joyce8/EMBER2024-capa huggingface dataset:
Function at 0x954d80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov esi, dword [esp + 0x24]
push dword [esi]
call fcn.00952830
add esp, 4
test eax, eax
jne 0x954ee6
mov ecx, dword [esi + 4]
mov eax, 0x16
cmp ecx, 0x80
ja 0x954ee6
mov edx, dword [esi + 8]
cmp edx, 0x80
jg 0x954ee6
cmp ecx, edx
jg 0x954ee6
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
cmp edi, 0x11
jb 0x954e54
test ecx, ecx
jne 0x954e54
imul eax, dword [esi], 0x58
mov ebp, dword [eax + 0xc2890c]
cmp ebp, edi
jae 0x954e5c
mov eax, edi
sub eax, ebp
mov dword [esp + 4], eax
jne 0x954df4
xor eax, eax
jmp 0x954e52
lea eax, [esi + 0x210]
mov dword [esp], eax
lea eax, [esi + 0x8c]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
test ebp, ebp
mov eax, 0
je 0x954e27
mov ecx, dword [ebx + eax]
xor dword [esi + eax + 0x8c], ecx
add eax, 4
cmp eax, ebp
jb 0x954e16
imul eax, dword [esi], 0x58
push dword [esp]
mov ecx, dword [esp + 0x10]
push ecx
push ecx
call dword [eax + 0xc28918]
add esp, 0xc
test eax, eax
jne 0x954ee6
mov eax, dword [esp + 8]
add ebx, ebp
add eax, ebp
cmp eax, dword [esp + 4]
jb 0x954e09
sub edi, eax
test edi, edi
je 0x954ee4
lea eax, [esi + 0x210]
mov dword [esp + 8], eax
lea eax, [esi + 0x8c]
mov dword [esp + 4], eax
lea eax, [esi + 0xc]
mov dword [esp], eax
mov eax, dword [esi + 4]
mov ebp, dword [esi + 8]
cmp eax, ebp
jne 0x954ec0
xor ecx, ecx
test eax, eax
je 0x954e98
movzx eax, byte [esi + ecx + 0x8c]
xor byte [esi + ecx + 0xc], al
inc ecx
cmp ecx, dword [esi + 8]
jb 0x954e86
imul eax, dword [esi], 0x58
push dword [esp + 8]
push dword [esp + 8]
push dword [esp + 8]
call dword [eax + 0xc28918]
add esp, 0xc
test eax, eax
jne 0x954ee6
mov dword [esi + 4], 0
xor eax, eax
mov ebp, dword [esi + 8]
sub ebp, eax
lea eax, [esi + eax + 0xc]
cmp edi, ebp
cmovb ebp, edi
push ebp
push ebx
push eax
call fcn.009876a0
add esp, 0xc
mov eax, dword [esi + 4]
add ebx, ebp
add eax, ebp
sub edi, ebp
mov dword [esi + 4], eax
jne 0x954e79
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x954ef0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
mov esi, dword [esp + 0x10]
push dword [esi]
call fcn.00952830
add esp, 4
test eax, eax
jne 0x954fe1
mov edx, dword [esi + 4]
mov eax, 0x16
cmp edx, 0x80
ja 0x954fe1
mov ecx, dword [esi + 8]
cmp ecx, 0x80
jg 0x954fe1
cmp edx, ecx
jg 0x954fe1
xor eax, eax
cmp edx, ecx
jne 0x954f3e
xor ecx, ecx
jmp 0x954f6b
lea ecx, [edx + 1]
mov dword [esi + 4], ecx
mov byte [esi + edx + 0xc], pe_nt_image_headers32
mov ecx, 1
mov edi, dword [esi + 4]
mov edx, dword [esi + 8]
jmp 0x954f67
lea edx, [edi + 1]
mov dword [esi + 4], edx
mov byte [esi + edi + 0xc], 0
mov edi, dword [esi + 4]
mov edx, dword [esi + 8]
cmp edi, edx
jl 0x954f56
test edx, edx
je 0x954f8d
shl ecx, 7
add ecx, esi
movzx edx, byte [eax + ecx + 0x10c]
xor dl, byte [esi + eax + 0x8c]
xor byte [esi + eax + 0xc], dl
inc eax
cmp eax, dword [esi + 8]
jb 0x954f74
imul eax, dword [esi], 0x58
lea ebx, [esi + 0x210]
lea ecx, [esi + 0xc]
push ebx
