ebx + 8]
add edx, 0x10
mov dword [ebx + 8], edx
jmp 0x100b69da
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
movzx edx, word [ebx + 0xc]
cmp ecx, edx
jne 0x100b69c3
mov eax, dword [ebx + 8]
jmp 0x100b69df
mov eax, dword [ebx + 8]
movzx ecx, word [eax]
test ecx, ecx
jne 0x100b69d1
xor eax, eax
jmp 0x100b69df
mov edx, dword [ebx + 8]
add edx, 2
mov dword [ebx + 8], edx
jmp 0x100b690f
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret

Function at 0x100a88e6
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100a8477

Function at 0x100ba7f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x100baed0
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x100baf0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.100bb000
add esp, 4
push eax
lea ecx, [ebp - 0x10]
call fcn.100bb810
push 0x1013d26c
lea edx, [ebp - 0x10]
push edx
call fcn.10073b30
mov esp, ebp
pop ebp
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x754d5246
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, str.4e_
nop
mov ebx, 0x42f314
nop
mov ecx, 0x1bf51c34
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x1000c414
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x34], 0
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x14], esi
mov ebx, edx
je 0x1000c5de
test ebx, ebx
je 0x1000c5de
lea eax, [esi + 0x8c]
test eax, eax
je 0x1000c5de
lea edi, [esi + 0x34]
test edi, edi
je 0x1000c5de
lea ecx, [esi + 0x88]
test ecx, ecx
je 0x1000c5de
mov edx, dword [edi]
mov ecx, dword [edi + 4]
mov eax, dword [eax]
mov dword [esp + 0x18], edx
mov edx, dword [edi + 8]
mov dword [esp + 0x1c], ecx
mov ecx, dword [edi + 0xc]
push ebp
push edi
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ecx
call fcn.10008fd0
mov eax, dword [esp + 0x4c]
add eax, 7
cdq
and edx, 7
add eax, edx
mov ebp, eax
add esp, 4
sar ebp, 3
cmp dword [esi + 0x20], 0
je 0x1000c4ba
xor edx, edx
test ebp, ebp
jle 0x1000c4f4
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0x2c]
sub eax, ecx
sub ebx, ecx
mov cl, byte [edi + edx]
lea esi, [esp + edx + 0x2c]
xor cl, byte [eax + esi]
inc edx
cmp edx, ebp
mov byte [esi], cl
mov byte [ebx + esi], cl
jl 0x1000c4a4
jmp 0x1000c4f0
xor ecx, ecx
test ebp, ebp
jle 0x1000c4f4
mov edx, dword [esp + 0x44]
lea eax, [esp + 0x2c]
sub edx, eax
mov eax, ebx
lea esi, [esp + 0x2c]
sub eax, esi
mov dword [esp + 0x14], eax
mov bl, byte [edi + ecx]
lea esi, [esp + ecx + 0x2c]
mov al, byte [edx + esi]
xor bl, al
mov byte [esi], al
mov eax, dword [esp + 0x14]
inc ecx
cmp ecx, ebp
mov byte [eax + esi], bl
jl 0x1000c4d6
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x48]
and ebx, 0x80000007
jns 0x1000c505
dec ebx
or ebx, 0xfffffff8
inc ebx
mov eax, dword [esp + 0x48]
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x1000c54c
mov ecx, dword [esp + eax + 0x1c]
mov edx, dword [esp + eax + 0x20]
lea eax, [esp + eax + 0x1c]
mov dword [edi], ecx
mov ecx, dword [eax + 8]
mov dword [edi + 4], edx
mov edx, dword [eax + 0xc]
pop ebp
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10087a66
add esp, 0x30
ret
mov cl, 8
sub cl, bl
lea edi, [esi + 0x35]
mov byte [esp + 0x11], cl
lea esi, [esp + eax + 0x1d]
mov ebp, 4
movzx edx, byte [esi - 1]
mov al, byte [esi]
mov ecx, ebx
shl dl, cl
movzx ecx, byte [esp + 0x11]
mov bl, al
shr bl, cl
add esi, 4
add edi, 4
or dl, bl
mov ebx, dword [esp + 0x14]
mov byte [edi - 5], dl
mov dl, byte [esi - 3]
mov ecx, ebx
shl al, cl
movzx ecx, byte [esp + 0x11]
shr dl, cl
movzx ecx, byte [esp + 0x11]
or al, dl
mov byte [edi - 4], al
mov al, byte [esi - 2]
mov dl, al
mov al, byte [esi - 3]
shr dl, cl
mov ecx, ebx
shl al, cl
movzx ecx, byte [esp + 0x11]
or dl, al
mov al, byte [esi - 2]
mov byte [edi - 3], dl
movzx edx, byte [esi - 1]
shr dl, cl
mov ecx, ebx
shl al, cl
or dl, al
sub ebp, 1
mov byte [edi - 2], dl
jne 0x1000c560
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.10087a66
add esp, 0x30
ret
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 0x205002b
call fcn.10087a66
add esp, 0x30
ret
Function at 0x1001afd0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x88
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
mov ebp, dword [esp + 0x98]
push esi
push edi
push 0x80
lea eax, [esp + 0x18]
push 0
push eax
mov ebx, ecx
mov esi, edx
call fcn.1008e320
lea edi, [ebx + 7]
shr edi, 3
lea ecx, [edi*8]
mov edx, ecx
mov ecx, ebx
sub ecx, edx
mov dword [esi + 0x80], ebx
add ecx, 8
mov ebx, 1
shl ebx, cl
mov eax, 0xff
cdq
idiv ebx
add esp, 0xc
mov dword [esi + 0x84], edi
mov ebx, edx
mov dword [esi + 0x88], ebx
test ebp, ebp
jle 0x1001b05a
mov eax, dword [esp + 0x9c]
push ebp
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.1008d020
add esp, 0xc
cmp ebp, 0x80
mov eax, ebp
jge 0x1001b09d
xor ecx, ecx
test eax, eax
jle 0x1001b094
test ecx, ecx
jl 0x1001b094
movzx edx, byte [esp + eax + 0x13]
movzx ebp, byte [esp + ecx + 0x14]
add edx, ebp
and edx, 0x800000ff
jns 0x1001b08a
dec edx
or edx, 0xffffff00
inc edx
mov dl, byte [edx + 0x100d0128]
mov byte [esp + eax + 0x14], dl
inc eax
inc ecx
cmp eax, 0x80
jl 0x1001b066
lea eax, [esp + 0x94]
sub eax, edi
movzx ecx, byte [eax]
and ecx, ebx
mov dl, byte [ecx + 0x100d0128]
mov byte [eax], dl
mov eax, 0x7f
sub eax, edi
js 0x1001b0dd
lea ecx, [edi + eax]
lea ecx, [esp + ecx + 0x14]
movzx edi, byte [ecx]
movzx edx, byte [esp + eax + 0x15]
xor edx, edi
mov dl, byte [edx + 0x100d0128]
mov byte [esp + eax + 0x14], dl
dec eax
dec ecx
test eax, eax
jge 0x1001b0c3
lea edx, [esp + 0x15]
lea edi, [esp + 0x14]
lea ebx, [esp + 0x17]
lea ebp, [esp + 0x16]
xor ecx, ecx
sub edx, esi
sub edi, esi
sub ebx, esi
sub ebp, esi
lea eax, [esi + 4]
mov dword [esp + 0x10], ebp
mov edi, edi
movzx esi, byte [esp + ecx*2 + 0x15]
mov ebp, 0x100
imul si, bp
movzx bp, byte [esp + ecx*2 + 0x14]
add si, bp
mov word [eax - 4], si
movzx esi, byte [esp + ecx*2 + 0x17]
mov ebp, 0x100
imul si, bp
movzx bp, byte [esp + ecx*2 + 0x16]
add si, bp
mov word [eax - 2], si
movzx esi, byte [edx + eax]
mov ebp, 0x100
imul si, bp
movzx bp, byte [edi + eax]
add si, bp
mov word [eax], si
movzx esi, byte [ebx + eax]
mov ebp, 0x100
imul si, bp
mov ebp, dword [esp + 0x10]
movzx bp, byte [eax + ebp]
add si, bp
mov word [eax + 2], si
add ecx, 4
add eax, 8
cmp ecx, 0x40
jl 0x1001b100
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10087a66
add esp, 0x88
ret
Function at 0x10022a70
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x10022a80
mov eax, 0xe010049
pop esi
ret
call sym.inicrypto_v5.4.1.dll_ISC_Crypto_Initialize
test eax, eax
jne 0x10022ab1
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
pop esi
ret
Function at 0x1002fcc0
Capabilities:
Hash data using sha1

