joyce8/EMBER2024-capa huggingface dataset:
Function at 0x766c47
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
sub esp, 0xa8
and eax, 0xff
mov dl, al
push ebx
mov dh, dl
push esi
mov eax, edx
mov esi, ecx
shl eax, 0x10
push edi
mov ecx, 0x10
lea edi, [esp + 0xc]
mov ax, dx
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
xor ecx, ecx
sub esi, eax
mov bl, byte [esp + ecx + 0xc]
lea eax, [esp + ecx + 0xc]
mov dl, byte [esi + eax]
xor bl, dl
inc ecx
cmp ecx, 0x14
mov byte [eax], bl
jb 0x766c78
lea ecx, [esp + 0x4c]
call fcn.007659d7
lea eax, [esp + 0xc]
lea ecx, [esp + 0x4c]
push 0x40
push eax
mov dword [esp + 0x74], 0
call fcn.007661e7
mov ecx, dword [esp + 0xb8]
push ecx
lea ecx, [esp + 0x50]
call fcn.00766287
pop edi
pop esi
pop ebx
add esp, 0xa8
ret 4

Function at 0x768b87
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
mov dword [ecx + 0x30], edx
mov dword [ecx + 0x4c], edx
mov dword [ecx + 0x20], edx
mov dword [ecx + 0x2c], 0x20
mov dword [ecx + 0x54], 1
mov dword [ecx + 0x48], 4
mov dword [ecx + 0x58], edx
lea esi, [ecx + 0x70]
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x768bae
pop esi
ret

Function at 0x76e8b7
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x76e8c7
pop edi
pop ebx
ret

Function at 0x76e8f7
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x76e907
pop esi
pop ebp
pop ebx
ret 4
Function at 0x76eba7
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
xor edx, edx
push edi
cmp edx, dword [esp + 0x1c]
jae 0x76ed18
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0x76ec31
lea ebx, [ebx]
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x76ec07
add edi, dword [esp + 8]
mov ecx, dword [esp + 0x20]
mov dword [ecx + edx*4], edi
inc edx
cmp edx, 8
jb 0x76ebeb
cmp edx, 0x10
jae 0x76ecb2
lea eax, [edx - 8]
mov dword [esp + 8], eax
jmp 0x76ec57
cmp edx, dword [esp + 0x1c]
jae 0x76ed18
or eax, 8
xor edi, edi
cmp eax, 1
je 0x76ec98
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x76ec6b
add edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 8], eax
cmp edx, 0x10
jb 0x76ec57
cmp edx, dword [esp + 0x1c]
jae 0x76ed18
lea eax, [edx - 0x10]
mov dword [esp + 0x18], eax
jmp 0x76ecc7
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x76ecfd
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x76ecd7
add edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 0x18], eax
cmp edx, dword [esp + 0x1c]
jb 0x76ecc7
pop edi
pop ebp
add esp, 0xc
ret 0xc
Function at 0x770847
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
lea eax, [edi + 0x32550]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0x770867
xor edx, edx
lea ecx, [edx + 1]
mov dword [esp + 0xc], 4
lea ecx, [ecx]
movzx ebx, word [edi + ecx*2 + 0x32bf4]
mov eax, esi
and eax, 1
mov ebp, eax
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
xor ebx, ebp
add edx, dword [edi + ebx*4 + 0x30ea0]
add ecx, ecx
shr esi, 1
or ecx, eax
dec dword [esp + 0xc]
jne 0x770877
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
inc esi
mov dword [eax], edx
add eax, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
cmp esi, 0x10
jb 0x770867
pop esi
pop ebp
mov dword [edi + 0x32590], 0
pop ebx
add esp, 0xc
ret
Function at 0x7708d7
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
mov eax, 4
push edi
mov dword [esp + 0x18], eax
movzx ebp, byte [edx + eax + 0x306a0]
mov ecx, ebp
mov esi, ebp
and esi, 1
shr ecx, 1
dec ecx
or esi, 2
shl esi, cl
mov edi, eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x10], 0
sub edi, esi
mov ebx, 1
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x770968
jmp 0x77092b
mov ebp, dword [esp + 0x1c]
mov ecx, ebx
sub ecx, ebp
mov eax, edi
and eax, 1
add ecx, esi
movzx ecx, word [edx + ecx*2 + 0x32b0e]
mov ebp, eax
neg ebp
sar ebp, 4
shr ecx, 4
and ebp, 0x7f
xor ecx, ebp
mov ecx, dword [edx + ecx*4 + 0x30ea0]
add dword [esp + 0x10], ecx
add ebx, ebx
shr edi, 1
or ebx, eax
dec dword [esp + 0x14]
jne 0x770927
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x20], ecx
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x80
jb 0x7708ea
lea eax, [edx + 0x32910]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
sub eax, edx
lea ebp, [edx + 0x31d58]
sub eax, 0x31d50
lea edi, [edx + 0x31950]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 4
lea ebx, [ebx]
xor ebx, ebx
cmp dword [edx + 0x32594], ebx
jbe 0x770a12
lea ebx, [ebx]
mov eax, ebx
or eax, 0x40
xor esi, esi
cmp eax, 1
je 0x770a06
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebp + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add esi, dword [edx + ebp*4 + 0x30ea0]
mov eax, ecx
cmp eax, 1
jne 0x7709d7
mov ebp, dword [esp + 0x18]
mov dword [edi + ebx*4], esi
inc ebx
cmp ebx, dword [edx + 0x32594]
jb 0x7709c7
mov eax, 0xe
cmp dword [edx + 0x32594], eax
jbe 0x770a35
mov ecx, eax
shr ecx, 1
sub ecx, 5
shl ecx, 4
add dword [edi + eax*4], ecx
inc eax
cmp eax, dword [edx + 0x32594]
jb 0x770a1f
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov ecx, dword [edi + 4]
mov dword [ebp - 4], ecx
mov eax, dword [edi + 8]
mov dword [ebp], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp + 4], ecx
mov eax, 4
lea ecx, [ebp + 8]
lea ecx, [ecx]
movzx esi, byte [edx + eax + 0x306a0]
mov esi, dword [edi + esi*4]
mov ebx, dword [esp + 0x14]
add esi, dword [ebx + ecx]
inc eax
mov dword [ecx], esi
add ecx, 4
cmp eax, 0x80
jb 0x770a57
sub dword [esp + 0x10], 0xffffff80
sub dword [esp + 0x14], 0x200
add ebp, 0x200
add edi, 0x100
dec dword [esp + 0x1c]
mov dword [esp + 0x18], ebp
jne 0x7709b7
pop edi
pop esi
pop ebp
mov dword [edx + 0x3bcf8], 0
pop ebx
add esp, 0x210
ret

Function at 0x775ef7
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
mov dword [ecx + 0x20], eax
mov dword [ecx + 0x24], eax
ret
Function at 0x7767e7
Capabilities:
Create thread

Disassembly:
push esi
lea eax, [esp + 8]
push eax
push 0
mov esi, ecx
mov ecx, dword [esp + 0x10]
push ecx
push edx
push 0
push 0
call fcn.0077ba1f
add esp, 0x18
mov dword [esi], eax
pop esi
test eax, eax
je 0x77680f
xor eax, eax
ret 4
call dword [fcn.0047a048]
test eax, eax
jne 0x77681e
mov eax, 1
ret 4

Function at 0x776cf7
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
test edx, edx
je 0x776d32
push esi
push edi
mov edi, dword [esp + 0x10]
mov edi, edi
movzx esi, byte [ecx]
xor esi, eax
shrd eax, edi, 8
and esi, 0xff
xor eax, dword [esi*8 + 0x495a20]
shr edi, 8
xor edi, dword [esi*8 + 0x495a24]
inc ecx
dec edx
jne 0x776d07
mov edx, edi
pop edi
pop esi
ret 8
mov edx, dword [esp + 8]
ret 8
Function at 0x7ba775
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xa4
mov eax, dword [0x10143d90]
xor eax, esp
mov dword [esp + 0xa0], eax
mov eax, dword [esp + 0xb8]
push ebx
mov ebx, dword [esp + 0xb0]
push ebp
mov ebp, dword [esp + 0xb8]
push esi
mov esi, dword [esp + 0xb4]
cmp dword [esi + 0x3d0], 0
push edi
je 0x7ba847
test eax, eax
je 0x7ba847
mov eax, dword [eax + 0xa4]
test eax, eax
je 0x7ba847
lea edx, [ebx - 1]
mov ecx, 0x100f76f4
cmp edx, 3
ja 0x7ba847
jmp dword [edx*4 + 0x1000a8d0]
mov eax, dword [esi + 0x200]
xor edi, edi
test eax, eax
je 0x7ba89c
mov ecx, dword [esi + 0x18c]
mov edx, dword [esp + 0xc4]
push ecx
push edx
push ebp
push ebx
push esi
call eax
add esp, 0x14
mov edi, eax
jmp 0x7ba8d7
test ebx, ebx
js 0x7ba8d7
cmp ebx, 2
jg 0x7ba8d7
mov eax, dword [esi + 0x188]
push eax
push 1
lea ecx, [ebx + ebx*2 + 0x100f76bc]
push 2
push ecx
call fcn.008917e9
mov edx, dword [esi + 0x188]
mov eax, dword [esp + 0xd4]
push edx
push 1
push eax
push ebp
call fcn.008917e9
add esp, 0x20
mov eax, edi
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0088f463
add esp, 0xa4
ret

Function at 0x7ba995
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x10143d90]
xor eax, esp
mov dword [esp + 0x104], eax
mov ecx, dword [esp + 0x110]
push esi
mov esi, dword [esp + 0x110]
push edi
lea eax, [esp + 0x11c]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x100
push edx
call fcn.007c9515
lea eax, [esp + 0x18]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7ba9db
sub eax, edx
mov edx, dword [esi + 0x190]
mov edi, eax
test edx, edx
je 0x7baa11
cmp dword [esi + 0x4788], 0
jne 0x7baa11
lea ecx, [esp + 8]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x7ba9fd
mov dword [esi + 0x4788], 1
cmp dword [esi + 0x41c], 0
je 0x7baa87
mov eax, dword [esi + 0x200]
mov byte [esp + edi + 8], 0xa
inc edi
mov byte [esp + edi + 8], 0
test eax, eax
je 0x7baa5b
mov ecx, dword [esi + 0x18c]
push ecx
push edi
lea edx, [esp + 0x10]
push edx
push 0
push esi
call eax
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0088f463
add esp, 0x108
ret
mov eax, dword [esi + 0x188]
push eax
push 1
push 2
push 0x100f76bc
call fcn.008917e9
mov ecx, dword [esi + 0x188]
push ecx
push 1
lea edx, [esp + 0x20]
push edi
push edx
call fcn.008917e9
add esp, 0x20
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
call fcn.0088f463
add esp, 0x108
ret
Function at 0x7baa64
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x10143d90]
xor eax, esp
mov dword [esp + 0x104], eax
mov ecx, dword [esp + 0x110]
push esi
mov esi, dword [esp + 0x110]
push edi
lea eax, [esp + 0x11c]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x100
push edx
call fcn.007c9515
lea eax, [esp + 0x18]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7ba9db
sub eax, edx
mov edx, dword [esi + 0x190]
mov edi, eax
test edx, edx
je 0x7baa11
cmp dword [esi + 0x4788], 0
jne 0x7baa11
lea ecx, [esp + 8]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
test al, al
jne 0x7ba9fd
mov dword [esi + 0x4788], 1
cmp dword [esi + 0x41c], 0
je 0x7baa87
mov eax, dword [esi + 0x200]
mov byte [esp + edi + 8], 0xa
inc edi
mov byte [esp + edi + 8], 0
test eax, eax
je 0x7baa5b
mov ecx, dword [esi + 0x18c]
push ecx
push edi
lea edx, [esp + 0x10]
push edx
push 0
push esi
call eax
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0088f463
add esp, 0x108
ret
mov eax, dword [esi + 0x188]
push eax
push 1
push 2
push 0x100f76bc
call fcn.008917e9
mov ecx, dword [esi + 0x188]
push ecx
push 1
lea edx, [esp + 0x20]
push edi
push edx
call fcn.008917e9
add esp, 0x20
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
call fcn.0088f463
add esp, 0x108
ret
Function at 0x7bac23
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xb8
mov eax, dword [0x10143d90]
xor eax, esp
mov dword [esp + 0xb4], eax
mov ecx, dword [esp + 0xc4]
push ebx
mov ebx, dword [esp + 0xc4]
push esi
mov esi, dword [ebx]
push edi
lea eax, [esp + 0xd4]
push eax
push ecx
call fcn.007ca095
mov edi, eax
add esp, 8
mov dword [esp + 0x18], edi
test edi, edi
jne 0x7bab02
lea eax, [edi + 0x1b]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.0088f463
add esp, 0xb8
ret
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7bab05
sub eax, edx
mov ecx, eax
mov dword [esp + 0xc], edi
push ebp
mov edx, dword [esp + 0xcc]
xor eax, eax
cmp edx, dword [ebx + 0x19c]
lea edx, [esp + 0x18]
push edx
sete al
push ecx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x18]
push ecx
mov dword [esp + 0x24], 0
mov edx, dword [ebx + eax*4 + 0x1b8]
push eax
push ebx
call edx
mov ebp, eax
xor ecx, ecx
add esp, 0x14
cmp ebp, ecx
jge 0x7bab6b
mov eax, dword [esp + 0x18]
cmp eax, ecx
je 0x7bac4e
cmp eax, 0x51
jne 0x7bac48
xor ebp, ebp
mov dword [esp + 0x14], ecx
cmp dword [esi + 0x41c], ecx
je 0x7bac03
cmp dword [esi + 0x3d0], ecx
je 0x7babe4
mov eax, dword [ebx + 0xa4]
cmp eax, ecx
je 0x7babe4
push eax
push 0x100f76e0
push 0x100f76f4
push 0x100f76d4
lea eax, [esp + 0x34]
push 0xa0
push eax
call fcn.007c9575
lea eax, [esp + 0x3c]
add esp, 0x18
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x7babb6
sub eax, edx
mov edi, eax
mov eax, dword [esi + 0x200]
test eax, eax
je 0x7bac1a
mov ecx, dword [esi + 0x18c]
push ecx
push edi
lea edx, [esp + 0x2c]
push edx
push 0
push esi
call eax
add esp, 0x14
test eax, eax
jne 0x7bac03
mov eax, dword [esi + 0x200]
test eax, eax
je 0x7bac03
mov ecx, dword [esi + 0x18c]
mov edx, dword [esp + 0x10]
push ecx
push ebp
push edx
push 4
push esi
call eax
add esp, 0x14
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x1c]
cmp ebp, ecx
je 0x7bac56
sub ecx, ebp
add dword [esp + 0x10], ebp
jmp 0x7bab15
mov eax, dword [esi + 0x188]
push eax
push 1
push 2
push 0x100f76bc
call fcn.008917e9
mov ecx, dword [esi + 0x188]
push ecx
push 1
lea edx, [esp + 0x3c]
push edi
push edx
call fcn.008917e9
add esp, 0x20
jmp 0x7babe4
mov dword [esp + 0x14], eax
jmp 0x7bac56
mov dword [esp + 0x14], 0x37
push edi
call dword [0x1014003c]
mov ecx, dword [esp + 0xc8]
mov eax, dword [esp + 0x18]
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0088f463
add esp, 0xb8
ret

Function at 0x7e0c95
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push 0
push eax
push ecx
push 0
push 0
call fcn.00892726
add esp, 0x18
test eax, eax
je 0x7e0cb8
cmp eax, 0xffffffff
jne 0x7e0cba
xor eax, eax
ret
Function at 0x7efb45
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x474
call fcn.00890ba5
mov eax, dword [0x10143d90]
xor eax, esp
mov dword [esp + 0x470], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0x3c], 0
test esi, esi
jne 0x7efb8c
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x470]
xor ecx, esp
call fcn.0088f463
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push esi
call fcn.00892c42
add esp, 8
test eax, eax
js 0x7efb75
mov eax, 8
call fcn.00890ba5
fldz
fstp qword [esp]
lea ecx, [esp + 0x50]
push 0x30
push ecx
call fcn.007ef9b5
mov ebx, dword [ebp + 0xc]
add esp, 0x10
test ebx, ebx
je 0x7efb75
push 0x100f6854
push esi
call fcn.00890986
add esp, 8
mov dword [esp + 0x40], eax
test eax, eax
je 0x7efc66
jmp 0x7efbe9
mov eax, dword [esp + 0x40]
test ebx, ebx
jle 0x7efbf7
mov esi, ebx
cmp ebx, 0x400
jl 0x7efbfc
mov esi, 0x400
push eax
push esi
lea edx, [esp + 0x80]
push 1
push edx
call fcn.008908ad
mov edi, eax
add esp, 0x10
mov dword [esp + 0x44], edi
test edi, edi
jle 0x7efc4a
fild dword [esp + 0x44]
mov eax, 8
call fcn.00890ba5
lea eax, [esp + 0x80]
fstp qword [esp]
push esi
push eax
call fcn.007ef9b5
add dword [esp + 0x4c], edi
add esp, 0x10
test ebx, ebx
jle 0x7efbe5
sub ebx, esi
test ebx, ebx
jg 0x7efbe5
mov ecx, dword [esp + 0x40]
push ecx
call fcn.008905ef
lea edx, [esp + 0x7c]
push 0x400
push edx
call fcn.007ff145
add esp, 0xc
mov ecx, dword [esp + 0x47c]
mov eax, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0088f463
mov esp, ebp
pop ebp
ret

Function at 0x7fac35
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.00891c15
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
pop esi
ret
Function at 0x832b05
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x832be8
push esi
mov esi, dword [esp + 0x14]
inc esi
lea ebx, [ebx]
movzx edx, byte [esi - 1]
cmp edi, 3
jl 0x832b82
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x1011e0e8]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x1011e0e8]
mov byte [ecx + 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + 0x1011e0e8]
mov byte [ecx + 2], al
and edx, 0x3f
mov dl, byte [edx + 0x1011e0e8]
mov byte [ecx + 3], dl
jmp 0x832bd3
shl edx, 0x10
cmp edi, 2
jne 0x832b92
movzx eax, byte [esi]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + 0x1011e0e8]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + 0x1011e0e8]
mov byte [ecx + 1], al
cmp edi, 1
jne 0x832bbf
lea edx, [edi + 0x3c]
jmp 0x832bcc
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + 0x1011e0e8]
mov byte [ecx + 2], dl
mov byte [ecx + 3], 0x3d
sub edi, 3
add ecx, 4
add ebp, 4
add esi, 3
test edi, edi
jg 0x832b25
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x83ffac
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.00890ba5
mov eax, dword [0x10143d90]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
je 0x84010f
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx eax, byte [esi + 1]
movzx ebx, byte [esi]
movzx ecx, byte [esi + 2]
movzx edx, byte [esi + 3]
shl eax, 8
or ebx, eax
movzx eax, byte [esi + 4]
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 5]
shl edx, 0x18
or ebx, edx
movzx edx, byte [esi + 6]
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 7]
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
add esi, 8
mov byte [edi], dl
mov byte [ebp], al
call fcn.007ed465
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.007ed535
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.007fc155
push ebp
call fcn.007ed465
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.007ed535
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.007fc155
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ebx
shr edx, 0x10
mov byte [eax + 2], dl
mov edx, dword [esp + 0x44]
shr ebx, 0x18
mov byte [eax + 3], bl
mov ebx, edx
add esp, 0x30
mov byte [eax + 4], dl
shr ebx, 8
mov byte [eax + 5], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax + 6], bl
mov byte [eax + 7], dl
mov eax, ebp
mov byte [eax], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 2], dl
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, dword [esp + 0x10]
mov edx, ecx
shr edx, 8
mov byte [eax + 4], cl
mov byte [eax + 5], dl
mov edx, ecx
shr edx, 0x10
shr ecx, 0x18
dec dword [esp + 0x18]
mov byte [eax + 6], dl
mov byte [eax + 7], cl
jne 0x83ffc8
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.0088f463
add esp, 0xa0
ret
Function at 0x861925
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x86193e
mov esi, edi
mov edi, eax
jmp 0x861940
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x861950
mov eax, ebx
jmp 0x86195a
push eax
push ebx
call fcn.007f88a5
add esp, 8
test eax, eax
jne 0x861962
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x86197e
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x861969
cmp eax, dword [esi + 4]
jge 0x861995
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x861985
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x8619b6
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x8619b3
dec eax
test eax, eax
jg 0x8619a5
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret