joyce8/EMBER2024-capa huggingface dataset:
Function at 0x713d60
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x8606e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
xor ecx, ecx
lea edx, [ebp - 0x10]
inc ecx
mov eax, ecx
xor eax, esi
shl eax, 4
add eax, dword [ebp + 8]
inc ecx
mov dword [edx], eax
lea edx, [edx + 4]
cmp ecx, 4
jl 0x713d7e
xor ecx, ecx
cmp ecx, 3
jge 0x713ec0
mov eax, dword [ebp + ecx*4 - 0x10]
inc ecx
mov dword [ebp - 0x18], ecx
movsd xmm3, qword [eax]
movsd xmm4, qword [eax + 8]
xor eax, eax
cmp ecx, 3
movsd qword [ebp - 0x30], xmm3
movsd qword [ebp - 0x38], xmm4
cmovne eax, ecx
mov eax, dword [ebp + eax*4 - 0x10]
movsd xmm0, qword [eax]
movsd xmm2, qword [eax + 8]
subsd xmm0, xmm3
subsd xmm2, xmm4
ucomisd xmm0, qword [0x823b40]
movsd qword [ebp - 0x40], xmm0
movsd qword [ebp - 0x28], xmm2
lahf
test ah, 0x44
jp 0x713dfc
ucomisd xmm2, qword [0x823b40]
lahf
test ah, 0x44
jnp 0x713d95
movsd xmm1, qword [edi + 8]
subsd xmm1, xmm4
push ecx
push ecx
mulsd xmm1, xmm0
movsd xmm0, qword [edi]
subsd xmm0, xmm3
mulsd xmm0, xmm2
subsd xmm1, xmm0
movsd qword [ebp - 0x20], xmm1
movsd qword [esp], xmm1
call fcn.006ba309
pop ecx
pop ecx
test al, al
jne 0x713eaf
mov ebx, dword [ebp + 0xc]
xor eax, eax
movsd xmm1, qword [ebp - 0x20]
movsd xmm3, qword [ebp - 0x28]
movsd xmm4, qword [ebp - 0x30]
mov dword [ebp - 0x14], eax
movsd xmm2, qword [ebx + 8]
movsd xmm0, qword [ebx]
subsd xmm2, qword [ebp - 0x38]
subsd xmm0, xmm4
mulsd xmm2, qword [ebp - 0x40]
mulsd xmm0, xmm3
subsd xmm2, xmm0
movaps xmm0, xmm2
mulsd xmm0, xmm1
comisd xmm0, xmmword [0x823b40]
jbe 0x713e9b
push ecx
push ecx
movsd qword [esp], xmm2
call fcn.006c3c86
pop ecx
pop ecx
test al, al
je 0x713eaf
movsd xmm1, qword [ebp - 0x20]
movsd xmm3, qword [ebp - 0x28]
movsd xmm4, qword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
inc eax
add ebx, 0x10
mov dword [ebp - 0x14], eax
cmp eax, 4
jl 0x713e47
mov ecx, dword [ebp - 0x18]
jmp 0x713d95
inc esi
add edi, 0x10
cmp esi, 4
jl 0x713d78
xor al, al
jmp 0x713ec2
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004ccd8f
mov esp, ebp
pop ebp
ret

Function at 0x717589
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor ecx, ecx
push ebx
mov ebx, edx
push esi
shr ebx, 4
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x7175c3
rol esi, 0xf
xor esi, dword [edi]
rol esi, 0xf
xor esi, dword [edi + 4]
rol esi, 0xf
xor esi, dword [edi + 8]
rol esi, 0xf
xor esi, dword [edi + 0xc]
add edi, 0x10
sub ebx, 1
jne 0x7175a2
xor ecx, ecx
shr edx, 2
xor ebx, ebx
and edx, 3
lea eax, [edi + edx*4]
lea edx, [edx*4 + 3]
shr edx, 2
cmp edi, eax
cmova edx, ebx
test edx, edx
je 0x7175ee
rol esi, 0xf
xor esi, dword [edi]
inc ecx
lea edi, [edi + 4]
cmp ecx, edx
jb 0x7175e1
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
Function at 0x731c4e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, dword [edi + 0x2c]
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, ebx
sub edx, dword [edi + 0x6c]
mov dword [ebp - 8], edx
cmp dword [edi + 0x6c], eax
jb 0x731cea
mov ecx, dword [edi + 0x38]
push ebx
lea eax, [ecx + ebx]
push eax
push ecx
call fcn.0062f5d0
mov ecx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
sub dword [edi + 0x5c], ebx
mov edi, ecx
mov dword [ebp - 4], ecx
lea esi, [eax + ecx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x731c9f
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x40]
mov edi, ebx
lea esi, [eax + ebx*2]
lea esi, [esi - 2]
xor ecx, ecx
movzx edx, word [esi]
mov eax, edx
sub eax, ebx
cmp edx, ebx
movzx eax, ax
cmovae ecx, eax
mov word [esi], cx
sub edi, 1
jne 0x731cc6
mov edx, dword [ebp - 8]
mov edi, dword [ebp + 8]
add edx, ebx
mov esi, dword [edi]
cmp dword [esi + 4], 0
je 0x731e0f
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [esi + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x731d17
xor eax, eax
jmp 0x731d63
sub eax, ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x731d34
push ecx
push dword [esi]
push dword [esi + 0x30]
call fcn.00732072
jmp 0x731d44
cmp eax, 2
jne 0x731d4d
push ecx
push dword [esi]
push dword [esi + 0x30]
call fcn.007322b9
mov ecx, dword [ebp - 4]
add esp, 0xc
mov dword [esi + 0x30], eax
push ecx
push dword [esi]
push dword [ebp - 8]
call fcn.0062f5d0
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [esi], eax
add dword [esi + 8], eax
add dword [edi + 0x74], eax
cmp dword [edi + 0x74], 3
jb 0x731d8b
mov edx, dword [edi + 0x6c]
mov eax, dword [edi + 0x38]
mov ecx, dword [edi + 0x58]
movzx esi, byte [edx + eax]
mov dword [edi + 0x48], esi
movzx eax, byte [edx + eax + 1]
shl esi, cl
xor esi, eax
and esi, dword [edi + 0x54]
mov dword [edi + 0x48], esi
cmp dword [edi + 0x74], 0x106
jae 0x731da0
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x731c5c
mov ecx, dword [edi + 0x16c0]
mov ebx, dword [edi + 0x3c]
cmp ecx, ebx
jae 0x731e0f
mov esi, dword [edi + 0x6c]
add esi, dword [edi + 0x74]
cmp ecx, esi
jae 0x731ddf
mov eax, 0x102
sub ebx, esi
cmp ebx, eax
cmova ebx, eax
mov eax, dword [edi + 0x38]
push ebx
add eax, esi
push 0
push eax
call fcn.0062ff20
lea eax, [ebx + esi]
add esp, 0xc
mov dword [edi + 0x16c0], eax
jmp 0x731e0f
lea eax, [esi + 0x102]
cmp ecx, eax
jae 0x731e0f
mov eax, dword [edi + 0x38]
sub esi, ecx
sub ebx, ecx
add esi, 0x102
cmp esi, ebx
cmova esi, ebx
add eax, ecx
push esi
push 0
push eax
call fcn.0062ff20
add esp, 0xc
add dword [edi + 0x16c0], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x7322b9
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
jne 0x7322c6
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.007322cc

Function at 0x734607
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.00740011
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x734634
xor eax, eax
jmp 0x734730
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x631d46
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
call fcn.007356b2
push esi
push eax
call fcn.00631d60
add esp, 0x14
test eax, eax
je 0x73466f
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.007401bc
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.00735694
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.00736db3
add esp, 0x28
test eax, eax
jne 0x7346a6
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
cmp dword [ebp - 8], esi
jne 0x7346e7
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.0074018d
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x7346e2
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
je 0x734717
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.007400e2
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.0074009a
add esp, 0x14
jmp 0x73462d
push esi
push esi
push esi
push dword [ebp - 4]
call fcn.0073ff60
push dword [ebp - 4]
call fcn.007347da
mov eax, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x736b59
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x736b8f
push edi
mov edi, 0x10c
cmp dword [ebp + 0xc], edi
jae 0x736b82
push eax
call fcn.00740086
push 2
call fcn.0073fffd
pop ecx
pop ecx
mov dword [esi], eax
push edi
push 0
push eax
call fcn.0062ff20
add esp, 0xc
pop edi
pop esi
pop ebp
ret
Function at 0x737f84
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push dword [ebp + 0x18]
xor edi, edi
xor esi, esi
push dword [ebp + 0x1c]
inc edi
mov dword [ebp - 8], esi
push edi
call fcn.00740011
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jne 0x737fb1
xor eax, eax
jmp 0x738155
mov eax, dword [ebp - 4]
mov ecx, SysReAllocString
push 0x40
push 0x631d46
mov dword [eax + 0x2a4], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2a8], ecx
mov eax, dword [ebp - 4]
mov dword [eax + 0x2ac], esi
mov eax, dword [ebp - 4]
push dword [ebp - 4]
mov dword [eax + 0x2b0], esi
call fcn.007356b2
push esi
push eax
call fcn.00631d60
add esp, 0x14
test eax, eax
je 0x737ffe
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 4]
call fcn.007401bc
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.00735694
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.00736db3
add esp, 0x28
test eax, eax
jne 0x738035
mov dword [ebp - 8], edi
cmp dword [ebp - 8], esi
jne 0x738071
mov eax, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0xb4]
push dword [ebp - 4]
call fcn.0074018d
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xb0], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0xb0], esi
jne 0x738071
mov dword [ebp - 8], edi
mov eax, dword [ebp - 4]
mov dword [eax + 0x98], 0x736e85
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0x9c], fcn.00736ed4
mov eax, dword [ebp - 4]
mov dword [eax + 0xa0], ecx
cmp dword [ebp - 8], esi
jne 0x7380f1
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push str.1.2.5
push eax
call fcn.00730474
add esp, 0xc
cmp eax, 0xfffffffa
je 0x7380da
cmp eax, 0xfffffffc
je 0x7380d3
cmp eax, 0xfffffffe
je 0x7380cc
test eax, eax
je 0x7380ec
push str.Unknown_zlib_error
jmp 0x7380df
push str.zlib_stream_error
jmp 0x7380df
push str.zlib_memory_error
jmp 0x7380df
push str.zlib_version_error
push dword [ebp - 4]
call fcn.007356ce
pop ecx
mov dword [ebp - 8], edi
pop ecx
cmp dword [ebp - 8], esi
je 0x738121
mov eax, dword [ebp - 4]
push dword [eax + 0xb0]
push dword [ebp - 4]
call fcn.007400e2
push dword [ebp + 0x18]
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push dword [ebp - 4]
mov dword [eax + 0xb0], esi
call fcn.0074009a
add esp, 0x14
jmp 0x737faa
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push esi
push esi
mov eax, dword [eax + 0xb0]
mov dword [ecx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push dword [ebp - 4]
mov eax, dword [eax + 0xb4]
mov dword [ecx + 0x88], eax
call fcn.0073cf58
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401260
Capabilities:
Hide graphical window

Disassembly:
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [0x403100], eax
push esp
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, dword [esp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4030f4], eax
xor eax, eax
mov ebp, esp
mov ecx, 0xa
push eax
dec ecx
jne 0x40128d
push esp
mov dword [ebp - 0x24], 0x401330
mov eax, dword [0x4030f4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], str.wookernof
call dword [sym.imp.USER32.dll_RegisterClassA]
xor eax, eax
push eax
push dword [0x4030f4]
push eax
push eax
push 0x190
push 0x2b2
push 0x640
push 0x9c4
push 0
push str.tofkol
push str.wookernof
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x403104], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x40132c
mov esi, dword [sym.imp.USER32.dll_TranslateMessage]
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea eax, [ebp - 0x1c]
push eax
call esi
lea ecx, [ebp - 0x1c]
push ecx
call edi
xor eax, eax
push eax
push eax
push eax
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x40130d
pop ebp
ret 0x10
Function at 0x186ae30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x621000]
push edi
or ebp, 0xffffffff
jmp 0x186ae52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x186ae59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x186ae48
mov eax, 1
add ebx, ebx
jne 0x186ae6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x186ae7c
jne 0x186ae9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x186ae9b
dec eax
add ebx, ebx
jne 0x186ae88
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x186ae60
add ebx, ebx
jne 0x186ae97
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x186aeed
xor ecx, ecx
sub eax, 3
jb 0x186aeb3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x186af22
sar eax, 1
mov ebp, eax
jmp 0x186aebe
add ebx, ebx
jne 0x186aebe
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x186ae8c
inc ecx
add ebx, ebx
jne 0x186aecc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x186ae8c
add ebx, ebx
jne 0x186aed9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x186aece
jne 0x186aeea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x186aece
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x186af0c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x186aefe
jmp 0x186ae4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x186af0c
add edi, ecx
jmp 0x186ae4e
pop esi
mov edi, esi
mov ecx, 0x35334c
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x186af47
cmp byte [edi], 0x98
jne 0x186af2c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x186af2a
lea edi, [esi + 0x966000]
mov eax, dword [edi]
or eax, eax
je 0x186af8f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9e79d0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9e7b10]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x186af4d
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9e7b14]
or eax, eax
je 0x186af89
mov dword [ebx], eax
add ebx, 4
jmp 0x186af6a
call dword [esi + 0x9e7b24]
mov ebp, dword [esi + 0x9e7b18]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x186afc3
sub esp, 0xffffff80
jmp 0x1295fcc
Function at 0x10001490
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x100014de
mov eax, dword [ebp + 8]
dec edi
push ebx
shr edi, 4
push esi
mov esi, dword [ebp + 0xc]
lea ebx, [eax + 0xf0]
inc edi
nop
movups xmm0, xmmword [esi]
push eax
push esi
call fcn.10001e80
add esp, 8
mov ecx, ebx
mov edx, 0x10
mov al, byte [ecx]
lea ecx, [ecx + 1]
xor byte [esi], al
inc esi
sub edx, 1
jne 0x100014c4
mov eax, dword [ebp + 8]
movups xmmword [ebx], xmm0
sub edi, 1
jne 0x100014b0
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x10001e80
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
add edx, 0xe0
push edi
mov ecx, esi
mov ebx, 4
nop word [eax + eax]
mov edi, 4
mov al, byte [edx]
inc edx
xor byte [ecx], al
inc ecx
sub edi, 1
jne 0x10001ea5
sub ebx, 1
jne 0x10001ea0
mov eax, dword [ebp + 0xc]
add eax, 0xd0
mov byte [ebp + 0xb], 0xd
mov dword [ebp - 4], eax
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
nop dword [eax + eax]
mov ecx, edi
mov edx, 4
nop word [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x100b9560]
mov byte [ecx - 4], al
sub edx, 1
jne 0x10001f30
inc edi
sub ebx, 1
jne 0x10001f20
mov edx, dword [ebp - 4]
mov eax, esi
mov ebx, 4
mov edi, 4
nop dword [eax]
mov cl, byte [edx]
inc edx
xor byte [eax], cl
inc eax
sub edi, 1
jne 0x10001f60
sub ebx, 1
jne 0x10001f54
push esi
call fcn.10002040
mov dl, byte [ebp + 0xb]
add esp, 4
sub dword [ebp - 4], 0x10
dec dl
mov byte [ebp + 0xb], dl
test dl, dl
jne 0x10001ec4
movzx eax, byte [esi + 9]
mov edi, esi
mov cl, byte [esi + 0xd]
mov ebx, 4
mov byte [esi + 0xd], al
movzx eax, byte [esi + 5]
mov byte [esi + 9], al
movzx eax, byte [esi + 1]
mov byte [esi + 5], al
movzx eax, byte [esi + 0xa]
mov byte [esi + 1], cl
mov cl, byte [esi + 2]
mov byte [esi + 2], al
movzx eax, byte [esi + 0xe]
mov byte [esi + 0xa], cl
mov cl, byte [esi + 6]
mov byte [esi + 6], al
movzx eax, byte [esi + 7]
mov byte [esi + 0xe], cl
mov cl, byte [esi + 3]
mov byte [esi + 3], al
movzx eax, byte [esi + 0xb]
mov byte [esi + 7], al
movzx eax, byte [esi + 0xf]
mov byte [esi + 0xb], al
mov byte [esi + 0xf], cl
mov ecx, edi
mov edx, 4
nop dword [eax + eax]
movzx eax, byte [ecx]
lea ecx, [ecx + 4]
mov al, byte [eax + 0x100b9560]
mov byte [ecx - 4], al
sub edx, 1
jne 0x10001ff0
inc edi
sub ebx, 1
jne 0x10001fe4
sub dword [ebp + 0xc], esi
mov dword [ebp + 8], 4
mov edx, dword [ebp + 0xc]
mov ecx, 4
nop dword [eax]
mov al, byte [edx + esi]
xor byte [esi], al
inc esi
sub ecx, 1
jne 0x10002020
sub dword [ebp + 8], 1
jne 0x10002014
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002240
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
movzx eax, byte [edx]
mov esi, 8
mov byte [ecx], al
movzx eax, byte [edx + 1]
mov byte [ecx + 1], al
movzx eax, byte [edx + 2]
mov byte [ecx + 2], al
movzx eax, byte [edx + 3]
mov byte [ecx + 3], al
movzx eax, byte [edx + 4]
mov byte [ecx + 4], al
movzx eax, byte [edx + 5]
mov byte [ecx + 5], al
movzx eax, byte [edx + 6]
mov byte [ecx + 6], al
movzx eax, byte [edx + 7]
mov byte [ecx + 7], al
movzx eax, byte [edx + 8]
mov byte [ecx + 8], al
movzx eax, byte [edx + 9]
mov byte [ecx + 9], al
movzx eax, byte [edx + 0xa]
mov byte [ecx + 0xa], al
movzx eax, byte [edx + 0xb]
mov byte [ecx + 0xb], al
movzx eax, byte [edx + 0xc]
mov byte [ecx + 0xc], al
movzx eax, byte [edx + 0xd]
mov byte [ecx + 0xd], al
movzx eax, byte [edx + 0xe]
mov byte [ecx + 0xe], al
movzx eax, byte [edx + 0xf]
mov byte [ecx + 0xf], al
movzx eax, byte [edx + 0x10]
mov byte [ecx + 0x10], al
movzx eax, byte [edx + 0x11]
mov byte [ecx + 0x11], al
movzx eax, byte [edx + 0x12]
mov byte [ecx + 0x12], al
movzx eax, byte [edx + 0x13]
mov byte [ecx + 0x13], al
movzx eax, byte [edx + 0x14]
mov byte [ecx + 0x14], al
movzx eax, byte [edx + 0x15]
mov byte [ecx + 0x15], al
movzx eax, byte [edx + 0x16]
mov byte [ecx + 0x16], al
movzx eax, byte [edx + 0x17]
mov byte [ecx + 0x17], al
movzx eax, byte [edx + 0x18]
mov byte [ecx + 0x18], al
movzx eax, byte [edx + 0x19]
mov byte [ecx + 0x19], al
movzx eax, byte [edx + 0x1a]
mov byte [ecx + 0x1a], al
movzx eax, byte [edx + 0x1b]
mov byte [ecx + 0x1b], al
movzx eax, byte [edx + 0x1c]
mov byte [ecx + 0x1c], al
mov bh, byte [edx + 0x1d]
lea edi, [ecx + 0x1d]
mov byte [edi], bh
movzx eax, byte [edx + 0x1e]
mov byte [ecx + 0x1e], al
movzx eax, byte [edx + 0x1f]
mov byte [ecx + 0x1f], al
mov cl, byte [edi + 1]
lea eax, [edi]
mov dh, byte [eax + 2]
mov edi, esi
mov bl, byte [eax - 1]
mov byte [ebp - 1], cl
mov byte [ebp - 2], dh
and edi, 7
jne 0x10002384
movzx ecx, cl
movzx edx, bh
mov bh, byte [ecx + str.cw]
movzx ecx, byte [ebp - 2]
mov cl, byte [ecx + str.cw]
mov byte [ebp - 1], cl
movzx ecx, bl
mov cl, byte [ecx + str.cw]
mov byte [ebp - 2], cl
mov ecx, esi
shr ecx, 3
mov bl, byte [ecx + 0x100b9660]
xor bl, byte [edx + str.cw]
mov dh, byte [ebp - 2]
jmp 0x100023b3
cmp edi, 4
jne 0x100023b3
mov dl, byte [ebp - 1]
movzx ecx, bl
mov bl, byte [ecx + str.cw]
movzx ecx, bh
mov bh, byte [ecx + str.cw]
movzx ecx, dl
mov cl, byte [ecx + str.cw]
mov byte [ebp - 1], cl
movzx ecx, dh
mov dh, byte [ecx + str.cw]
movzx ecx, byte [eax - 0x1d]
lea edi, [eax + 4]
mov dl, byte [ebp - 1]
xor cl, bl
mov byte [eax + 3], cl
inc esi
mov cl, byte [eax - 0x1c]
xor cl, bh
mov byte [ebp - 2], cl
mov bh, byte [ebp - 2]
mov byte [edi], cl
movzx ecx, byte [eax - 0x1b]
xor cl, dl
mov byte [eax + 5], cl
movzx ecx, byte [eax - 0x1a]
xor cl, dh
mov byte [eax + 6], cl
cmp esi, 0x3c
jb 0x10002331
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003c00
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx + 0x20], 0
mov eax, ecx
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x28], 0
mov dword [ecx], 0x6a09e667
mov dword [ecx + 4], 0xbb67ae85
mov dword [ecx + 8], 0x3c6ef372
mov dword [ecx + 0xc], 0xa54ff53a
mov dword [ecx + 0x10], 0x510e527f
mov dword [ecx + 0x14], 0x9b05688c
mov dword [ecx + 0x18], 0x1f83d9ab
mov dword [ecx + 0x1c], 0x5be0cd19
ret

Function at 0x10003c50
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push dword [ebp + 0x10]
mov edi, ecx
push dword [ebp + 0xc]
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi], 0x6a09e667
mov dword [edi + 4], 0xbb67ae85
mov dword [edi + 8], 0x3c6ef372
mov dword [edi + 0xc], 0xa54ff53a
mov dword [edi + 0x10], 0x510e527f
mov dword [edi + 0x14], 0x9b05688c
mov dword [edi + 0x18], 0x1f83d9ab
mov dword [edi + 0x1c], 0x5be0cd19
call fcn.10003cd0
push dword [ebp + 8]
mov ecx, edi
call fcn.10003d80
mov eax, dword [ebp + 8]
pop edi
mov esp, ebp
pop ebp
ret 0xc