joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10296490
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, ecx
mov dword [ebp - 0x14], edx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [eax]
add edi, 8
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 8
mov esi, dword [edx]
lea edi, [edi + 0x10]
mov edx, dword [edi - 0x14]
mov ebx, esi
xor edx, esi
ror ebx, 4
xor ebx, dword [edi - 0x18]
mov eax, edx
shr eax, 0x10
movzx ecx, al
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x10462208]
xor ecx, dword [eax*4 + 0x10469c08]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0x10462608]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10469808]
mov eax, edx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x10468c08]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x104644e8]
movzx eax, dl
mov edx, dword [edi - 0xc]
xor ecx, dword [eax*4 + 0x10462a08]
movzx eax, bl
xor ecx, dword [eax*4 + 0x104640e8]
xor ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ebx, ecx
xor edx, ebx
mov dword [ebp - 4], ebx
mov dword [eax], ecx
mov eax, edx
shr eax, 0x10
ror ecx, 4
xor ecx, dword [edi - 0x10]
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp - 0x10]
movzx ecx, al
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x10462208]
xor ecx, dword [eax*4 + 0x10469c08]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0x10462608]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10469808]
mov eax, edx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x10468c08]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x104644e8]
movzx eax, dl
mov edx, dword [ebp - 0x14]
xor ecx, dword [eax*4 + 0x10462a08]
movzx eax, bl
xor ecx, dword [eax*4 + 0x104640e8]
xor ecx, esi
sub dword [ebp - 8], 1
mov dword [edx], ecx
jne 0x102964b3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x102965d0
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov eax, ecx
mov dword [ebp - 0x14], edx
push esi
push edi
mov edi, dword [ebp + 8]
mov ecx, dword [eax]
add edi, 0x7c
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], 8
mov esi, dword [edx]
lea edi, [edi - 0x10]
mov edx, dword [edi + 0x10]
mov ebx, esi
xor edx, esi
ror ebx, 4
xor ebx, dword [edi + 0xc]
mov eax, edx
shr eax, 0x10
movzx ecx, al
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x10462208]
xor ecx, dword [eax*4 + 0x10469c08]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0x10462608]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10469808]
mov eax, edx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x10468c08]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x104644e8]
movzx eax, dl
mov edx, dword [edi + 8]
xor ecx, dword [eax*4 + 0x10462a08]
movzx eax, bl
xor ecx, dword [eax*4 + 0x104640e8]
xor ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ebx, ecx
xor edx, ebx
mov dword [ebp - 4], ebx
mov dword [eax], ecx
mov eax, edx
shr eax, 0x10
ror ecx, 4
xor ecx, dword [edi + 4]
mov dword [ebp - 0x10], ecx
mov ebx, dword [ebp - 0x10]
movzx ecx, al
mov eax, edx
shr eax, 8
movzx eax, al
mov ecx, dword [ecx*4 + 0x10462208]
xor ecx, dword [eax*4 + 0x10469c08]
mov eax, ebx
shr eax, 0x10
movzx eax, al
xor ecx, dword [eax*4 + 0x10462608]
mov eax, ebx
shr eax, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x10469808]
mov eax, edx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x10468c08]
mov eax, ebx
shr eax, 0x18
xor ecx, dword [eax*4 + 0x104644e8]
movzx eax, dl
mov edx, dword [ebp - 0x14]
xor ecx, dword [eax*4 + 0x10462a08]
movzx eax, bl
xor ecx, dword [eax*4 + 0x104640e8]
xor ecx, esi
sub dword [ebp - 8], 1
mov dword [edx], ecx
jne 0x102965f3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10297060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x10], 0
mov dword [ebp - 4], ecx
je 0x102970e6
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ecx + 0x1c]
push esi
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push edi
nop
mov esi, dword [ecx + 4]
mov edi, ebx
sub esi, eax
mov ecx, eax
sub edi, eax
