joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a65b0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x174
call fcn.10175fd0
mov eax, dword [0x1024ee80]
xor eax, esp
mov dword [esp + 0x170], eax
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x18c]
push ebx
mov ebx, dword [esp + 0x18c]
push ebp
mov ebp, dword [esp + 0x180]
push esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x190]
push edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1a0]
push eax
push str.SHA512
push ecx
call fcn.1004c8e0
add esp, 0xc
mov edi, eax
call fcn.1004c850
mov dword [esp + 0x18], 0
mov esi, eax
test edi, edi
je 0x100a67be
test esi, esi
je 0x100a67be
push 0
push edi
push esi
call fcn.1004c220
add esp, 0xc
test eax, eax
je 0x100a67be
push 0x20
push ebx
push esi
call fcn.1004c260
add esp, 0xc
test eax, eax
je 0x100a67be
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xc4]
push eax
push esi
call fcn.1004c0f0
add esp, 0xc
test eax, eax
je 0x100a67be
mov al, byte [esp + 0xdf]
and byte [esp + 0xc0], 0xf8
and al, 0x3f
push 0
or al, 0x40
push edi
push esi
mov byte [esp + 0xeb], al
call fcn.1004c220
add esp, 0xc
test eax, eax
je 0x100a67be
push 0x20
lea eax, [esp + 0xe4]
push eax
push esi
call fcn.1004c260
add esp, 0xc
test eax, eax
je 0x100a67be
mov ebx, dword [esp + 0x190]
push ebx
push dword [esp + 0x14]
push esi
call fcn.1004c260
add esp, 0xc
test eax, eax
je 0x100a67be
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x104]
push eax
push esi
call fcn.1004c0f0
add esp, 0xc
test eax, eax
je 0x100a67be
lea eax, [esp + 0x100]
push eax
call fcn.100ab220
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.100a5ce0
lea eax, [esp + 0x2c]
push eax
push ebp
call fcn.100a5c60
push 0
push edi
push esi
call fcn.1004c220
add esp, 0x20
test eax, eax
je 0x100a67be
push 0x20
push ebp
push esi
call fcn.1004c260
add esp, 0xc
test eax, eax
je 0x100a67be
push 0x20
push dword [esp + 0x20]
push esi
call fcn.1004c260
add esp, 0xc
test eax, eax
je 0x100a67be
push ebx
push dword [esp + 0x14]
push esi
call fcn.1004c260
add esp, 0xc
test eax, eax
je 0x100a67be
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x144]
push eax
push esi
call fcn.1004c0f0
add esp, 0xc
test eax, eax
je 0x100a67be
lea eax, [esp + 0x140]
push eax
call fcn.100ab220
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x14c]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.100a6ce0
add esp, 0x14
mov dword [esp + 0x18], 1
lea eax, [esp + 0x100]
push 0x40
push eax
call fcn.10001320
lea eax, [esp + 0xc8]
push 0x40
push eax
call fcn.10001320
push edi
call fcn.1004c910
push esi
call fcn.1004c7c0
mov ecx, dword [esp + 0x198]
add esp, 0x18
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10175bf0
add esp, 0x174
ret
Function at 0x100ae630
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
lea edx, [eax + 0x3c]
movd xmm0, ebx
pshufd xmm4, xmm0, 0
lea ecx, [esi + 0x3c]
cmp eax, ecx
ja 0x100ae67f
cmp edx, esi
jb 0x100ae67f
push edi
sub esi, eax
mov edi, 0x10
nop dword [eax]
mov edx, dword [eax + esi]
lea eax, [eax + 4]
mov ecx, dword [eax - 4]
xor ecx, edx
and ecx, ebx
xor edx, ecx
mov dword [eax + esi - 4], edx
xor dword [eax - 4], ecx
sub edi, 1
jne 0x100ae660
pop edi
pop esi
pop ebx
ret
sub esi, eax
mov ecx, 4
nop word [eax + eax]
lea eax, [eax + 0x10]
movups xmm1, xmmword [esi + eax - 0x10]
movups xmm3, xmmword [eax - 0x10]
movaps xmm2, xmm1
xorps xmm2, xmm3
andps xmm2, xmm4
movaps xmm0, xmm2
xorps xmm2, xmm3
xorps xmm0, xmm1
movups xmmword [esi + eax - 0x10], xmm0
movups xmmword [eax - 0x10], xmm2
sub ecx, 1
jne 0x100ae690
pop esi
pop ebx
ret
Function at 0x100b4280
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x100b4349
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x100b42a1
cmp al, 0x6b
jne 0x100b4349
inc ecx
cmp al, 0x6b
jne 0x100b4302
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x100b42c2
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x100b42c2
cmp dl, 0xbb
jne 0x100b42d6
inc eax
cmp eax, esi
jl 0x100b42b0
sub esi, eax
test eax, eax
jne 0x100b4305
