joyce8/EMBER2024-capa huggingface dataset:
Function at 0xa687826
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x230
mov eax, 0xa73ce93
call fcn.0a707bfc
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x234]
push eax
push 1
xor ebx, ebx
mov dword [ebp - 0x238], esi
push ebx
push 0xa596900
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xa687927
mov edi, 0x208
lea eax, [ebp - 0x218]
push edi
push ebx
push eax
call fcn.0a709cd0
add esp, 0xc
mov dword [ebp - 0x238], edi
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 0xa59692c
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.0a63e685
cmp dword [ebp - 0x21c], 7
lea eax, [ebp - 0x230]
mov ecx, dword [ebp - 0x220]
cmova eax, dword [ebp - 0x230]
push 0x5c
pop edx
mov dword [ebp - 4], ebx
cmp word [eax + ecx*2 - 2], dx
je 0xa68790c
cmp dword [ebp - 0x21c], 7
lea eax, [ebp - 0x230]
cmova eax, dword [ebp - 0x230]
cmp word [eax + ecx*2 - 2], 0x2f
je 0xa68790c
push edx
lea ecx, [ebp - 0x230]
call fcn.0a646503
lea eax, [ebp - 0x230]
mov ecx, esi
push eax
call fcn.0a681b53
lea ecx, [ebp - 0x230]
call fcn.0a63e708
jmp 0xa68793e
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 7
mov word [esi], ax
mov eax, esi
call fcn.0a707bab
ret

Function at 0xa688307
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
mov edx, ecx
push esi
mov esi, dword [ebp + 8]
cmp dword [ebp + 0xc], ecx
jbe 0xa688330
movsx eax, byte [esi + edx]
add eax, ecx
imul ecx, eax, 0x401
mov eax, ecx
shr eax, 6
xor ecx, eax
inc edx
cmp edx, dword [ebp + 0xc]
jb 0xa688317
imul ecx, ecx, 9
pop esi
mov eax, ecx
shr eax, 0xb
xor eax, ecx
imul eax, eax, 0x8001
pop ebp
ret

Function at 0xa68985f
Capabilities:
Accept command line arguments

Disassembly:
push 0x28
mov eax, 0xa738797
call fcn.0a707bfc
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, ebx
mov edi, eax
call fcn.0a689741
test edi, edi
je 0xa6898fc
xor esi, esi
cmp dword [ebp - 0x2c], esi
jle 0xa6898f5
push dword [edi + esi*4]
lea ecx, [ebp - 0x28]
call fcn.0a63e685
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 7
cmova eax, dword [ebp - 0x28]
cmp word [eax], 0x2d
jne 0xa6898e3
cmp dword [ebp - 0x14], 7
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmova ecx, dword [ebp - 0x28]
lea eax, [ecx + eax*2]
mov ecx, ebx
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
add eax, 2
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0a68962c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0a63e708
inc esi
cmp esi, dword [ebp - 0x2c]
jl 0xa689893
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.0a707bab
ret
Function at 0xa689c12
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea ecx, [ebp + 8]
call fcn.0a68c68b
test al, al
je 0xa689c5f
push dword [ebp + 0x10]
lea ecx, [ebp + 8]
push dword [ebp + 0xc]
call fcn.0a68c364
mov edi, eax
test edi, edi
je 0xa689c5f
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp + 0x14]
mov dword [edi], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov al, 1
jmp 0xa689c61
xor al, al
pop edi
leave
ret

Function at 0xa689c94
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
lea esi, [ebx + 0x1c]
mov ecx, esi
call fcn.0a6315dd
cmp byte [ebx], 0
je 0xa689d1f
cmp byte [ebx + 1], 0
jne 0xa689d1f
cmp byte [ebp + 8], 0
push edi
mov byte [ebx + 1], 1
lea edi, [ebx + 0x18]
je 0xa689ccc
push edi
push 0x40
push 5
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebx + 4]
cmp byte [ebx + 0x15], 0
mov eax, dword [ecx]
mov dword [ebx + 0x10], eax
mov al, byte [ecx + 4]
mov byte [ebx + 0x14], al
setne al
add al, 0xe8
mov byte [ecx], al
mov eax, dword [ebx + 8]
sub eax, dword [ebx + 4]
sub eax, 5
cmp byte [ebp + 8], 0
mov dword [ecx + 1], eax
je 0xa689d0b
cmp byte [ebp + 0xc], 0
jne 0xa689d0b
push edi
push dword [edi]
push 5
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 5
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
push esi
call fcn.0a705d9b
pop ecx
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0xa689d33
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push 0x40
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp + 0xc]
push 0x90
push dword [ebp + 8]
call fcn.0a709cd0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
leave
ret
Function at 0xa689e88
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
push esi
lea esi, [ebx + 0x1c]
mov ecx, esi
call fcn.0a6315dd
cmp byte [ebx], 0
je 0xa689ef6
cmp byte [ebx + 1], 0
je 0xa689ef6
cmp byte [ebp + 8], 0
push edi
mov byte [ebx + 1], 0
lea edi, [ebx + 0x18]
je 0xa689ec0
push edi
push 0x40
push 5
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp byte [ebp + 8], 0
mov ecx, dword [ebx + 4]
mov eax, dword [ebx + 0x10]
mov dword [ecx], eax
mov al, byte [ebx + 0x14]
mov byte [ecx + 4], al
je 0xa689ee2
push edi
push dword [edi]
push 5
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov edi, dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 5
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
pop edi
push esi
call fcn.0a705d9b
pop ecx
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0xa68c7d6
Capabilities:
Get common file path

Disassembly:
push 0x4c
mov eax, 0xa73d74a
call fcn.0a707bfc
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x48]
push eax
xor ebx, ebx
mov dword [ebp - 0x44], esi
push ebx
push ebx
push 0xa596b10
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
js 0xa68c844
lea eax, [ebp - 0x48]
mov byte [ebp - 0x4c], 1
mov dword [ebp - 0x50], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0xa58c6f0]
mov dword [ebp - 4], ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0xa552654]
cmp eax, dword [ecx + 0x3050]
jg 0xa68c85f
push 0xa55263c
mov ecx, esi
call fcn.0a645676
push dword [ebp - 0x48]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
call fcn.0a707bab
ret
push 0xa596a98
lea ecx, [ebp - 0x54]
call fcn.0a63c2ce
push 0xa623890
lea eax, [ebp - 0x54]
push eax
call fcn.0a7096de
mov edi, 0xa552654
push edi
call fcn.0a7080fc
cmp dword [0xa552654], 0xffffffff
pop ecx
jne 0xa68c827
mov byte [ebp - 0x44], bl
lea eax, [ebp - 0x40]
push dword [ebp - 0x44]
mov byte [ebp - 4], 1
push 0xa596ab8
push eax
call fcn.0a64508e
mov byte [ebp - 0x44], bl
lea eax, [ebp - 0x48]
push dword [ebp - 0x44]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0a68c775
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x28]
push eax
push 0xa55263c
call fcn.0a64572b
add esp, 0x24
lea ecx, [ebp - 0x28]
call fcn.0a63e708
lea ecx, [ebp - 0x40]
call fcn.0a63e708
push 0xa741355
call fcn.0a708066
push edi
mov byte [ebp - 4], bl
call fcn.0a7080ab
pop ecx
pop ecx
jmp 0xa68c827

Function at 0xa68d711
Capabilities:
Create thread

Disassembly:
push 0
mov eax, 0xa73a126
call fcn.0a707bc9
mov esi, ecx
push dword [ebp + 8]
lea eax, [ebp + 8]
push eax
call fcn.0a68d790
xor ebx, ebx
lea edi, [esi + 4]
push edi
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push 0xa68d6ba
push ebx
push ebx
call fcn.0a717942
add esp, 0x20
mov dword [esi], eax
test eax, eax
je 0xa68d755
call fcn.0a707b97
ret 4
push 6
mov dword [edi], ebx
call fcn.0a705ee5
int3
Function at 0xa68e7ea
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
inc ebx
mov dword [ebp - 4], esi
lea eax, [esi + 0x10]
mov dword [esi + 8], edi
mov dword [esi + 0xc], edx
mov esi, eax
push dword [ebp + 0x14]
mov ecx, edx
xor eax, eax
push dword [ebp + 0x10]
shr ecx, 0x1e
xor eax, edx
xor ecx, edi
push eax
push ecx
call fcn.0a7084a0
mov edi, eax
mov eax, 0x138
add edi, ebx
mov dword [esi], edi
lea esi, [esi + 8]
adc edx, 0
inc ebx
mov dword [esi - 4], edx
cmp ebx, eax
jb 0xa68e80a
mov esi, dword [ebp - 4]
pop edi
mov dword [esi], eax
pop esi
pop ebx
leave
ret 0x10

Function at 0xa68ef18
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 4], esi
test eax, eax
je 0xa68ef50
cmp word [eax], si
je 0xa68ef50
push esi
lea ecx, [ebp - 4]
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0xa68ef7b
mov ecx, dword [ebp - 4]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
mov esi, eax
test ecx, ecx
je 0xa68ef79
cmp ecx, dword [ebp + 8]
je 0xa68ef79
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0xa68eff4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa94
mov eax, dword [0xa4151c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x84]
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
push 0x20
push ecx
push 0xffffffffffffffff
push eax
push ebx
push 0xfde9
call esi
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0xffffffffffffffff
push edi
push ebx
push 0xfde9
call esi
lea eax, [ebp - 0xa90]
push eax
push 0x20019
push ebx
push 0xa596900
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0xa68f068
push 0xa596db4
jmp 0xa68f10d
lea eax, [ebp - 0xa94]
mov dword [ebp - 0xa94], 0x208
push eax
lea eax, [ebp - 0x28c]
push eax
push ebx
push ebx
push 0xa596dd0
push dword [ebp - 0xa90]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xa90]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0xa68f108
mov eax, dword [ebp - 0xa94]
cmp eax, 1
jb 0xa68f108
shr eax, 1
je 0xa68f0cf
cmp word [ebp + ebx*2 - 0x28c], 0x2f
jne 0xa68f0ca
push 0x5c
pop ecx
mov word [ebp + ebx*2 - 0x28c], cx
inc ebx
cmp ebx, eax
jb 0xa68f0b4
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x28c]
push eax
push 0xa596e00
lea eax, [ebp - 0xa8c]
push 0x800
push eax
call fcn.0a68eece
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0a68ecba
add esp, 0x1c
jmp 0xa68f11d
push 0xa596de4
push 2
call fcn.0a70d940
pop ecx
push eax
call fcn.0a68f15e
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0a707b89
leave
ret

Function at 0xa68f1ae
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0xa4151c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xb
mov ebx, ecx
lea edi, [ebp - 0x34]
pop ecx
mov esi, 0xa596e34
rep movsd dword es:[edi], dword [esi]
push 0x30
pop eax
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor edi, edi
mov word [ebp - 0xa], ax
jmp 0xa68f21a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0xa68f200
mov ax, word [ebp - 0xa]
cmp ax, 0x39
jae 0xa68f247
inc ax
mov word [ebp - 0xa], ax
jmp 0xa68f21a
cmp eax, 0xe7
jne 0xa68f247
push 0x2710
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
je 0xa68f247
push edi
push edi
push 3
push edi
push edi
push 0xc0000000
lea eax, [ebp - 0x34]
push eax
call esi
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0xa68f1e3
mov byte [ebx], 1
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0a707b89
leave
ret
xor al, al
jmp 0xa68f238
Function at 0xa6923c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor ecx, ecx
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 2
jb 0xa6923d4
pop esi
mov eax, edx
pop ebp
ret

Function at 0xa6923eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
xor ecx, ecx
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + ecx]
xor eax, edx
imul edx, eax, 0x1000193
inc ecx
cmp ecx, 8
jb 0xa6923f7
pop esi
mov eax, edx
pop ebp
ret

Function at 0xa69565f
Capabilities:
Hash data using fnv

Disassembly:
push 0x24
mov eax, 0xa739ab6
call fcn.0a707bfc
mov esi, dword [ebp + 8]
xor edi, edi
push 0xa5999b8
mov ecx, esi
call fcn.0a6957b6
test al, al
je 0xa6956b3
lea eax, [ebp - 0x29]
push eax
push 0xffffffffffffffff
push 4
push esi
lea ecx, [ebp - 0x28]
call fcn.0a666c3d
push 0x10
lea eax, [ebp - 0x28]
mov dword [ebp - 4], edi
push edi
push eax
call fcn.0a695872
add esp, 0xc
lea ecx, [ebp - 0x28]
mov esi, eax
mov edi, edx
call fcn.0a6311be
mov eax, esi
jmp 0xa695708
cmp dword [esi + 0x14], 0xf
jbe 0xa6956bb
mov esi, dword [esi]
mov ebx, 0x5ef961ba
mov edi, 0x47f5817a
jmp 0xa6956fa
inc esi
cmp cl, 0x5c
jne 0xa6956d2
add cl, 0xd3
jmp 0xa6956dd
mov al, cl
sub al, 0x41
cmp al, 0x19
ja 0xa6956dd
add cl, 0x20
movzx eax, cl
push 0x100
cdq
push 0x1b3
xor edx, edi
xor eax, ebx
push edx
push eax
call fcn.0a7084a0
mov ebx, eax
mov edi, edx
mov cl, byte [esi]
test cl, cl
jne 0xa6956c7
and edi, 0x7fffffff
mov eax, ebx
mov edx, edi
call fcn.0a707bab
ret 4

Function at 0xa6b8134
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0xa6b8143
push 0x10
pop eax
pop ebp
ret
xor ecx, ecx
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax + 0x1c], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
xor eax, eax
pop ebp
ret
Function at 0xa6b9b20
Capabilities:
Encrypt data using aes

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0a6c00b5
Function at 0xa6baaed
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf8
mov eax, dword [0xa4151c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0xf8], eax
movzx edx, byte [esi + 0xa5d1e58]
mov eax, edx
shr edx, 3
and eax, 7
mov ecx, dword [eax*4 + 0xa5d1dd8]
movzx eax, byte [edx + edi]
and eax, ecx
cmp eax, ecx
sete al
mov byte [ebp + esi - 0x3c], al
inc esi
cmp esi, 0x38
jb 0xa6bab11
xor esi, esi
cmp word [ebp + 0xc], 1
jne 0xa6bab4e
push 0xf
pop ecx
sub ecx, esi
add ecx, ecx
jmp 0xa6bab51
lea ecx, [esi + esi]
and dword [ebp + ecx*4 - 0xf0], 0
and dword [ebp + ecx*4 - 0xf4], 0
xor eax, eax
movzx edx, byte [esi + 0xa5d1e90]
cmp edx, 0x1c
jae 0xa6bab75
mov bl, byte [ebp + edx - 0x3c]
jmp 0xa6bab79
mov bl, byte [ebp + edx - 0x58]
mov byte [ebp + eax - 0x74], bl
inc eax
inc edx
cmp eax, 0x1c
jb 0xa6bab6a
cmp eax, 0x38
jae 0xa6babac
movzx edx, byte [esi + 0xa5d1e90]
add edx, eax
cmp edx, 0x38
jae 0xa6bab9d
mov bl, byte [ebp + edx - 0x3c]
jmp 0xa6baba1
mov bl, byte [ebp + edx - 0x58]
mov byte [ebp + eax - 0x74], bl
inc eax
inc edx
cmp eax, 0x38
jb 0xa6bab92
xor edx, edx
movzx eax, byte [edx + 0xa5d1ea0]
mov edi, edx
cmp byte [ebp + eax - 0x74], 0
je 0xa6babcc
mov eax, dword [edi*4 + 0xa5d1df8]
or dword [ebp + ecx*4 - 0xf4], eax
movzx eax, byte [edx + 0xa5d1eb8]
cmp byte [ebp + eax - 0x74], 0
je 0xa6babe8
mov eax, dword [edi*4 + 0xa5d1df8]
or dword [ebp + ecx*4 - 0xf0], eax
inc edx
cmp edx, 0x18
jb 0xa6babae
inc esi
cmp esi, 0x10
jb 0xa6bab3e
pop edi
pop esi
pop ebx
push dword [ebp - 0xf8]
lea eax, [ebp - 0xf4]
push eax
call fcn.0a6ba7a7
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0a707b89
leave
ret

Function at 0xa6bac1b
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0xa6bac2a
push 0x10
pop eax
pop ebp
ret
xor ecx, ecx
mov dword [eax + 8], 0xf3bcc908
mov dword [eax + 0x48], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0xc], 0x6a09e667
mov dword [eax + 0x10], 0x84caa73b
mov dword [eax + 0x14], 0xbb67ae85
mov dword [eax + 0x18], 0xfe94f82b
mov dword [eax + 0x1c], 0x3c6ef372
mov dword [eax + 0x20], 0x5f1d36f1
mov dword [eax + 0x24], 0xa54ff53a
mov dword [eax + 0x28], 0xade682d1
mov dword [eax + 0x2c], 0x510e527f
mov dword [eax + 0x30], 0x2b3e6c1f
mov dword [eax + 0x34], 0x9b05688c
mov dword [eax + 0x38], 0xfb41bd6b
mov dword [eax + 0x3c], 0x1f83d9ab
mov dword [eax + 0x40], 0x137e2179
mov dword [eax + 0x44], 0x5be0cd19
xor eax, eax
pop ebp
ret
Function at 0xa6bc13d
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
jne 0xa6bc14c
push 0x10
pop eax
pop ebp
ret
xor ecx, ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret
Function at 0xa6be64c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0xa6be75c
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0xa6be75c
mov esi, dword [ebp + 0x14]
test esi, esi
je 0xa6be75c
push dword [esi + 0x1130]
call fcn.0a6bfaf4
pop ecx
test eax, eax
jne 0xa6be75f
mov edi, dword [esi + 0x1134]
lea eax, [edi - 1]
cmp eax, 0x8f
ja 0xa6be75c
mov eax, dword [ebp + 0x10]
xor edx, edx
div edi
test edx, edx
jne 0xa6be75c
imul ecx, dword [esi + 0x1130], 0x68
mov eax, dword [ecx + 0xa58ae68]
mov dword [ebp - 4], eax
test eax, eax
je 0xa6be6db
mov eax, dword [ebp + 0x10]
lea ecx, [esi + 0x90]
div edi
push ecx
push esi
push eax
push ebx
push dword [ebp + 8]
call dword [ebp - 4]
add esp, 0x14
jmp 0xa6be75f
cmp dword [ebp + 0x10], 0
je 0xa6be758
mov eax, dword [ebp + 8]
xor edx, edx
test edi, edi
jle 0xa6be6ff
mov edi, eax
mov ecx, esi
sub edi, esi
mov al, byte [ecx + edi]
xor byte [ecx], al
inc edx
inc ecx
cmp edx, dword [esi + 0x1134]
jl 0xa6be6f0
imul eax, dword [esi + 0x1130], 0x68
lea ecx, [esi + 0x90]
push ecx
push ebx
push esi
call dword [eax + 0xa58ae4c]
add esp, 0xc
test eax, eax
jne 0xa6be75f
and dword [ebp - 4], eax
mov edi, dword [esi + 0x1134]
test edi, edi
jle 0xa6be746
mov edx, ebx
mov ecx, esi
mov ebx, dword [ebp - 4]
sub edx, esi
mov al, byte [ecx + edx]
inc ebx
mov byte [ecx], al
inc ecx
mov edi, dword [esi + 0x1134]
cmp ebx, edi
jl 0xa6be732
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
add ebx, edi
add eax, edi
mov dword [ebp + 0xc], ebx
sub dword [ebp + 0x10], edi
mov dword [ebp + 8], eax
jne 0xa6be6e4
xor eax, eax
jmp 0xa6be75f
push 0x10
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xa6be764
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0xa4151c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x20], ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], edi
test ebx, ebx
je 0xa6be8ad
test edi, edi
je 0xa6be8ad
test esi, esi
je 0xa6be8ad
push dword [esi + 0x1130]
call fcn.0a6bfaf4
pop ecx
test eax, eax
jne 0xa6be8b0
mov ecx, dword [esi + 0x1134]
lea eax, [ecx - 1]
cmp eax, 0x8f
ja 0xa6be8ad
cmp ecx, 0x10
jg 0xa6be8ad
mov ecx, dword [ebp + 0x10]
xor edx, edx
mov eax, ecx
div dword [esi + 0x1134]
test edx, edx
jne 0xa6be8ad
imul eax, dword [esi + 0x1130], 0x68
mov eax, dword [eax + 0xa58ae6c]
mov dword [ebp - 0x18], eax
test eax, eax
je 0xa6be816
lea eax, [esi + 0x90]
push eax
mov eax, ecx
div dword [esi + 0x1134]
push esi
push eax
push ebx
push edi
call dword [ebp - 0x18]
add esp, 0x14
jmp 0xa6be8b0
test ecx, ecx
je 0xa6be8a9
lea ecx, [esi + 0x90]
imul eax, dword [esi + 0x1130], 0x68
push ecx
lea ecx, [ebp - 0x14]
push ecx
push edi
call dword [eax + 0xa58ae50]
add esp, 0xc
test eax, eax
jne 0xa6be8b0
and dword [ebp - 0x18], eax
mov eax, dword [esi + 0x1134]
test eax, eax
jle 0xa6be890
lea eax, [ebp - 0x14]
mov edx, esi
sub eax, edi
mov dword [ebp - 0x24], eax
mov eax, edi
mov edi, dword [ebp - 0x24]
sub eax, esi
sub ebx, esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ebx
mov ebx, eax
lea eax, [ebx + edx]
mov cl, byte [eax + edi]
xor cl, byte [edx]
mov al, byte [eax]
mov byte [edx], al
mov eax, dword [ebp - 0x2c]
mov byte [edx + eax], cl
mov ecx, dword [ebp - 0x18]
mov eax, dword [esi + 0x1134]
inc ecx
inc edx
mov dword [ebp - 0x18], ecx
cmp ecx, eax
jl 0xa6be866
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
add edi, eax
lea ecx, [esi + 0x90]
add ebx, eax
mov dword [ebp - 0x1c], edi
sub dword [ebp + 0x10], eax
mov dword [ebp - 0x20], ebx
jne 0xa6be824
xor eax, eax
jmp 0xa6be8b0
push 0x10
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0a707b89
leave
ret