joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10043ad4
Capabilities:
Check http status code

Disassembly:
add eax, dword [eax]
add esp, 0xc
test eax, eax
jne 0x10044218
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov dword [ebx + 0x1dc], eax
test eax, eax
jne 0x100440bc
mov dword [ecx], eax
cmp dword [ebx + 0x1e4], 0
mov dword [ebp - 0x1c], 0
je 0x10043fa0
nop dword [eax]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [edi + 0x130]
push dword [esi + 0x2c4]
push edi
call fcn.10077103
mov ecx, eax
add esp, 0x14
test ecx, ecx
jne 0x100440f2
push dword [ebp + 0xc]
push dword [edi + 0x130]
push 2
push edi
call fcn.10076bbd
add esp, 0x10
mov ecx, eax
mov eax, dword [ebp + 0xc]
sub dword [ebx + 0x1dc], eax
add dword [edi + 0x130], eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10043b0e
Capabilities:
Check http status code

Disassembly:
add eax, dword [eax]
add esp, 0xc
test eax, eax
jne 0x10044218
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov dword [ebx + 0x1dc], eax
test eax, eax
jne 0x100440bc
mov dword [ecx], eax
cmp dword [ebx + 0x1e4], 0
mov dword [ebp - 0x1c], 0
je 0x10043fa0
nop dword [eax]
lea ecx, [ebp + 0xc]
push ecx
push eax
push dword [edi + 0x130]
push dword [esi + 0x2c4]
push edi
call fcn.10077103
mov ecx, eax
add esp, 0x14
test ecx, ecx
jne 0x100440f2
push dword [ebp + 0xc]
push dword [edi + 0x130]
push 2
push edi
call fcn.10076bbd
add esp, 0x10
mov ecx, eax
mov eax, dword [ebp + 0xc]
sub dword [ebx + 0x1dc], eax
add dword [edi + 0x130], eax
mov eax, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100481e0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100bd044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push esi
mov esi, dword [ebp + 8]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x10048229
push ebx
push esi
lea eax, [ebp - 0x18]
push eax
push 2
call fcn.10047ff0
add esp, 0x10
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call 0x100ba5f4
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1004825a
push ebx
push esi
lea eax, [ebp - 0x14]
push eax
push 0x17
call fcn.1008f637
add esp, 0x10
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call 0x100ba625
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call 0x100ba637
mov esp, ebp
pop ebp
ret

Function at 0x10048ac5
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
adc byte [esi - 0x75], dl
jne 0x10048ade
push esi
push 0
push dword [ebp + 0x10]
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 4
mov dword [ebp + 0x14], esi
call 0x100bcc94
add esp, 0xc
lea eax, [ebp - 8]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10048b8f
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x800c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10048b71
push 0
push dword [ebp + 0xc]

Function at 0x10048b2f
Capabilities:
Hash data via wincrypt

Disassembly:
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x10048b71
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x10048b71
cmp esi, dword [ebp - 0xc]
jb 0x10048b71
push 0
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 4]
test eax, eax
je 0x10048b7f
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 8]
test eax, eax
je 0x10048b8f
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1004aa27
Capabilities:
Convert ip address from string

Disassembly:
mov eax, dword [ebp - 0x1a0]
mov dword [edi], eax
mov eax, dword [ebp - 0x1a0]
inc dword [eax + 0x14]
push ebx
call fcn.100789ae
fild word [edx]
add byte [ebx + 0x3f8304c4], al
add byte [edi], cl
invalid
xchg esi, eax
add byte [eax], al
invalid
push dword [ebp - 0x1a8]
push esi
push ebx
call fcn.10093817
add esp, 0xc
test eax, eax
jne 0x1004ae20
cmp dword [esi + 0xb8], 2
jne 0x1004aa8f
mov ecx, dword [ebp - 0x198]
mov eax, 0x1b8
add byte [ebx - 0x374600c7], al
add dword [eax], eax
add byte [edi], cl
inc ebp
rol dword [ebx + 0x7402303c], 8
mov eax, dword [esi + 0xac]
jmp 0x1004aa92
mov eax, dword [esi + 0x64]
push 0
push eax
push ebx
call fcn.10078aab
add esp, 0xc
test eax, eax
jne 0x1004aac6
push str.Failed_to_set_SNI
push ebx
call fcn.1007d61d
add esp, 8
mov eax, 0x23
pop edi
pop esi
pop ebx
invalid

Function at 0x1004c0a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
lea esi, [ebx + 1]
push esi
push ebx
call dword [0x100bd008]
mov edi, eax
add esp, 8
test edi, edi
je 0x1004c0fa
nop dword [eax]
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x1004c116
cmp esi, ebx
je 0x1004c116
cmp esi, 0x8000
ja 0x1004c116
cmp esi, ebx
jb 0x1004c10d
push esi
push edi
call dword [0x100bd008]
mov edi, eax
add esp, 8
test edi, edi
jne 0x1004c0c0
mov ebx, dword [ebp - 4]
push ebx
call dword [0x100bd004]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [0x100bd004]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx

Function at 0x1004c94d
Capabilities:
Read file on windows
Read pipe

Disassembly:
add dword [eax], eax
add byte [edi - 0x77], dl
inc ebp
mov ah, 0xe8
invalid

Function at 0x1004d190
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov byte [ebp + 9], al
mov al, byte [ebp + 0x10]
push 0
mov ecx, dword [esi + 0xc]
mov byte [ebp + 0xa], al
lea eax, [ebp + 8]
push 3
push eax
mov byte [ebp + 8], 0xff
push dword [ecx + 0x150]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x1004d1d7
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.1007fd44
add esp, 0xc
pop esi
pop ebp
ret
Function at 0x1004d342
Capabilities:
Send data
Send data on socket

Disassembly:
jae 0x1004d354
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1004d354
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ecx + 0x1ca8]
push esi
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [ebp + 8], eax
mov eax, dword [ebp - 4]
movzx eax, word [eax + 0x1caa]
push eax
call esi
mov edx, dword [ebp + 8]
movzx ecx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x1004d3c0
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1004d3c0
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1004d3c0
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1004d3c0
shr ecx, 0xb0
dec edi
or eax, 0x78b07ff
cmp eax, edi
jae 0x1004d3c0
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x1004d3c0
mov byte [eax], 0xf0
mov eax, dword [edi]
inc eax
mov esi, dword [ebp - 4]
mov dword [esi + 0x1eb8], eax
lea ecx, [esi + 0x1cb4]
sub eax, ecx
mov dword [edi], ecx
sub eax, 2
push eax
lea eax, [esi + 0x1cb6]
push eax
push 0x3e
push ebx
call fcn.100998e6
add esp, 0x10
lea eax, [esi + 0x1cb4]
push 0
push 3
push eax
mov eax, dword [ebp - 8]
push dword [eax + 0x150]
call dword [sym.imp.WS2_32.dll_send]
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x1004d41e
call edi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.1007ff8b
add esp, 0xc
push 4
lea eax, [esi + 0x1cb7]
push eax
push ebx
call fcn.10099a0d
add esp, 0xc
lea eax, [esi + 0x1cbb]
push 0
push 2
push eax
mov eax, dword [ebp - 8]
push dword [eax + 0x150]
call dword [sym.imp.WS2_32.dll_send]
pop esi
test eax, eax
jns 0x1004d460
call edi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.1007ffcd
add esp, 0xc
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1004f1e1
Capabilities:
Send data
Send data on socket

Disassembly:
xor eax, eax
mov word [esi + 0x144], ax
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14c]
mov byte [eax], 0
mov eax, dword [esi + 0x14c]
mov byte [eax + 1], 4
movzx edx, word [esi + 0x144]
mov eax, dword [esi + 0x14c]
mov ecx, edx
shr ecx, 8
mov byte [eax + 2], cl
mov eax, dword [esi + 0x14c]
mov byte [eax + 3], dl
lea eax, [esi + 0xb0]
mov al, 0
add byte [eax], al
push dword [esi + 0x130]
push eax
push 0
push 4
push dword [esi + 0x14c]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
js 0x1004f2b8

Function at 0x1004f220
Capabilities:
Send data
Send data on socket

Disassembly:
xor eax, eax
mov word [esi + 0x144], ax
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x14c]
mov byte [eax], 0
mov eax, dword [esi + 0x14c]
mov byte [eax + 1], 4
movzx edx, word [esi + 0x144]
mov eax, dword [esi + 0x14c]
mov ecx, edx
shr ecx, 8
mov byte [eax + 2], cl
mov eax, dword [esi + 0x14c]
mov byte [eax + 3], dl
lea eax, [esi + 0xb0]
mov al, 0
add byte [eax], al
push dword [esi + 0x130]
push eax
push 0
push 4
push dword [esi + 0x14c]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
js 0x1004f2b8
Function at 0x10057b51
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
movzx eax, cx
mov dword [ebp - 0x61c], eax
mov eax, dword [ebp - 0x60c]
movzx eax, ax
mov dword [ebp - 0x60c], eax
mov esi, dword [ebp - 0x608]

Function at 0x1005ded6
Capabilities:
Convert ip address from string

Disassembly:
jmp 0x1005de7c
inc ebp
mov eax, 0x8a014e8d
push es
mov al, byte [esi]
inc esi
test al, al
jne 0x1005de81
sub esi, ecx
cmp byte [edi], 0x5b
jne 0x1005e026
cmp esi, 4
jb 0x1005e010
inc edi
sub esi, 2
cmp byte [edi + esi], 0x5d
jne 0x1005e010
push str.0123456789abcdefABCDEF:.
push edi
call 0x100e4e95
add esp, 8
cmp esi, eax
je 0x1005df71
mov esi, eax
add eax, edi
mov dword [ebp - 0x4c], eax
cmp byte [eax], 0x25
jne 0x1005e010
push 2
lea ebx, [eax + 1]
push 0x100a52b4
mov ah, 0x52
or dl, byte [eax]
push ebx
call 0x100e30c0
add esp, 0xc
test eax, eax
jne 0x1005def7
mov cl, byte [ebx + 2]
lea eax, [ebx + 2]
test cl, cl
je 0x1005def7
cmp cl, 0x5d
cmovne ebx, eax
mov al, byte [ebx]
test al, al
je 0x1005dffa
lea edx, [ebp - 0x14]
sub edx, ebx
xor ecx, ecx
cmp al, 0x5d
je 0x1005df1d
cmp ecx, 0xf
jge 0x1005df1d
mov byte [edx + ebx], al
inc ecx
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x1005df08
test ecx, ecx
je 0x1005dffa
cmp byte [ebx], 0x5d
jne 0x1005dffa
cmp ecx, 0x10
jae 0x1005e04e
lea eax, [ebp - 0x14]
mov byte [ebp + ecx - 0x14], 0
push eax
call dword [0x100bd00c]
mov ecx, dword [ebp - 0x48]
add esp, 4
mov dword [ecx + 0x14], eax
test eax, eax
jne 0x1005df69
pop edi
pop esi
mov eax, 7
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call 0x100d0334
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x4c]
mov word [eax], 0x5d
lea eax, [ebp - 0x14]
mov byte [edi + esi], 0
push eax
push edi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1005e010
add byte [eax], al
push 0x2e
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x17
call 0x100bddac
add esp, 0x10
test eax, eax
je 0x1005dfd9
lea edx, [ebp - 0x44]
lea ecx, [edx + 1]
nop dword [eax]
pop edi
pop esi
mov eax, 3
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call 0x100d03db
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x16
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call 0x100d03f1
mov esp, ebp
pop ebp
ret
push str.__r_n_t_:___
push edi
call 0x100de9c1
add esp, 8
cmp esi, eax
je 0x1005dfdd
mov ecx, dword [ebp - 4]
mov eax, 0x15
pop edi
pop esi
xor ecx, ebp
pop ebx
call 0x100d0419
mov esp, ebp
pop ebp
ret
call 0x100d05b8
int3

Function at 0x100666ac
Capabilities:
Get file size
Read file on windows

Disassembly:
add dword [eax], ebp
add byte [eax], al
adc byte [eax - 1], 0x15
or al, 0xf1
or dword [eax], edx
Function at 0x100667b0
Capabilities:
Read file on windows

Disassembly:
push 0
lea eax, [ebp - 0x110]
mov dword [ebp - 0x110], 0
push eax
mov eax, edi
sub eax, esi
push eax
lea eax, [esi + ebx]
push eax
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1006683b
mov eax, dword [ebp - 0x110]
test eax, eax
je 0x10066837
add esi, eax
cmp esi, edi
jb 0x100667a2
push dword [ebp - 0x10c]
mov byte [edi + ebx], 0
push dword [ebp - 0x108]
push edi
push ebx
push dword [ebp - 0x118]
call fcn.10066410
add esp, 0x14
mov esi, eax
mov edi, esi
jmp 0x100667de
push 0x100
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call 0x100c64f3
push eax
push dword [ebp - 0x108]
push str.schannel:_failed_to_read_from_CA_file__s:__s
invalid
mov ch, 0xf4
invalid
invalid
Function at 0x10069393
Capabilities:
Encode data using base64

Disassembly:
cmp ecx, 0x12
ja case.0x100693a3.13
movzx eax, byte [ecx + 0x10069abc]
jmp dword [eax*4 + 0x10069aac]
mov ecx, 4
mov dword [ebp - 0xc], ecx
jmp 0x100693c1
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, ebx
div ecx
int1
test edx, edx
jne case.0x100693a3.13
mov eax, ebx
div ecx
cmp eax, 0x3fffffff
ja case.0x100693a3.13
add byte [eax], al
lea eax, [eax*4 + 1]
push eax
call dword [section..data]
mov edx, eax
add esp, 4
mov dword [ebp - 0x14], edx
test edx, edx
je case.0x100693a3.13
cmp dword [ebp - 0x10], 0xc
jne 0x1006941f
test ebx, ebx
je 0x10069414
push ebx
push edi
push edx
call 0x100dd02e
add esp, 0xc
xor ebx, ebx
cmp edi, dword [ebp - 0x24]
jae 0x10069414
mov eax, dword [ebp - 0xc]
xor ecx, ecx
sub eax, 2
je 0x10069444
sub eax, 2
jne 0x1006944d
movzx ecx, byte [edi]
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
add edi, 2
invalid
invalid
movzx eax, byte [edi]
shl ecx, 8
invalid
or ecx, eax
inc edi
movzx eax, byte [edi]
inc edi
shl ecx, 8
or ecx, eax
mov eax, 1
add byte [eax], al
add byte [ecx - 0x67e0fbb], cl
add byte [eax], 0
add byte [edx + 0x6c], dh
cmp ecx, 0x800
jb 0x100694b8
cmp ecx, 0x10000
jb 0x1006949b
cmp ecx, 0x200000
jae 0x100694e9
mov al, cl
mov dword [ebp - 0x10], 3
add edx, ebx
and al, 0x3f
or al, 0x80
or ecx, 0x400000
shr ecx, 6
mov byte [edx + 3], al
add ebp, ebx
invalid
add edx, ebx
mov dword [ebp - 0x10], 2
add byte [eax], al
mov al, cl
or ecx, 0x20000
and al, 0x3f
or al, 0x80
shr ecx, 6
mov byte [edx + 2], al
jmp 0x100694ba
add edx, ebx
mov al, cl
or ecx, 0x3000
and al, 0x3f
shr ecx, 6
or al, 0x80
mov byte [edx + 1], al
add edx, ebx
push edx
call dword [0x100bd004]
add esp, 4
mov eax, dword [ebp - 8]
or ebx, 0xffffffff
xor edx, edx
test ebx, ebx
mov ebx, dword [ebp + 0xc]
cmovns edx, eax
dec ecx
ror byte [ecx - 0x2d7a07ab], 1

Function at 0x100693aa
Capabilities:
Encode data using base64

Disassembly:
mov ecx, 2
mov dword [ebp - 0xc], ecx
jmp 0x100693c1

Function at 0x10069442
Capabilities:
Encode data using base64

Disassembly:
mov dword [edx], 0xc107b60f
loope 0x10069452
invalid
loope 0x1006945c
inc ebp
invalid
Function at 0x1006ca50
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100bd044]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push 0xf0000040
push 1
push 0
push 0
push eax
mov dword [ebp - 0x20], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1006cb3e
push esi
mov esi, dword [ebp + 0x10]
push 8
mov dword [ebp - 0x18], 0x6c09d
mov dword [ebp - 0x14], 0x6601
mov dl, byte [esi + 1]
mov cl, byte [esi]
mov al, dl
shr al, 1
mov byte [ebp - 0xc], cl
shl cl, 7
or al, cl
shl dl, 6
mov cl, byte [esi + 2]
mov byte [ebp - 0xb], al
mov al, cl
shr al, 2
or al, dl
shl cl, 5
mov dl, byte [esi + 3]
mov byte [ebp - 0xa], al
mov al, dl
shr al, 3
or al, cl
shl dl, 4
mov cl, byte [esi + 4]
mov byte [ebp - 9], al
mov al, cl
shr al, 4
or al, dl
shl cl, 3
mov dl, byte [esi + 5]
mov byte [ebp - 8], al
mov al, dl
shr al, 5
or al, cl
shl dl, 2
mov cl, byte [esi + 6]
mov byte [ebp - 7], al
mov al, cl
shr al, 6
add cl, cl
or al, dl
mov dword [ebp - 0x10], 8
mov byte [ebp - 6], al
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 5], cl
call 0x100da8d5
add esp, 8
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
pop esi
test eax, eax
jne 0x1006cb4f
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call 0x100def1a
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push dword [ebp - 0x20]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [edi + 4], eax
lea eax, [ebp - 0x20]
push eax
push edi
push 0
push 0
push 0
push dword [ebp - 0x24]
mov dword [edi], ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop edi
call 0x100def63
mov esp, ebp
pop ebp
Function at 0x1006d23f
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
inc ebp
or al, 0x50
mov eax, dword [ebx + 8]
call eax
mov eax, dword [ebx + 0x14]
add esp, 0x18
mov dword [ebp - 8], eax
push dword [esi + 4]
mov eax, dword [ebx]
call eax
push dword [esi + 8]
mov eax, dword [ebx]
call eax
mov eax, dword [ebp - 8]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x1006d2a9
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub dword [ebp - 8], 1
jne 0x1006d270
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
cmp ebx, dword [eax + 0x10]
jae 0x1006d2d9
mov eax, dword [edi]
push 1
push 0x100a6cc8
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0x100a6cc9
push dword [esi + 8]
call eax
mov eax, dword [ebp + 8]
inc ebx
add esp, 0x18
cmp ebx, dword [eax + 0x10]
jb 0x1006d2b1
push dword [ebp + 0x18]
call 0x100a2731
mov ecx, dword [esi]
push eax
push dword [ebp + 0x14]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [ebp + 0x1c]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0x1006d301

Function at 0x1006f455
Capabilities:
Compress data via zlib inflate or deflate

Disassembly:
cmp dword [ebp + 0xc], 6
mov dword [ecx + 0x50], 0x100a6e58
mov dword [ecx + 0x58], 9
mov dword [ecx + 0x54], 0x100a7658
mov dword [ecx + 0x5c], 5
mov dword [ecx + 4], 0x3f47
jne 0x1006f4b5
shr edx, 2
sub esi, 3
invalid
Function at 0x100707e0
Capabilities:
Compute adler32 checksum

Disassembly:
mov al, 0x15
add byte [eax], al
jb 0x100708da
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
nop word [eax + eax]
sub ebx, 0x15b0
mov edx, 0x15b
nop dword [eax + eax]
movzx eax, byte [esi]
add ecx, eax
movzx eax, byte [esi + 1]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 2]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 3]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 4]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 5]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 6]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 7]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 8]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 9]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xa]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xb]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xc]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xd]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xe]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xf]
add edi, ecx
add esi, 0x10
add ecx, eax
add edi, ecx
sub edx, 1
jne 0x10070810
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul eax, edx, 0xffff000f
add edi, eax
sub dword [ebp + 8], 1
jne 0x10070800
test ebx, ebx
je 0x100709a5
cmp ebx, 0x10
jb 0x10070972
mov edx, ebx
shr edx, 4
nop
movzx eax, byte [esi]
sub ebx, 0x10
add ecx, eax
movzx eax, byte [esi + 1]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 2]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 3]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 4]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 5]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 6]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 7]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 8]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 9]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xa]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xb]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xc]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xd]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xe]
add edi, ecx
add ecx, eax
movzx eax, byte [esi + 0xf]
add edi, ecx
add esi, 0x10
add ecx, eax
add edi, ecx
sub edx, 1
jne 0x100708e0
test ebx, ebx
je 0x10070981
movzx eax, byte [esi]
lea esi, [esi + 1]
add ecx, eax
add edi, ecx
sub ebx, 1
jne 0x10070972
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
shl edi, 0x10
or edi, ecx
pop esi
mov eax, edi
pop edi
pop ebx
pop ebp
ret