joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a45b0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp - 4]
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 8], eax
cmp edx, ecx
ja 0x100a45e8
jb 0x100a45de
cmp eax, ebx
jae 0x100a45e8
mov eax, ebx
mov edx, ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 0x18]
push 0
push eax
push edx
push ecx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esi + 8], eax
test eax, eax
jne 0x100a460e
call fcn.1009f330
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov edx, dword [ebp + 0x10]
test ebx, ebx
jne 0x100a461f
mov ecx, dword [ebp - 8]
sub ecx, edx
mov dword [esi + 4], ecx
jmp 0x100a4622
mov dword [esi + 4], ebx
mov ecx, dword [ebp + 0x1c]
mov dword [esi + 0x10], edx
mov edx, dword [ebp + 0x14]
push 0
mov dword [esi + 0x14], edx
mov edx, dword [esi + 4]
push edx
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push ecx
push eax
mov dword [esi + 0x18], ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov dword [esi], eax
test eax, eax
jne 0x100a4670
call fcn.1009f330
mov edi, eax
mov eax, dword [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
mov dword [esi + 8], 0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x100a4720
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
xor eax, eax
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x24]
mov word [ebp - 0x24], ax
mov eax, dword [ebp + 8]
push edx
push eax
mov dword [ebp - 8], 0x1c
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x100a474f
xor eax, eax
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ecx
push edx
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x24]
push edx
call fcn.100a40c0
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x100a4770
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 4]
push 0
push 0x80
push 3
push 0
push 1
push bind
test ecx, ecx
je 0x100a479e
mov eax, dword [ebp + 8]
push eax
call fcn.100a4490
jmp 0x100a47a8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x100a480d
call fcn.1009f330
test eax, eax
js 0x100a4820
mov eax, dword [edi]
lea edx, [ebp - 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x100a47d7
call fcn.1009f330
test eax, eax
js 0x100a4820
mov eax, dword [ebp - 8]
push esi
mov esi, dword [ebp - 4]
test esi, esi
jne 0x100a47e3
test eax, eax
je 0x100a4811
mov edx, dword [ebp + 0x14]
xor ecx, ecx
cmp esi, ecx
ja 0x100a4811
jb 0x100a47f2
cmp eax, edx
ja 0x100a4811
mov eax, dword [edi]
mov ecx, dword [ebp + 0x10]
push 4
push 2
push 0
push 0
push 0
push eax
call fcn.100a45b0
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov dword [edi], eax
jmp 0x100a47b6
or eax, esi
mov eax, 0x800703ee
je 0x100a481f
mov eax, 0x800700df
pop esi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x100a57c0
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp dword [ebp + 0xc], ebx
je 0x100a582f
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
push 0x30
push eax
push ecx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x100a58a5
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x1c]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
je 0x100a5824
cmp eax, 0xffffffff
jne 0x100a581c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x100a5824
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp word [eax], 2
setne cl
dec ecx
and ecx, 0xfffffff4
add ecx, 0x1c
push ecx
push eax
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x100a58a5
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x1c]
push 0x23
push ecx
push edx
call dword [sym.imp.WS2_32.dll_WSAEventSelect]
cmp eax, 0xffffffff
je 0x100a58a5
mov dword [esi + 0x50], 1
push 0
mov dword [esi + 0x54], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov edx, dword [eax + 0xb8]
mov ecx, esi
call edx
cmp eax, 2
jne 0x100a5824
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100a589e
mov eax, 0x4c7
push eax
call dword [sym.imp.WS2_32.dll_WSASetLastError]
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x100a5a20
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x190]
push edi
test eax, eax
jne 0x100a5adc
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
lea esp, [esp]
mov ecx, dword [esi + 0x2c]
mov eax, dword [esi + 0x60]
mov edx, dword [esi + 0x1c]
push 0
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
test edi, edi
jle 0x100a5aaf
push 0
call ebx
mov eax, dword [esi + 0x60]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0xc8]
mov ecx, esi
call eax
cmp eax, 2
jne 0x100a5ab8
mov edx, dword [esi + 0x24]
push edx
push str._C_CNNID:__Iu__OnReceive___event_return_HR_ERROR__connection_will_be_closed___n
call fcn.100a05b0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x100a5a94
mov eax, 0x4c7
mov dword [esi + 0x10], 4
mov dword [esi + 0x14], eax
mov ecx, 1
mov dword [esi + 0x18], ecx
pop edi
mov dword [esi + 0xc], ecx
pop esi
xor eax, eax
pop ebx
ret
cmp edi, 0xffffffff
je 0x100a5acf
test edi, edi
je 0x100a5ae5
mov ecx, dword [esi + 0x190]
test ecx, ecx
je 0x100a5a40
pop edi
pop esi
mov eax, 1
pop ebx
ret
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x100a5a94
pop edi
pop esi
mov eax, 1
pop ebx
ret
mov dword [esi + 0x10], 5
mov dword [esi + 0x14], 0
mov ecx, 1
mov dword [esi + 0x18], ecx
pop edi
mov dword [esi + 0xc], ecx
pop esi
xor eax, eax
pop ebx
ret
Function at 0x100a5b10
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x18]
push esi
mov esi, ecx
mov ecx, dword [ebx + 0x14]
sub eax, ecx
push edi
je 0x100a5bb6
lea esp, [esp]
mov edx, dword [esi + 0x2c]
cmp eax, edx
jl 0x100a5b39
mov eax, edx
push 0
push eax
mov eax, dword [esi + 0x1c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
test edi, edi
jle 0x100a5ba3
lea ebx, [esi + 0x158]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
sub dword [esi + 0x18c], edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x14]
mov edx, dword [esi]
push edi
push eax
mov eax, dword [edx + 0xc0]
mov ecx, esi
call eax
cmp eax, 2
jne 0x100a5b99
mov ecx, dword [esi + 0x24]
push ecx
push str._C_CNNID:__Iu__OnSend___event_should_not_return_HR_ERROR____n
call fcn.100a05b0
add esp, 8
push edi
mov ecx, ebx
call fcn.100a6c30
jmp 0x100a5ba8
cmp edi, 0xffffffff
je 0x100a5bc2
mov ecx, dword [ebx + 0x14]
mov eax, dword [ebx + 0x18]
sub eax, ecx
jne 0x100a5b30
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 8
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x100a5be4
mov edx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [edx], 1
mov eax, 1
pop ebx
pop ebp
ret 8
mov ecx, 1
pop edi
mov dword [esi + 0x14], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], 3
mov dword [esi + 0x18], ecx
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8

