joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002e4c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100d6608
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x101242d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov esi, ecx
mov ecx, dword [esi + 0x218]
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x34], 0
test ecx, ecx
je 0x1002e546
cmp dword [esi + 0x21c], eax
jbe 0x1002e546
mov edx, dword [0x10126a2c]
mov edi, edx
inc edx
mov dword [0x10126a2c], edx
test edi, edi
jne 0x1002e54b
cmp dword [esi + 0x21c], eax
jbe 0x1002e54b
jmp 0x1002e530
movzx edx, byte [0x101269b8]
xor word [ecx + eax*2], dx
inc eax
cmp eax, dword [esi + 0x21c]
jb 0x1002e530
jmp 0x1002e54b
mov ecx, 0x100dc504
xor eax, eax
mov word [ebp - 0x2c], ax
mov eax, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
lea edi, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x1002e564
sub eax, edi
sar eax, 1
push eax
push ecx
lea ecx, [ebp - 0x2c]
call fcn.10006440
mov edi, dword [ebp - 0x30]
lea ecx, [ebp - 0x2c]
push ecx
push edi
mov dword [ebp - 4], 0
call fcn.1000e010
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
add esp, 8
cmp edx, 8
jae 0x1002e5a2
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
lea ecx, [eax + ecx*2]
mov eax, dword [ebp - 0x2c]
cmp edx, 8
jae 0x1002e5b3
lea eax, [ebp - 0x2c]
cmp eax, ecx
je 0x1002e5c3
xor edx, edx
mov word [eax], dx
add eax, 2
cmp eax, ecx
jne 0x1002e5b7
mov ecx, dword [esi + 0x218]
xor eax, eax
test ecx, ecx
je 0x1002e604
cmp dword [esi + 0x21c], eax
jbe 0x1002e604
dec dword [0x10126a2c]
jne 0x1002e604
cmp dword [esi + 0x21c], eax
jbe 0x1002e604
jmp 0x1002e5f0
movzx edx, byte [0x101269b8]
xor word [ecx + eax*2], dx
inc eax
cmp eax, dword [esi + 0x21c]
jb 0x1002e5f0
cmp dword [ebp - 0x18], 8
jb 0x1002e616
mov eax, dword [ebp - 0x2c]
push eax
call fcn.100b8b52
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b993a
mov esp, ebp
pop ebp
ret 4

Function at 0x100329bb
Capabilities:
Hash data using murmur3

Disassembly:
mov byte [esp], 0x4a
mov dword [esp], 0x81c3d761
push 0x91ab4993
pushfd
lea esp, [esp + 8]
jmp fcn.100304bf

Function at 0x1003bb40
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x101242d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x100dd76c
mov dword [ebp - 0xa8], eax
jmp loc.1012f0ae
Function at 0x100440a0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x10044183
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
movzx edx, byte [esi]
jl 0x1004411e
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x10044170
shl edx, 0x10
cmp edi, 2
jne 0x1004412f
movzx eax, byte [esi + 1]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x1004415d
lea edx, [edi + 0x3c]
jmp 0x1004416a
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x100440c0
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x10047d00
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.100b9410
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret

Function at 0x10053840
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x1005392d
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x100538c5
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.10053480
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x1005388a
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x100539f5
call fcn.100538da
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x10053991
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.10053480
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x10053941
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x100539f5
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.10053480
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x100539f0
jmp 0x100539f5
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10053a80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x10053b76
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x10053b0e
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.100535e0
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x10053ad3
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x10053c3e
call fcn.10053b23
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x10053bda
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.10053710
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x10053b8a
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x10053c3e
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.10053710
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x10053c39
jmp 0x10053c3e
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10054e00
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x10054e24
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
sub edi, 1
jne 0x10054e16
pop esi
movzx eax, cl
pop edi
ret
Function at 0x1005e3b0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x1005e3d0
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x100625d0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x10062617
mov al, byte [edx]
test al, al
je 0x10062617
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x100625e7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x1006bda0
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.100b9410
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret
Function at 0x10072f70
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.100ba4f0
mov eax, dword [0x101242d0]
xor eax, esp
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x2c]
dec ebx
push edi
mov edi, dword [esp + 0x38]
mov dword [esp + 8], ecx
lea ecx, [ebx - 0x29]
cmp edi, ecx
mov dword [esp + 0xc], edx
jle 0x10072fd3
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.100489c0
add esp, 0x14
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100b993a
add esp, 0x20
ret
cmp ebx, 0x29
jge 0x10073000
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.100489c0
add esp, 0x14
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100b993a
add esp, 0x20
ret
push ebp
push esi
push 0
mov byte [eax], 0
lea esi, [eax + 1]
lea ebp, [eax + 0x15]
call fcn.10066220
mov edx, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x1c]
push 0
push ebp
push edx
push eax
call fcn.1004b280
add esp, 0x18
test eax, eax
je 0x10073099
mov ecx, ebx
sub ecx, edi
sub ecx, 0x29
push ecx
lea edx, [ebp + 0x14]
push 0
push edx
call fcn.100b9410
mov ecx, dword [esp + 0x1c]
mov eax, ebp
sub eax, edi
add eax, ebx
push edi
mov byte [eax - 0x15], 1
push ecx
add eax, 0xffffffec
push eax
call fcn.100b8d30
push 0x14
push esi
call fcn.1005b480
add esp, 0x20
test eax, eax
jle 0x10073099
push 0x49
add ebx, 0xffffffec
push str..crypto_rsa_rsa_oaep.c
push ebx
call fcn.10043ea0
mov edi, eax
add esp, 0xc
mov dword [esp + 0x14], edi
test edi, edi
jne 0x100730ae
push 0x4c
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.100489c0
add esp, 0x14
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100b993a
add esp, 0x20
ret
push 0x14
push esi
push ebx
push edi
call fcn.10072f40
add esp, 0x10
test eax, eax
jl 0x10073099
test ebx, ebx
jle 0x100730db
mov eax, ebp
sub edi, ebp
mov ecx, ebx
lea esp, [esp]
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
sub ecx, 1
jne 0x100730d0
call fcn.10066220
push eax
push ebx
push ebp
lea eax, [esp + 0x24]
push 0x14
push eax
call fcn.10072dc0
add esp, 0x14
test eax, eax
jl 0x10073099
lea ecx, [esp + 0x18]
lea edi, [esp + 0x19]
lea ebp, [esp + 0x1a]
lea edx, [esp + 0x1b]
sub ecx, esi
sub edi, esi
sub ebp, esi
sub edx, esi
lea ebx, [esp + 0x1c]
sub ebx, esi
mov eax, esi
mov dword [esp + 0x10], ebx
mov esi, 4
nop
movzx ebx, byte [ecx + eax]
xor byte [eax], bl
movzx ebx, byte [edi + eax]
xor byte [eax + 1], bl
movzx ebx, byte [eax + ebp]
xor byte [eax + 2], bl
movzx ebx, byte [edx + eax]
xor byte [eax + 3], bl
mov ebx, dword [esp + 0x10]
movzx ebx, byte [ebx + eax]
xor byte [eax + 4], bl
add eax, 5
sub esi, 1
jne 0x10073120
mov ecx, dword [esp + 0x14]
push ecx
call fcn.10044040
mov ecx, dword [esp + 0x30]
add esp, 4
lea eax, [esi + 1]
pop esi
pop ebp
pop edi
pop ebx
xor ecx, esp
call fcn.100b993a
add esp, 0x20
ret
Function at 0x10073770
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x1007383c
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x10073791
cmp al, 0x6b
jne 0x1007383c
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x100737fd
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x100737b1
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x100737b1
cmp al, 0xbb
jne 0x100737da
inc ecx
cmp ecx, esi
jl 0x100737a1
sub esi, ecx
test ecx, ecx
jne 0x10073800
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.100489c0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.100489c0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x10073829
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.100489c0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.100b8d30
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.100489c0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret

Function at 0x10077e50
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x10c], 0xffffffff
jne 0x10077e62
xor eax, eax
pop edi
ret
push ebx
push esi
push edi
call fcn.10049fc0
mov ebx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
mov dword [eax], esi
test ebx, ebx
je 0x10077f12
mov eax, dword [edi + 0x10c]
push ebp
cmp eax, esi
jne 0x10077eb0
test esi, esi
jle 0x10077ef1
mov ecx, ebx
lea eax, [edi + 0x8c]
mov ebp, esi
lea ebx, [ebx]
mov dl, byte [eax + 0x60]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x10077ea0
jmp 0x10077ef1
mov ecx, esi
sub ecx, eax
cmp ecx, 1
mov byte [eax + edi + 0xec], 0x80
jle 0x10077ed5
dec ecx
push ecx
lea eax, [eax + edi + 0xed]
push 0
push eax
call fcn.100b9410
add esp, 0xc
test esi, esi
jle 0x10077ef1
mov ecx, ebx
lea eax, [edi + 0xac]
mov ebp, esi
mov dl, byte [eax + 0x40]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x10077ee3
push esi
push ebx
push ebx
push edi
call fcn.1004b650
add esp, 0x10
pop ebp
test eax, eax
jne 0x10077f12
push esi
push ebx
call fcn.10054810
add esp, 8
pop esi
pop ebx
xor eax, eax
pop edi
ret
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x10079030
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.100ba4f0
mov eax, dword [0x101242d0]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebp, ebp
je 0x1007907f
mov eax, 1
mov dword [esi], ebp
jmp 0x10079081
mov ebp, dword [esi]
test ecx, ecx
je 0x10079164
push ebp
call fcn.1004b680
mov ebx, eax
add esp, 4
cmp ebx, 0x80
jle 0x100790b0
push str.j____int_sizeof_ctx__key_
push 0x68
push str..cryptohmachmac.c
call fcn.10054dd0
add esp, 0xc
mov edi, dword [esp + 0xa8]
cmp ebx, edi
jge 0x10079107
mov ecx, dword [esp + 0x10]
push ecx
lea ebx, [esi + 4]
push ebp
push ebx
call fcn.1004add0
add esp, 0xc
test eax, eax
je 0x10079206
mov edx, dword [esp + 0x14]
push edi
push edx
push ebx
call fcn.1004af80
add esp, 0xc
test eax, eax
je 0x10079206
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.1004af90
add esp, 0xc
test eax, eax
je 0x10079206
jmp 0x10079141
cmp edi, 0x80
jbe 0x10079123
push str.len_0__len__int_sizeof_ctx__key_
push 0x75
push str..cryptohmachmac.c
call fcn.10054dd0
add esp, 0xc
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edx, [esi + 0x50]
push edx
call fcn.100b8d30
mov eax, dword [esp + 0xb4]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], eax
mov edi, dword [edi]
cmp edi, 0x80
je 0x1007916c
mov ecx, 0x80
sub ecx, edi
push ecx
lea edx, [edi + esi + 0x50]
push 0
push edx
call fcn.100b9410
add esp, 0xc
jmp 0x1007916c
test eax, eax
je 0x100791f2
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x10079170
mov edi, dword [esp + 0x10]
push edi
lea ebx, [esi + 0x1c]
push ebp
push ebx
call fcn.1004add0
add esp, 0xc
test eax, eax
je 0x10079206
push ebp
call fcn.1004b680
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.1004af80
add esp, 0x10
test eax, eax
je 0x10079206
xor eax, eax
mov cl, byte [esi + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x100791b4
push edi
lea ebx, [esi + 0x34]
push ebp
push ebx
call fcn.1004add0
add esp, 0xc
test eax, eax
je 0x10079206
push ebp
call fcn.1004b680
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.1004af80
add esp, 0x10
test eax, eax
je 0x10079206
lea eax, [esi + 0x1c]
push eax
add esi, 4
push esi
call fcn.1004b120
add esp, 8
test eax, eax
jne 0x1007920a
xor eax, eax
jmp 0x1007920f
mov eax, 1
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100b993a
add esp, 0x8c
ret
Function at 0x10084190
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.100ba4f0
mov eax, dword [0x101242d0]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
jbe 0x10084324
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx ebx, byte [esi]
movzx eax, byte [esi + 1]
inc esi
movzx ecx, byte [esi + 1]
inc esi
movzx edx, byte [esi + 1]
shl eax, 8
or ebx, eax
inc esi
movzx eax, byte [esi + 1]
inc esi
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 1]
shl edx, 0x18
inc esi
or ebx, edx
movzx edx, byte [esi + 1]
inc esi
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 1]
inc esi
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
inc esi
mov byte [edi], dl
mov byte [ebp], al
call fcn.10043780
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.10043850
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.10053480
push ebp
call fcn.10043780
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.10043850
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.10053480
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
inc eax
shr edx, 8
add esp, 0x30
mov byte [eax], dl
inc eax
inc eax
mov edx, ebx
shr edx, 0x10
mov byte [eax - 1], dl
mov edx, dword [esp + 0x14]
inc eax
shr ebx, 0x18
mov byte [eax - 1], bl
mov byte [eax], dl
mov ebx, edx
inc eax
inc eax
shr ebx, 8
mov byte [eax - 1], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax], bl
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 8
mov eax, ebp
mov byte [eax], cl
mov byte [eax + 1], dl
inc eax
inc eax
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
inc eax
shr ecx, 0x18
mov byte [eax], cl
mov ecx, dword [esp + 0x10]
inc eax
mov byte [eax], cl
mov edx, ecx
shr edx, 8
inc eax
mov byte [eax], dl
mov edx, ecx
inc eax
shr edx, 0x10
shr ecx, 0x18
sub dword [esp + 0x18], 1
mov byte [eax], dl
mov byte [eax + 1], cl
jne 0x100841d3
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.100b993a
add esp, 0xa0
ret