mov edx, 8
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [edi + ecx - 1], al
sub edx, 1
jne 0x10297090
mov ecx, dword [ebp - 8]
push 1
push ebx
push ebx
mov eax, dword [ecx]
call dword [eax + 0x20]
mov esi, dword [ebp - 4]
mov eax, ebx
mov edx, 8
mov esi, dword [esi + 0x10]
sub esi, ebx
nop dword [eax]
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x102970c0
mov eax, dword [ebp + 8]
add ebx, 8
mov ecx, dword [ebp - 4]
add eax, 8
sub dword [ebp + 0x10], 1
mov dword [ebp + 8], eax
jne 0x10297080
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x102970f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 0x10], 0
mov dword [ebp - 4], ecx
je 0x10297176
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ecx + 0x1c]
push esi
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push edi
nop
mov esi, dword [ecx + 0x10]
mov edi, ebx
sub esi, eax
mov ecx, eax
sub edi, eax
mov edx, 8
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [edi + ecx - 1], al
sub edx, 1
jne 0x10297120
mov ecx, dword [ebp - 8]
push 1
push ebx
push ebx
mov eax, dword [ecx]
call dword [eax + 0x24]
mov esi, dword [ebp - 4]
mov eax, ebx
mov edx, 8
mov esi, dword [esi + 4]
sub esi, ebx
nop dword [eax]
mov cl, byte [esi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x10297150
mov eax, dword [ebp + 8]
add ebx, 8
mov ecx, dword [ebp - 4]
add eax, 8
sub dword [ebp + 0x10], 1
mov dword [ebp + 8], eax
jne 0x10297110
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x102a6040
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10401ab3
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x104c5878]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
lea ecx, [esi + 0x30]
call fcn.10276b50
mov dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.102bff10
test byte [ebp + 8], 1
je 0x102a6097
push 0x64
push esi
call fcn.103b6ca6
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x102a6700
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10401c53
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x104c5878]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x54], 0
cmp dword [esi + 0x14], 0x10
mov dword [ebp - 0x50], eax
mov eax, esi
mov dword [ebp - 0x58], ebx
jb 0x102a674d
mov eax, dword [esi]
mov ecx, dword [esi + 0x10]
cmp ecx, 4
jne 0x102a6761
cmp dword [eax], 0x65736162
jne 0x102a6761
mov al, 1
jmp 0x102a6763
xor al, al
test ecx, ecx
je 0x102a676f
test al, al
je 0x102a6800
push 0x64
call fcn.103b684b
mov esi, eax
add esp, 4
mov dword [ebp - 0x5c], esi
mov dword [ebp - 4], 1
mov ecx, esi
push dword [ebp - 0x50]
call fcn.102bfe20
mov byte [ebp - 4], 2
lea ecx, [esi + 0x30]
mov dword [esi], vtable.ECDSA_Verification_Operation.0
mov eax, dword [edi - 8]
mov eax, dword [eax + 8]
add eax, 4
add eax, edi
mov dword [esi + 0x24], eax
mov eax, dword [edi - 8]
mov eax, dword [eax + 8]
sub eax, 0xffffff80
add eax, edi
mov dword [esi + 0x28], eax
mov eax, dword [edi - 8]
mov eax, dword [eax + 8]
add eax, 0x48
add eax, edi
push eax
mov dword [esi + 0x2c], eax
call fcn.102ba2c0
mov byte [ebp - 4], 0
mov dword [ebx], esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x54], 1
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.103b6385
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [edi - 8]
lea ecx, [edi - 8]
lea edx, [ebp - 0x4c]
push edx
mov eax, dword [eax + 4]
add ecx, eax
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x34]
push esi
push eax
call fcn.1026ba90
push 0x104b614c
lea eax, [ebp - 0x34]
push eax
call fcn.103ce033
int3
Function at 0x102a8260
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [ebx + 4]
push edi
mov edi, ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebx]
sub edi, eax
sub esi, ecx
mov dword [ebp + 0xc], eax
mov dword [ebp - 8], ecx
mov dword [ebp + 8], esi
cmp esi, edi
jne 0x102a829f
mov ecx, ebx
call fcn.103162b0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
jbe 0x102a82ac
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, ecx
mov edx, 0
sub edi, dword [ebx + 4]