Function at 0x100a69f0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
lea eax, [esi + 0x48]
push eax
push 0
push esi
push 0x100a6800
push 0
push 0
call fcn.101e4081
xor ecx, ecx
add esp, 0x18
test eax, eax
setne cl
mov dword [esi + 0x44], eax
pop esi
mov eax, ecx
ret
Function at 0x100b3380
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ebx, ebx
test ebp, ebp
je 0x100b33f5
mov al, byte [ebp]
test al, al
je 0x100b33f5
push esi
mov dword [esp + 0x10], 0x100
push edi
lea ecx, [ecx]
movsx eax, al
push eax
call fcn.100efe60
mov esi, eax
or esi, dword [esp + 0x18]
mov ecx, 0x20
mov edi, esi
shr edi, 2
xor edi, esi
and edi, 0xf
add esp, 4
sub ecx, edi
mov eax, ebx
xor edx, edx
call fcn.101e1bf0
imul esi, esi
add dword [esp + 0x14], 0x100
mov ecx, edi
shl ebx, cl
inc ebp
or eax, ebx
xor eax, esi
mov ebx, eax
mov al, byte [ebp]
test al, al
jne 0x100b33a0
pop edi
mov eax, ebx
pop esi
shr eax, 0x10
pop ebp
xor eax, ebx
pop ebx
ret
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x100c2e80
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
ret