push ecx
push ecx
call dword [eax + 0xc28918]
add esp, 0xc
test eax, eax
jne 0x954fe1
mov edi, dword [esp + 0x18]
imul eax, dword [esi], 0x58
push ebx
call dword [eax + 0xc28920]
add esp, 4
xor eax, eax
cmp dword [esi + 8], 0
mov ecx, 0
je 0x954fdf
mov edx, dword [esp + 0x14]
xor ecx, ecx
cmp ecx, dword [edi]
jae 0x954fdf
movzx ebx, byte [esi + ecx + 0xc]
mov byte [edx + ecx], bl
inc ecx
cmp ecx, dword [esi + 8]
jb 0x954fcd
mov dword [edi], ecx
pop esi
pop edi
pop ebx
ret
Function at 0x960e30
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x34]
mov ecx, eax
neg ecx
cmovl ecx, eax
and ecx, 0xff80
add ecx, 0xffffef80
cmp ecx, 0x6f7f
ja 0x960f7d
mov eax, fcn.00960e30
mov dword [esp + 8], ecx
mov ecx, fcn.00960e30
xor edx, edx
xor eax, 2
or ecx, 2
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
xor eax, eax
mov ebp, dword [edx*4 + 0xb69d80]
mov edi, dword [edx*4 + str.4__D88H4_000008___4_0h__H_H0T0________00LD__D____H0LP0L_H___8______]
mov dword [esp + 0x1c], edx
add ecx, dword [esp + 0x10]
sete al
mov ecx, eax
xor ecx, 0xaea8c0f5
lea ebx, [ecx + eax*2 + 0xc14]
mov eax, 1
xor ebx, dword [edx*4 + 0xb6a220]
mov ecx, ebx
and cl, 7
movzx edx, cl
shl eax, cl
xor cl, 7
mov dword [esp], edx
mov edx, 1
shl edx, cl
movzx ecx, byte [ebp + edi - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x960f5d
mov dword [esp + 4], eax
mov al, byte [ebp + edi - 1]
mov ecx, eax
or cl, dl
lock cmpxchg byte [ebp + edi - 1], cl
jne 0x960ee2
mov ecx, dword [esp + 4]
movzx eax, al
test edx, eax
je 0x960f04
movzx eax, byte [ebp + edi - 1]
test ecx, eax
je 0x960ef9
jmp 0x960f5d
mov dword [esp + 0xc], edx
movzx eax, byte [ebp + edi - 1]
test ecx, eax
jne 0x960f53
lea ecx, [edi - 4]
shr ecx, 2
je 0x960f4b
xor eax, eax
mov edx, ebp
mov dword [esp + 0x18], ecx
mov esi, dword [edx]
mov ecx, eax
mov dword [esp], ebx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, ebx
shr ebx, cl
mov ecx, dword [esp + 0x18]
or ebx, dword [esp]
mov dword [edx], esi
not esi
add edx, 4
imul ebx, esi
cmp eax, ecx
jne 0x960f21
mov eax, dword [esp + 4]
or byte [ebp + edi - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [ebp + edi - 1], al
mov edx, dword [esp + 0x1c]
inc edx
cmp edx, 0x93
jne 0x960e78
mov eax, dword [esp + 8]
shr eax, 5
mov eax, dword [eax + 0xb69830]
jmp 0x960f7f
xor eax, eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x960f90
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x30]
mov ecx, eax
neg ecx
cmovl ecx, eax
and ecx, 0xffff007f
lea eax, [ecx - 1]
cmp eax, 0x74
ja 0x9610c5
mov eax, fcn.00985720
mov dword [esp + 8], ecx
xor ecx, ecx
and eax, 1
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
xor edx, edx
mov edi, dword [ecx*4 + 0xb6a470]
mov ebp, dword [ecx*4 + str.___L__0H8]
mov dword [esp + 0x18], ecx
xor eax, fcn.00985720
mov eax, 1
sete dl
or edx, 0xfc768478
add edx, 0x400
xor edx, dword [ecx*4 + 0xb6a630]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x9610aa
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x96102f