call fcn.10055e90
push str.RSA_padding_check_X931
push 0x56
jmp 0x100b42e2
call fcn.10055e90
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.10055f90
push 0
push 0x8a
push 4
call fcn.10056040
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x100b4337
call fcn.10055e90
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.10055f90
push 0
push 0x8b
push 4
call fcn.10056040
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call fcn.10177320
add esp, 0xc
mov eax, esi
pop esi
ret
call fcn.10055e90
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.10055f90
push 0
push 0x89
push 4
call fcn.10056040
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
Function at 0x100c7020
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.10175fd0
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x24]
push ebp
mov ebp, dword [eax + 0x64]
push esi
mov esi, dword [esp + 0x28]
push edi
mov ecx, dword [ebp + 0x70]
mov edi, dword [esp + 0x28]
mov dword [esp + 0x10], ebp
test ecx, ecx
je 0x100c7089
test ebx, ebx
je 0x100c7069
lea edx, [ebp + 0x30]
add edx, ecx
cmp ecx, 0x40
jae 0x100c7069
mov al, byte [edx]
inc ecx
xor al, byte [esi]
inc edx
mov byte [edi], al
inc esi
inc edi
sub ebx, 1
jne 0x100c7055
mov dword [ebp + 0x70], ecx
test ebx, ebx
je 0x100c7144
cmp ecx, 0x40
jne 0x100c7089
mov dword [ebp + 0x70], 0
add dword [ebp + 0x20], 1
jne 0x100c7089
inc dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
mov eax, ebx
and eax, 0x3f
sub ebx, eax
mov dword [esp + 0x1c], eax
lea eax, [ebp + 0x20]
mov dword [esp + 0x24], eax
cmp ebx, 0x40
jb 0x100c70f7
push dword [esp + 0x24]
mov ecx, ebx
xor ebp, ebp
shr ecx, 6
lea eax, [ecx + edx]
cmp eax, ecx
cmovae ebp, eax
neg edx
cmp eax, ecx
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x14]
cmovae edx, ecx
shl edx, 6
push ebp
push edx
push esi
push edi
mov dword [esp + 0x28], edx
call fcn.1001ae80
mov eax, dword [esp + 0x28]
add esp, 0x14
sub ebx, eax
add esi, eax
add edi, eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 0x20], eax
test eax, eax
jne 0x100c70f0
inc dword [ebp + 0x24]
mov edx, eax
cmp ebx, 0x40
jae 0x100c70a3
mov ebx, dword [esp + 0x1c]
test ebx, ebx
je 0x100c7144
push 0x40
lea eax, [ebp + 0x30]
push 0
push eax
call fcn.101778a0
lea eax, [ebp + 0x20]
push eax
push ebp
lea eax, [ebp + 0x30]
push 0x40
push eax
push eax
call fcn.1001ae80
add esp, 0x20
xor edx, edx
test ebx, ebx
je 0x100c7141
sub esi, edi
nop dword [eax + eax]
mov al, byte [edx + ebp + 0x30]
lea ecx, [edx + edi]
xor al, byte [esi + ecx]
inc edx
mov byte [ecx], al
cmp edx, ebx
jb 0x100c7130
mov dword [ebp + 0x70], ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
Function at 0x100cbdb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.10175fd0
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x34]
mov edi, dword [edi]
mov dword [esp + 0x14], edi
test edi, edi
je 0x100cbdf9
mov ecx, dword [esp + 0x30]
nop dword [eax]
test esi, esi
je 0x100cbdf9
mov al, byte [edi + ecx]
dec esi
xor al, byte [ebp]
inc edi
mov byte [ebx], al
inc ebp
inc ebx
and edi, 0xf
mov dword [esp + 0x14], edi
jne 0x100cbde0
mov eax, dword [esp + 0x2c]
mov edx, dword [eax + 0xc]
bswap edx
mov dword [esp + 0x24], edx
cmp esi, 0x10
jb 0x100cbe94
mov edi, eax
mov ecx, esi
shr ecx, 4
push edi
push dword [esp + 0x2c]
lea eax, [ecx + edx]
neg edx
cmp eax, ecx
cmovae edx, ecx
mov dword [esp + 0x18], edx
xor edx, edx
push dword [esp + 0x18]
cmp eax, ecx
push ebx
cmovae edx, eax
push ebp
mov dword [esp + 0x38], edx
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, edx
bswap eax
mov dword [edi + 0xc], eax
test edx, edx
jne 0x100cbe76
mov edx, 0xc
mov eax, 1
nop word [eax + eax]
movzx ecx, byte [edx + edi - 1]
dec edx
add eax, ecx
mov byte [edx + edi], al
shr eax, 8
test edx, edx
jne 0x100cbe60
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
shl eax, 4
sub esi, eax
add ebx, eax
add ebp, eax
cmp esi, 0x10
jae 0x100cbe11
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], edx
test esi, esi
je 0x100cbef2
mov ecx, dword [esp + 0x30]
xorps xmm0, xmm0
push eax
push dword [esp + 0x2c]
push 1
push ecx
push ecx
movups xmmword [ecx], xmm0
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, dword [esp + 0x2c]
add edx, 1
bswap edx
mov dword [eax + 0xc], edx
jne 0x100cbecd
push eax
call fcn.100cbf30
add esp, 4
mov eax, dword [esp + 0x30]
sub ebp, eax
sub ebx, eax
lea ecx, [edi + eax]
add edi, esi
nop word [eax + eax]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub esi, 1
jne 0x100cbee0
mov eax, dword [esp + 0x34]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100cf650
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, 4
call fcn.10175fd0
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 1
cmp edi, 0xffffffff
jne 0x100cf698
call fcn.10055e90
push str.BIO_connect
push 0x54
push str.crypto_bio_bio_sock2.c
call fcn.10055f90
push 0
push 0x87
push 0x20
call fcn.10056040
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
mov eax, ebx
shr eax, 3
push esi
and eax, 1
push eax
push edi
call fcn.10088430
add esp, 8
test eax, eax
je 0x100cf727
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
test bl, 4
je 0x100cf72e
push 4
lea eax, [esp + 0x10]
push eax
push 8
push 0xffff
push edi
call esi
test eax, eax
je 0x100cf72e
call fcn.10055e90
push str.BIO_connect
push 0x5e
push str.crypto_bio_bio_sock2.c
call fcn.10055f90
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.10056040
call fcn.10055e90
push str.BIO_connect
push 0x60
push str.crypto_bio_bio_sock2.c
call fcn.10055f90
push 0
push 0x89
push 0x20
call fcn.10056040
add esp, 0x24
pop esi
pop ebx
xor eax, eax
pop edi
pop ecx
ret
test bl, 0x10
je 0x100cf79f
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push edi
call esi
test eax, eax
je 0x100cf79f
call fcn.10055e90
push str.BIO_connect
push 0x68
push str.crypto_bio_bio_sock2.c
call fcn.10055f90
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.10056040
call fcn.10055e90
push str.BIO_connect
push 0x6a
push str.crypto_bio_bio_sock2.c
call fcn.10055f90
push 0
push 0x8a
push 0x20
call fcn.10056040
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
mov esi, dword [esp + 0x18]
push esi
call fcn.100886e0
add esp, 4
push eax
push esi
call fcn.100886d0
add esp, 4
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x100cf82b
push eax
call fcn.100cf560
add esp, 4
test eax, eax
jne 0x100cf727
call fcn.10055e90
push str.BIO_connect
push 0x72
push str.crypto_bio_bio_sock2.c
call fcn.10055f90
add esp, 0xc
push str.calling_connect__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.10056040
call fcn.10055e90
push str.BIO_connect
push 0x74
push str.crypto_bio_bio_sock2.c
call fcn.10055f90
push 0
push 0x67
push 0x20
call fcn.10056040
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
pop esi
pop ebx
mov eax, 1
pop edi
pop ecx
ret

Function at 0x100d33a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov cl, byte [esp + 0x10]
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
movzx eax, cl
and eax, 1
push edi
mov edi, dword [esp + 0x10]
test esi, esi
je 0x100d33e2
push ebx
add edi, esi
lea ebx, [edx + esi]
movzx edx, byte [edi - 1]
lea edi, [edi - 1]
movzx ecx, cl
lea ebx, [ebx - 1]
xor edx, ecx
mov cl, byte [esp + 0x1c]
add eax, edx
mov byte [ebx], al
shr eax, 8
sub esi, 1
jne 0x100d33c2
pop ebx
pop edi
pop esi
ret
Function at 0x100e8a10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.10175fd0
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x100e8a58
call fcn.10055e90
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5c
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.10055f90
push 0
push 0x78
push 4
call fcn.10056040
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.100e8760
add esp, 4
test eax, eax
jne 0x100e8a94
call fcn.10055e90
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x61
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.10055f90
push 0
push 0xb2
push 4
call fcn.10056040
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.100b6a20
push esi
call fcn.100b67d0
push esi
mov dword [esp + 0x2c], eax
call fcn.100b67d0
push esi
mov ebp, eax
call fcn.100b67d0
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x100e8bf6
test ebp, ebp
je 0x100e8bcd
test ebx, ebx
je 0x100e8bc4
push 4
push ebp
call fcn.100607f0
push 4
push ebx
call fcn.100607f0
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x100e8afe
call fcn.100606c0
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x100e8b0d
call fcn.100606c0
mov dword [esi + 0x24], eax
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x100e8bc0
test eax, eax
je 0x100e8bc0
push 4
push ecx
call fcn.100607f0
push 4
push dword [esi + 0x24]
call fcn.100607f0
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.10154480
add esp, 0x3c
test eax, eax
je 0x100e8bc0
nop dword [eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.10154480
add esp, 0x2c
test eax, eax
je 0x100e8bc0
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.100e86f0
add esp, 0x10
test eax, eax
js 0x100e8bc0
je 0x100e8b60
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.100e86f0
add esp, 0x10
test eax, eax
js 0x100e8bc0
je 0x100e8b60
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
push ebp
call fcn.1005fdd0
add esp, 4
test ebx, ebx
je 0x100e8bda
push ebx
call fcn.1005fdd0
add esp, 4
push dword [esp + 0x20]
call fcn.1005fdd0
push esi
call fcn.100b66d0
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x100e8bcd
jmp 0x100e8bc4
Function at 0x101011e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.10175fd0
push ebx
mov ebx, dword [esp + 0x10]
xor ecx, ecx
push esi
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x1c], 0x10
push edi
mov edi, dword [esp + 0x1c]
test esi, esi
jle 0x101012de
cmp esi, 8
jb 0x101012c4
lea eax, [esi - 1]
lea edx, [esi - 1]
add eax, edi
add edx, ebx
cmp ebx, eax
ja 0x1010122a
cmp edx, edi
jae 0x101012c4
mov edx, edi
push ebp
cmp esi, 0x40
jb 0x10101299
mov eax, esi
lea ebp, [edi + 0x30]
and eax, 0xffffffc0
sub edx, ebx
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x10]
movups xmm0, xmmword [eax - 0x10]
add ecx, 0x40
lea ebp, [ebp + 0x40]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ebp - 0x70]
xorps xmm1, xmm0
movups xmmword [eax - 0x50], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [edx + eax - 0x40]
xorps xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ebp - 0x50]
xorps xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm1, xmmword [eax - 0x20]
movups xmm0, xmmword [ebp - 0x40]
xorps xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
cmp ecx, dword [esp + 0x10]
jl 0x10101243
mov eax, esi
and al, 0x3f
cmp al, 8
jb 0x101012bf
jmp 0x1010129b
sub edx, ebx
mov ebp, esi
lea eax, [ecx + ebx]
and ebp, 0xfffffff8
movq xmm1, qword [edx + eax]
lea eax, [eax + 8]
movq xmm0, qword [eax - 8]
add ecx, 8
xorps xmm1, xmm0
movq qword [eax - 8], xmm1
cmp ecx, ebp
jl 0x101012a3
pop ebp
cmp ecx, esi
jge 0x101012de
mov edx, esi
lea eax, [ecx + ebx]
sub edi, ebx
sub edx, ecx
nop dword [eax]
mov cl, byte [eax + edi]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x101012d0
push esi
push ebx
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x20]
push ebx
push dword [eax + 8]
call fcn.10065c00
add esp, 0x14
test eax, eax
je 0x10101307
xor eax, eax
cmp dword [esp + 0x20], esi
pop edi
pop esi
sete al
pop ebx
pop ecx
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x101014a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x10101513
mov edx, dword [esp + 0x10]
test edx, edx
je 0x10101513
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [ebx + 0x14]
cmp edx, edi
cmovb edi, edx
test edi, edi
je 0x101014e0
push esi
mov esi, ebp
lea ecx, [ebx + 0x1c]
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub edi, 1
jne 0x101014d0
pop esi
mov eax, dword [ebx + 0x14]
cmp edx, eax
jbe 0x10101511
sub edx, eax
cmp edx, 0x10
jbe 0x101014f5
mov edx, 0x10
jmp 0x101014f9
test edx, edx
je 0x10101511
xor ecx, ecx
nop dword [eax + eax]
mov eax, dword [ebx + 0x14]
add eax, ecx
mov al, byte [eax + ebp]
xor byte [ebx + ecx + 0x3c], al
inc ecx
cmp ecx, edx
jb 0x10101500
pop edi
pop ebx
pop ebp
ret
Function at 0x10101790
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x74
call fcn.10175fd0
mov eax, dword [0x1024ee80]
xor eax, esp
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x78]
mov edx, 0x10
mov eax, dword [esp + 0x84]
push ebx
push ebp
mov ebp, dword [esp + 0x84]
push esi
mov esi, dword [ecx + 0x94]
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x98]
movups xmm0, xmmword [esi + 0x3c]
mov dword [esp + 0x18], ecx
mov ecx, 1
push edi
mov dword [esp + 0x18], eax
movups xmmword [esp + 0x20], xmm0
nop
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x101017f0
movups xmm0, xmmword [esi + 0x3c]
movups xmmword [esp + 0x30], xmm0
cmp dword [esi + 0x14], 0x10
jne 0x10101817
lea edi, [edx + 0x20]
jmp 0x10101842
mov edx, 0x10
mov ecx, 1
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x10101821
movups xmm0, xmmword [esi + 0x3c]
mov edi, 0x30
movups xmmword [esp + 0x40], xmm0
push edi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x5c]
push eax
push dword [esi]
call fcn.10065c00
add esp, 0x14
test eax, eax
je 0x10101959
cmp dword [esp + 0x14], edi
jne 0x10101959
push dword [esi + 0x14]
lea eax, [esp + 0x54]
push eax
lea ebx, [esi + 0x1c]
push ebx
call fcn.10177320
mov eax, dword [esi + 0x14]
add esp, 0xc
cmp dword [esi + 0x18], 0
movups xmm0, xmmword [esp + eax + 0x50]
movups xmmword [esi + 0x3c], xmm0
je 0x101018ef
mov edi, dword [esp + 0x90]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebp, ebp
jne 0x101018af
test ecx, ecx
jne 0x101018af
test eax, eax
je 0x101018d2
push dword [esp + 0x98]
push eax
push dword [esp + 0xa8]
push ecx
push edi
push ebp
push esi
call fcn.10101520
add esp, 0x1c
test eax, eax
je 0x10101959
test edi, edi
je 0x10101912
mov eax, dword [esp + 0x1c]
push dword [eax + 0x8c]
lea eax, [esi + 0x60]
push eax
push esi
call fcn.101014a0
add esp, 0xc
jmp 0x10101912
push dword [esp + 0x90]
push ebp
push esi
call fcn.101014a0
push dword [esp + 0xa4]
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.101014a0
add esp, 0x18
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi]
call fcn.10065bd0
add esp, 0x18
test eax, eax
je 0x10101959
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi + 4]
call fcn.10065bd0
add esp, 0x18
test eax, eax
je 0x10101959
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.10175bf0
add esp, 0x74
ret
mov ecx, dword [esp + 0x80]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10175bf0
add esp, 0x74
ret
Function at 0x10104ee5
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x10104e2d
xor eax, eax
pop ebx
ret
push edi
push dword [ebx + 4]
push 0
push dword [ebx + 8]
push dword [ebx]
call fcn.10095760
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x10104e74
call fcn.10055e90
push str.ecx_gen
push 0x24c
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.10055f90
push edi
push 0xc0100
push 0x39
call fcn.10056040
add esp, 0x18
xor eax, eax
pop edi
pop ebx
ret
test byte [ebx + 0xc], 3
je 0x10104ebf
push esi
push edi
call fcn.100956e0
mov esi, eax
add esp, 4
test esi, esi
jne 0x10104ec2
call fcn.10055e90
push str.ecx_gen
push 0x255
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.10055f90
push esi
push 0xc0100
push 0x39
call fcn.10056040
add esp, 0x18
push edi
call fcn.10095700
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
ret
push 0
push dword [edi + 0x4c]
push esi
push dword [ebx]
call fcn.1007f550
add esp, 0x10
test eax, eax
jle 0x10104eb3
mov eax, dword [ebx + 8]
cmp eax, 3
ja case.default.0x10104ede
jmp dword [eax*4 + 0x10104f5c]
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
lea eax, [edi + 0xc]
push esi
push eax
call fcn.100a6ae0
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
and byte [esi], 0xfc
lea eax, [edi + 0xc]
or byte [esi + 0x37], 0x80
push esi
push eax
call fcn.100afd60
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.100a64a0
jmp 0x10104f47
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.100ae150
add esp, 0x10
test eax, eax
je 0x10104eb3
or dword [edi + 8], 1
mov eax, edi
pop esi
pop edi
pop ebx
ret