Function at 0x100c9330
Capabilities:
Allocate thread local storage

Disassembly:
push 0
push 0
push 0
call fcn.100a8370
add esp, 0xc
test eax, eax
jne 0x100c9345
xor eax, eax
ret
push 0
push 0x103965f8
call fcn.100c2e60
add esp, 8
test eax, eax
je 0x100c9342
push ebx
push 0
push 0x103965fc
call fcn.100c2e60
add esp, 8
test eax, eax
je 0x100c93d5
mov eax, dword [0x10396608]
mov ecx, dword [0x10349098]
push esi
push eax
push ecx
xor ecx, ecx
lea ebx, [ecx + 1]
call fcn.100c9170
mov esi, eax
add esp, 8
test esi, esi
je 0x100c93bd
push esi
call fcn.100c9040
add esp, 4
test eax, eax
jne 0x100c93a7
push esi
call fcn.100c85d0
add esp, 4
xor esi, esi
jmp 0x100c93bd
push 0x1c
push str.OpenSSL_NIST_SP_800_90A_DRBG
mov dword [esi + 0x58], ebx
push esi
mov dword [esi + 0x5c], ebx
call fcn.100c8650
add esp, 0xc
mov dword [0x10396600], esi
test esi, esi
pop esi
jne 0x100c93e6
push 0x103965fc
call fcn.100c2ed0
add esp, 4
push 0x103965f8
call fcn.100c2ed0
add esp, 4
xor eax, eax
pop ebx
ret
mov eax, ebx
pop ebx
ret
Function at 0x100cb870
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x208
call fcn.101e1c60
mov eax, dword [0x1035eca0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x100cb8e5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x100cb8e5
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x204]
push 0x200
push edx
call fcn.101e55da
add esp, 0x10
test eax, eax
jns 0x100cb8c8
mov eax, 0x200
push 0
lea ecx, [ebp - 0x208]
push ecx
push eax
lea edx, [ebp - 0x204]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x100cba2e
mov ebx, dword [ebp + 8]
mov eax, ebx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100cb8f0
sub eax, edx
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.101e4890
mov esi, esp
test esi, esi
jne 0x100cb914
mov esi, str.no_stack_
jmp 0x100cb99f
push edi
push esi
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x100cb941
test edi, edi
je 0x100cb941
lea ebx, [ebx]
mov ecx, dword [ebp + 8]
movsx dx, byte [eax + ecx]
mov word [esi + eax*2], dx
inc eax
cmp eax, edi
jb 0x100cb930
xor eax, eax
test edi, edi
je 0x100cb99f
cmp word [esi + eax*2], 0x25
jne case.0x100cb964.43
lea ecx, [esi + eax*2 + 2]
movzx edx, word [ecx]
add edx, 0xffffffd6
cmp edx, 0x49
ja case.0x100cb964.43
movzx edx, byte [edx + 0x100cba60]
jmp dword [edx*4 + 0x100cba48]
inc eax
add ecx, 2
jmp 0x100cb952
mov ecx, 0x53
mov word [esi + eax*2 + 2], cx
jmp case.0x100cb964.43
mov edx, 0x73
jmp 0x100cb995
mov ecx, 0x43
mov word [esi + eax*2 + 2], cx
jmp case.0x100cb964.43
mov edx, 0x63
mov word [esi + eax*2 + 2], dx
inc eax
cmp eax, edi
jb 0x100cb947
lea eax, [ebp + 0xc]
push eax
push esi
lea ecx, [ebp - 0x204]
push 0xff
push ecx
call fcn.101e5511
xor edx, edx
add esp, 0x10
mov word [ebp - 6], dx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x100cba18
call fcn.100cb730
test eax, eax
jle 0x100cba18
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x100cba2e
push 0
lea ecx, [ebp - 0x208]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x204]
push esi
mov dword [ebp - 0x208], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x100cba2e
push 0x10
push str.OpenSSL:_FATAL
lea edx, [ebp - 0x204]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101e425c
mov esp, ebp
pop ebp
ret

