joyce8/EMBER2024-capa huggingface dataset:
Function at 0x647f89f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64807c87
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x64854008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi + 4]
mov esi, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x14], ecx
cmp esi, dword [eax]
mov eax, dword [ebp + 0x10]
jne 0x647f8a5c
cmp eax, dword [edi + 4]
jne 0x647f8a5c
lea ecx, [edi + 4]
mov dword [ebp - 4], 0
call fcn.647f8ca0
push 8
mov ecx, edi
call fcn.647f8b00
mov ecx, dword [edi + 4]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x647f8adc
cmp esi, eax
je 0x647f8ad8
mov eax, dword [esi]
mov dword [ebp + 0xc], eax
movzx eax, byte [esi + 8]
xor eax, 0x811c9dc5
imul ecx, eax, 0x1000193
movzx eax, byte [esi + 9]
xor ecx, eax
movzx eax, byte [esi + 0xa]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [esi + 0xb]
imul ecx, ecx, 0x1000193
xor ecx, eax
mov eax, dword [edi + 0x18]
imul ecx, ecx, 0x1000193
and eax, ecx
mov ecx, edi
push eax
push esi
call fcn.647f8cf0
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov dword [ecx], eax
mov ecx, dword [esi]
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
lea ecx, [esi + 0xc]
dec dword [edi + 8]
call fcn.647f75a0
push 0x20
push 1
push esi
call int.64788c50
mov esi, dword [ebp + 0xc]
add esp, 0xc
cmp esi, dword [ebp + 0x10]
jne 0x647f8a60
mov ecx, dword [ebp - 0x14]
mov dword [ecx], esi
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.648031e0
mov esp, ebp
pop ebp
ret 0xc

Function at 0x647f8bc0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x64854008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
push esi
movzx edx, byte [eax + 8]
movzx ecx, byte [eax + 9]
xor edx, 0x811c9dc5
imul edx, edx, 0x1000193
push edi
xor edx, ecx
movzx ecx, byte [eax + 0xa]
imul edx, edx, 0x1000193
xor edx, ecx
movzx ecx, byte [eax + 0xb]
imul edx, edx, 0x1000193
xor edx, ecx
mov ecx, dword [ebx + 0x18]
imul edx, edx, 0x1000193
and ecx, edx
push ecx
push eax
mov ecx, ebx
call fcn.647f8cf0
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0xc]
dec dword [ebx + 8]
call fcn.647f75a0
push 0x20
push 1
push edi
call int.64788c50
mov eax, dword [ebp - 8]
add esp, 0xc
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
mov dword [eax], esi
pop esi
pop ebx
call fcn.648031e0
mov esp, ebp
pop ebp
ret 8
Function at 0x647f98c0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x648180f0
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x64854008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], eax
movzx eax, byte [edi]
xor eax, 0x811c9dc5
mov esi, dword [ebx + 0xc]
imul ecx, eax, 0x1000193
movzx eax, byte [edi + 1]
mov dword [ebp - 0x24], ebx
xor ecx, eax
movzx eax, byte [edi + 2]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [edi + 3]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
mov eax, dword [esi + ecx*8]
lea edx, [ecx*8]
mov dword [ebp - 0x20], edx
cmp eax, dword [ebx + 4]
jne 0x647f9954
mov esi, dword [ebx + 4]
jmp 0x647f995a
mov esi, dword [esi + edx + 4]
mov esi, dword [esi]
cmp esi, eax
je 0x647f996c
mov ecx, dword [edi]
mov esi, dword [esi + 4]
cmp ecx, dword [esi + 8]
je 0x647f99b3
cmp esi, eax
jne 0x647f9960
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x647f999c
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov edx, dword [esi + 4]
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebx + 0xc]
add ecx, edx
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x647f9a04
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov dword [eax + edx + 4], edi
jmp 0x647f9a24
mov edi, dword [ebp + 0x10]
mov ecx, dword [edi + 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
lea ecx, [edi + 0xc]
dec dword [ebx + 8]
call fcn.647f75a0
push 0x20
push 1
push edi
call int.64788c50
mov eax, dword [ebp - 0x1c]
add esp, 0xc
