joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10094f50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x19c
mov eax, dword [0x101ed004]
xor eax, esp
mov dword [esp + 0x194], eax
mov eax, dword [esp + 0x1bc]
push ebx
push ebp
mov ebp, dword [esp + 0x1b0]
mov ebx, ecx
push esi
mov esi, dword [esp + 0x1b8]
push edi
cmp byte [ebp + 0x100], 0
mov edi, dword [esp + 0x1c8]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], eax
je 0x100951b6
mov eax, dword [esp + 0x1b4]
test eax, eax
je 0x100951b6
mov dword [ebx + 0xa98], eax
cmp byte [ebp + 0x100], 0
je 0x10094fff
movzx eax, byte [ebp + 0x101]
lea edi, [esp + 0xa0]
mov ecx, 0x40
mov esi, ebp
rep movsd dword es:[edi], dword [esi]
push eax
push 0
mov edx, 0x100
lea ecx, [esp + 0xa8]
call fcn.100a0620
mov esi, dword [esp + 0x1c]
add esp, 8
mov edi, dword [esp + 0x18]
xor eax, eax
mov word [esp + 0x19e], ax
jmp 0x10095009
xor eax, eax
mov word [esp + 0xa0], ax
push 0
push 0
push 0x80
lea eax, [esp + 0x2c]
mov byte [esp + 0x2c], 0
push eax
push 0xffffffffffffffff
lea eax, [esp + 0xb4]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x1b4]
dec eax
mov byte [esp + 0x9f], 0
cmp eax, 4
ja case.default.0x10095049
jmp dword [eax*4 + 0x100951d4]
mov cl, byte [esp + 0x20]
mov word [ebx + 0x10b5], 0
mov byte [ebx + 0x10b4], 0
test cl, cl
je case.default.0x10095049
xor al, al
lea edx, [esp + 0x20]
xor ah, ah
xor ch, ch
add al, cl
lea edx, [edx + 1]
add ch, cl
rol al, 1
xor ah, cl
mov cl, byte [edx]
test cl, cl
jne 0x10095076
mov byte [ebx + 0x10b6], al
mov byte [ebx + 0x10b5], ah
mov byte [ebx + 0x10b4], ch
jmp case.default.0x10095049
lea ecx, [ebx + 0xba4]
call fcn.100e20a0
lea ecx, [esp + 0x20]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100950b0
sub ecx, edx
lea edx, [esp + 0x20]
push 0x101f1fd0
push ecx
or ecx, 0xffffffff
call fcn.100d5f20
mov dl, byte [esp + 0x20]
mov word [ebx + 0x10b8], ax
shr eax, 0x10
mov word [ebx + 0x10ba], ax
xor eax, eax
mov dword [ebx + 0x10bc], eax
test dl, dl
je case.default.0x10095049
xor esi, esi
lea ebp, [esp + 0x20]
xor edi, edi
nop dword [eax + eax]
movzx eax, dl
lea ebp, [ebp + 1]
movzx edx, dl
lea ecx, [ebx + eax*4]
movzx eax, word [ecx + 0xba4]
xor ax, dx
xor di, ax
mov word [ebx + 0x10bc], di
movzx eax, word [ecx + 0xba6]
add ax, dx
mov dl, byte [ebp]
add si, ax
mov word [ebx + 0x10be], si
test dl, dl
jne 0x10095100
jmp case.default.0x10095049
lea eax, [esp + 0x20]
mov ecx, ebx
push eax
call fcn.10093470
jmp case.default.0x10095049
push esi
lea eax, [esp + 0xa4]
push eax
push ebp
push ecx
mov ecx, ebx
call fcn.10093810
jmp case.default.0x10095049
push dword [esp + 0x1c]
lea eax, [esp + 0xa4]
push edi
push dword [esp + 0x1cc]
push dword [esp + 0x1cc]
push esi
push eax
push ebp
push ecx
mov ecx, ebx
call fcn.100945f0
mov ecx, 0x80
lea eax, [esp + 0x20]
nop dword [eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x10095190
mov ecx, 0x100
lea eax, [esp + 0xa0]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x100951a7
mov al, 1
jmp 0x100951b8
xor al, al
mov ecx, dword [esp + 0x1a4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10142783
add esp, 0x19c
ret 0x20
Function at 0x1009f4e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10162f0b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x101ed004]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
push 0x8003
mov byte [esi + 0xc], 0
call fcn.1015d6d9
push 0x8003
push 0
push eax
mov dword [esi + 0x10], eax
call fcn.10143f10
mov dword [ebp - 4], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov byte [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov byte [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x54], 0
mov dword [esi + 0x58], 0
mov byte [esi + 0x5c], 0
push 0x100
lea eax, [esi + 0x4b44]
push 0
push eax
call fcn.10143f10
mov dword [esi + 0xe364], 0
mov dword [esi + 0x9f1c], 0
mov dword [esi + 0x9f24], 0
mov dword [esi + 0x9f20], 0
mov dword [esi + 0xe664], 0
mov byte [ebp - 4], 6
push 0x8003
mov byte [esi + 0xe690], 0
call fcn.1015d6d9
push 0x8003
push 0
push eax
mov dword [esi + 0xe694], eax
call fcn.10143f10
mov eax, dword [ebp + 8]
add esp, 0x2c
mov dword [esi + 0xe698], 0
mov ecx, esi
mov dword [esi + 0xe69c], 0
mov dword [esi + 0xe6a0], 0
mov dword [esi + 0xe6a4], 0
mov byte [esi + 0xe6a8], 0
mov dword [esi + 0xe6ac], 0
mov dword [esi + 0xe6b0], 0
mov dword [esi + 0xe6b4], 0
mov dword [esi + 0xe6b8], 0
mov byte [esi + 0xe6bc], 0
mov dword [esi + 0xe6c0], 0
mov dword [esi + 0xe6c4], 0
mov dword [esi + 0xe6c8], 0
mov dword [esi + 0xe6cc], 0
mov byte [esi + 0xe6d0], 0
push 0
mov dword [esi], eax
mov dword [esi + 0x4b40], 0
mov byte [esi + 0x4c44], 0
mov word [esi + 0x4c50], 0
mov byte [esi + 0x4c52], 0
mov dword [esi + 0x1c], 1
mov dword [esi + 0x14], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0xe6d8], 0
mov dword [esi + 0xe6dc], 0
call fcn.1009feb0
mov ecx, esi
mov dword [esi + 0x577c], 0
mov dword [esi + 0x5780], 0
mov dword [esi + 0x5778], 0
mov dword [esi + 0x5774], 0
mov dword [esi + 0x5770], 0
mov dword [esi + 0x576c], 0
mov dword [esi + 0x5768], 0x3500
mov dword [esi + 0x5798], 0x2001
mov dword [esi + 0x5794], 0x80
mov dword [esi + 0x5790], 0x80
mov dword [esi + 0x578c], 0
mov dword [esi + 0x5764], 0
mov dword [esi + 0x5784], 0
mov dword [esi + 0x5788], 0
mov dword [esi + 0x84], 0
call fcn.10099eb0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x100a0620
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov ecx, dword [0x101fb4ac]
test ecx, ecx
jne 0x100a068f
cmp byte [0x101fb4a8], cl
jne 0x100a068f
call fcn.100e4bd0
mov dword [0x101fb4a4], eax
test eax, eax
je 0x100a067b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptProtectMemory
push eax
call esi
push str.CryptUnprotectMemory
push dword [0x101fb4a4]
mov dword [0x101fb4ac], eax
call esi
mov ecx, dword [0x101fb4ac]
mov dword [0x101fb4b0], eax
mov byte [0x101fb4a8], 1
jmp 0x100a0694
mov eax, dword [0x101fb4b0]
mov ecx, dword [0x101fb4ac]
mov byte [0x101fb4a8], 1
jmp 0x100a0694
mov eax, dword [0x101fb4b0]
movzx esi, byte [esp + 0x14]
mov edx, ebx
and edx, 0xfffffff0
cmp byte [esp + 0x10], 0
je 0x100a06b4
test ecx, ecx
je 0x100a06c3
push esi
push edx
push edi
call ecx
test eax, eax
je 0x100a06ec
jmp 0x100a06e8
test eax, eax
je 0x100a06c3
push esi
push edx
push edi
call eax
test eax, eax
je 0x100a06f3
jmp 0x100a06e8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
xor eax, eax
mov dword [esp + 0x14], ecx
test ebx, ebx
je 0x100a06e8
add cl, 0x4b
lea edx, [eax + edi]
add cl, al
inc eax
xor byte [edx], cl
mov ecx, dword [esp + 0x14]
cmp eax, ebx
jb 0x100a06d5
pop edi
pop esi
pop ebx
ret
push 2
call fcn.100951f0
push 2
call fcn.100951f0
int3
Function at 0x100a1100
Capabilities:
Hash data using sha256

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x10], edx
mov esi, dword [edi + 0x20]
mov ebx, esi
mov ebp, dword [edi + 0x24]
and esi, 0x3f
shld ebp, ebx, 3
shl ebx, 3
mov byte [esi + edi + 0x28], 0x80
inc esi
cmp esi, 0x38
je 0x100a1168
jbe 0x100a1150
cmp esi, 0x40
jae 0x100a1147
mov eax, 0x40
lea ecx, [edi + 0x28]
sub eax, esi
add ecx, esi
push eax
push 0
push ecx
call fcn.10143f10
add esp, 0xc
mov ecx, edi
call fcn.100a0eb0
xor esi, esi
mov eax, 0x38
sub eax, esi
push eax
lea eax, [edi + 0x28]
add eax, esi
push 0
push eax
call fcn.10143f10
add esp, 0xc
bswap ebp
bswap ebx
mov ecx, edi
mov dword [edi + 0x60], ebp
mov dword [edi + 0x64], ebx
call fcn.100a0eb0
mov eax, dword [edi]
mov ecx, dword [esp + 0x10]
bswap eax
mov dword [ecx], eax
mov eax, dword [edi + 4]
bswap eax
mov dword [ecx + 4], eax
mov eax, dword [edi + 8]
bswap eax
mov dword [ecx + 8], eax
mov eax, dword [edi + 0xc]
bswap eax
mov dword [ecx + 0xc], eax
mov eax, dword [edi + 0x10]
bswap eax
mov dword [ecx + 0x10], eax
mov eax, dword [edi + 0x14]
bswap eax
mov dword [ecx + 0x14], eax
mov eax, dword [edi + 0x18]
bswap eax
mov dword [ecx + 0x18], eax
mov eax, dword [edi + 0x1c]
bswap eax
mov dword [ecx + 0x1c], eax
mov dword [edi], 0x6a09e667
mov dword [edi + 4], 0xbb67ae85
mov dword [edi + 8], 0x3c6ef372
mov dword [edi + 0xc], 0xa54ff53a
mov dword [edi + 0x10], 0x510e527f
mov dword [edi + 0x14], 0x9b05688c
mov dword [edi + 0x18], 0x1f83d9ab
mov dword [edi + 0x1c], 0x5be0cd19
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100a3960
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
push ebx
push ebp
mov ebp, ecx
mov ebx, edx
mov ecx, dword [esp + 0x10]
mov eax, 1
push esi
push edi
mov dword [esp + 0x10], ebx
mov edx, 0x3020100
mov esi, dword [ecx + 0x1238]
mov dword [ecx + 0x1240], 0x3020100
nop dword [eax + eax]
add edx, 0x4040404
mov dword [ecx + eax*4 + 0x1240], edx
inc eax
cmp eax, esi
jbe 0x100a3990
xor edi, edi
xor esi, esi
test ebx, ebx
je 0x100a39ee
nop word [eax + eax]
movzx eax, byte [esi + ebp]
mov ebx, dword [esp + 0x18]
or edi, eax
mov cl, byte [eax + ecx + 0x1240]
mov byte [esi + ebp], cl
mov byte [ebx + 0x123f], cl
nop word [eax + eax]
mov cl, byte [eax + ebx + 0x123f]
mov edx, eax
sub eax, 1
mov byte [edx + ebx + 0x1240], cl
jns 0x100a39d0
inc esi
mov ecx, ebx
cmp esi, dword [esp + 0x10]
jb 0x100a39b0
shr edi, 2
mov dword [ecx + 0x1238], edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100aa0d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
mov ebx, ecx
push esi
push edi
mov esi, edx
mov eax, dword [ebx]
test eax, eax
jne 0x100aa0e3
cmp dword [esi], eax
je 0x100aa0fd
jmp 0x100aa0f1
push 0x8000
push 0
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [ebx], 0
mov dword [esi], 0
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x100aa11d
push 0x40
push 0x3000
push edi
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebx], eax
test eax, eax
je 0x100aa121
mov dword [esi], edi
pop edi
pop esi
pop ebx
ret
mov ecx, str.allocx_failed
mov dword [esi], 0
call fcn.1004bef0
int3
Function at 0x100b7460
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x101ed004]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
lea eax, [esp + 0x1c]
mov edi, ecx
push eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x14], edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
test eax, eax
je 0x100b7505
mov esi, dword [esp + 0x18]
test esi, esi
je 0x100b7505
xor eax, eax
xor ebx, ebx
xor edi, edi
mov dword [esp + 0xc], eax
xor ecx, ecx
mov edx, 2
mov dword [esp + 0x18], ecx
lea ecx, [edx - 2]
mov eax, esi
shr eax, cl
lea ecx, [edx - 1]
and eax, 1
add ebx, eax
mov eax, esi
shr eax, cl
mov ecx, edx
and eax, 1
add dword [esp + 0x18], eax
mov eax, esi
shr eax, cl
lea ecx, [edx + 1]
and eax, 1
add edx, 4
add dword [esp + 0xc], eax
mov eax, esi
shr eax, cl
and eax, 1
add edi, eax
lea eax, [edx - 2]
cmp eax, 0x20
jb 0x100b74b5
mov eax, dword [esp + 0xc]
add eax, edi
mov edi, dword [esp + 0x10]
add eax, dword [esp + 0x18]
add eax, ebx
jmp 0x100b7514
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [esp + 0x10], 0x40000000
mov dword [esp + 0x14], 0
mov dword [edi + 0x10], 0x40000000
mov dword [edi + 0x14], 0
mov dword [edi + 8], 0x40000000
mov dword [edi + 0xc], 0
call fcn.100e7d10
test al, al
je 0x100b757c
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov dword [edi + 0x14], edx
mov dword [edi + 0x10], esi
shrd esi, edx, 5
shr edx, 5
mov eax, esi
mov ecx, edx
shld ecx, eax, 4
shl eax, 4
add eax, esi
mov dword [edi + 8], eax
adc ecx, edx
mov dword [edi + 0xc], ecx
mov ecx, dword [esp + 0x44]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10142783
mov esp, ebp
pop ebp
ret
Function at 0x100c0170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
xor eax, eax
nop dword [eax]
xor esi, esi
xor edx, edx
mov edi, eax
mov ecx, eax
and edi, 1
neg edi
adc esi, edx
and edi, 0xd7870f42
shrd ecx, edx, 1
neg esi
xor edi, ecx
shr edx, 1
and esi, 0xc96c5795
xor ecx, ecx
xor esi, edx
mov ebx, edi
and ebx, 1
neg ebx
adc ecx, ecx
xor edx, edx
shrd edi, esi, 1
neg ecx
and ebx, 0xd7870f42
and ecx, 0xc96c5795
shr esi, 1
xor ecx, esi
xor ebx, edi
mov esi, ebx
and esi, 1
neg esi
adc edx, edx
and esi, 0xd7870f42
shrd ebx, ecx, 1
neg edx
xor esi, ebx
shr ecx, 1
and edx, 0xc96c5795
mov edi, esi
xor edx, ecx
and edi, 1
xor ecx, ecx
neg edi
adc ecx, ecx
and edi, 0xd7870f42
shrd esi, edx, 1
neg ecx
xor edi, esi
shr edx, 1
and ecx, 0xc96c5795
mov esi, edi
xor ecx, edx
and esi, 1
xor edx, edx
neg esi
adc edx, edx
and esi, 0xd7870f42
shrd edi, ecx, 1
neg edx
xor esi, edi
shr ecx, 1
and edx, 0xc96c5795
mov edi, esi
xor edx, ecx
and edi, 1
xor ecx, ecx
neg edi
adc ecx, ecx
and edi, 0xd7870f42
shrd esi, edx, 1
neg ecx
xor edi, esi
shr edx, 1
and ecx, 0xc96c5795
mov ebx, edi
xor esi, esi
and ebx, 1
xor ecx, edx
neg ebx
adc esi, esi
neg esi
and ebx, 0xd7870f42
shrd edi, ecx, 1
and esi, 0xc96c5795
shr ecx, 1
xor ebx, edi
xor esi, ecx
mov edx, ebx
xor ecx, ecx
and edx, 1
neg edx
adc ecx, ecx
and edx, 0xd7870f42
shrd ebx, esi, 1
neg ecx
and ecx, 0xc96c5795
shr esi, 1
xor edx, ebx
xor ecx, esi
mov dword [eax*8 + 0x101f9108], edx
mov dword [eax*8 + 0x101f910c], ecx
inc eax
cmp eax, 0x100
jb 0x100c0180
mov esi, 0x101f9110
mov edi, 0x80
mov ecx, dword [esi - 8]
lea esi, [esi + 0x30]
mov edx, dword [esi - 0x34]
movzx eax, cl
shrd ecx, edx, 8
shr edx, 8
xor edx, dword [eax*8 + 0x101f910c]
xor ecx, dword [eax*8 + 0x101f9108]
mov dword [esi + 0x7cc], edx
mov edx, dword [esi - 0x2c]
mov dword [esi + 0x7c8], ecx
mov ecx, dword [esi - 0x30]
movzx eax, cl
shrd ecx, edx, 8
shr edx, 8
xor edx, dword [eax*8 + 0x101f910c]
xor ecx, dword [eax*8 + 0x101f9108]
mov dword [esi + 0x7d4], edx
mov edx, dword [esi - 0x24]
mov dword [esi + 0x7d0], ecx
mov ecx, dword [esi - 0x28]
movzx eax, cl
shrd ecx, edx, 8
shr edx, 8
xor edx, dword [eax*8 + 0x101f910c]
xor ecx, dword [eax*8 + 0x101f9108]
mov dword [esi + 0x7dc], edx
mov edx, dword [esi - 0x1c]
mov dword [esi + 0x7d8], ecx
mov ecx, dword [esi - 0x20]
movzx eax, cl
shrd ecx, edx, 8
shr edx, 8
xor edx, dword [eax*8 + 0x101f910c]
xor ecx, dword [eax*8 + 0x101f9108]
mov dword [esi + 0x7e4], edx
mov edx, dword [esi - 0x14]
mov dword [esi + 0x7e0], ecx
mov ecx, dword [esi - 0x18]
movzx eax, cl
shrd ecx, edx, 8
shr edx, 8
xor edx, dword [eax*8 + 0x101f910c]
xor ecx, dword [eax*8 + 0x101f9108]
mov dword [esi + 0x7ec], edx
mov edx, dword [esi - 0xc]
mov dword [esi + 0x7e8], ecx
mov ecx, dword [esi - 0x10]
movzx eax, cl
shrd ecx, edx, 8
shr edx, 8
xor ecx, dword [eax*8 + 0x101f9108]
xor edx, dword [eax*8 + 0x101f910c]
mov dword [esi + 0x7f0], ecx
mov dword [esi + 0x7f4], edx
sub edi, 1
jne 0x100c02c0
pop edi
pop esi
mov dword [0x101fc764], 0x100f0440
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100cde50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
push 4
mov ebp, ecx
mov esi, edx
push str.wvpk
xor ebx, ebx
mov dword [esp + 0x24], esi
push ebp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x20], ebx
call fcn.1014c3c0
add esp, 0xc
test eax, eax
jne 0x100cdfcf
mov edi, dword [ebp + 4]
lea eax, [edi + 8]
cmp eax, 0x20
jb 0x100cdfcf
add edi, 0xffffffe8
lea eax, [ebp + 0x20]
cmp edi, 2
jb 0x100cdfad
nop
mov cl, byte [eax + 1]
sub edi, 2
mov ch, byte [eax]
add eax, 2
movzx esi, cl
add esi, esi
mov byte [esp + 0x13], ch
test ch, ch
jns 0x100cdee4
cmp edi, 2
jb 0x100cdfcf
mov cl, byte [eax + 1]
mov bl, byte [eax]
add eax, 2
movzx edx, cl
shl edx, 8
movzx ecx, bl
mov ebx, dword [esp + 0x14]
add edx, ecx
mov ch, byte [esp + 0x13]
shl edx, 9
add esi, edx
sub edi, 2
cmp edi, esi
jb 0x100cdfcf
cmp dword [esp + 0x1c], 0
je 0x100cdf9c
mov cl, ch
and cl, 0x3f
cmp cl, 0x2f
jne 0x100cdf9c
mov edx, eax
or ebx, 0xffffffff
sub edx, dword [esp + 0x18]
sub edx, 2
sar edx, 1
test ch, 0x40
jne 0x100cdfcf
cmp esi, 2
jb 0x100cdfcf
cmp esi, 4
ja 0x100cdfcf
test edx, edx
je 0x100cdf43
movzx ecx, word [ebp]
lea ebx, [ebx + ebx*2]
add ebx, ecx
lea ebp, [ebp + 2]
sub edx, 1
jne 0x100cdf32
movzx edx, byte [eax]
cmp esi, 4
jne 0x100cdf74
movzx ecx, bl
cmp edx, ecx
jne 0x100cdfcf
mov cl, byte [eax + 1]
mov edx, ebx
shr edx, 8
cmp cl, dl
jne 0x100cdfcf
mov cl, byte [eax + 2]
mov edx, ebx
shr edx, 0x10
cmp cl, dl
jne 0x100cdfcf
mov cl, byte [eax + 3]
shr ebx, 0x18
add eax, esi
jmp 0x100cdf8b
mov ecx, ebx
shr ecx, 0x10
xor ebx, ecx
movzx ecx, bl
cmp edx, ecx
jne 0x100cdfcf
mov cl, byte [eax + 1]
shr ebx, 8
add eax, 2
cmp cl, bl
jne 0x100cdfcf
mov ebx, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
inc ebx
mov dword [esp + 0x14], ebx
sub edi, esi
add eax, esi
cmp edi, 2
jae 0x100cdea0
mov esi, dword [esp + 0x1c]
test edi, edi
jne 0x100cdfcf
test esi, esi
je 0x100cdfc2
test dword [ebp + 0x18], 0x10000000
je 0x100cdfc2
test ebx, ebx
je 0x100cdfcf
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x100d34b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [esp + 0x18]
mov ebx, ecx
push edi
xor edi, edi
mov dword [esp + 0x10], ebx
mov esi, dword [esi]
and esi, 7
cmp edx, 5
jae 0x100d34d5
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
add dword [esp + 0x18], 5
push ebp
lea ebp, [edx - 4]
add ebp, ebx
lea eax, [edi + ebx]
cmp eax, ebp
jae 0x100d34f6
mov cl, byte [eax]
and cl, 0xfe
cmp cl, 0xe8
je 0x100d34f6
inc eax
cmp eax, ebp
jb 0x100d34e7
mov edx, eax
sub edx, edi
mov edi, eax
sub edx, ebx
sub edi, ebx
cmp eax, ebp
jae 0x100d35f8
cmp edx, 2
jbe 0x100d3585
xor esi, esi
movzx edx, byte [eax + 4]
lea ecx, [edx + 1]
test cl, 0xfe
jne 0x100d35e7
movzx ecx, byte [eax + 3]
mov ebx, dword [esp + 0x1c]
shl edx, 8
add ebx, edi
or edx, ecx
movzx ecx, byte [eax + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax + 1]
shl edx, 8
or edx, ecx
mov ecx, edx
add edx, ebx
sub ecx, ebx
cmp dword [esp + 0x24], 0
cmove edx, ecx
mov dword [esp + 0x10], edx
mov ebx, edx
test esi, esi
je 0x100d35b9
and esi, 6
shl esi, 2
mov ecx, esi
shr edx, cl
inc edx
test dl, 0xfe
jne 0x100d35b7
mov ebx, 0x100
shl ebx, cl
mov ecx, dword [esp + 0x1c]
dec ebx
xor ebx, dword [esp + 0x10]
add ecx, edi
cmp dword [esp + 0x24], 0
je 0x100d35b5
add ebx, ecx
jmp 0x100d35b7
mov ecx, edx
shr esi, cl
test esi, esi
je 0x100d350f
cmp esi, 4
ja 0x100d35aa
cmp esi, 3
je 0x100d35aa
mov ecx, esi
shr ecx, 1
movzx ecx, byte [ecx + eax + 1]
inc ecx
test cl, 0xfe
jne 0x100d350f
or esi, 8
shr esi, 1
inc edi
jmp 0x100d34e0
sub ebx, ecx
xor esi, esi
mov ecx, ebx
mov byte [eax + 1], bl
shr ecx, 8
mov byte [eax + 2], cl
mov ecx, ebx
shr ebx, 0x18
and bl, 1
shr ecx, 0x10
neg bl
mov byte [eax + 3], cl
mov byte [eax + 4], bl
mov eax, 5
mov ebx, dword [esp + 0x14]
add edi, eax
jmp 0x100d34e0
or esi, 8
mov eax, 1
shr esi, 1
add edi, eax
jmp 0x100d34e0
mov eax, dword [esp + 0x20]
mov ecx, edx
shr esi, cl
xor ecx, ecx
cmp edx, 2
pop ebp
cmovbe ecx, esi
mov dword [eax], ecx
mov eax, edi
pop edi
pop esi
pop ebx
add esp, 8
ret
Function at 0x100d5f20
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], edx
push edi
mov edi, dword [esp + 0x14]
test esi, esi
je 0x100d5f50
test dl, 7
je 0x100d5f4c
movzx eax, byte [edx]
inc edx
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [edi + eax*4]
sub esi, 1
jne 0x100d5f33
mov dword [esp + 8], edx
cmp esi, 8
jb 0x100d5fde
push ebx
push ebp
mov ebp, esi
shr ebp, 3
xor ecx, dword [edx]
sub esi, 8
mov ebx, dword [edx + 4]
mov eax, ecx
shr eax, 8
movzx edx, al
mov eax, ecx
shr eax, 0x10
movzx eax, al
mov edx, dword [edi + edx*4 + 0x1800]
xor edx, dword [edi + eax*4 + 0x1400]
mov eax, ebx
shr eax, 8
movzx eax, al
xor edx, dword [edi + eax*4 + 0x800]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor edx, dword [edi + eax*4 + 0x400]
mov eax, ecx
shr eax, 0x18
xor edx, dword [edi + eax*4 + 0x1000]
movzx eax, cl
xor edx, dword [edi + eax*4 + 0x1c00]
movzx eax, bl
shr ebx, 0x18
xor edx, dword [edi + eax*4 + 0xc00]
xor edx, dword [edi + ebx*4]
mov ecx, edx
mov edx, dword [esp + 0x10]
add edx, 8
mov dword [esp + 0x10], edx
sub ebp, 1
jne 0x100d5f60
pop ebp
pop ebx
test esi, esi
je 0x100d5ff8
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [edi + eax*4]
sub esi, 1
jne 0x100d5fe2
pop edi
mov eax, ecx
pop esi
pop ecx
ret 8
Function at 0x100d7320
Capabilities:
Hash data using sha256

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, dword [edi + 0x20]
and esi, 0x3f
mov byte [esi + edi + 0x28], 0x80
inc esi
cmp esi, 0x38
je 0x100d734f
and esi, 0x3f
jne 0x100d7344
mov ecx, edi
call fcn.100d65a0
mov byte [esi + edi + 0x28], 0
inc esi
cmp esi, 0x38
jne 0x100d7338
mov ecx, dword [edi + 0x20]
mov eax, dword [edi + 0x24]
shld eax, ecx, 3
shl ecx, 3
bswap ecx
bswap eax
mov dword [edi + 0x64], ecx
mov ecx, edi
mov dword [edi + 0x60], eax
call fcn.100d65a0
xor edx, edx
nop
mov ecx, dword [edi + edx*4 + 4]
lea ebx, [ebx + 8]
mov eax, dword [edi + edx*4]
add edx, 2
bswap eax
mov dword [ebx - 8], eax
bswap ecx
mov dword [ebx - 4], ecx
cmp edx, 8
jb 0x100d7370
mov dword [edi], 0x6a09e667
mov dword [edi + 4], 0xbb67ae85
mov dword [edi + 8], 0x3c6ef372
mov dword [edi + 0xc], 0xa54ff53a
mov dword [edi + 0x10], 0x510e527f
mov dword [edi + 0x14], 0x9b05688c
mov dword [edi + 0x18], 0x1f83d9ab
mov dword [edi + 0x1c], 0x5be0cd19
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
pop edi
pop esi
pop ebx
ret