joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13057c10
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
mov eax, dword [esp + 8]
mov eax, dword [eax]
push ebx
mov ebx, dword [eax + 0x867c]
mov dword [esp + 4], eax
jne 0x13057d83
push ebp
push esi
push edi
lea edi, [ebx + 0x1cb0]
lea ebp, [ebx + 0x1eb0]
cmp edi, ebp
mov dword [ebp], edi
jae 0x13057c4a
mov byte [edi], 0xff
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x13057c58
mov byte [eax], 0xfa
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x13057c66
mov byte [eax], 0x1f
add dword [ebp], 1
movzx ecx, word [ebx + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push ecx
call esi
movzx edx, ax
movzx eax, word [ebx + 0x1caa]
push eax
mov dword [esp + 0x20], edx
call esi
movzx ecx, ax
mov eax, dword [ebp]
cmp eax, ebp
jae 0x13057c9b
mov dl, byte [esp + 0x1c]
mov byte [eax], dl
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x13057cac
mov dl, byte [esp + 0x1d]
mov byte [eax], dl
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x13057cb9
mov byte [eax], cl
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x13057cc6
mov byte [eax], ch
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x13057cd4
mov byte [eax], 0xff
add dword [ebp], 1
mov eax, dword [ebp]
cmp eax, ebp
jae 0x13057ce2
mov byte [eax], 0xf0
add dword [ebp], 1
mov eax, dword [ebp]
mov esi, dword [esp + 0x10]
mov ecx, eax
sub ecx, edi
sub ecx, 2
push ecx
lea edx, [ebx + 0x1cb2]
push edx
push 0x3e
mov dword [ebx + 0x1eb4], eax
mov dword [ebp], edi
call fcn.13057220
mov ebp, dword [sym.imp.WS2_32.dll_send]
add esp, 0xc
push 0
push 3
push edi
mov edi, dword [esp + 0x24]
mov eax, dword [edi + 0x130]
push eax
call ebp
test eax, eax
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
jge 0x13057d42
call esi
mov ecx, dword [esp + 0x10]
push eax
push str.Sending_data_failed___d_
push ecx
call fcn.13042ce0
add esp, 0xc
lea edx, [ebx + 0x1cb3]
push 4
push edx
call fcn.13057aa0
mov eax, dword [edi + 0x130]
add esp, 8
push 0
push 2
add ebx, 0x1cb7
push ebx
push eax
call ebp
test eax, eax
jge 0x13057d80
call esi
mov ecx, dword [esp + 0x10]
push eax
push str.Sending_data_failed___d_
push ecx
call fcn.13042ce0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x130587d0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x88
mov eax, dword [0x13147f14]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
mov ebx, dword [esi + 0x134]
push ebp
mov ebp, dword [esi]
push edi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebx
or edi, 0xffffffff
mov dword [esp + 0x18], 0x80
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1305882a
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push ebx
mov dword [esp + 0x18], 0x80
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push ebx
push esi
call fcn.130454a0
add esp, 8
cmp edi, 0xffffffff
jne 0x13058864
push str.Error_accept__ing_server_connect
push ebp
call fcn.13042ce0
add esp, 8
pop edi
pop ebp
mov eax, 0x1e
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.130222cb
add esp, 0x88
ret
push str.Connection_accepted_from_server_n
push ebp
call fcn.13042c50
push 1
push edi
mov dword [esi + 0x134], edi
call fcn.13066a00
mov dword [esi + 0x13c], 1
mov eax, dword [ebp + 0x16c]
add esp, 0x10
test eax, eax
je 0x130588d8
mov ecx, dword [ebp + 0x170]
push 1
push edi
push ecx
call eax
add esp, 0xc
test eax, eax
je 0x130588d8
push edi
push esi
call fcn.130454a0
add esp, 8
pop edi
pop ebp
mov dword [esi + 0x134], 0xffffffff
mov eax, 0x2a
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.130222cb
add esp, 0x88
ret
mov ecx, dword [esp + 0x90]
pop edi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.130222cb
add esp, 0x88
ret
Function at 0x1305c030
Capabilities:
Check http status code

Disassembly:
mov eax, 0x51eb851f
imul ecx
sar edx, 5
push ebx
mov ebx, dword [edi]
mov eax, edx
push ebp
mov ebp, dword [esp + 0xc]
shr eax, 0x1f
push esi
add eax, edx
xor esi, esi
cmp eax, 2
je 0x1305c068
push str.Couldnt_set_desired_mode
push ebx
call fcn.13042ce0
add esp, 8
pop esi
pop ebp
mov eax, 0x11
pop ebx
ret
cmp ecx, 0xc8
je 0x1305c07f
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.13042c50
add esp, 0xc
cmp ebp, 0x13
jne 0x1305c093
push edi
call fcn.1305bfc0
add esp, 4
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x14
jne 0x1305c0a7
push edi
call fcn.13059300
add esp, 4
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x15
jne 0x1305c0b9
mov ecx, edi
call fcn.1305c010
mov esi, eax
pop esi
pop ebp
pop ebx
ret
cmp ebp, 0x16
jne 0x1305c0c7
mov ecx, edi
call fcn.1305c020
mov esi, eax
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x130632c0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x13147f14]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.1302abea
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x13063325
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x13063325
lea edx, [esp]
push edx
call dword [0x1314911c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.130222cb
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.130222cb
add esp, 0x108
ret
jmp 0x130632c0

Function at 0x13063340
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x13147f14]
xor eax, esp
mov dword [esp + 0x104], eax
mov eax, dword [esp + 0x10c]
push eax
call fcn.1302abea
add esp, 4
test eax, eax
mov byte [esp], 0
je 0x13063325
push 0x104
lea ecx, [esp + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp byte [esp], 0
je 0x13063325
lea edx, [esp]
push edx
call dword [0x1314911c]
add esp, 4
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.130222cb
add esp, 0x108
ret
mov ecx, dword [esp + 0x104]
xor ecx, esp
xor eax, eax
call fcn.130222cb
add esp, 0x108
ret
jmp 0x130632c0
Function at 0x13066b70
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [eax + 0x2c]
push esi
push edi
mov edi, dword [ebx]
mov esi, dword [edi + 0x1a8]
test esi, esi
jne 0x13066b89
mov esi, dword [eax + 0x28]
mov ecx, dword [eax + 0x24]
mov edx, dword [eax + 0x20]
push ecx
push edx
call fcn.13047040
push edx
push eax
call fcn.13047070
add esp, 0x10
sub esi, eax
cmp dword [edi + 0x19c], 0
je 0x13066bd6
mov eax, dword [ebx + 0x124]
mov ecx, dword [ebx + 0x120]
push eax
push ecx
call fcn.13047040
push edx
push eax
call fcn.13047070
mov ecx, dword [edi + 0x19c]
sub ecx, eax
add esp, 0x10
cmp esi, ecx
mov eax, ecx
jge 0x13066bd8
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x13067c10
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
mov byte [esi + edi - 1], 0
jne 0x13067c42
push 0x2e
push esi
call fcn.130364f0
add esp, 8
test eax, eax
je 0x13067c40
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret

Function at 0x13069c10
Capabilities:
Read file on windows

Disassembly:
push edi
mov edi, eax
mov eax, dword [esi]
cmp dword [eax + 4], 2
jne 0x13069c32
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x13069c26
xor eax, eax
pop edi
ret
mov eax, dword [eax + 8]
push eax
push edi
push 1
push ebx
call ecx
jmp 0x13069c62
cmp dword [esi + 8], 0
jne 0x13069c55
mov ecx, dword [eax + 8]
push 0x13109488
push ecx
call fcn.1306c631
add esp, 8
test eax, eax
mov dword [esi + 8], eax
jne 0x13069c55
or eax, 0xffffffff
pop edi
ret
mov edx, dword [esi + 8]
push edx
push edi
push 1
push ebx
call fcn.1306c337
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x13069c84
mov eax, dword [esi + 8]
test eax, eax
je 0x13069c7e
push eax
call fcn.130252aa
add esp, 4
mov dword [esi + 8], edi
mov eax, dword [esi]
mov ecx, dword [eax]
mov dword [esi], ecx
mov eax, edi
pop edi
ret
Function at 0x1306b1a0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push edi
push eax
call dword [0x13149110]
mov edi, eax
add esp, 4
test edi, edi
jne 0x1306b1c5
pop edi
pop esi
pop ecx
ret
lea eax, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], eax
mov edx, dword [esi + 0xc]
push ebx
add edx, eax
push ebp
mov ebp, dword [esp + 0x20]
mov dword [edi + 8], edx
cmp ebp, dword [esi + 0x10]
jbe 0x1306b20c
push eax
mov eax, dword [esi]
call eax
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 4]
mov eax, dword [esi + 4]
push ebp
push ecx
push edx
call eax
mov ebx, dword [edi + 8]
mov ecx, dword [edi + 4]
add ebx, dword [esi + 0xc]
mov edx, dword [esi + 8]
push ecx
push ebx
call edx
mov ebp, dword [esi + 0x14]
add esp, 0x18
jmp 0x1306b210
mov ebx, dword [esp + 0x1c]
mov eax, dword [edi + 4]
mov ecx, dword [esi]
push eax
call ecx
mov edx, dword [edi + 8]
mov eax, dword [esi]
push edx
call eax
add esp, 8
test ebp, ebp
mov dword [esp + 0x10], 0
jbe 0x1306b270
mov dword [esp + 0x10], ebp
mov cl, byte [ebx]
xor cl, 0x36
mov byte [esp + 0x18], cl
mov eax, dword [edi + 4]
mov ecx, dword [esi + 4]
push 1
lea edx, [esp + 0x1c]
push edx
push eax
call ecx
mov dl, byte [ebx]
xor dl, 0x5c
mov byte [esp + 0x24], dl
mov ecx, dword [edi + 8]
mov edx, dword [esi + 4]
push 1
lea eax, [esp + 0x28]
push eax
push ecx
add ebx, 1
call edx
add esp, 0x18
sub ebp, 1
jne 0x1306b233
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 0x10]
pop ebp
pop ebx
jae 0x1306b2b3
jmp 0x1306b280
mov ecx, dword [edi + 4]
mov edx, dword [esi + 4]
push 1
push 0x1310973f
push ecx
call edx
mov eax, dword [edi + 8]
mov ecx, dword [esi + 4]
push 1
push 0x13109740
push eax
call ecx
mov eax, dword [esp + 0x20]
add eax, 1
add esp, 0x18
cmp eax, dword [esi + 0x10]
mov dword [esp + 8], eax
jb 0x1306b280
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x1306fde0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.13020d10
mov eax, dword [0x13147f14]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x48], 0
test esi, esi
jne 0x1306fe27
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.130222cb
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x54]
push eax
push esi
call fcn.1306e254
add esp, 8
test eax, eax
jl 0x1306fe10
mov eax, 8
call fcn.13020d10
fldz
fstp qword [esp]
lea ecx, [esp + 0x5c]
push 0x24
push ecx
call fcn.1306fc50
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x1306fe10
push 0x13109488
push esi
call fcn.1306c631
add esp, 8
mov dword [esp + 0x4c], eax
test eax, eax
je 0x1306ff01
jmp 0x1306fe84
mov eax, dword [esp + 0x4c]
test ebx, ebx
jle 0x1306fe92
cmp ebx, 0x400
mov esi, ebx
jl 0x1306fe97
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x80]
push 1
push edx
call fcn.1306c337
mov edi, eax
add esp, 0x10
mov dword [esp + 0x50], edi
test edi, edi
jle 0x1306fee5
fild dword [esp + 0x50]
mov eax, 8
call fcn.13020d10
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.1306fc50
add dword [esp + 0x58], edi
add esp, 0x10
test ebx, ebx
jle 0x1306fe80
sub ebx, esi
test ebx, ebx
jg 0x1306fe80
mov ecx, dword [esp + 0x4c]
push ecx
call fcn.130252aa
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.1307db00
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x48]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.130222cb
mov esp, ebp
pop ebp
ret
Function at 0x1307a350
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
mov edx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
dec ecx
push edi
mov edi, dword [esi + 4]
shr ecx, 0x1f
xor edx, edi
dec ecx
and edx, ecx
xor edi, edx
mov dword [esi + 4], edi
xor dword [eax + 4], edx
lea edx, [ebx - 1]
cmp edx, 9
ja case.default.0x1307a382
jmp dword [edx*4 + 0x1307a4ac]
mov edi, 0xa
cmp ebx, edi
jle case.0x1307a382.10
push ebp
mov edx, dword [esi]
mov ebx, dword [edx + edi*4]
lea ebp, [edx + edi*4]
mov edx, dword [eax]
mov edx, dword [edx + edi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + edi*4], edx
lea ebx, [ebx + edi*4]
inc edi
cmp edi, dword [esp + 0x20]
jl 0x1307a393
pop ebp
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x24]
mov edx, dword [edx + 0x24]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x24], edi
mov edi, dword [eax]
xor dword [edi + 0x24], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x20]
mov edx, dword [edx + 0x20]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x20], edi
mov edi, dword [eax]
xor dword [edi + 0x20], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x1c]
mov edx, dword [edx + 0x1c]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x1c], edi
mov edi, dword [eax]
xor dword [edi + 0x1c], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x18]
mov edx, dword [edx + 0x18]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x18], edi
mov edi, dword [eax]
xor dword [edi + 0x18], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x14]
mov edx, dword [edx + 0x14]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x14], edi
mov edi, dword [eax]
xor dword [edi + 0x14], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x10]
mov edx, dword [edx + 0x10]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x10], edi
mov edi, dword [eax]
xor dword [edi + 0x10], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0xc]
mov edx, dword [edx + 0xc]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0xc], edi
mov edi, dword [eax]
xor dword [edi + 0xc], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 8]
mov edx, dword [edx + 8]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 8], edi
mov edi, dword [eax]
xor dword [edi + 8], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 4]
mov edx, dword [edx + 4]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 4], edi
mov edi, dword [eax]
xor dword [edi + 4], edx
mov esi, dword [esi]
mov edx, dword [eax]
mov edi, dword [esi]
mov edx, dword [edx]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [esi], edi
mov eax, dword [eax]
xor dword [eax], edx
pop edi
pop esi
pop ebx
ret
Function at 0x1307bb30
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.1301f940
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret
Function at 0x13081150
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.13020d10
mov eax, dword [0x13147f14]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x130811b5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x130811b5
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.13025326
add eax, 0x40
push eax
call fcn.130f8771
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.130222cb
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.130f8608
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x13081244
call fcn.13081010
test eax, eax
jle 0x13081244
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.130222cb
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.130222cb
add esp, 0x108
ret

Function at 0x130812a0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x130812c4
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
sub edi, 1
jne 0x130812b6
pop esi
movzx eax, cl
pop edi
ret
Function at 0x130877e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x13087827
mov al, byte [edx]
test al, al
je 0x13087827
push edi
mov edi, pe_nt_image_headers32
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x130877f7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x13092640
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x1309271b
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x130926b6
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.13092280
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x13092684
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x130927d4
call fcn.130926c8
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x13092773
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.13092280
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1309272c
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x130927d4
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.13092280
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x130927cf
jmp 0x130927d4
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x13092840
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x13092924
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x130928bf
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.130923e0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1309288d
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x130929dd
call fcn.130928d1
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x1309297c
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.13092510
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x13092935
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x130929dd
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.13092510
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x130929d8
jmp 0x130929dd
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1309e020
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.1301f940
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
mov eax, 1
pop esi
ret

Function at 0x1309e080
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.1301f940
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
pop esi
ret

Function at 0x1309e4c0
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
lea eax, [ecx + 1]
ret

Function at 0x1309e560
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret