joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100109f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4fc
mov eax, dword [0x100358f0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x10032800
push ecx
mov dword [ebp - 0x4f8], edx
call fcn.100297d2
mov edi, eax
add esp, 8
mov dword [ebp - 0x4fc], edi
test edi, edi
je 0x10010b96
push esi
push 0xec
lea eax, [ebp - 0x4f0]
push 0
push eax
call fcn.10017e80
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x4f0]
call fcn.1000e0f0
push edi
push 0x400
lea eax, [ebp - 0x404]
push 1
push eax
call fcn.100299ac
mov esi, eax
add esp, 0x1c
test esi, esi
je 0x10010b5a
push ebx
lea esp, [esp]
lea edi, [ebp - 0x404]
test esi, esi
je 0x10010b32
mov ecx, dword [ebp - 0x4f0]
mov ebx, 0x40
mov eax, dword [ebp - 0x4f0]
and ecx, 0x3f
add eax, esi
mov dword [ebp - 0x4f4], ecx
sub ebx, ecx
mov dword [ebp - 0x4f0], eax
cmp eax, esi
jae 0x10010aac
inc dword [ebp - 0x4ec]
test ecx, ecx
je 0x10010af2
cmp esi, ebx
jb 0x10010af2
push ebx
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x4c8]
add eax, ecx
push eax
call fcn.10017fb0
add esp, 0xc
lea edx, [ebp - 0x4c8]
lea ecx, [ebp - 0x4f0]
call fcn.1000e180
lea edi, [ebp - 0x404]
mov dword [ebp - 0x4f4], 0
add edi, ebx
sub esi, ebx
cmp esi, 0x40
jb 0x10010b16
mov ebx, esi
shr ebx, 6
lea esp, [esp]
mov edx, edi
lea ecx, [ebp - 0x4f0]
call fcn.1000e180
add edi, 0x40
sub esi, 0x40
dec ebx
jne 0x10010b00
test esi, esi
je 0x10010b32
mov eax, dword [ebp - 0x4f4]
push esi
push edi
lea eax, [ebp + eax - 0x4c8]
push eax
call fcn.10017fb0
add esp, 0xc
mov edi, dword [ebp - 0x4fc]
lea eax, [ebp - 0x404]
push edi
push 0x400
push 1
push eax
call fcn.100299ac
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x10010a70
pop ebx
mov edx, dword [ebp - 0x4f8]
lea ecx, [ebp - 0x4f0]
call fcn.10010730
mov eax, 0xec
lea ecx, [ebp - 0x4f0]
pop esi
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec eax
jne 0x10010b77
push edi
call fcn.1001b397
add esp, 4
push edi
test eax, eax
je 0x10010baa
call fcn.1001b502
add esp, 4
mov eax, 0xffffff88
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f2b3
mov esp, ebp
pop ebp
ret
call fcn.1001b502
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor eax, eax
pop edi
call fcn.1001f2b3
mov esp, ebp
pop ebp
ret
Function at 0x10010bd0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x100358f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, edx
push esi
mov esi, ecx
mov dword [ebp - 0x28], esi
push edi
mov edi, dword [ebp + 0xc]
cmp eax, 0x40
jbe 0x10010c1a
lea ecx, [ebp - 0x24]
mov edx, eax
push edi
push ecx
mov ecx, ebx
call fcn.10010960
xor eax, eax
lea ebx, [ebp - 0x24]
add esp, 8
test edi, edi
sete al
lea eax, [eax*4 + 0x1c]
mov dword [ebp + 8], eax
push 0x40
lea edi, [esi + 0x68]
push 0x36
push edi
call fcn.10017e80
push 0x40
add esi, 0xa8
push 0x5c
push esi
call fcn.10017e80
mov ecx, dword [ebp + 8]
add esp, 0x18
test ecx, ecx
je 0x10010c57
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor byte [esi - 0x40], al
lea esi, [esi + 1]
movzx eax, byte [ebx - 1]
xor byte [esi - 1], al
dec ecx
jne 0x10010c41
mov ebx, dword [ebp - 0x28]
mov ecx, ebx
mov edx, dword [ebp + 0xc]