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.648031e0
mov esp, ebp
pop ebp
ret 0xc
cmp eax, esi
jne 0x647f9a0c
mov dword [ecx], edi
jmp 0x647f9a24
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x647f9a24
add edx, dword [ebx + 0xc]
mov eax, dword [edx + 4]
mov eax, dword [eax + 4]
mov dword [edx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.647f9b10
mov eax, dword [ebp - 0x1c]
mov dword [eax], edi
mov byte [eax + 4], 1
jmp 0x647f99e6
Function at 0x647fc460
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x648091c7
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x64854008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea ecx, [edi + 0x30]
mov dword [edi], vtable.asw::mi::ModuleDestructions.0
call fcn.647fcb30
push 0x40
push 1
push dword [edi + 0x30]
call int.64788c50
add esp, 0xc
lea ecx, [edi + 0x28]
call fcn.647fcb30
push 0x40
push 1
push dword [edi + 0x28]
call int.64788c50
add esp, 0xc
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [ebp - 4], 0
mov edi, dword [edi + 8]
test edi, edi
je 0x647fc4f1
or eax, 0xffffffff
lock xadd dword [edi + 8], eax
jne 0x647fc4f1
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x6481d4a8]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.648031e0
mov esp, ebp
pop ebp
ret

Function at 0x647fd8c0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x64818a28
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x64854008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0x14], ebx
push 0x10000
mov dword [ebp - 0x18], 0
call fcn.6480380f
mov esi, eax
add esp, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0
test edi, edi
je 0x647fd91a
mov eax, edi
jmp 0x647fd922
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x8000
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetMappedFileNameW]
test eax, eax
jne 0x647fd97b
test edi, edi
jne 0x647fd955
push 0x8000
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameW]
test eax, eax
jne 0x647fd97b
push str.Unable_to_retrieve_the_path_of_the_module_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.64802140
add esp, 0xc
lea eax, [ebp - 0x30]
push 0x64850520
push eax
call fcn.64807648
sub esp, 0x18
mov ecx, esp
push esi
call fcn.6478d2e0
mov ecx, ebx
call fcn.647fe310
add esp, 0x18
test esi, esi
je 0x647fd99d
push esi
call fcn.64803602
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.648031e0
mov esp, ebp
pop ebp
ret
Function at 0x647fe780
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x64854008]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x20c], ecx
mov dword [ebp - 0x208], 0
push esi
push edi
mov edi, edx
test ecx, ecx
je 0x647fe8a1
test edi, edi
je 0x647fe8a1
cmp word [edi], 0
je 0x647fe8a1
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
mov eax, ebx
or eax, 8
push eax
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x647fe883
nop word [eax + eax]
push 0x100
lea eax, [ebp - 0x204]
push eax
push 0
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x647fe839
mov ecx, dword [ebp - 0x208]
lea edx, [ebp - 0x204]
push ebx
call fcn.647fe780
add esp, 4
test al, al
je 0x647fe82b
xor esi, esi
jmp 0x647fe7f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x647fe7f0
jmp 0x647fe883
test esi, esi
jne 0x647fe883
push str.advapi32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x647fe874
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x647fe874
push 0
push ebx
push edi
push dword [ebp - 0x20c]
mov ecx, esi
call dword [0x6481d4a8]
call esi
jmp 0x647fe881
push edi
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
mov eax, dword [ebp - 0x208]
pop ebx
test eax, eax
je 0x647fe8a6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x208], 0
jmp 0x647fe8a6
mov esi, 0x57
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
call fcn.648031e0
mov esp, ebp
pop ebp
ret

Function at 0x647fe8d0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x64854008]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