Disassembly:
call sym.inicrypto_v5.4.1.dll_ISC_Crypto_Initialize
test eax, eax
jne 0x1002fd37
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x1002fcd9
mov eax, 0x1b010049
pop esi
ret
push 0x40
lea eax, [esi + 0x20]
push 0
push eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0x67452301
mov dword [esi + 0x10], 0xefcdab89
mov dword [esi + 0x14], 0x98badcfe
mov dword [esi + 0x18], 0x10325476
mov dword [esi + 0x1c], 0xc3d2e1f0
mov byte [esi + 0xa0], 0
call fcn.1008e320
push 0x40
push 0
add esi, 0x60
push esi
call fcn.1008e320
add esp, 0x18
xor eax, eax
pop esi
ret
Function at 0x10030d50
Capabilities:
Hash data using sha224

Disassembly:
call sym.inicrypto_v5.4.1.dll_ISC_Crypto_Initialize
test eax, eax
jne 0x10030de0
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x10030d6d
mov eax, 0x1b050049
pop esi
ret
push 0x40
lea eax, [esi + 0x2c]
push 0
push eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0xc1059ed8
mov dword [esi + 0x10], 0x367cd507
mov dword [esi + 0x14], 0x3070dd17
mov dword [esi + 0x18], 0xf70e5939
mov dword [esi + 0x1c], 0xffc00b31
mov dword [esi + 0x20], 0x68581511
mov dword [esi + 0x24], 0x64f98fa7
mov dword [esi + 0x28], 0xbefa4fa4
mov byte [esi + 0xac], 0
call fcn.1008e320
push 0x40
push 0
add esi, 0x6c
push esi
call fcn.1008e320
add esp, 0x18
xor eax, eax
pop esi
ret

Function at 0x10030ed0
Capabilities:
Hash data using sha256

Disassembly:
call sym.inicrypto_v5.4.1.dll_ISC_Crypto_Initialize
test eax, eax
jne 0x10030f60
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x10030eed
mov eax, 0x1b080049
pop esi
ret
push 0x40
lea eax, [esi + 0x2c]
push 0
push eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0x6a09e667
mov dword [esi + 0x10], 0xbb67ae85
mov dword [esi + 0x14], 0x3c6ef372
mov dword [esi + 0x18], 0xa54ff53a
mov dword [esi + 0x1c], 0x510e527f
mov dword [esi + 0x20], 0x9b05688c
mov dword [esi + 0x24], 0x1f83d9ab
mov dword [esi + 0x28], 0x5be0cd19
mov byte [esi + 0xac], 0
call fcn.1008e320
push 0x40
push 0
add esi, 0x6c
push esi
call fcn.1008e320
add esp, 0x18
xor eax, eax
pop esi
ret
Function at 0x10031760
Capabilities:
Hash data using sha224

Disassembly:
call sym.inicrypto_v5.4.1.dll_ISC_Crypto_Initialize
test eax, eax
jne 0x10031831
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x1003177d
mov eax, 0x1b0c0049
pop esi
ret
push 0x80
lea eax, [esi + 0x50]
push 0
push eax
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 0x10], 0xc1059ed8
mov dword [esi + 0x14], 0xcbbb9d5d
mov dword [esi + 0x18], 0x367cd507
mov dword [esi + 0x1c], 0x629a292a
mov dword [esi + 0x20], 0x3070dd17
mov dword [esi + 0x24], 0x9159015a
mov dword [esi + 0x28], 0xf70e5939
mov dword [esi + 0x2c], 0x152fecd8
mov dword [esi + 0x30], 0xffc00b31
mov dword [esi + 0x34], 0x67332667
mov dword [esi + 0x38], 0x68581511
mov dword [esi + 0x3c], 0x8eb44a87
mov dword [esi + 0x40], 0x64f98fa7
mov dword [esi + 0x44], 0xdb0c2e0d
mov dword [esi + 0x48], 0xbefa4fa4
mov dword [esi + 0x4c], 0x47b5481d
mov byte [esi + 0x150], 0
call fcn.1008e320
push 0x80
push 0
add esi, 0xd0
push esi
call fcn.1008e320
add esp, 0x18
xor eax, eax
pop esi
ret

Function at 0x10031910
Capabilities:
Hash data using sha256

Disassembly:
call sym.inicrypto_v5.4.1.dll_ISC_Crypto_Initialize
test eax, eax
jne 0x100319e1
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x1003192d
mov eax, 0x1b0f0049
pop esi
ret
push 0x80
lea eax, [esi + 0x50]
push 0
push eax
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 0x10], 0xf3bcc908
mov dword [esi + 0x14], 0x6a09e667
mov dword [esi + 0x18], 0x84caa73b
mov dword [esi + 0x1c], 0xbb67ae85
mov dword [esi + 0x20], 0xfe94f82b
mov dword [esi + 0x24], 0x3c6ef372
mov dword [esi + 0x28], 0x5f1d36f1
mov dword [esi + 0x2c], 0xa54ff53a
mov dword [esi + 0x30], 0xade682d1
mov dword [esi + 0x34], 0x510e527f
mov dword [esi + 0x38], 0x2b3e6c1f
mov dword [esi + 0x3c], 0x9b05688c
mov dword [esi + 0x40], 0xfb41bd6b
mov dword [esi + 0x44], 0x1f83d9ab
mov dword [esi + 0x48], 0x137e2179
mov dword [esi + 0x4c], 0x5be0cd19
mov byte [esi + 0x150], 0
call fcn.1008e320
push 0x80
push 0
add esi, 0xd0
push esi
call fcn.1008e320
add esp, 0x18
xor eax, eax
pop esi
ret
Function at 0x10033580
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebx, eax
push edi
mov edi, ecx
mov ecx, dword [esi + 0xc]
mov eax, ecx
cdq
and edx, 7
add eax, edx
sar eax, 3
mov dword [esp + 0xc], eax
mov eax, dword [esi + 8]
add eax, ecx
mov ebp, ebx
cmp eax, 0x640
jne 0x1003365c
mov edx, ecx
and edx, 0x80000007
jns 0x100335bb
dec edx
or edx, 0xfffffff8
inc edx
jne 0x1003365c
cmp ecx, 1
jl 0x1003365c
mov eax, dword [esi]
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp eax, dword [esi + 4]
jne 0x1003365c
test ebx, ebx
jl 0x1003365c
jle 0x10033655
mov ecx, dword [esi + 0x10]
mov edx, dword [esp + 0xc]
test ecx, ecx
je 0x10033620
cmp ecx, edx
jge 0x10033620
lea eax, [ecx + ebp]
cmp eax, edx
jl 0x100335fc
mov eax, edx
cmp ecx, eax
jge 0x10033611
mov ebx, ecx
sub ebx, dword [esi + 0x10]
inc ecx
mov bl, byte [ebx + edi]
xor byte [esi + ecx + 0x13], bl
cmp ecx, eax
jl 0x10033600
mov ecx, dword [esi + 0x10]
mov ebx, eax
sub ebx, ecx
sub ecx, eax
add edi, ebx
add ebp, ecx
jmp 0x10033640
cmp ebp, edx
mov eax, ebp
jl 0x10033628
mov eax, edx
xor ecx, ecx
test eax, eax
jle 0x1003363c
mov edi, edi
mov bl, byte [ecx + edi]
xor byte [esi + ecx + 0x14], bl
inc ecx
cmp ecx, eax
jl 0x10033630
add edi, eax
sub ebp, eax
cmp eax, edx
jne 0x1003364e
lea ecx, [esi + 0x14]
call fcn.10032dc0
xor eax, eax
mov dword [esi + 0x10], eax
test ebp, ebp
jg 0x100335e4
pop edi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
pop edi
pop ebp
mov eax, 0x1b23002b
pop ebx
pop ecx
ret