call fcn.1000e0f0
mov eax, dword [ebx]
mov esi, 0x40
mov ecx, eax
mov edx, esi
and ecx, 0x3f
add eax, esi
sub edx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebx], eax
cmp eax, esi
jae 0x10010c85
inc dword [ebx + 4]
test ecx, ecx
je 0x10010cb7
cmp edx, esi
ja 0x10010cb7
push edx
lea eax, [ebx + 0x28]
add eax, ecx
push edi
push eax
call fcn.10017fb0
add esp, 0xc
lea edx, [ebx + 0x28]
mov ecx, ebx
call fcn.1000e180
sub esi, dword [ebp - 0x2c]
xor ecx, ecx
add edi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
cmp esi, 0x40
jb 0x10010cd7
mov eax, esi
shr eax, 6
mov dword [ebp - 0x2c], eax
nop
mov edx, edi
mov ecx, ebx
call fcn.1000e180
add edi, 0x40
sub esi, 0x40
dec dword [ebp - 0x2c]
jne 0x10010cc0
mov ecx, dword [ebp - 0x28]
test esi, esi
je 0x10010ceb
push esi
lea eax, [ebx + 0x28]
add eax, ecx
push edi
push eax
call fcn.10017fb0
add esp, 0xc
pop edi
pop esi
mov eax, 0x20
lea ecx, [ebp - 0x24]
pop ebx
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec eax
jne 0x10010cf6
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f2b3
mov esp, ebp
pop ebp
ret
Function at 0x10010ed0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x1d0], edx
test edx, edx
jne 0x10010f66
mov dword [ecx + 0x10], 0xf3bcc908
mov dword [ecx + 0x14], 0x6a09e667
mov dword [ecx + 0x18], 0x84caa73b
mov dword [ecx + 0x1c], 0xbb67ae85
mov dword [ecx + 0x20], 0xfe94f82b
mov dword [ecx + 0x24], 0x3c6ef372
mov dword [ecx + 0x28], 0x5f1d36f1
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0xade682d1
mov dword [ecx + 0x34], 0x510e527f
mov dword [ecx + 0x38], 0x2b3e6c1f
mov dword [ecx + 0x3c], 0x9b05688c
mov dword [ecx + 0x40], 0xfb41bd6b
mov dword [ecx + 0x44], 0x1f83d9ab
mov dword [ecx + 0x48], 0x137e2179
mov dword [ecx + 0x4c], 0x5be0cd19
ret
mov dword [ecx + 0x10], 0xc1059ed8
mov dword [ecx + 0x14], 0xcbbb9d5d
mov dword [ecx + 0x18], 0x367cd507
mov dword [ecx + 0x1c], 0x629a292a
mov dword [ecx + 0x20], 0x3070dd17
mov dword [ecx + 0x24], 0x9159015a
mov dword [ecx + 0x28], 0xf70e5939
mov dword [ecx + 0x2c], 0x152fecd8
mov dword [ecx + 0x30], 0xffc00b31
mov dword [ecx + 0x34], 0x67332667
mov dword [ecx + 0x38], 0x68581511
mov dword [ecx + 0x3c], 0x8eb44a87
mov dword [ecx + 0x40], 0x64f98fa7
mov dword [ecx + 0x44], 0xdb0c2e0d
mov dword [ecx + 0x48], 0xbefa4fa4
mov dword [ecx + 0x4c], 0x47b5481d
ret
Function at 0x10012300
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5e0
mov eax, dword [0x100358f0]
xor eax, esp
mov dword [esp + 0x5dc], eax
push esi
push edi
push 0x10032800
push ecx
mov edi, edx
call fcn.100297d2
mov esi, eax
add esp, 8
test esi, esi
je 0x100123d0
push 0x1d8
lea eax, [esp + 0xc]
push 0
push eax
call fcn.10017e80
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x14]
call fcn.10010ed0
push esi
push 0x400
lea eax, [esp + 0x1f4]
push 1
push eax
call fcn.100299ac
add esp, 0x1c
test eax, eax
je 0x1001239d
nop
push eax
lea edx, [esp + 0x1e4]
lea ecx, [esp + 0xc]
call fcn.10011dc0
push esi
push 0x400
lea eax, [esp + 0x1ec]
push 1
push eax
call fcn.100299ac
add esp, 0x14
test eax, eax
jne 0x10012370
mov edx, edi
lea ecx, [esp + 8]
call fcn.10011e90
mov eax, 0x1d8
lea ecx, [esp + 8]
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec eax
jne 0x100123b1
push esi
call fcn.1001b397
add esp, 4
push esi
test eax, eax
je 0x100123e9
call fcn.1001b502
add esp, 4
mov eax, 0xffffff86
pop edi
pop esi
mov ecx, dword [esp + 0x5dc]
xor ecx, esp
call fcn.1001f2b3
mov esp, ebp
pop ebp
ret
call fcn.1001b502
mov ecx, dword [esp + 0x5e8]
add esp, 4
xor eax, eax
pop edi
pop esi
xor ecx, esp
call fcn.1001f2b3
mov esp, ebp
pop ebp
ret

Function at 0x10012410
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x100358f0]
xor eax, esp
mov dword [esp + 0x220], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esp + 8], esi
push edi
mov edi, edx
cmp ebx, 0x80
jbe 0x100124a2
push 0x1d8
lea eax, [esp + 0x14]
push 0
push eax
call fcn.10017e80
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 0x1c]
call fcn.10010ed0
push ebx
mov edx, edi
call fcn.10011dc0
add esp, 0x10
lea edx, [esp + 0x1e8]
lea ecx, [esp + 0x10]
call fcn.10011e90
mov eax, 0x1d8
lea ecx, [esp + 0x10]
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec eax
jne 0x10012481
cmp dword [ebp + 0xc], 0
lea edi, [esp + 0x1e8]
mov ebx, 0x40
mov eax, 0x30
cmovne ebx, eax
push 0x80
lea eax, [esi + 0xd0]
push 0x36
push eax
call fcn.10017e80
push 0x80
add esi, 0x150
push 0x5c
push esi
call fcn.10017e80
add esp, 0x18
test ebx, ebx
je 0x100124e6
nop
movzx eax, byte [edi]
lea edi, [edi + 1]
xor byte [esi - 0x80], al
lea esi, [esi + 1]
movzx eax, byte [edi - 1]
xor byte [esi - 1], al
dec ebx
jne 0x100124d0
mov edx, dword [ebp + 0xc]
mov ecx, dword [esp + 0xc]
call fcn.10010ed0
push 0x80
lea edx, [ecx + 0xd0]
call fcn.10011dc0
add esp, 4
lea ecx, [esp + 0x1e8]
mov eax, 0x40
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec eax
jne 0x10012511
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001f2b3
mov esp, ebp
pop ebp
ret
Function at 0x10013ad0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x100358f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xe0]
push edi
mov edi, dword [ebp + 0x10]
push 0xdc
push 0
push eax
call fcn.10017e80
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd8], 0x67452301
mov dword [ebp - 0xd4], 0xefcdab89
mov dword [ebp - 0xd0], 0x98badcfe
mov dword [ebp - 0xcc], 0x10325476
mov dword [ebp - 0xc8], 0xc3d2e1f0
test eax, eax
je 0x10013b5f
push eax
mov edx, esi
lea ecx, [ebp - 0xe0]
call fcn.10013850
add esp, 4
mov edx, edi
lea ecx, [ebp - 0xe0]
call fcn.10013900
pop edi
mov ecx, 0xdc
lea eax, [ebp - 0xe0]
pop esi
lea esp, [esp]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x10013b80
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f2b3
mov esp, ebp
pop ebp
ret

Function at 0x10013dc0
Capabilities:
Authenticate hmac
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100358f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x1c], esi
push edi
mov edi, edx
cmp ebx, 0x40
jbe 0x10013df8
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
call fcn.10013ad0
add esp, 0xc
lea edi, [ebp - 0x18]
mov ebx, 0x14
push 0x40
lea eax, [esi + 0x5c]
push 0x36
push eax
call fcn.10017e80
push 0x40
add esi, 0x9c
push 0x5c
push esi
call fcn.10017e80
add esp, 0x18
test ebx, ebx
je 0x10013e36
lea esp, [esp]
movzx eax, byte [edi]
lea edi, [edi + 1]
xor byte [esi - 0x40], al
lea esi, [esi + 1]
movzx eax, byte [edi - 1]
xor byte [esi - 1], al
dec ebx
jne 0x10013e20
mov eax, dword [ebp - 0x1c]
mov ecx, eax
lea edx, [eax + 0x5c]
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax], 0x40
call fcn.10012730
pop edi
pop esi
mov eax, 0x14
lea ecx, [ebp - 0x18]
pop ebx
mov edi, edi
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec eax
jne 0x10013e80
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f2b3
mov esp, ebp
pop ebp
ret
Function at 0x10013ea0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100358f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x24], edx
mov ebx, ecx
push edi
lea edx, [ebp - 0x18]
call fcn.10013900
lea edx, [ebx + 0x9c]
mov dword [ebx + 4], 0
mov ecx, ebx
mov dword [ebx + 8], 0x67452301
mov dword [ebx + 0xc], 0xefcdab89
mov dword [ebx + 0x10], 0x98badcfe
mov dword [ebx + 0x14], 0x10325476
mov dword [ebx + 0x18], 0xc3d2e1f0
mov dword [ebx], 0x40
call fcn.10012730
mov eax, dword [ebx]
lea edi, [ebp - 0x18]
mov ecx, eax
mov esi, 0x14
and ecx, 0x3f
mov edx, 0x40
add eax, esi
sub edx, ecx
mov dword [ebp - 0x1c], edx
mov dword [ebx], eax
cmp eax, esi
jae 0x10013f21
inc dword [ebx + 4]
test ecx, ecx
je 0x10013f7c
cmp edx, esi
ja 0x10013f7c
push edx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebx + 0x1c]
add eax, ecx
push eax
call fcn.10017fb0
add esp, 0xc
lea edx, [ebx + 0x1c]
mov ecx, ebx
call fcn.10012730
sub esi, dword [ebp - 0x1c]
lea edi, [ebp - 0x18]
add edi, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], ecx
cmp esi, 0x40
jb 0x10013f78
mov eax, esi
shr eax, 6
mov dword [ebp - 0x1c], eax
mov edx, edi
mov ecx, ebx
call fcn.10012730
add edi, 0x40
sub esi, 0x40
dec dword [ebp - 0x1c]
jne 0x10013f61
mov ecx, dword [ebp - 0x20]
test esi, esi
je 0x10013f8c
push esi
lea eax, [ebx + 0x1c]
add eax, ecx
push edi
push eax
call fcn.10017fb0
add esp, 0xc
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.10013900
pop edi
pop esi
mov ecx, 0x14
lea eax, [ebp - 0x18]
pop ebx
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x10013fa1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f2b3
mov esp, ebp
pop ebp
ret

Function at 0x10015890
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe0
mov eax, dword [0x100358f0]
xor eax, esp
mov dword [esp + 0xdc], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [esp + 4]
push edi
mov edi, dword [ebp + 0x10]
push 0xd8
push 0
push eax
call fcn.10017e80
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
test eax, eax
je 0x1001590c
push eax
mov edx, esi
lea ecx, [esp + 0xc]
call fcn.10015630
add esp, 4
mov edx, edi
lea ecx, [esp + 8]
call fcn.100156e0
mov ecx, 0xd8
lea eax, [esp + 8]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x10015920
mov ecx, dword [esp + 0xe4]
pop edi
pop esi
xor ecx, esp
call fcn.1001f2b3
mov esp, ebp
pop ebp
ret
Function at 0x10015b30
Capabilities:
Authenticate hmac
Encode data using xor
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100358f0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x1c], esi
push edi
mov edi, edx
cmp ebx, 0x40
jbe 0x10015b68
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
call fcn.10015890
add esp, 0xc
lea edi, [ebp - 0x18]
mov ebx, 0x10
push 0x40
lea eax, [esi + 0x58]
push 0x36
push eax
call fcn.10017e80
push 0x40
add esi, 0x98
push 0x5c
push esi
call fcn.10017e80
add esp, 0x18
test ebx, ebx
je 0x10015ba6
lea esp, [esp]
movzx eax, byte [edi]
lea edi, [edi + 1]
xor byte [esi - 0x40], al
lea esi, [esi + 1]
movzx eax, byte [edi - 1]
xor byte [esi - 1], al
dec ebx
jne 0x10015b90
mov eax, dword [ebp - 0x1c]
mov ecx, eax
lea edx, [eax + 0x58]
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax], 0x40
call fcn.10014e10
mov eax, 0x10
lea ecx, [ebp - 0x18]
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec eax
jne 0x10015be4
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001f2b3
mov esp, ebp
pop ebp
ret

Function at 0x10015c00
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100358f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x20], edx
mov ebx, ecx
push edi
lea edx, [ebp - 0x14]
call fcn.100156e0
lea edx, [ebx + 0x98]
mov dword [ebx + 4], 0
mov ecx, ebx
mov dword [ebx + 8], 0x67452301
mov dword [ebx + 0xc], 0xefcdab89
mov dword [ebx + 0x10], 0x98badcfe
mov dword [ebx + 0x14], 0x10325476
mov dword [ebx], 0x40
call fcn.10014e10
mov eax, dword [ebx]
lea edi, [ebp - 0x14]
mov ecx, eax
mov esi, 0x10
and ecx, 0x3f
mov edx, 0x40
add eax, esi
sub edx, ecx
mov dword [ebp - 0x18], edx
mov dword [ebx], eax
cmp eax, esi
jae 0x10015c7a
inc dword [ebx + 4]
test ecx, ecx
je 0x10015cdb
cmp edx, esi
ja 0x10015cdb
push edx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebx + 0x18]
add eax, ecx
push eax
call fcn.10017fb0
add esp, 0xc
lea edx, [ebx + 0x18]
mov ecx, ebx
call fcn.10014e10
sub esi, dword [ebp - 0x18]
lea edi, [ebp - 0x14]
add edi, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
cmp esi, 0x40
jb 0x10015cd7
mov eax, esi
shr eax, 6
mov dword [ebp - 0x18], eax
lea ebx, [ebx]
mov edx, edi
mov ecx, ebx
call fcn.10014e10
add edi, 0x40
sub esi, 0x40
dec dword [ebp - 0x18]
jne 0x10015cc0
mov ecx, dword [ebp - 0x1c]
test esi, esi
je 0x10015ceb
push esi
lea eax, [ebx + 0x18]
add eax, ecx
push edi
push eax
call fcn.10017fb0
add esp, 0xc
mov edx, dword [ebp - 0x20]
mov ecx, ebx
call fcn.100156e0
pop edi
pop esi
mov ecx, 0x10
lea eax, [ebp - 0x14]
pop ebx
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x10015d00
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f2b3
mov esp, ebp
pop ebp
ret
Function at 0x10017900
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x100358f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xe0]
push edi
mov edi, dword [ebp + 0x10]
push 0xdc
push 0
push eax
call fcn.10017e80
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd8], 0x67452301
mov dword [ebp - 0xd4], 0xefcdab89
mov dword [ebp - 0xd0], 0x98badcfe
mov dword [ebp - 0xcc], 0x10325476
mov dword [ebp - 0xc8], 0xc3d2e1f0
test eax, eax
je 0x1001798f
push eax
mov edx, esi
lea ecx, [ebp - 0xe0]
call fcn.10017680
add esp, 4
mov edx, edi
lea ecx, [ebp - 0xe0]
call fcn.10017730
pop edi
mov ecx, 0xdc
lea eax, [ebp - 0xe0]
pop esi
lea esp, [esp]
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x100179b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f2b3
mov esp, ebp
pop ebp
ret

Function at 0x10017bf0
Capabilities:
Authenticate hmac
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100358f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [ebp - 0x1c], esi
push edi
mov edi, edx
cmp ebx, 0x40
jbe 0x10017c28
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
call fcn.10017900
add esp, 0xc
lea edi, [ebp - 0x18]
mov ebx, 0x14
push 0x40
lea eax, [esi + 0x5c]
push 0x36
push eax
call fcn.10017e80
push 0x40
add esi, 0x9c
push 0x5c
push esi
call fcn.10017e80
add esp, 0x18
test ebx, ebx
je 0x10017c66
lea esp, [esp]
movzx eax, byte [edi]
lea edi, [edi + 1]
xor byte [esi - 0x40], al
lea esi, [esi + 1]
movzx eax, byte [edi - 1]
xor byte [esi - 1], al
dec ebx
jne 0x10017c50
mov eax, dword [ebp - 0x1c]
mov ecx, eax
lea edx, [eax + 0x5c]
mov dword [eax + 4], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
mov dword [eax], 0x40
call fcn.10015dc0
pop edi
pop esi
mov eax, 0x14
lea ecx, [ebp - 0x18]
pop ebx
mov edi, edi
mov byte [ecx], 0
lea ecx, [ecx + 1]
dec eax
jne 0x10017cb0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f2b3
mov esp, ebp
pop ebp
ret
Function at 0x10017cd0
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100358f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x24], edx
mov ebx, ecx
push edi
lea edx, [ebp - 0x18]
call fcn.10017730
lea edx, [ebx + 0x9c]
mov dword [ebx + 4], 0
mov ecx, ebx
mov dword [ebx + 8], 0x67452301
mov dword [ebx + 0xc], 0xefcdab89
mov dword [ebx + 0x10], 0x98badcfe
mov dword [ebx + 0x14], 0x10325476
mov dword [ebx + 0x18], 0xc3d2e1f0
mov dword [ebx], 0x40
call fcn.10015dc0
mov eax, dword [ebx]
lea edi, [ebp - 0x18]
mov ecx, eax
mov esi, 0x14
and ecx, 0x3f
mov edx, 0x40
add eax, esi
sub edx, ecx
mov dword [ebp - 0x1c], edx
mov dword [ebx], eax
cmp eax, esi
jae 0x10017d51
inc dword [ebx + 4]
test ecx, ecx
je 0x10017dac
cmp edx, esi
ja 0x10017dac
push edx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebx + 0x1c]
add eax, ecx
push eax
call fcn.10017fb0
add esp, 0xc
lea edx, [ebx + 0x1c]
mov ecx, ebx
call fcn.10015dc0
sub esi, dword [ebp - 0x1c]
lea edi, [ebp - 0x18]
add edi, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], ecx
cmp esi, 0x40
jb 0x10017da8
mov eax, esi
shr eax, 6
mov dword [ebp - 0x1c], eax
mov edx, edi
mov ecx, ebx
call fcn.10015dc0
add edi, 0x40
sub esi, 0x40
dec dword [ebp - 0x1c]
jne 0x10017d91
mov ecx, dword [ebp - 0x20]
test esi, esi
je 0x10017dbc
push esi
lea eax, [ebx + 0x1c]
add eax, ecx
push edi
push eax
call fcn.10017fb0
add esp, 0xc
mov edx, dword [ebp - 0x24]
mov ecx, ebx
call fcn.10017730
pop edi
pop esi
mov ecx, 0x14
lea eax, [ebp - 0x18]
pop ebx
mov byte [eax], 0
lea eax, [eax + 1]
dec ecx
jne 0x10017dd1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001f2b3
mov esp, ebp
pop ebp
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401320
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x404169], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.trast
push str.bask
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401368
xor eax, eax
jmp 0x401383
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x402630
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp fcn.0040263d