push esi
push edi
mov edi, dword [ebp + 8]
test ecx, ecx
je 0x647fe933
test edx, edx
je 0x647fe933
cmp word [edx], 0
je 0x647fe933
lea eax, [ebp - 8]
push eax
push 2
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x647fe91c
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x647fe938
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], 0
jmp 0x647fe938
mov esi, 0x57
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
call fcn.648031e0
mov esp, ebp
pop ebp
ret
Function at 0x647fe960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x64854008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
test ecx, ecx
je 0x647fea00
test edx, edx
je 0x647fea00
cmp word [edx], 0
je 0x647fea00
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 0x14]
or eax, 1
push eax
push 0
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x647fe9e9
mov dword [ebp - 8], eax
push eax
mov ecx, edi
call fcn.647e7e80
lea eax, [ebp - 8]
push eax
push dword [edi]
push dword [ebp - 0x10]
push 0
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [edi], 0
mov esi, eax
mov eax, dword [ebp - 8]
jne 0x647fe9e1
test eax, eax
je 0x647fe9e1
test esi, esi
je 0x647fe9b2
cmp esi, 0xea
je 0x647fe9b2
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x647fea05
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], 0
jmp 0x647fea05
mov esi, 0x57
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
test esi, esi
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.648031e0
mov esp, ebp
pop ebp
ret
Function at 0x64800580
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x64854008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x6485c59c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x6485d748]
test al, 1
jne 0x648005d5
or eax, 1
mov dword [0x6485d748], eax
lea eax, [ebp - 0x158]
push eax
call fcn.648002f0
add esp, 4
movups xmm0, xmmword [eax]
movups xmmword [0x6485d74c], xmm0
movups xmm0, xmmword [eax + 0x10]
movups xmmword [0x6485d75c], xmm0
xor eax, eax
lea edi, [ebp - 0x110]
mov ecx, 0x40
mov edx, 0x6485d74c
rep stosd dword es:[edi], eax
push 0x20
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x130], 0x6a09e667
mov dword [ebp - 0x12c], 0xbb67ae85
mov dword [ebp - 0x128], 0x3c6ef372
mov dword [ebp - 0x124], 0xa54ff53a
mov dword [ebp - 0x120], 0x510e527f
mov dword [ebp - 0x11c], 0x9b05688c
mov dword [ebp - 0x118], 0x1f83d9ab
mov dword [ebp - 0x114], 0x5be0cd19
call fcn.64800820
rdtsc
add esp, 4
mov dword [ebp - 0xc], edx
lea edx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x138]
push 8
call fcn.64800820
add esp, 4
lea edx, [ebp - 0x138]
mov ecx, 0x6485d74c
call fcn.64800880
mov edi, dword [0x6485d74c]
mov esi, dword [0x6485d750]
push 0x6485c59c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
mov edx, esi
xor ecx, ebp
pop esi
call fcn.648031e0
mov esp, ebp
pop ebp
ret
Function at 0x648006b0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x28], ebx
push edi
lea eax, [ebx + 0x2c]
mov ebx, 0x30
mov edx, dword [eax + 0x34]
lea eax, [eax + 4]
mov esi, dword [eax - 4]
mov edi, edx
mov ecx, edx
rol edi, 0xf
rol ecx, 0xd
xor edi, ecx
shr edx, 0xa
xor edi, edx
mov ecx, esi
mov edx, esi
ror ecx, 7
rol edx, 0xe
xor edx, ecx
shr esi, 3
xor edx, esi
add edi, edx
add edi, dword [eax + 0x1c]
add edi, dword [eax - 8]
mov dword [eax + 0x38], edi
sub ebx, 1
jne 0x648006c6
mov ebx, dword [ebp - 0x28]
mov edx, 0x6483a8c8
mov dword [ebp - 0x24], edx
mov eax, dword [ebx + 8]
mov edi, eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x24]
mov dword [ebp - 0x20], eax
lea eax, [ebx + 0x28]
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
mov esi, ebx
mov eax, ebx
rol eax, 7
mov ecx, ebx
ror esi, 0xb
not ecx
and ecx, dword [ebp - 0xc]
xor esi, eax
mov eax, ebx
ror eax, 6
xor esi, eax
mov eax, dword [ebp - 8]
and eax, ebx
xor ecx, eax
mov eax, dword [ebp - 0x14]
add esi, ecx
add dword [ebp - 0x14], 4
add esi, dword [eax]
mov eax, edi
add esi, dword [edx]
mov edx, edi
add esi, dword [ebp - 0x20]
rol eax, 0xa
ror edx, 0xd
xor edx, eax
mov eax, edi
ror eax, 2
xor edx, eax
mov eax, dword [ebp - 0x10]
mov ecx, eax
and eax, edi
xor ecx, edi
and ecx, dword [ebp - 4]
xor ecx, eax
mov eax, dword [ebp - 0xc]
add edx, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov ecx, edi
mov dword [ebp - 8], ebx
mov ebx, dword [ebp - 0x18]
lea edi, [edx + esi]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0x24]
add ebx, esi
mov eax, dword [ebp - 4]
add edx, 4
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], edx
cmp edx, 0x6483a9c8
jl 0x64800747
mov eax, dword [ebp - 0x2c]
add eax, edi
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x28]
pop edi
pop esi
add dword [ebx + 0xc], ecx
mov dword [ebx + 8], eax
mov eax, dword [ebp - 4]
add dword [ebx + 0x10], eax
mov eax, dword [ebp - 0x18]
add dword [ebx + 0x14], eax
mov eax, dword [ebp - 0x1c]
add dword [ebx + 0x18], eax
mov eax, dword [ebp - 8]
add dword [ebx + 0x1c], eax
mov eax, dword [ebp - 0xc]
add dword [ebx + 0x20], eax
mov eax, dword [ebp - 0x20]
add dword [ebx + 0x24], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x64800880
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
push edi
mov edi, ecx
mov eax, dword [esi + 4]
mov ebx, dword [esi]
mov dword [ebp - 4], eax
mov eax, ebx
shr eax, 5
and eax, 0xf
lea ecx, [esi + eax*4]
mov eax, dword [ecx + 0x28]
shl eax, 8
or eax, 0x80
mov dword [ecx + 0x28], eax
add dword [esi], 8
jne 0x648008ba
inc dword [esi + 4]
mov dword [esi], 0
test dword [esi], 0x1ff
jne 0x648008c9
mov ecx, esi
call fcn.648006b0
mov eax, dword [esi]
and eax, 0x1ff
cmp eax, 0x1c0
je 0x6480090f
mov eax, dword [esi]
shr eax, 5
and eax, 0xf
shl dword [esi + eax*4 + 0x28], 8
add dword [esi], 8
jne 0x648008f2
inc dword [esi + 4]
mov dword [esi], 0
test dword [esi], 0x1ff
jne 0x64800901
mov ecx, esi
call fcn.648006b0
mov eax, dword [esi]
and eax, 0x1ff
cmp eax, 0x1c0
jne 0x648008d7
mov eax, dword [ebp - 4]
mov ecx, esi
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], ebx
call fcn.648006b0
xor edx, edx
mov eax, edx
mov ecx, 3
and eax, 3
sub ecx, eax
mov eax, edx
shr eax, 2
shl ecx, 3
mov eax, dword [esi + eax*4 + 8]
shr eax, cl
mov byte [edx + edi], al
inc edx
cmp edx, 0x20
jl 0x64800921
xor eax, eax
lea edi, [esi + 0x28]
mov ecx, 0x40
rep stosd dword es:[edi], eax
pop edi
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 8], 0x6a09e667
mov dword [esi + 0xc], 0xbb67ae85
mov dword [esi + 0x10], 0x3c6ef372
mov dword [esi + 0x14], 0xa54ff53a
mov dword [esi + 0x18], 0x510e527f
mov dword [esi + 0x1c], 0x9b05688c
mov dword [esi + 0x20], 0x1f83d9ab
mov dword [esi + 0x24], 0x5be0cd19
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x64806410
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x648193ae
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x64854008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x64854010]
cmp eax, 0xffffffff
jne 0x6480644c
xor ebx, ebx
mov dword [ebp - 0x18], ebx
jmp 0x64806458
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x64806497
cmp dword [ebx + 0x18], 0
mov esi, dword [ebx + 0xc]
jne 0x648064ea
test esi, esi
jne 0x648064f0
push 0x64805eb0
push 0x6485a06c
call fcn.64805b00
mov eax, dword [0x64854010]
add esp, 8
cmp eax, 0xffffffff
je 0x64806497
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 1
test ebx, ebx
je 0x648064ce
or eax, 0xffffffff
lock xadd dword [ebx + 4], eax
jne 0x648064ce
mov eax, dword [ebx]
push 0
mov esi, dword [eax]
mov ecx, esi
call dword [0x6481d4a8]
mov ecx, ebx
call esi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.648031e0
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x6480654f
mov edi, edi
mov eax, dword [esi + 4]
mov dword [ebx + 0xc], eax
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x64806538
mov eax, dword [eax]
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x6481d4a8]
mov ecx, dword [ebp - 0x14]
call edi
mov ebx, dword [esi]
push 0
mov eax, dword [ebx]
mov edi, dword [eax]
mov ecx, edi
call dword [0x6481d4a8]
mov ecx, ebx
call edi
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [ebp - 0x18]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebx + 0xc]
test esi, esi
jne 0x648064f0
cmp dword [ebx + 0x18], 0
je 0x64806466
lea eax, [ebx + 0x14]
lea esp, [esp]
mov esi, dword [eax]
mov esi, dword [esi]
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x64806588
mov ecx, dword [esi + 0x1c]
test ecx, ecx
je 0x64806588
mov eax, dword [eax]
push ecx
mov edi, dword [eax + 4]
mov ecx, edi
call dword [0x6481d4a8]
mov ecx, dword [ebp - 0x14]
call edi
push esi
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebx + 0x14]
call fcn.64805f70
cmp dword [ebx + 0x18], 0
lea eax, [ebx + 0x14]
jne 0x64806560
jmp 0x64806466
Function at 0x1001b1f9
Capabilities:
Encode data using xor

Disassembly:
call 0x1001b172
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or eax, dword [ebx - 0x178f73c]
xor esi, 0xde5af04
add eax, esi
lea esp, [esp - 0xe]
mov esi, dword [esp + 0xe]
lea esp, [esp + 0x12]
xor esi, dword [esp]
push eax
sub eax, 0xf24f2b00
mov eax, esp
or dword [eax - 0x22], ebx
pop eax
jmp 0x1001b1a2
xor dword [esp], esi
xor eax, 0
mov dword [esp], esi
add esp, 4
add esi, dword [ebp + 8]
push ebp
add ebp, 0xc
mov ecx, dword [ebp]
pop ebp
ja 0x1001b1be
xor edx, 0
jmp 0x1001b1c9
xor edx, edx
jmp 0x1001b1e0
jmp 0x1001b1ec
xor eax, eax
push 0x8427d7c0
call 0x1001b1f9
stc
add esp, 8
add esi, 0
cmp ecx, 0
je 0x1001b235
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
add bl, dl
xor byte [esi], bl
mov dl, byte [esi]
inc esi
add ebx, edi
rol ebx, 8
dec ecx
jne 0x1001b20e
lea esp, [esp - 4]
xchg dword [esp], ebx
mov ebx, dword [esp]
or eax, edx
xor eax, eax
add eax, dword [esp]
add esp, 4
pop esi
pop edi
pop ebx
xchg dword [esp], ecx
mov dword [esp], ecx
lea esp, [esp + 4]
pop edx
leave
je 0x1001b24c
add eax, 0
jno 0x1001b251
add esi, 0
ret 0x10

Function at 0x1001bfba
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 0x63]
mov dword [esp + 0x5f], ebx
lea esp, [esp + 0x5f]
mov ebx, 0x8dff8662
xchg dword [esp], ebx
and dword [esp], ebp
jmp 0x1001bfdc
add ebx, 0
or dword [esp], ebp
mov ebp, esp
push eax
push edi
lea esp, [esp - 4]
xchg dword [esp], ecx
pop ecx
lea esp, [esp - 4]
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp edi, dword [ebp + 0x14]
ja 0x1001c17e
cmp edi, dword [ebp + 0x10]
jb 0x1001c17e
lea esi, [esi]
sub esi, 0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
sub esp, 0x6a
mov dword [esp + 0x66], 0xc2ccbc3c
add esp, 0x66
mov dword [esp], edi
or edi, 0xffffffff
and edi, 0xcedcf875
xor edi, 0xce9c140e
xchg dword [esp], edi
push edx
mov edx, esp
xor edx, 0
add edx, 0
push ebx
lea ebx, [edx + 4]
mov dword [ebx], eax
pop ebx
pop edx
push edi
call fcn.1001baa6
inc edi
jmp 0x1001c065
jmp 0x1001c072
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.1001baa6
inc edi
and dword [esp - 0x4e], ecx
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push edi
call fcn.1001baa6
inc edi
ror eax, 8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push 0
sub esi, 0
add dword [esp], edx
xor edx, edx
je 0x1001c0c6
sub bl, byte [ebx]
mov eax, 0x64f7f691
int 0x82
xchg ebx, eax
ror cl, 1
into
out dx, eax
cld
test edx, ebx
or edx, 0x13e27bd2
push ebx
add ebx, esi
mov ebx, esp
xor dword [ebx - 0x2a], edi
fdiv qword [ecx]
jnp 0x1001c0aa
pop ebx
xor edx, 0x1b7d0cc
add edx, 0xedeb415d
xchg dword [esp], edx
push edx
mov edx, esp
call int.1001c0f4
add dword [eax], 0x39
jle 0x1001c0d0
sub al, 0xf5
mov ch, al
call fcn.1001c109
mov dword [edi], eax
pop ecx
pop edi
pop eax
leave
ret 0x10