joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1009b520
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.1008ef40
xor eax, eax
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x16c], eax
mov dword [esi + 0x168], eax
cmp ebx, 0xc
jne 0x1009b58c
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov byte [esi + 0xf], 1
mov ebx, 1
jmp 0x1009b6c0
mov ecx, ebx
push edi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
cmp ebx, 0x10
jb 0x1009b613
mov ecx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 4
mov edi, ecx
mov dword [esp + 0x18], eax
shl eax, 4
sub edi, esi
add ecx, eax
mov dword [esp + 0x1c], ecx
push ebp
jmp 0x1009b5c0
lea ecx, [edi + esi + 2]
mov eax, esi
mov ebp, 4
jmp 0x1009b5d0
movzx edx, byte [edi + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
dec ebp
jne 0x1009b5d0
lea eax, [esi + 0x60]
push eax
push esi
call fcn.1009b100
add esp, 8
add edi, 0x10
sub ebx, 0x10
dec dword [esp + 0x1c]
jne 0x1009b5c0
mov ecx, dword [esp + 0x10]
xor eax, eax
pop ebp
cmp ebx, eax
je 0x1009b63d
jbe 0x1009b62c
mov ecx, dword [esp + 0x1c]
mov eax, esi
sub ecx, esi
mov edi, ebx
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec edi
jne 0x1009b623
lea eax, [esi + 0x60]
push eax
push esi
call fcn.1009b100
mov ecx, dword [esp + 0x14]
add esp, 8
mov eax, dword [esp + 0x10]
shld eax, ecx, 3
mov edx, eax
shr edx, 0x18
xor byte [esi + 8], dl
mov edx, eax
shr edx, 0x10
xor byte [esi + 9], dl
mov edx, eax
shr edx, 8
xor byte [esi + 0xa], dl
add ecx, ecx
mov edx, eax
xor byte [esi + 0xb], dl
add ecx, ecx
add ecx, ecx
xor byte [esi + 0xf], cl
mov edi, eax
mov edx, ecx
shrd edx, edi, 0x18
xor byte [esi + 0xc], dl
shr edi, 0x18
mov edi, eax
mov edx, ecx
shrd edx, edi, 0x10
xor byte [esi + 0xd], dl
mov edx, ecx
shrd edx, eax, 8
xor byte [esi + 0xe], dl
shr eax, 8
lea eax, [esi + 0x60]
push eax
push esi
shr edi, 0x10
call fcn.1009b100
movzx ebx, byte [esi + 0xc]
movzx ecx, byte [esi + 0xd]
movzx edx, byte [esi + 0xe]
movzx eax, byte [esi + 0xf]
shl ebx, 8
or ebx, ecx
shl ebx, 8
or ebx, edx
add esp, 8
shl ebx, 8
or ebx, eax
pop edi
mov ecx, dword [esi + 0x174]
mov eax, dword [esi + 0x170]
push ecx
lea edx, [esi + 0x20]
push edx
push esi
call eax
inc ebx
mov ecx, ebx
mov edx, ebx
add esp, 0xc
mov eax, ebx
shr ecx, 0x18
shr edx, 0x10
shr eax, 8
mov byte [esi + 0xf], bl
mov byte [esi + 0xc], cl
mov byte [esi + 0xd], dl
mov byte [esi + 0xe], al
pop esi
pop ebx
add esp, 8
ret
Function at 0x1009b700
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x38]
or eax, dword [esi + 0x3c]
je 0x1009b714
mov eax, 0xfffffffe
pop esi
ret
push ebx
mov ebx, dword [esp + 0x14]
xor eax, eax
mov ecx, ebx
add ecx, dword [esi + 0x30]
adc eax, dword [esi + 0x34]
cmp eax, 0x20000000
ja 0x1009b7c9
jb 0x1009b738
test ecx, ecx
jne 0x1009b7c9
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esi + 0x16c]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
test edi, edi
je 0x1009b779
mov edi, edi
test ebx, ebx
je 0x1009b765
mov cl, byte [ebp]
xor byte [edi + esi + 0x40], cl
inc edi
inc ebp
dec ebx
and edi, 0xf
jne 0x1009b750
jmp 0x1009b769
test edi, edi
jne 0x1009b7bc
lea edx, [esi + 0x60]
push edx
lea eax, [esi + 0x40]
push eax
call fcn.1009b100
add esp, 8
mov eax, ebx
and eax, 0xfffffff0
mov dword [esp + 0x14], eax
je 0x1009b79f
push eax
lea ecx, [esi + 0x60]
push ecx
lea edx, [esi + 0x40]
push edx
mov ecx, ebp
call fcn.1009b270
mov eax, dword [esp + 0x20]
add esp, 0xc
add ebp, eax
sub ebx, eax
test ebx, ebx
je 0x1009b7bc
xor eax, eax
mov edi, ebx
test ebx, ebx
je 0x1009b7bc
jmp 0x1009b7b0
mov cl, byte [eax + ebp]
xor byte [esi + eax + 0x40], cl
inc eax
cmp eax, ebx
jb 0x1009b7b0
mov dword [esi + 0x16c], edi
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret
pop ebx
or eax, 0xffffffff
pop esi
ret
Function at 0x1009cf70
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.1008ef40
mov eax, dword [0x1014f644]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x44]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