Function at 0x100cbae0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
je 0x100cbb06
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
sub esi, eax
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
or cl, dl
inc eax
dec edi
jne 0x100cbaf7
pop esi
pop ebx
movzx eax, cl
pop edi
ret
Function at 0x100e52d0
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
push ebx
call fcn.1013d650
push 0x62
push esi
mov edi, eax
mov ebp, 1
call fcn.101e2720
add esp, 0x10
test eax, eax
jne 0x100e52fc
lea ebp, [eax + 0x11]
test edi, edi
jne 0x100e5385
push 0x45
push str.crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.100b26d0
push 0x1023a9ac
push esi
push 0x1025e0ac
push ebx
push str.fopen_
push 5
call fcn.100b2c50
add esp, 0x2c
call fcn.101e2f6f
cmp dword [eax], 2
je 0x100e5366
call fcn.101e2f6f
cmp dword [eax], 6
je 0x100e5366
push 0x4e
push str.crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.100b26d0
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x4c
push str.crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.100b26d0
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x1025e050
call fcn.100af130
mov esi, eax
add esp, 4
test esi, esi
jne 0x100e53a8
push edi
call fcn.101e2e3e
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.100af300
push edi
push ebp
push 0x6a
push esi
call fcn.100afa50
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x100f4fb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, edi
mov ecx, ebp
cmp edi, 4
jb 0x100f4fd8
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x100f4fe0
sub esi, 4
add ecx, 4
add edx, 4
cmp esi, 4
jae 0x100f4fc4
test esi, esi
je case.0x100f509e.2
movzx eax, byte [edx]
movzx ebx, byte [ecx]
sub eax, ebx
jne 0x100f5027
cmp esi, 1
jbe case.0x100f509e.2
movzx eax, byte [edx + 1]
movzx ebx, byte [ecx + 1]
sub eax, ebx
jne 0x100f5027
cmp esi, 2
jbe case.0x100f509e.2
movzx eax, byte [edx + 2]
movzx ebx, byte [ecx + 2]
sub eax, ebx
jne 0x100f5027
cmp esi, 3
jbe case.0x100f509e.2
movzx eax, byte [edx + 3]
movzx ecx, byte [ecx + 3]
sub eax, ecx
sar eax, 0x1f
or eax, 1
jle case.0x100f509e.2
mov ebx, dword [esp + 0x10]
xor edx, edx
test edi, edi
jle 0x100f5050
mov esi, ebx
mov eax, ebp
sub esi, ebp
mov cl, byte [esi + eax]
cmp cl, byte [eax]
jne 0x100f5050
inc edx
inc eax
cmp edx, edi
jl 0x100f5043
lea eax, [edi - 1]
test eax, eax
js 0x100f506f
mov esi, ebx
lea ecx, [eax + ebp]
sub esi, ebp
mov edi, edi
cmp byte [ecx + esi], 0
jne 0x100f506f
cmp byte [ecx], 0xff
jne 0x100f506f
dec ecx
dec eax
jns 0x100f5060
cmp edx, eax
jl case.0x100f509e.2
jle 0x100f5080
pop esi
pop ebp
lea eax, [edx*8]
pop ebx
ret
mov cl, byte [edx + ebx]
mov bl, byte [edx + ebp]
mov al, bl
xor al, cl
mov byte [esp + 0x10], cl
movzx ecx, al
dec ecx
cmp ecx, 0x7e
ja case.0x100f509e.2
movzx ecx, byte [ecx + 0x100f5110]
jmp dword [ecx*4 + 0x100f50f0]
mov esi, 7
jmp 0x100f50d4
mov esi, 6
jmp 0x100f50d4
mov esi, 5
jmp 0x100f50d4
mov esi, 4
jmp 0x100f50d4
mov esi, 3
jmp 0x100f50d4
mov esi, 2
jmp 0x100f50d4
mov esi, 1
test byte [esp + 0x10], al
jne case.0x100f509e.2
and bl, al
cmp bl, al
jne case.0x100f509e.2
lea eax, [esi + edx*8]
pop esi
pop ebp
pop ebx
ret
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret

Function at 0x100fc1f0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
movzx edi, byte [esp + 0x10]
mov eax, edi
and eax, 1
add esi, ecx
add edx, ecx
test ecx, ecx
je 0x100fc223
push ebx
lea esp, [esp]
movzx ebx, byte [edx - 1]
dec edx
xor ebx, edi
add eax, ebx
dec esi
mov byte [esi], al
shr eax, 8
dec ecx
jne 0x100fc210
pop ebx
pop edi
pop esi
ret
Function at 0x100fde50
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x84], 0xffffffff
jne 0x100fde62
xor eax, eax
pop edi
ret
mov eax, dword [edi]
push ebx
push esi
push eax
call fcn.100cc750
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add esp, 4
mov esi, eax
mov dword [ecx], esi
test ebx, ebx
je 0x100fdf07
mov eax, dword [edi + 0x84]
push ebp
cmp eax, esi
jne 0x100fdeae
test esi, esi
jle 0x100fdee4
mov ecx, ebx
lea eax, [edi + 4]
mov ebp, esi
lea esp, [esp]
mov dl, byte [eax + 0x60]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
dec ebp
jne 0x100fdea0
jmp 0x100fdee4
mov ecx, esi
sub ecx, eax
mov byte [eax + edi + 0x64], 0x80
cmp ecx, 1
jle 0x100fdecd
dec ecx
push ecx
lea eax, [eax + edi + 0x65]
push 0
push eax
call fcn.101e44a0
add esp, 0xc
test esi, esi
jle 0x100fdee4
mov ecx, ebx
lea eax, [edi + 0x24]
mov ebp, esi
mov dl, byte [eax + 0x40]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
dec ebp
jne 0x100fded8
mov eax, dword [edi]
push esi
push ebx
push ebx
push eax
call fcn.100cc760
add esp, 0x10
pop ebp
test eax, eax
jne 0x100fdf07
push esi
push ebx
call fcn.100efe10
add esp, 8
pop esi
pop ebx
xor eax, eax
pop edi
ret
pop esi
pop ebx
mov eax, 1
pop edi
ret

Function at 0x1010bdd0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.1010bb60

Function at 0x1010c280
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.1010bde0

Function at 0x1010e010
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
cmp edi, eax
je 0x1010e09b
mov edx, dword [esp + 8]
lea ecx, [edx - 1]
not edx
shr edx, 0x1f
push esi
mov esi, dword [edi + 4]
shr ecx, 0x1f
and ecx, edx
mov edx, dword [eax + 4]
xor edx, esi
dec ecx
and edx, ecx
xor esi, edx
mov dword [edi + 4], esi
xor dword [eax + 4], edx
mov esi, dword [edi + 0xc]
mov edx, dword [eax + 0xc]
xor edx, esi
and edx, ecx
xor esi, edx
mov dword [edi + 0xc], esi
xor dword [eax + 0xc], edx
mov esi, dword [edi + 0x10]
mov edx, dword [eax + 0x10]
xor edx, esi
and edx, ecx
and edx, 4
xor esi, edx
mov dword [edi + 0x10], esi
xor dword [eax + 0x10], edx
xor esi, esi
cmp dword [esp + 0x18], esi
jle 0x1010e09a
push ebx
push ebp
mov edx, dword [edi]
mov ebx, dword [edx + esi*4]
lea ebp, [edx + esi*4]
mov edx, dword [eax]
mov edx, dword [edx + esi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + esi*4], edx
lea ebx, [ebx + esi*4]
inc esi
cmp esi, dword [esp + 0x20]
jl 0x1010e073
pop ebp
pop ebx
pop esi
pop edi
ret

Function at 0x10110370
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.101e44a0
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
mov eax, 1
pop esi
ret
Function at 0x101103d0
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.101e44a0
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
pop esi
ret
Function at 0x10111a50
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
lea eax, [ecx + 1]
ret

Function at 0x10111af0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x101179e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.101e1c60
mov eax, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x28]
test esi, esi
je 0x10117a25
test ebx, ebx
je 0x10117a25
mov cl, byte [esi + edi]
mov ebp, dword [esp + 0x18]
xor cl, byte [ebp]
mov eax, dword [esp + 0x1c]
mov byte [eax], cl
inc eax
inc ebp
inc esi
dec ebx
and esi, 0xf
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebp
jne 0x10117a00
cmp ebx, 0x10
jb 0x10117a9d
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, edx
sub eax, edi
mov dword [esp + 0x20], eax
mov eax, ebx
shr eax, 4
mov ebp, ecx
mov dword [esp + 0x10], eax
shl eax, 4
add ecx, eax
sub ebp, edi
add edx, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x24]
push edx
push edi
push edi
call dword [esp + 0x3c]
add esp, 0xc
cmp esi, 0x10
jae 0x10117a8a
mov ecx, 0xf
sub ecx, esi
shr ecx, 2
lea eax, [esi + edi]
inc ecx
mov edx, dword [esp + 0x20]
mov edx, dword [edx + eax]
xor edx, dword [eax]
add eax, 4
dec ecx
mov dword [eax + ebp - 4], edx
jne 0x10117a77
add dword [esp + 0x20], 0x10
sub ebx, 0x10
add ebp, 0x10
xor esi, esi
dec dword [esp + 0x10]
jne 0x10117a56
test ebx, ebx
je 0x10117ad9
mov eax, dword [esp + 0x24]
push eax
push edi
push edi
call dword [esp + 0x3c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
add esp, 0xc
lea eax, [esi + edi]
sub ebp, edi
sub ecx, edi
add esi, ebx
mov dl, byte [eax + ebp]
xor dl, byte [eax]
inc eax
dec ebx
mov byte [eax + ecx - 1], dl
jne 0x10117ac0
mov eax, dword [esp + 0x2c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x2c]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
pop ecx
ret