mov bl, 1
sub edi, eax
add edi, dword [ebp - 4]
je 0x102a82d9
mov esi, eax
xor ecx, ecx
movzx eax, bl
cmp byte [esi + edx], cl
cmove ecx, eax
inc edx
mov bl, cl
cmp edx, edi
jne 0x102a82c1
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
xor edx, edx
mov byte [ebp + 0xf], 0
test esi, esi
je 0x102a830a
add eax, edi
mov edi, dword [ebp - 8]
mov dword [ebp + 8], eax
nop dword [eax + eax]
movzx ecx, byte [eax + edx]
movzx eax, byte [edx + edi]
inc edx
xor ecx, eax
mov al, byte [ebp + 0xf]
or eax, ecx
mov byte [ebp + 0xf], al
mov eax, dword [ebp + 8]
cmp edx, esi
jne 0x102a82f0
mov cl, byte [ebp + 0xf]
xor edx, edx
pop edi
movzx eax, bl
test cl, cl
pop esi
cmovne eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x102ac350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10402b88
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x104c5878]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1026e3d0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
sub eax, edi
mov esi, dword [ebp + 0xc]
cmp eax, esi
je 0x102ac39b
xor bl, bl
jmp 0x102ac3d1
mov byte [ebp + 0xf], 0
test esi, esi
je 0x102ac3ca
mov edx, dword [ebp + 8]
sub edi, edx
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, byte [edi + edx - 1]
xor ecx, eax
mov al, byte [ebp + 0xf]
or eax, ecx
mov byte [ebp + 0xf], al
sub esi, 1
jne 0x102ac3b0
cmp byte [ebp + 0xf], 0
sete bl
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1c]
test edx, edx
je 0x102ac419
mov ecx, dword [ebp - 0x14]
sub ecx, edx
je 0x102ac3fb
mov eax, edx
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x102ac3f0
push edx
call fcn.103b6396
add esp, 4
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x102b6230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, edx
mov esi, ecx
mov eax, edi
shr eax, 1
cmp eax, ebx
jb 0x102b636a
cmp ebx, 1
jne 0x102b6261
mov edx, dword [ebp + 0xc]
push dword [edx]
push ebx
call fcn.102b5400
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
mov edx, dword [ebp + 0x10]
cmp ebx, 4
ja 0x102b627f
cmp edx, 4
jb 0x102b627f
cmp edi, 8
jb 0x102b627f
mov edx, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.102ad1b0
cmp ebx, 6
ja 0x102b629a
cmp edx, 6
jb 0x102b629a
cmp edi, 0xc
jb 0x102b629a
mov edx, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.102ad590
cmp ebx, 8
ja 0x102b62b5
cmp edx, 8
jb 0x102b62b5
cmp edi, 0x10
jb 0x102b62b5
mov edx, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.102adeb0
cmp ebx, 9
jne 0x102b62cf
cmp edx, ebx
jb 0x102b62d4
cmp edi, 0x12
jb 0x102b62d4
mov edx, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.102aef30
cmp ebx, 0x10
ja 0x102b62ea
cmp edx, 0x10
jb 0x102b62ea
cmp edi, 0x20
jb 0x102b62ea
mov edx, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.102b0430
cmp edx, 0x20
jb 0x102b6311
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x102b6311
cmp ebx, edx
jne 0x102b6303
test bl, 1
jne 0x102b6311
mov eax, ebx
jmp 0x102b6352
mov ecx, ebx
ja 0x102b6311
test cl, 1
je 0x102b6326
inc ecx
cmp ecx, edx
jbe 0x102b6307
mov edx, dword [ebp + 0xc]
mov ecx, esi
push ebx
push edx
push ebx
call fcn.102b5910
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret
lea eax, [ecx + ecx]
cmp eax, edi
ja 0x102b6311
mov eax, ecx
and al, 3
cmp al, 2
jne 0x102b634d
lea eax, [ecx + 2]
mov dword [ebp + 0x14], eax
cmp eax, edx
ja 0x102b634d
lea eax, [ecx*2 + 4]
cmp eax, edi
mov eax, dword [ebp + 0x14]
jbe 0x102b634f
mov eax, ecx
mov ecx, dword [ebp + 8]
test eax, eax
je 0x102b6311
mov edx, dword [ebp + 0xc]
push ecx
push eax
mov ecx, esi
call fcn.102b5c40
add esp, 8
pop edi
pop esi
pop ebx
pop ebp
ret
push 0x410f
push str.d:oxdcpcfcoreext_botanplatformswin_x86_botan_all.cpp
push str.Botan::bigint_sqr
mov edx, str.Output_size_is_sufficient
mov ecx, str.z_size_2___x_sw
call fcn.102efab0
int3
Function at 0x102c5dc0
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
sub eax, ecx
je 0x102c5dd9
push eax
push 0
push ecx
call fcn.103ce630
add esp, 0xc
mov eax, dword [esi + 0x28]
mov dword [esi + 0x18], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [eax], 0xc1059ed8
mov eax, dword [esi + 0x28]
mov dword [eax + 4], 0x367cd507
mov eax, dword [esi + 0x28]
mov dword [eax + 8], 0x3070dd17
mov eax, dword [esi + 0x28]
mov dword [eax + 0xc], 0xf70e5939
mov eax, dword [esi + 0x28]
mov dword [eax + 0x10], 0xffc00b31
mov eax, dword [esi + 0x28]
mov dword [eax + 0x14], 0x68581511
mov eax, dword [esi + 0x28]
mov dword [eax + 0x18], 0x64f98fa7
mov eax, dword [esi + 0x28]
pop esi
mov dword [eax + 0x1c], 0xbefa4fa4
ret

Function at 0x102c5ea0
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
sub eax, ecx
je 0x102c5eb9
push eax
push 0
push ecx
call fcn.103ce630
add esp, 0xc
mov eax, dword [esi + 0x28]
mov dword [esi + 0x18], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [eax], 0x6a09e667
mov eax, dword [esi + 0x28]
mov dword [eax + 4], 0xbb67ae85
mov eax, dword [esi + 0x28]
mov dword [eax + 8], 0x3c6ef372
mov eax, dword [esi + 0x28]
mov dword [eax + 0xc], 0xa54ff53a
mov eax, dword [esi + 0x28]
mov dword [eax + 0x10], 0x510e527f
mov eax, dword [esi + 0x28]
mov dword [eax + 0x14], 0x9b05688c
mov eax, dword [esi + 0x28]
mov dword [eax + 0x18], 0x1f83d9ab
mov eax, dword [esi + 0x28]
pop esi
mov dword [eax + 0x1c], 0x5be0cd19
ret
Function at 0x102cdc80
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
sub eax, ecx
je 0x102cdc99
push eax
push 0
push ecx
call fcn.103ce630
add esp, 0xc
mov eax, dword [esi + 0x28]
mov dword [esi + 0x18], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov eax, dword [esi + 0x28]
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov eax, dword [esi + 0x28]
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov eax, dword [esi + 0x28]
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov eax, dword [esi + 0x28]
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov eax, dword [esi + 0x28]
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov eax, dword [esi + 0x28]
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov eax, dword [esi + 0x28]
pop esi
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
ret

Function at 0x102cdd40
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
sub eax, ecx
je 0x102cdd59
push eax
push 0
push ecx
call fcn.103ce630
add esp, 0xc
mov eax, dword [esi + 0x28]
mov dword [esi + 0x18], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov eax, dword [esi + 0x28]
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov eax, dword [esi + 0x28]
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov eax, dword [esi + 0x28]
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov eax, dword [esi + 0x28]
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov eax, dword [esi + 0x28]
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov eax, dword [esi + 0x28]
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov eax, dword [esi + 0x28]
pop esi
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
ret
Function at 0x102ceab0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x10], edi
mov esi, dword [edi + 0x18]
test ecx, ecx
je 0x102cebcc
mov eax, dword [edi + 8]
shr eax, 3
mov dword [esp + 0x14], eax
nop word [eax + eax]
sub eax, esi
mov ebx, ecx
cmp eax, ecx
cmovb ebx, eax
sub ecx, ebx
mov dword [ebp + 0xc], ecx
test ebx, ebx
je 0x102cebab
mov edi, dword [ebp + 8]
nop dword [eax]
mov edx, esi
and edx, 7
je 0x102ceb3d
mov eax, dword [esp + 0x10]
mov ecx, esi
shr ecx, 3
mov eax, dword [eax + 0xc]
lea edi, [eax + ecx*8]
mov eax, dword [ebp + 8]
lea ecx, [edx*8]
movzx eax, byte [eax]
cdq
call fcn.103f3750
xor dword [edi], eax
inc esi
xor dword [edi + 4], edx
mov edi, dword [ebp + 8]
inc edi
mov dword [ebp + 8], edi
sub ebx, 1
jne 0x102ceb00
jmp 0x102ceba4
test ebx, ebx
je 0x102ceba4
test bl, 7
jne 0x102ceb6f
mov eax, dword [esp + 0x10]
mov ecx, esi
shr ecx, 3
add esi, 8
mov eax, dword [eax + 0xc]
lea edx, [eax + ecx*8]
mov eax, dword [edi]
mov ecx, dword [edi + 4]
add edi, 8
xor dword [edx], eax
xor dword [edx + 4], ecx
mov dword [ebp + 8], edi
sub ebx, 8
jne 0x102ceb41
jmp 0x102ceba4
test ebx, ebx
je 0x102ceba4
mov eax, dword [esp + 0x10]
mov ecx, esi
shr ecx, 3
mov eax, dword [eax + 0xc]
lea edi, [eax + ecx*8]
mov eax, dword [ebp + 8]
mov ecx, esi
and ecx, 7
shl ecx, 3
movzx eax, byte [eax]
cdq
call fcn.103f3750
xor dword [edi], eax
inc esi
xor dword [edi + 4], edx
inc dword [ebp + 8]
sub ebx, 1
jne 0x102ceb73
mov edi, dword [esp + 0x10]
mov ecx, dword [ebp + 0xc]
mov eax, dword [esp + 0x14]
cmp esi, eax
jne 0x102cebc4
mov ecx, dword [edi + 0xc]
call fcn.102cde00
mov ecx, dword [ebp + 0xc]
xor esi, esi
mov eax, dword [esp + 0x14]
test ecx, ecx
jne 0x102ceae0
mov dword [edi + 0x18], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x102cf5f0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10404978
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x104c5878]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x102cf69e
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
add eax, ecx
push eax
push ecx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.1031f830
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
push esi
sub eax, esi
push eax
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x102cf69e
mov ecx, dword [ebp - 0x10]
mov eax, esi
sub ecx, esi
je 0x102cf680
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x102cf675
push esi
call fcn.103b6396
add esp, 4
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x102d7c20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10407228
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x104c5878]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov al, byte [ebp + 0x18]
mov dword [edi], vtable.Botan::TLS::Channel.0
mov byte [edi + 4], al
mov dword [edi + 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [edi + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x10], 0x104c6490
mov dword [edi + 0x14], 0x104c6498
mov dword [edi + 0x18], eax
mov dword [edi + 0x1c], 0
mov byte [ebp - 4], 1
mov dword [edi + 0x20], 0
mov byte [ebp - 4], 2
mov dword [edi + 0x24], 0
mov byte [ebp - 4], 3
lea esi, [edi + 0x28]
mov dword [ebp + 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10315000
mov dword [esi], eax
mov byte [ebp - 4], 6
lea esi, [edi + 0x30]
mov dword [ebp + 0x18], esi
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.10315000
mov dword [esi], eax
mov byte [ebp - 4], 9
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov byte [ebp - 4], 0xa
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov byte [ebp - 4], 0xb
push ecx
mov ecx, edi
call fcn.102d7df0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x102e25f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10408eb2
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x104c5878]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
mov dword [esi], vtable.Botan::TLS::Handshake_State.0
mov dword [esi + 8], eax
mov dword [ebp - 4], 0
lea eax, [esi + 0x14]
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
push eax
mov edx, dword [ecx]
call dword [edx]
xor eax, eax
lea ecx, [esi + 0x48]
mov word [esi + 0x18], ax
mov dword [esi + 0x1c], eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov byte [esi + 0x44], al
call fcn.10278570
mov byte [ebp - 4], 1
lea eax, [esi + 0x9c]
mov dword [ebp + 0xc], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 3
mov dword [esi + 0xa8], 0
mov byte [ebp - 4], 4
mov dword [esi + 0xac], 0
mov byte [ebp - 4], 5
mov dword [esi + 0xb0], 0
mov byte [ebp - 4], 6
mov dword [esi + 0xb4], 0
mov byte [ebp - 4], 7
mov dword [esi + 0xb8], 0
mov byte [ebp - 4], 8
mov dword [esi + 0xbc], 0
mov byte [ebp - 4], 9
mov dword [esi + 0xc0], 0
mov byte [ebp - 4], 0xa
mov dword [esi + 0xc4], 0
mov byte [ebp - 4], 0xb
mov dword [esi + 0xc8], 0
mov byte [ebp - 4], 0xc
mov dword [esi + 0xcc], 0
mov byte [ebp - 4], 0xd
mov dword [esi + 0xd0], 0
mov byte [ebp - 4], 0xe
mov dword [esi + 0xd4], 0
mov byte [ebp - 4], 0xf
mov dword [esi + 0xd8], 0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8