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x961051
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x961046
jmp 0x9610aa
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x9610a0
lea ecx, [ebp - 4]
shr ecx, 2
je 0x961098
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x96106e
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x36
jne 0x960fc7
mov eax, dword [esp + 8]
mov eax, dword [eax*4 + 0xb69ba8]
jmp 0x9610c7
xor eax, eax
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x9620b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x34
mov eax, dword [0xbd33e0]
mov edi, edx
mov esi, ecx
mov ebx, esp
xor eax, esp
mov dword [esp + 0x30], eax
push 0x30
push 0
push ebx
call fcn.00985720
add esp, 0xc
lea ebp, [esi + 0x20]
mov eax, 0x10
test eax, eax
je 0x9620ea
inc byte [esi + eax - 1]
lea eax, [eax - 1]
je 0x9620dd
push ebx
push esi
push 1
push ebp
call fcn.00976870
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x96218d
mov ecx, 0x10
lea eax, [esp + 0x10]
test ecx, ecx
je 0x962117
inc byte [esi + ecx - 1]
lea ecx, [ecx - 1]
je 0x96210a
push eax
push esi
push 1
push ebp
call fcn.00976870
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x96218d
mov eax, 0x10
lea ecx, [esp + 0x20]
test eax, eax
je 0x962140
inc byte [esi + eax - 1]
lea eax, [eax - 1]
je 0x962133
push ecx
push esi
push 1
push ebp
call fcn.00976870
add esp, 0x10
mov ebx, eax
test eax, eax
jne 0x96218d
xor eax, eax
movzx ecx, byte [edi + eax]
xor byte [esp + eax], cl
inc eax
cmp eax, 0x30
jne 0x962155
push 0x100
lea eax, [esp + 4]
push eax
push ebp
call fcn.00975780
add esp, 0xc
mov ebx, eax
test eax, eax
jne 0x96218d
push 0x10
lea eax, [esp + 0x24]
push eax
push esi
call fcn.009876a0
add esp, 0xc
xor ebx, ebx
push 0x30
lea eax, [esp + 4]
push eax
call fcn.00965b40
add esp, 8
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00989fe9
mov eax, ebx
add esp, 0x34
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x9642b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
mov esi, edx
mov edi, ecx
push edx
call fcn.00989030
add esp, 4
test byte [edi + 0x118], 0x20
mov ebx, eax
je 0x9642f3
add edi, 0xf8
mov ecx, edi
mov edx, esi
push ebx
call fcn.00964700
add esp, 4
test eax, eax
je 0x964445
mov edi, dword [edi + 0xc]
test edi, edi
jne 0x9642d2
jmp 0x96443e
mov ebp, fcn.00968b60
add edi, 0x70
and ebp, 1
inc ebp
cmp dword [edi + 4], 3
jne 0x964433
mov eax, ebp
movzx ecx, byte [0xbd0a2b]
xor eax, fcn.00968b60
sete al
not al
and al, 5
movzx eax, al
bt ecx, eax
jb 0x96440b
mov al, byte [0xbd0a2b]
mov ecx, ebp
mov dl, 1
xor ecx, fcn.00968b60
sete cl
not cl
and cl, 5
xor cl, 7
shl dl, cl
or dl, al
lock cmpxchg byte [0xbd0a2b], dl
jne 0x96432f
mov ecx, ebp
movzx eax, al
xor ecx, fcn.00968b60
sete cl
not cl
and cl, 5
xor cl, 7
movzx ecx, cl
bt eax, ecx
jae 0x96438f
mov eax, ebp
movzx ecx, byte [0xbd0a2b]
xor eax, fcn.00968b60
sete al
not al
and al, 5
movzx eax, al
bt ecx, eax
jae 0x964370
jmp 0x96440b
mov eax, ebp
movzx ecx, byte [0xbd0a2b]
xor eax, fcn.00968b60
sete al
not al
and al, 5
movzx eax, al
bt ecx, eax
jb 0x9643ef
mov eax, ebp
xor ecx, ecx
xor eax, fcn.00968b60
mov eax, dword [0xbd0a20]
sete cl
xor ecx, 0xb501b52d
add ecx, 0xa0
mov edx, ecx
xor eax, ecx
shr edx, 0x1f
mov dword [0xbd0a20], eax
not eax
or edx, ecx
and cl, 7
imul edx, eax
xor dword [0xbd0a24], edx
mov dl, 1
shl dl, cl
or byte [0xbd0a2b], dl
mov eax, ebp
xor eax, fcn.00968b60
mov al, 0xfe
sete cl
not cl
and cl, 5
xor cl, 7
rol al, cl
and byte [0xbd0a2b], al
push 3
push dword [edi + 8]
push 0xbd0a20
call fcn.00988e30
add esp, 0xc
test eax, eax
jne 0x964433
lea ecx, [edi + 0xc]
mov edx, esi
push ebx
call fcn.00964720
add esp, 4
test eax, eax
je 0x964445
mov edi, dword [edi + 0x18]
test edi, edi
jne 0x9642ff
mov eax, dword [esp + 0x14]
or byte [eax], 4
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x968930
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [0xbd33e0]
mov ecx, dword [esp + 0x58]
mov esi, 0xffffaf00
xor eax, esp
test ecx, ecx
mov dword [esp + 0x40], eax
je 0x968a35
mov eax, dword [ecx]
test eax, eax
je 0x968a35
mov ebp, dword [ecx + 8]
test ebp, ebp
je 0x968a35
mov edi, dword [esp + 0x60]
movzx eax, byte [eax + 9]
mov ebx, dword [esp + 0x5c]
cmp eax, edi
jae 0x9689c2
push ecx
mov ebp, ecx
call fcn.00968780
add esp, 4
mov esi, eax
test eax, eax
jne 0x968a28
push edi
push ebx
push ebp
call fcn.009687f0
add esp, 0xc
mov esi, eax
test eax, eax
jne 0x968a28
mov ebx, esp
push ebx
push ebp
call fcn.00968860
add esp, 8
mov esi, eax
test eax, eax
jne 0x968a28
mov eax, dword [ebp]
mov ebp, dword [ebp + 8]
movzx edi, byte [eax + 8]
movzx eax, byte [eax + 9]
lea esi, [ebp + eax]
push eax
push 0x36
push ebp
call fcn.00985720
add esp, 0xc
mov eax, dword [esp + 0x58]
mov eax, dword [eax]
movzx eax, byte [eax + 9]
push eax
push 0x5c
push esi
call fcn.00985720
add esp, 0xc
test edi, edi
je 0x968a02
xor eax, eax
movzx ecx, byte [ebx + eax]
xor byte [ebp + eax], cl
movzx ecx, byte [ebx + eax]
xor byte [esi + eax], cl
inc eax
cmp eax, edi
jne 0x9689ee
mov edi, dword [esp + 0x58]
push edi
call fcn.00968780
add esp, 4
mov esi, eax
test eax, eax
jne 0x968a28
mov eax, dword [edi]
movzx eax, byte [eax + 9]
push eax
push ebp
push edi
call fcn.009687f0
add esp, 0xc
mov esi, eax
mov eax, esp
push 0x40
push eax
call fcn.00965b40
add esp, 8
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.00989fe9
mov eax, esi
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x968bd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, dword [esp + 0x30]
lea ecx, [eax - 0xc02b]
cmp ecx, 5
jbe 0x968d38
cmp eax, 0x9e
je 0x968c18
cmp eax, 0x9f
jne case.0x968d3d.49197
mov eax, 0xb6ade0
jmp case.0x968d3d.49195
mov eax, 0xb6ad68
jmp case.0x968d3d.49195
mov eax, 0xb6ad90
jmp case.0x968d3d.49195
mov eax, 0xb6adb8
jmp case.0x968d3d.49195
mov eax, 0xb6ae08
mov ecx, 0x968d70
xor esi, esi
mov dword [esp + 8], eax
and ecx, 1
inc ecx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edi, dword [esi*4 + 0xb6aef0]
mov ebp, dword [esi*4 + str.00____]
mov dword [esp + 0x18], esi
xor ecx, 0x968d70
sete al
mov ecx, eax
xor ecx, 0x29f47007
lea edx, [ecx + eax*2 + 0xbe0]
mov eax, 1
xor edx, dword [esi*4 + 0xb6aed0]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x968d17
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x968c9c
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x968cbe
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x968cb3
jmp 0x968d17
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x968d0d
lea ecx, [ebp - 4]
shr ecx, 2
je 0x968d05
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x968cdb
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov esi, dword [esp + 0x18]
inc esi
cmp esi, 6
jne 0x968c30
mov eax, dword [esp + 8]
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
jmp case.0x968d3d.49195
mov eax, 0xb6ad40
jmp dword [ecx*4 + 0xb6af48]
Function at 0x969380
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
cmp dword [esp + 0x40], 0
mov eax, 0xf3bcc908
mov ecx, 0xc1059ed8
mov ebp, 0xcbbb9d5d
mov ebx, 0x8eb44a87
mov edi, 0x64f98fa7
mov esi, 0xdb0c2e0d
mov edx, 0xbefa4fa4
cmove ecx, eax
mov eax, 0x6a09e667
mov dword [esp + 0x24], ecx
cmove ebp, eax
mov eax, 0x84caa73b
mov ecx, 0x367cd507
cmove ecx, eax
mov eax, 0xbb67ae85
mov dword [esp + 0x20], ecx
mov ecx, 0x629a292a
cmove ecx, eax
mov eax, 0xfe94f82b
mov dword [esp + 0x1c], ecx
mov ecx, 0x3070dd17
cmove ecx, eax
mov eax, 0x3c6ef372
mov dword [esp + 0x18], ecx
mov ecx, 0x9159015a
cmove ecx, eax
mov eax, 0x5f1d36f1
mov dword [esp + 0x14], ecx
mov ecx, 0xf70e5939
cmove ecx, eax
mov eax, 0xa54ff53a
mov dword [esp + 0x10], ecx
mov ecx, 0x152fecd8
cmove ecx, eax
mov eax, 0xade682d1
mov dword [esp + 0xc], ecx
mov ecx, 0xffc00b31
cmove ecx, eax
mov eax, 0x510e527f
mov dword [esp + 8], ecx
mov ecx, 0x67332667
cmove ecx, eax
mov eax, 0x68581511
mov dword [esp + 4], ecx
mov ecx, 0x2b3e6c1f
cmove eax, ecx
mov ecx, 0x47b5481d
mov dword [esp], eax
mov eax, 0x9b05688c
cmove ebx, eax
mov eax, 0xfb41bd6b
cmove edi, eax
mov eax, 0x1f83d9ab
cmove esi, eax
mov eax, 0x137e2179
cmove edx, eax
mov eax, 0x5be0cd19
cmove ecx, eax
mov eax, dword [esp + 0x3c]
mov dword [eax + 0xc], 0
mov dword [eax + 8], 0
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 0x14], ebp
mov ebp, dword [esp + 0x24]
mov dword [eax + 0x10], ebp
mov ebp, dword [esp + 0x1c]
mov dword [eax + 0x1c], ebp
mov ebp, dword [esp + 0x20]
mov dword [eax + 0x18], ebp
mov ebp, dword [esp + 0x14]
mov dword [eax + 0x24], ebp
mov ebp, dword [esp + 0x18]
mov dword [eax + 0x20], ebp
mov ebp, dword [esp + 0xc]
mov dword [eax + 0x2c], ebp
mov ebp, dword [esp + 0x10]
mov dword [eax + 0x28], ebp
mov ebp, dword [esp + 4]
mov dword [eax + 0x34], ebp
mov ebp, dword [esp + 8]
mov dword [eax + 0x30], ebp
mov dword [eax + 0x3c], ebx
mov ebx, dword [esp]
mov dword [eax + 0x38], ebx
mov dword [eax + 0x44], esi
mov dword [eax + 0x40], edi
mov dword [eax + 0x48], edx
mov edx, dword [esp + 0x40]
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], edx
xor eax, eax
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x96a5b0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
cmp dword [esp + 0x24], 0
mov ecx, 0x6a09e667
mov eax, 0xc1059ed8
mov ebx, 0xf70e5939
mov esi, 0x68581511
mov ebp, 0xffc00b31
mov edx, 0x64f98fa7
cmove eax, ecx
mov ecx, 0xbb67ae85
mov dword [esp + 8], eax
mov eax, 0x367cd507
cmove eax, ecx
mov ecx, 0x3c6ef372
mov edi, dword [esp + 8]
mov dword [esp + 4], eax
mov eax, 0x3070dd17
cmove eax, ecx
mov ecx, 0xa54ff53a
mov dword [esp], eax
mov eax, 0x9b05688c
cmove ebx, ecx
mov ecx, 0x510e527f
cmove esi, eax
mov eax, 0x1f83d9ab
cmove ebp, ecx
mov ecx, 0xbefa4fa4
cmove edx, eax
mov eax, 0x5be0cd19
cmove ecx, eax
mov eax, dword [esp + 0x20]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], edi
mov edi, dword [esp + 4]
mov dword [eax + 0xc], edi
mov edi, dword [esp]
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], ebp
mov dword [eax + 0x1c], esi
mov dword [eax + 0x20], edx
mov edx, dword [esp + 0x24]
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], edx
xor eax, eax
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x96c2d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push eax
mov eax, dword [esp + 0x18]
mov byte [esp + 3], 0
test eax, eax
je 0x96c2fc
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
xor esi, esi
movzx ebx, byte [edx + esi]
mov bh, byte [ecx + esi]
inc esi
xor bh, bl
or byte [esp + 3], bh
cmp esi, eax
jne 0x96c2ea
mov al, byte [esp + 3]
movzx eax, al
add esp, 4
pop esi
pop ebx
ret
Function at 0x974da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, edx
mov edi, ecx
lea eax, [edx + 1]
push eax
push 0
push ecx
call fcn.00985720
add esp, 0xc
test esi, esi
je 0x974e5c
mov dword [esp + 4], edi
mov dword [esp + 8], esi
movzx eax, byte [esp + 0x20]
mov ecx, dword [esp + 0x24]
xor edi, edi
mov esi, dword [esp + 4]
mov dword [esp], eax
cmp byte [esp + 0x20], 0
mov edx, dword [esp + 8]
je 0x974e0f
xor ebx, ebx
mov eax, ebx
imul eax, edx
add eax, edi
push eax
push ecx
mov ebp, edx
call fcn.0096cae0
mov edx, ebp
add esp, 8
mov ecx, ebx
inc ebx
shl eax, cl
mov ecx, dword [esp + 0x24]
or byte [esi + edi], al
cmp ebx, dword [esp]
jne 0x974de9
inc edi
cmp edi, edx
jne 0x974ddc
mov edi, dword [esp + 4]
mov esi, dword [esp + 8]
mov edx, 1
xor ebx, ebx
mov ah, byte [edi]
mov ch, byte [edi + edx]
mov al, ch
xor ch, bl
mov cl, ch
and al, bl
mov bl, ah
not cl
mov byte [esp], al
and cl, 1
mov al, cl
shl cl, 7
mul ah
mov ah, bl
mov ebx, eax
or cl, ah
and bl, ch
xor ch, al
or bl, byte [esp]
mov byte [edi + edx], ch
mov byte [edi + edx - 1], cl
inc edx
mov ah, ch
cmp edx, esi
jbe 0x974e25
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x977250
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, 0x9791b0
mov dword [esp + 8], ecx
xor ecx, ecx
and eax, 1
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
xor edx, edx
mov edi, dword [ecx*4 + 0xb6bb90]
mov ebp, dword [ecx*4 + 0xb6bcc0]
mov dword [esp + 0x18], ecx
xor eax, 0x9791b0
mov eax, 1
sete dl
xor edx, 0xeee237f5
add edx, 0x1000
xor edx, dword [ecx*4 + 0xb6bdf0]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x97734d
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x9772d2
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x9772f4
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x9772e9
jmp 0x97734d
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x977343
lea ecx, [ebp - 4]
shr ecx, 2
je 0x97733b
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x977311
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov ecx, dword [esp + 0x18]
inc ecx
cmp ecx, 0x4c
jne 0x97726a
mov ebx, dword [esp + 8]
xor edi, edi
test ebx, ebx
je 0x977396
mov esi, 0xb6b778
mov eax, 0xbd0f58
mov ecx, dword [esi + 4]
cmp ecx, dword [ebx + 4]
jne 0x977388
push ecx
push dword [ebx + 8]
push eax
call fcn.00988e30
add esp, 0xc
test eax, eax
je 0x977394
mov eax, dword [esi + 0x14]
add esi, 0x14
test eax, eax
jne 0x97736f
jmp 0x977396
mov edi, esi
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x977d60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x1c
mov eax, 0x9794b0
mov edx, 3
xor esi, esi
mov dword [esp + 8], ecx
sub edx, eax
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edi, dword [esi*4 + 0xb6c1d0]
mov ebp, dword [esi*4 + 0xb6c270]
mov dword [esp + 0x18], esi
xor ecx, 0x9794b0
sete al
mov ecx, eax
xor ecx, 0x54c24529
lea edx, [ecx + eax*2 + 0x52c]
mov eax, 1
xor edx, dword [esi*4 + 0xb6c130]
mov ecx, edx
and cl, 7
movzx ebx, cl
shl eax, cl
xor cl, 7
mov dword [esp], ebx
mov ebx, 1
shl ebx, cl
movzx ecx, byte [edi + ebp - 1]
mov esi, dword [esp]
bt ecx, esi
jb 0x977e64
mov dword [esp + 4], eax
mov al, byte [edi + ebp - 1]
mov ecx, eax
or cl, bl
lock cmpxchg byte [edi + ebp - 1], cl
jne 0x977de9
mov ecx, dword [esp + 4]
movzx eax, al
test ebx, eax
je 0x977e0b
movzx eax, byte [edi + ebp - 1]
test ecx, eax
je 0x977e00
jmp 0x977e64
mov dword [esp + 0xc], ebx
movzx eax, byte [edi + ebp - 1]
test ecx, eax
jne 0x977e5a
lea ecx, [ebp - 4]
shr ecx, 2
je 0x977e52
xor eax, eax
mov ebx, edi
mov dword [esp + 0x14], ecx
mov esi, dword [ebx]
mov ecx, eax
mov dword [esp], edx
inc eax
shl dword [esp], cl
and cl, 0x1f
xor cl, 0x1f
xor esi, edx
shr edx, cl
mov ecx, dword [esp + 0x14]
or edx, dword [esp]
mov dword [ebx], esi
not esi
add ebx, 4
imul edx, esi
cmp eax, ecx
jne 0x977e28
mov eax, dword [esp + 4]
or byte [edi + ebp - 1], al
mov eax, dword [esp + 0xc]
not al
and byte [edi + ebp - 1], al
mov esi, dword [esp + 0x18]
inc esi
cmp esi, 0x27
jne 0x977d7d
mov ebx, dword [esp + 8]
xor edi, edi
test ebx, ebx
je 0x977ead
mov esi, 0xb6b510
mov eax, 0xbd19b8
mov ecx, dword [esi + 4]
cmp ecx, dword [ebx + 4]
jne 0x977e9f
push ecx
push dword [ebx + 8]
push eax
call fcn.00988e30
add esp, 0xc
test eax, eax
je 0x977eab
mov eax, dword [esi + 0x18]
add esi, 0x18
test eax, eax
jne 0x977e86
jmp 0x977ead
mov edi, esi
mov eax, edi
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x97b540
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
xor eax, eax
ret

Function at 0x97cbd0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
xor eax, eax
ret