mov bl, byte [esi]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x28]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x2c]
mov dword [esp + 0x20], edx
mov byte [esp + 0xf], bl
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
test bl, 0x40
jne 0x1009cfc8
push ecx
lea ecx, [esi + 0x10]
push ecx
push esi
call eax
add esp, 0xc
movzx eax, bl
and eax, 7
mov ebx, 0xf
sub ebx, eax
mov byte [esi], al
mov eax, ebx
xor ecx, ecx
mov dword [esp + 0x24], ebx
cmp eax, 0xf
jae 0x1009cff7
movzx edx, byte [esi + eax]
or ecx, edx
mov byte [esi + eax], 0
inc eax
shl ecx, 8
cmp eax, 0xf
jb 0x1009cfe4
movzx eax, byte [esi + 0xf]
mov ebp, dword [esp + 0x4c]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, ebp
je 0x1009d01e
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100719c1
add esp, 0x30
ret
push edi
mov edi, ebp
shr edi, 4
test edi, edi
je 0x1009d05f
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
lea ecx, [esi + 0x10]
push ecx
mov ecx, dword [esp + 0x20]
push esi
push edx
push edi
push eax
push ecx
call dword [esp + 0x3c]
shl edi, 4
mov edx, edi
add dword [esp + 0x34], edx
add dword [esp + 0x30], edx
add esp, 0x18
sub ebp, edx
je 0x1009d0c7
shr edx, 4
mov ecx, esi
call fcn.1009cd30
test ebp, ebp
je 0x1009d0c7
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
push esi
call dword [esp + 0x2c]
add esp, 0xc
xor eax, eax
test ebp, ebp
je 0x1009d0b6
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0x2c]
sub edi, ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x2c]
sub ecx, edx
mov dword [esp + 0x24], ecx
movzx ebx, byte [esp + eax + 0x2c]
lea ecx, [esp + eax + 0x2c]
movzx edx, byte [edi + ecx]
xor edx, ebx
mov ebx, dword [esp + 0x24]
mov byte [ebx + ecx], dl
xor byte [esi + eax + 0x10], dl
inc eax
cmp eax, ebp
jb 0x1009d093
mov ebx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0x10]
push ecx
push eax
push eax
call dword [esp + 0x2c]
add esp, 0xc
pop edi
cmp ebx, 0x10
jae 0x1009d0e3
mov edx, 0x10
sub edx, ebx
push edx
lea eax, [esi + ebx]
push 0
push eax
call fcn.1007ada0
add esp, 0xc
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [esp + 0x28]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
xor dword [esi + 0x14], eax
xor dword [esi + 0x10], edx
mov ecx, dword [esp + 0x3c]
xor dword [esi + 0x18], ecx
mov al, byte [esp + 0x1b]
mov edx, dword [esp + 0x40]
xor dword [esi + 0x1c], edx
mov ecx, dword [esp + 0x44]
add esp, 0xc
mov byte [esi], al
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.100719c1
add esp, 0x30
ret
Function at 0x1009e2a0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x1009e2e4
mov al, byte [edx]
test al, al
je 0x1009e2e4
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
inc edx
xor esi, eax
mov al, byte [edx]
test al, al
jne 0x1009e2b7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x100a23c0
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
call fcn.100a1d90
mov edi, eax
add esp, 4
test edi, edi
jne 0x100a2458
push 0xaf
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.100982d0
push 0x1011cb6c
push esi
push 0x1011cb68
push ebx
push str.fopen_
push 5
call fcn.10098430
add esp, 0x2c
call fcn.1007a456
cmp dword [eax], 2
jne 0x100a243a
push 0xb2
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.100982d0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0xb4
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.100982d0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x10150b3c
call fcn.100a1d00
mov esi, eax
add esp, 4
test esi, esi
jne 0x100a247a
push edi
call fcn.10076072
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.100a16a0
push edi
push 1
push 0x6a
push esi
call fcn.100a1a90
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x100a58c0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
mov edx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
dec ecx
push edi
mov edi, dword [esi + 4]
shr ecx, 0x1f
xor edx, edi
dec ecx
and edx, ecx
xor edi, edx
mov dword [esi + 4], edi
xor dword [eax + 4], edx
lea edx, [ebx - 1]
cmp edx, 9
ja case.default.0x100a58f2
jmp dword [edx*4 + 0x100a5a1c]
mov edi, 0xa
cmp ebx, edi
jle case.0x100a58f2.10
push ebp
mov edx, dword [esi]
mov ebx, dword [edx + edi*4]
lea ebp, [edx + edi*4]
mov edx, dword [eax]
mov edx, dword [edx + edi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + edi*4], edx
lea ebx, [ebx + edi*4]
inc edi
cmp edi, dword [esp + 0x20]
jl 0x100a5903
pop ebp
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x24]
mov edx, dword [edx + 0x24]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x24], edi
mov edi, dword [eax]
xor dword [edi + 0x24], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x20]
mov edx, dword [edx + 0x20]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x20], edi
mov edi, dword [eax]
xor dword [edi + 0x20], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x1c]
mov edx, dword [edx + 0x1c]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x1c], edi
mov edi, dword [eax]
xor dword [edi + 0x1c], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x18]
mov edx, dword [edx + 0x18]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x18], edi
mov edi, dword [eax]
xor dword [edi + 0x18], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x14]
mov edx, dword [edx + 0x14]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x14], edi
mov edi, dword [eax]
xor dword [edi + 0x14], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x10]
mov edx, dword [edx + 0x10]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x10], edi
mov edi, dword [eax]
xor dword [edi + 0x10], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0xc]
mov edx, dword [edx + 0xc]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0xc], edi
mov edi, dword [eax]
xor dword [edi + 0xc], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 8]
mov edx, dword [edx + 8]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 8], edi
mov edi, dword [eax]
xor dword [edi + 8], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 4]
mov edx, dword [edx + 4]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 4], edi
mov edi, dword [eax]
xor dword [edi + 4], edx
mov esi, dword [esi]
mov edx, dword [eax]
mov edi, dword [esi]
mov edx, dword [edx]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [esi], edi
mov eax, dword [eax]
xor dword [eax], edx
pop edi
pop esi
pop ebx
ret
Function at 0x100a7c60
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.1007ada0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret
Function at 0x100bad90
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x10c], 0xffffffff
jne 0x100bada2
xor eax, eax
pop edi
ret
push ebx
push esi
push edi
call fcn.100988c0
mov ebx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
mov dword [eax], esi
test ebx, ebx
je 0x100bae4e
mov eax, dword [edi + 0x10c]
push ebp
cmp eax, esi
jne 0x100badee
test esi, esi
jle 0x100bae2d
mov ecx, ebx
lea eax, [edi + 0x8c]
mov ebp, esi
lea ebx, [ebx]
mov dl, byte [eax + 0x60]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
dec ebp
jne 0x100bade0
jmp 0x100bae2d
mov ecx, esi
sub ecx, eax
mov byte [eax + edi + 0xec], 0x80
cmp ecx, 1
jle 0x100bae13
dec ecx
push ecx
lea eax, [eax + edi + 0xed]
push 0
push eax
call fcn.1007ada0
add esp, 0xc
test esi, esi
jle 0x100bae2d
mov ecx, ebx
lea eax, [edi + 0xac]
mov ebp, esi
mov dl, byte [eax + 0x40]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
dec ebp
jne 0x100bae21
push esi
push ebx
push ebx
push edi
call fcn.100988d0
add esp, 0x10
pop ebp
test eax, eax
jne 0x100bae4e
push esi
push ebx
call fcn.10098690
add esp, 8
pop esi
pop ebx
xor eax, eax
pop edi
ret
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x100c5840
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.1008ef40
mov eax, dword [0x1014f644]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x9c]
push ebx
mov ebx, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x94]
mov dword [esp + 8], eax
xor eax, eax
push edi
mov edi, dword [esp + 0x9c]
test ebx, ebx
je 0x100c58b5
cmp ebx, dword [esi]
je 0x100c58ac
test edi, edi
je 0x100c5892
cmp dword [esp + 0xa0], eax
jge 0x100c58ac
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.100719c1
add esp, 0x88
ret
mov eax, 1
mov dword [esi], ebx
jmp 0x100c58bb
mov ebx, dword [esi]
test ebx, ebx
je 0x100c5892
push ebp
test edi, edi
je 0x100c598d
push ebx
call fcn.100bcca0
mov ebp, eax
add esp, 4
cmp ebp, 0x80
jle 0x100c58eb
push str.j____int_sizeof_ctx__key_
push 0x74
push str..cryptohmachmac.c
call fcn.10097700
add esp, 0xc
mov eax, dword [esp + 0xa4]
cmp ebp, eax
jge 0x100c5945
mov ecx, dword [esp + 0x10]
push ecx
lea ebp, [esi + 4]
push ebx
push ebp
call fcn.100a30a0
add esp, 0xc
test eax, eax
je 0x100c5a3a
mov edx, dword [esp + 0xa4]
push edx
push edi
push ebp
call fcn.100a3250
add esp, 0xc
test eax, eax
je 0x100c5a3a
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebp
call fcn.100a3260
add esp, 0xc
test eax, eax
je 0x100c5a3a
jmp 0x100c596a
cmp eax, 0x80
ja 0x100c5a3a
push eax
lea ecx, [esi + 0x50]
push edi
push ecx
call fcn.10077f40
mov edx, dword [esp + 0xb0]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], edx
mov edi, dword [edi]
cmp edi, 0x80
je 0x100c5995
mov eax, 0x80
sub eax, edi
push eax
lea ecx, [edi + esi + 0x50]
push 0
push ecx
call fcn.1007ada0
add esp, 0xc
jmp 0x100c5995
test eax, eax
je 0x100c5a26
xor eax, eax
jmp 0x100c59a0
mov dl, byte [esi + eax + 0x50]
xor dl, 0x36
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x80
jl 0x100c59a0
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x1c]
push ebx
push ebp
call fcn.100a30a0
add esp, 0xc
test eax, eax
je 0x100c5a3a
push ebx
call fcn.100bcca0
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.100a3250
add esp, 0x10
test eax, eax
je 0x100c5a3a
xor eax, eax
mov dl, byte [esi + eax + 0x50]
xor dl, 0x5c
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x80
jl 0x100c59e4
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x34]
push ebx
push ebp
call fcn.100a30a0
add esp, 0xc
test eax, eax
je 0x100c5a3a
push ebx
call fcn.100bcca0
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.100a3250
add esp, 0x10
test eax, eax
je 0x100c5a3a
lea edx, [esi + 0x1c]
push edx
add esi, 4
push esi
call fcn.100a33c0
add esp, 8
test eax, eax
jne 0x100c5a3e
xor eax, eax
jmp 0x100c5a43
mov eax, 1
mov ecx, dword [esp + 0x94]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100719c1
add esp, 0x88
ret
Function at 0x100c6870
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x100c6939
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x100c6891
cmp al, 0x6b
jne 0x100c6939
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x100c68fa
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x100c68b1
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x100c68b1
cmp al, 0xbb
jne 0x100c68da
inc ecx
cmp ecx, esi
jl 0x100c68a1
sub esi, ecx
test ecx, ecx
jne 0x100c68fd
push 0x83
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.100982d0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x7b
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.100982d0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x100c6926
push 0x8b
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.100982d0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.10077f40
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x70
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.100982d0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x100c6c20
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5c
call fcn.1008ef40
mov eax, dword [0x1014f644]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x70]
push ebx
mov ebx, dword [esp + 0x64]
push ebp
mov ebp, dword [esp + 0x74]
push esi
mov esi, dword [esp + 0x88]
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x88]
dec edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
test eax, eax
jne 0x100c6c7d
call fcn.100a3650
mov dword [esp + 0x18], eax
test esi, esi
jne 0x100c6c85
mov dword [esp + 0x14], eax
push eax
call fcn.10098910
mov esi, eax
lea eax, [esi + esi]
sub edi, eax
lea edx, [edi - 1]
add esp, 4
cmp ebp, edx
jle 0x100c6cc9
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0xa0
push 4
call fcn.100982d0
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.100719c1
add esp, 0x5c
ret
inc eax
cmp dword [esp + 0x10], eax
jge 0x100c6cdb
push 0x40
push str..crypto_rsa_rsa_oaep.c
push 0x78
jmp 0x100c6ca5
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x84]
push 0
push ecx
lea eax, [ebx + 1]
mov byte [ebx], 0
push 0
lea ebx, [ebx + esi + 1]
push ebx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x34]
push edx
push eax
call fcn.100a3520
add esp, 0x18
test eax, eax
je 0x100c6cb4
sub edi, ebp
dec edi
push edi
lea ecx, [ebx + esi]
push 0
push ecx
call fcn.1007ada0
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x1c]
mov eax, ebx
sub eax, ebp
sub eax, esi
push ebp
add eax, edi
push ecx
push eax
mov byte [eax - 1], 1
call fcn.10077f40
mov ebp, dword [esp + 0x34]
push esi
push ebp
call fcn.100987a0
add esp, 0x20
test eax, eax
jle 0x100c6cb4
push 0x55
sub edi, esi
push str..crypto_rsa_rsa_oaep.c
push edi
call fcn.10097050
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
jne 0x100c6d75
push 0x57
push str..crypto_rsa_rsa_oaep.c
push 0x41
jmp 0x100c6ca5
mov edx, dword [esp + 0x14]
push edx
push esi
push ebp
push edi
push eax
call fcn.100c6aa0
add esp, 0x14
test eax, eax
js 0x100c6cb4
test edi, edi
jle 0x100c6dad
mov ebp, dword [esp + 0x10]
mov eax, ebx
sub ebp, ebx
mov ecx, edi
lea esp, [esp]
mov dl, byte [eax + ebp]
xor byte [eax], dl
inc eax
dec ecx
jne 0x100c6da0
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
push eax
push edi
push ebx
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.100c6aa0
add esp, 0x14
test eax, eax
js 0x100c6cb4
test esi, esi
jle 0x100c6ddf
lea ecx, [esp + 0x28]
mov eax, ebp
sub ecx, ebp
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x100c6dd6
mov eax, dword [esp + 0x10]
push eax
call fcn.10097210
mov ecx, dword [esp + 0x6c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.100719c1
add esp, 0x5c
ret
Function at 0x100d6ec0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 8
call fcn.1008ef40
mov eax, dword [esp + 0xc]
movzx edx, byte [eax + 1]
movzx ecx, byte [eax]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 2]
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 3]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax + 4]
mov dword [esp], ecx
movzx ecx, byte [eax + 7]
push esi
movzx esi, byte [eax + 5]
movzx eax, byte [eax + 6]
shl ecx, 8
shl esi, 8
or ecx, eax
or edx, esi
shl ecx, 0x10
or ecx, edx
cmp dword [esp + 0x24], 0
mov dword [esp + 8], ecx
pop esi
je 0x100d6f36
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.100d7420
jmp 0x100d6f4f
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.100d7540
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov byte [eax], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 2], dl
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, dword [esp + 0x14]
mov edx, ecx
shr edx, 8
mov byte [eax + 4], cl
mov byte [eax + 5], dl
mov edx, ecx
shr edx, 0x10
add esp, 0x10
shr ecx, 0x18
mov byte [eax + 6], dl
mov byte [eax + 7], cl
add esp, 8
ret
Function at 0x100e5be0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x100e5bf9
mov esi, edi
mov edi, eax
jmp 0x100e5bfb
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x100e5c0b
mov eax, ebx
jmp 0x100e5c15
push eax
push ebx
call fcn.100a52c0
add esp, 8
test eax, eax
jne 0x100e5c1d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x100e5c39
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x100e5c24
cmp eax, dword [esi + 4]
jge 0x100e5c50
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x100e5c40
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x100e5c71
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x100e5c6e
dec eax
test eax, eax
jg 0x100e5c60
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret