joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10101440
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x120
call fcn.10084f50
mov eax, dword [0x101c3080]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
mov dword [esp], eax
mov eax, dword [esp + 0x128]
push ebx
push ebp
push esi
movups xmm0, xmmword [eax]
push edi
movups xmm1, xmmword [eax + 0x10]
movd eax, xmm0
movups xmmword [esp + 0xec], xmm1
and al, 0xf8
psrldq xmm1, 0xc
movups xmmword [esp + 0xdc], xmm0
mov byte [esp + 0xdc], al
movd eax, xmm1
shr eax, 0x18
and al, 0x3f
or al, 0x40
mov byte [esp + 0xfb], al
lea eax, [esp + 0xdc]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.10103f60
mov eax, dword [esp + 0x6c]
add eax, dword [esp + 0x94]
mov dword [esp + 0xe4], eax
mov eax, dword [esp + 0x70]
add eax, dword [esp + 0x98]
mov dword [esp + 0xe8], eax
mov eax, dword [esp + 0x74]
add eax, dword [esp + 0x9c]
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x78]
add eax, dword [esp + 0xa0]
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 0x7c]
add eax, dword [esp + 0xa4]
mov dword [esp + 0xf4], eax
mov eax, dword [esp + 0x80]
add eax, dword [esp + 0xa8]
mov ebp, dword [esp + 0xb4]
mov edx, dword [esp + 0x8c]
mov edi, dword [esp + 0xb8]
mov ecx, dword [esp + 0x90]
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0xac]
add eax, dword [esp + 0x84]
mov dword [esp + 0xfc], eax
mov eax, dword [esp + 0xb0]
add eax, dword [esp + 0x88]
mov dword [esp + 0x100], eax
lea eax, [edx + ebp]
mov dword [esp + 0x104], eax
lea eax, [edi + ecx]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x94]
sub eax, dword [esp + 0x6c]
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x98]
sub eax, dword [esp + 0x70]
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x9c]
sub eax, dword [esp + 0x74]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0xa0]
sub eax, dword [esp + 0x78]
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0xa4]
sub eax, dword [esp + 0x7c]
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0xa8]
sub eax, dword [esp + 0x80]
mov dword [esp + 0x120], eax
mov eax, dword [esp + 0xac]
sub eax, dword [esp + 0x84]
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0xb0]
sub eax, dword [esp + 0x88]
mov dword [esp + 0x128], eax
lea eax, [esp + 0x10c]
sub ebp, edx
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x130], ebp
sub edi, ecx
push eax
mov dword [esp + 0x138], edi
call fcn.10101c40
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0xf0]
push eax
push eax
call fcn.10101ec0
lea eax, [esp + 0xf8]
push eax
push dword [esp + 0x30]
call fcn.10103720
mov ecx, dword [esp + 0x150]
add esp, 0x24
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10084565
add esp, 0x120
ret
Function at 0x1010eb40
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call fcn.100aa4e0
add esp, 4
cmp eax, 0x72
jne 0x1010ec8c
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
push ebp
push edi
push esi
push dword [esp + 0x28]
mov edi, eax
and eax, 1
push dword [esp + 0x28]
shr edi, 1
push dword [esp + 0x28]
lea ebp, [eax + edi]
push ebp
push dword [esp + 0x28]
call fcn.100cfec0
push eax
call fcn.1010e8d0
add esp, 0x1c
test eax, eax
jne 0x1010eb93
pop edi
pop ebp
pop esi
ret
push ebx
push 0xf8
push str.cryptokdf_tls1_prf.c
push esi
call fcn.100a7570
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1010ebe5
mov eax, dword [esp + 0x18]
push esi
push ebx
push dword [esp + 0x2c]
add eax, edi
push dword [esp + 0x2c]
push ebp
push eax
call fcn.100c9c40
push eax
call fcn.1010e8d0
add esp, 0x1c
test eax, eax
jne 0x1010ebec
push 0xfd
push str.cryptokdf_tls1_prf.c
push esi
push ebx
call fcn.100a7670
add esp, 0x10
pop ebx
pop edi
pop ebp
xor eax, eax
pop esi
ret
xor edi, edi
test esi, esi
je 0x1010ec6e
mov edx, dword [esp + 0x28]
cmp esi, 0x20
jb 0x1010ec4b
lea eax, [esi - 1]
lea ecx, [edx - 1]
add eax, ebx
add ecx, esi
cmp edx, eax
ja 0x1010ec11
cmp ecx, ebx
jae 0x1010ec4b
mov eax, esi
mov ecx, esi
and eax, 0x1f
mov ebp, ebx
sub ecx, eax
mov eax, edx
sub ebp, edx
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [ebx + edi + 0x10]
add edi, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edi, ecx
jb 0x1010ec20
cmp edi, esi
jae 0x1010ec6e
mov ebp, ebx
lea ecx, [edi + edx]
sub ebp, edx
mov edx, esi
sub edx, edi
nop word [eax + eax]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x1010ec60
push 0x102
push str.cryptokdf_tls1_prf.c
push esi
push ebx
call fcn.100a7670
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop ebp
pop esi
ret
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push esi
call fcn.1010e8d0
add esp, 0x1c
neg eax
sbb eax, eax
neg eax
pop esi
ret
Function at 0x1011de80
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push edi
mov eax, dword [ebx + 4]
cmp eax, dword [ecx + 4]
jge 0x1011de97
mov edi, ecx
jmp 0x1011de9b
mov edi, ebx
mov ebx, ecx
push dword [edi + 4]
mov ebp, dword [esp + 0x14]
push ebp
call fcn.100b9e40
add esp, 8
test eax, eax
jne 0x1011deb3
pop edi
pop ebp
pop ebx
ret
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x1011ded7
push esi
nop dword [eax + eax]
mov ecx, dword [ebx]
mov edx, dword [edi]
mov esi, dword [ecx + eax*4]
mov ecx, dword [ebp]
xor esi, dword [edx + eax*4]
mov dword [ecx + eax*4], esi
inc eax
cmp eax, dword [ebx + 4]
jl 0x1011dec0
pop esi
cmp eax, dword [edi + 4]
jge 0x1011def1
nop dword [eax]
mov ecx, dword [edi]
mov edx, dword [ebp]
mov ecx, dword [ecx + eax*4]
mov dword [edx + eax*4], ecx
inc eax
cmp eax, dword [edi + 4]
jl 0x1011dee0
mov eax, dword [edi + 4]
push ebp
mov dword [ebp + 4], eax
call fcn.100b9c40
add esp, 4
mov eax, 1
pop edi
pop ebp
pop ebx
ret
Function at 0x10121ea0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.10084f50
mov eax, dword [0x101c3080]
xor eax, esp
mov dword [esp + 0x88], eax
mov edx, dword [esp + 0xa0]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [esp + 0xac]
mov dword [esp + 0x10], edx
test edi, edi
je 0x10121f06
cmp edi, dword [esi]
je 0x10121efd
test ebp, ebp
je 0x10121f80
test ebx, ebx
js 0x10121f80
mov eax, 1
mov dword [esi], edi
jmp 0x10121f0c
mov edi, dword [esi]
test edi, edi
je 0x10121f80
test ebp, ebp
je 0x1012209a
push edi
call fcn.100b00a0
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x10121f40
push 0x28
push str.cryptohmachmac.c
push str.assertion_failed:_j____int_sizeof_ctx__key_
call fcn.100b8470
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
jge 0x10121f9b
push dword [esp + 0x10]
push edi
push dword [esi + 4]
call fcn.100c9550
add esp, 0xc
test eax, eax
je 0x10121f80
push ebx
push ebp
push dword [esi + 4]
call fcn.100c9700
add esp, 0xc
test eax, eax
je 0x10121f80
lea ebp, [esi + 0x10]
push ebp
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.100c94b0
add esp, 0xc
test eax, eax
jne 0x10121fb7
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10084565
add esp, 0x8c
ret
cmp ebx, 0x80
ja 0x10121f80
push ebx
lea eax, [esi + 0x14]
push ebp
push eax
call fcn.10086070
lea ebp, [esi + 0x10]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x80
je 0x10121fda
mov eax, 0x80
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call fcn.10085f10
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x10121fe0
push edx
push edi
push dword [esi + 8]
call fcn.100c9550
add esp, 0xc
test eax, eax
je 0x10121f80
push edi
call fcn.100b00a0
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call fcn.100c9700
add esp, 0x10
test eax, eax
je 0x10121f80
xor ecx, ecx
nop dword [eax]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x10122030
push dword [esp + 0x10]
push edi
push dword [esi + 0xc]
call fcn.100c9550
add esp, 0xc
test eax, eax
je 0x10121f80
push edi
call fcn.100b00a0
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.100c9700
add esp, 0x10
test eax, eax
je 0x10121f80
push dword [esi + 8]
push dword [esi + 4]
call fcn.100c9730
add esp, 8
test eax, eax
je 0x10121f80
mov eax, 1
jmp 0x10121f82
test eax, eax
je 0x1012207a
jmp 0x10121fde
Function at 0x10127460
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, 0x80
mov byte [ebx], 0
cmp ecx, edi
cmovg ecx, edi
test ebp, ebp
jg 0x10127488
mov ebp, 0x400
jmp 0x10127492
mov eax, 0x400
cmp ebp, eax
cmovg ebp, eax
test ecx, ecx
jle 0x101274b4
sub dword [esp + 0x1c], ebx
mov edx, ebx
mov ebx, dword [esp + 0x1c]
mov esi, ecx
mov al, byte [ebx + edx]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub esi, 1
jne 0x101274a2
mov ebx, dword [esp + 0x14]
movzx edx, byte [ebx + ecx - 1]
cmp ecx, edi
jge 0x101274d9
mov esi, ebx
sub esi, ecx
movzx eax, byte [esi + ecx]
add eax, edx
movzx eax, al
movzx edx, byte [eax + 0x101b2540]
mov byte [ecx + ebx], dl
inc ecx
cmp ecx, edi
jl 0x101274c1
lea eax, [ebp + 7]
mov edx, 0xff
sar eax, 3
neg ebp
sub edi, eax
mov dword [esp + 0x14], eax
movzx eax, byte [edi + ebx]
lea esi, [edi + ebx]
and ebp, 7
mov ecx, ebp
sar edx, cl
and edx, eax
movzx ecx, byte [edx + 0x101b2540]
mov byte [esi], cl
test edi, edi
je 0x10127528
mov edx, dword [esp + 0x14]
nop dword [eax]
movzx eax, byte [esi + edx - 1]
lea esi, [esi - 1]
xor eax, ecx
movzx ecx, byte [eax + 0x101b2540]
mov byte [esi], cl
sub edi, 1
jne 0x10127510
lea esi, [ebx + 0xfc]
mov edi, 0x40
lea edx, [ebx + 0x7e]
movzx ecx, byte [edx + 1]
lea esi, [esi - 4]
movzx eax, byte [edx]
lea edx, [edx - 2]
shl ecx, 8
or ecx, eax
movzx eax, cx
mov dword [esi + 4], eax
sub edi, 1
jne 0x10127536
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1012c150
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.10084f50
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [esi + 0x160]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esp + 0x14], ebx
mov dword [esi + 0x16c], 0
mov dword [esi + 0x168], 0
cmp edi, 0xc
jne 0x1012c1fb
mov eax, dword [esp + 0x18]
mov edi, 1
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov byte [esi + 0xf], 1
jmp 0x1012c329
mov dword [esp + 0xc], edi
push ebp
mov ebp, dword [esp + 0x1c]
cmp edi, 0x10
jb 0x1012c273
mov ebx, ebp
lea ecx, [esi + 0xf]
mov eax, edi
sub ebx, esi
shr eax, 4
mov dword [esp + 0x20], eax
nop dword [eax]
lea eax, [ebx + ecx]
cmp esi, eax
ja 0x1012c242
cmp ecx, ebp
jb 0x1012c242
mov eax, esi
mov edx, 0x10
mov cl, byte [ebx + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x1012c232
jmp 0x1012c250
movups xmm1, xmmword [esi]
movups xmm0, xmmword [ebp]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
lea eax, [esi + 0x60]
push eax
push esi
call dword [esp + 0x20]
add esp, 8
lea ecx, [esi + 0xf]
add ebp, 0x10
add ebx, 0x10
sub edi, 0x10
sub dword [esp + 0x20], 1
jne 0x1012c220
mov ebx, dword [esp + 0x18]
test edi, edi
je 0x1012c302
xor edx, edx
test edi, edi
je 0x1012c2f8
cmp edi, 0x20
jb 0x1012c2db
lea eax, [ebp - 1]
lea ecx, [esi - 1]
add eax, edi
add ecx, edi
cmp esi, eax
ja 0x1012c298
cmp ecx, ebp
jae 0x1012c2db
mov eax, edi
mov ecx, edi
and eax, 0x1f
mov ebx, ebp
sub ecx, eax
mov eax, esi
sub ebx, esi
nop word [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movups xmm1, xmmword [eax + ebx - 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm1, xmmword [edx + ebp + 0x10]
add edx, 0x20
movups xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edx, ecx
jb 0x1012c2b0
cmp edx, edi
jae 0x1012c2f4
sub ebp, esi
lea ecx, [edx + esi]
sub edi, edx
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edi, 1
jne 0x1012c2e6
mov ebx, dword [esp + 0x18]
lea eax, [esi + 0x60]
push eax
push esi
call ebx
add esp, 8
mov eax, dword [esp + 0x10]
xor ecx, ecx
shld ecx, eax, 3
shl eax, 3
bswap eax
xor dword [esi + 0xc], eax
lea eax, [esi + 0x60]
push eax
bswap ecx
xor dword [esi + 8], ecx
push esi
call ebx
mov edi, dword [esi + 0xc]
add esp, 8
bswap edi
pop ebp
push dword [esi + 0x174]
lea eax, [esi + 0x20]
push eax
mov eax, dword [esi + 0x170]
push esi
call eax
add esp, 0xc
inc edi
bswap edi
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x1012e970
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.10084f50
mov edx, dword [esp + 0x1c]
xor ecx, ecx
test edx, edx
je 0x1012ea65
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x20]
cmp edx, 0x20
jb 0x1012ea3e
push ebp
lea eax, [ebx - 1]
lea ebp, [esi - 1]
add eax, edx
add ebp, edx
cmp esi, eax
ja 0x1012e9b7
cmp ebp, ebx
jae 0x1012ea3d
lea eax, [edi - 1]
add eax, edx
cmp esi, eax
ja 0x1012e9c4
cmp ebp, edi
jae 0x1012ea3d
mov eax, edx
mov ebp, edx
mov edx, esi
and eax, 0x1f
sub edx, edi
sub ebp, eax
mov dword [esp + 0x10], edx
mov eax, edi
mov edx, ebx
mov dword [esp + 0x1c], ebp
sub edx, edi
lea ebp, [ebx + 0x10]
mov dword [esp + 0x14], edx
mov edx, esi
mov esi, dword [esp + 0x10]
sub edx, ebx
mov edi, dword [esp + 0x14]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x18]
nop
movups xmm0, xmmword [eax]
add ecx, 0x20
lea eax, [eax + 0x20]
lea ebp, [ebp + 0x20]
movups xmm1, xmmword [edi + eax - 0x20]
pxor xmm1, xmm0
movups xmmword [esi + eax - 0x20], xmm1
movups xmm1, xmmword [eax - 0x10]
movups xmm0, xmmword [ebp - 0x20]
pxor xmm1, xmm0
movups xmmword [ebx + ebp - 0x20], xmm1
cmp ecx, dword [esp + 0x1c]
jb 0x1012ea00
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
pop ebp
cmp ecx, edx
jae 0x1012ea62
sub edi, ebx
lea eax, [ecx + ebx]
sub esi, ebx
sub edx, ecx
nop dword [eax + eax]
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [eax + esi - 1], cl
sub edx, 1
jne 0x1012ea50
pop edi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x10131360
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x10131374
mov dword [esp + 0x18], fcn.1012fb40
jmp fcn.1012ad90
mov dword [esp + 0x18], fcn.1012ede0
jmp fcn.1012aad0
Function at 0x10160ed0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.10084f50
mov eax, dword [0x101c3080]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov ebx, dword [esp + 0xb8]
push ebp
push esi
mov esi, dword [esp + 0xbc]
xor ebp, ebp
mov dword [esp + 0x2c], eax
push edi
mov eax, dword [esi + 8]
mov dword [esp + 0x10], eax
sub eax, ebx
mov dword [esp + 0x24], eax
cmp dword [esi + 0xc], ebx
jae 0x10160f30
push 0x4c7
push 0x101bb9d4
push str.assertion_failed:_rec__orig_len___md_size
call fcn.100b8470
add esp, 0xc
cmp ebx, 0x40
jbe 0x10160f4c
push 0x4c8
push 0x101bb9d4
push str.assertion_failed:_md_size___EVP_MAX_MD_SIZE
call fcn.100b8470
add esp, 0xc
mov ecx, dword [esi + 0xc]
lea eax, [esp + 0x34]
neg eax
mov dword [esp + 0x20], ecx
and eax, 0x3f
lea edi, [esp + 0x34]
add edi, eax
lea eax, [ebx + 0x100]
mov dword [esp + 0x2c], edi
cmp ecx, eax
jbe 0x10160f7a
mov ebp, ecx
sub ebp, ebx
sub ebp, 0x100
push ebx
xor esi, esi
mov dword [esp + 0x18], 0
push esi
push edi
call fcn.10085f10
add esp, 0xc
mov dword [esp + 0x18], esi
cmp ebp, dword [esp + 0x20]
jae 0x1016102d
mov eax, dword [esp + 0xc0]
mov ecx, ebp
sub ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
mov eax, dword [eax + 0x14]
mov dword [esp + 0x28], eax
mov eax, ebp
mov edx, ecx
xor eax, dword [esp + 0x24]
xor edx, dword [esp + 0x10]
lea edi, [eax - 1]
not eax
shr eax, 0x1f
shr edi, 0x1f
and edi, eax
mov eax, ebp
xor eax, dword [esp + 0x10]
neg edi
or edx, eax
mov eax, dword [esp + 0x28]
xor edx, ebp
shr edx, 0x1f
neg edx
mov cl, byte [eax + ebp]
mov eax, edi
or eax, dword [esp + 0x14]
inc ebp
and eax, edx
mov edx, dword [esp + 0x18]
and edi, edx
mov dword [esp + 0x14], eax
and al, cl
or esi, edi
mov edi, dword [esp + 0x2c]
or byte [edx + edi], al
inc edx
mov ecx, edx
mov eax, edx
sub ecx, ebx
xor eax, ebx
xor ecx, ebx
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov ecx, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
cmp ebp, dword [esp + 0x20]
jb 0x10160fb5
xor edx, edx
test ebx, ebx
je 0x10161061
mov ebp, dword [esp + 0x30]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + edi]
movzx eax, byte [esi + edi]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, ebx
mov eax, esi
xor ecx, ebx
xor eax, ebx
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, ebx
jb 0x10161037
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10084565
add esp, 0xa8
ret
Function at 0x10161ba0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.10084f50
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
mov eax, dword [ebx + 4]
mov edi, dword [esp + 0x20]
inc edi
mov eax, dword [eax + 0x64]
test byte [eax + 0x34], 1
je 0x10161beb
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 8]
lea eax, [edi + ecx]
cmp eax, edx
jbe 0x10161bdb
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
add dword [esi + 0x14], ecx
sub edx, ecx
add dword [esi + 0x18], ecx
sub dword [esi + 0xc], ecx
mov dword [esi + 8], edx
jmp 0x10161bf0
cmp edi, dword [esi + 8]
ja 0x10161bd4
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 8]
push ebp
push dword [ebx + 0xb0]
movzx ebp, byte [ecx + eax - 1]
call fcn.100aa4e0
push eax
call fcn.100a7b20
add esp, 8
test eax, 0x200000
je 0x10161c2a
or eax, 0xffffffff
sub eax, ebp
add dword [esi + 8], eax
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
mov edx, dword [esi + 8]
lea ecx, [edi + ebp]
mov ebx, edx
mov dword [esp + 0x10], edx
sub ebx, ecx
mov eax, edx
xor ebx, ecx
xor eax, ecx
or ebx, eax
mov eax, 0x100
xor ebx, edx
shr ebx, 0x1f
dec ebx
cmp edx, eax
cmovb eax, edx
xor edi, edi
mov dword [esp + 0x18], eax
test eax, eax
je 0x10161cad
mov eax, dword [esi + 0x14]
mov ecx, ebp
shr ecx, 0x1f
lea esi, [edx - 1]
mov dword [esp + 0x24], ecx
add esi, eax
nop dword [eax + eax]
mov al, byte [esp + 0x24]
lea esi, [esi - 1]
mov edx, ebp
mov ecx, edi
sub edx, edi
shr ecx, 0x1f
shr edx, 0x1f
xor al, cl
xor dl, cl
inc edi
or dl, al
movzx eax, byte [esi + 1]
xor dl, byte [esp + 0x24]
xor eax, ebp
dec dl
movzx ecx, dl
and ecx, eax
not ecx
and ebx, ecx
cmp edi, dword [esp + 0x18]
jb 0x10161c70
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
not ebx
movzx eax, bl
lea ecx, [eax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [ebp + 1]
neg ecx
and eax, ecx
sub edx, eax
mov eax, ecx
pop ebp
pop edi
mov dword [esi + 8], edx
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebx
pop ecx
ret
Function at 0x10165e30
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10165e5d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10165e5d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x10167240
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x20]
cmp dword [eax], 5
je 0x1016725b
push eax
push esi
call fcn.10167880
add esp, 8
test eax, eax
jle 0x101672a3
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push esi
mov edi, eax
call fcn.100a78d0
add esp, 8
test edi, edi
jg 0x101672a0
push edi
call fcn.100da6f0
add esp, 4
test eax, eax
je 0x101672a0
push 0xa
push esi
call fcn.100a8030
add esp, 8
mov eax, edi
pop edi
pop esi
ret
Function at 0x409088
Capabilities:
Encode data using xor

Disassembly:
scasd eax, dword es:[edi]
enter 0xffffffffffffa11c, 0x52
or al, 0x2e
cmp esi, 0xf28a17a7
lds ecx, [edi + 0x30]
mov byte [0xfcbb21e8], al
adc ebx, eax
std
insd dword es:[edi], dx
adc bh, bl
je 0x40908c
salc
or byte ds:[eax - 0x6e1755e5], dl
test eax, 0xb1258168
mov esi, 0x4b1bc362
mov ah, 0x31
mov ebx, 0xc8164383
inc ecx
jg 0x4090eb
fld dword [ebp - 0x7c259e9d]
or dh, byte [esi + 0xaf8b52b]
cwde
xchg ebx, eax
cmp dh, dl
salc
sbb bh, byte [edx + edi*4]
add bh, byte [ecx]
aad 0x6c
add byte [edx - 0x46e545dd], bh
in eax, 0xc9
or byte [ebp + 0x19698997], 0xc9
mov edx, 0x619d86c5
or eax, 0x2b6bd12a
sbb edx, dword [esi - 0xd]
pop ecx
mov edi, 0xf091b3ad
wait
adc ch, byte [edx - 5]
jmp 0x40911d
invalid
adc ecx, dword [ebp - 0x38]
dec edx
dec ebp
and ebp, dword [ebp + ebp*2 - 0x4bdefec2]
add eax, 0xa88498a7
mov dl, byte [eax + esi*4 - 0x48]
pop es
scasd eax, dword es:[edi]
inc esi
cdq
jnp 0x409158
mov dl, 0x28
or ah, byte [esi - 0x2e]
pop edx
sub byte [ebx], bh
mul dword [edx]
lock adc byte [ebx], dl
rcr byte [edx + 0x28], cl
cmp esi, edi
and dh, al
adc byte [ebx], dl
jnp 0x40913b
sub byte [edx + 0x6cf8d168], dh
cmp eax, edi
mov es, edx
mov ecx, 0xdeb6e826
invalid
push 0x49
call 0xbdc68847
por mm2, qword [ecx]
cli
xchg eax, ebx
invalid

Function at 0x42cf62
Capabilities:
Encode data using xor

Disassembly:
adc ebx, ebp
xchg byte [ecx], ch
push ecx
push ebx
std
les ebx, ss:[edi + 0x24ea0fa2]
les ebx, [edi + 0x24ea0fa2]
xchg dword [eax + 0x77], edx
jb 0x42cf03
xor dword [esi - 0x69], 0
mov eax, 0xfa6dc32f
das
ret
insd dword es:[edi], dx
cli
jo 0x42cfce
xor al, 0xcf
std
sbb dword [eax + 0x43], ebx
push dword [edi + 0x11]
inc ebx
lds edi, [ebp + 0x3f8476ba]
fstpnce st(3), st(0)
inc ebx
invalid
Function at 0x6275d5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x62e3c8
cmp edx, dword [eax]
je 0x6275f7
add eax, 8
inc ecx
cmp eax, 0x62e458
jl 0x6275e8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x62e3c8]
jne 0x627725
mov eax, dword [0x633d60]
cmp eax, 1
je 0x6276ff
test eax, eax
jne 0x627628
cmp dword [0x62e2f0], 1
je 0x6276ff
cmp edx, 0xfc
je 0x627725
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x62765f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00627fc0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00628450
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x6276a2
lea eax, [ebp - 0x1a4]
push eax
call fcn.00628450
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62c634
push edi
call fcn.0062a320
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00627fc0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00627fd0
lea eax, [ebp - 0xa0]
push 0x62c614
push eax
call fcn.00627fd0
push dword [esi + 0x62e3cc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00627fd0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062a294
add esp, 0x2c
pop edi
jmp 0x627725
lea eax, [ebp + 8]
lea esi, [esi + 0x62e3cc]
push 0
push eax
push dword [esi]
call fcn.00628450
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret