joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4328a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov eax, 0x4a3af0
push esi
sub eax, 0xbc
push edi
mov dword [esp + 0x14], 0xbc
mov dword [esp + 0x1c], eax
jmp 0x4328c8
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov esi, dword [eax + ecx]
mov eax, esi
mov dword [esp + 0x10], esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4328d8
sub eax, edx
mov edi, eax
mov ecx, edi
shr ecx, 5
inc ecx
mov ebx, edi
mov dword [esp + 0x18], edi
mov edx, edi
cmp edi, ecx
jb 0x432918
movzx eax, byte [esi + edx - 1]
mov esi, ebx
shl esi, 5
add eax, esi
mov esi, ebx
shr esi, 2
add eax, esi
mov esi, dword [esp + 0x10]
sub edx, ecx
xor ebx, eax
cmp edx, ecx
jae 0x4328f5
mov dword [esp + 0x18], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov edx, dword [eax + 8]
mov eax, dword [eax]
dec edx
and edx, ebx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x432986
lea ecx, [ecx]
cmp dword [eax + 0xc], edi
jne 0x432980
mov ecx, edi
lea edx, [eax + 0x10]
cmp edi, 4
jb 0x432954
nop
mov ebx, dword [esi]
cmp ebx, dword [edx]
jne 0x432978
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x432940
test ecx, ecx
je 0x4329c6
mov bl, byte [edx]
cmp bl, byte [esi]
jne 0x432978
cmp ecx, 1
jbe 0x4329c6
mov bl, byte [edx + 1]
cmp bl, byte [esi + 1]
jne 0x432978
cmp ecx, 2
jbe 0x4329c6
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x4329c6
mov ebx, dword [esp + 0x18]
mov esi, dword [esp + 0x10]
mov eax, dword [eax]
test eax, eax
jne 0x432930
mov eax, dword [ebp + 8]
push esi
push eax
mov eax, ebx
call fcn.00432b70
add esp, 8
mov edx, dword [ebp + 8]
mov ecx, dword [esp + 0x14]
mov esi, dword [edx + 0x10]
mov dword [ecx + esi], eax
mov edx, dword [edx + 0x10]
mov eax, dword [ecx + edx]
or byte [eax + 5], 0x20
add ecx, 4
mov dword [esp + 0x14], ecx
cmp ecx, 0x100
jl 0x4328c4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov cl, byte [eax + 5]
mov esi, dword [esi + 0x10]
movzx ebx, byte [esi + 0x14]
movzx edx, cl
and edx, 3
not ebx
test bl, dl
je 0x432995
xor cl, 3
mov byte [eax + 5], cl
jmp 0x432995
Function at 0x432c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ecx, edi
shr ecx, 5
inc ecx
mov ebx, edi
mov dword [esp + 0xc], edi
mov edx, edi
cmp edi, ecx
jb 0x432c61
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax + edx - 1]
mov esi, ebx
shl esi, 5
add eax, esi
mov esi, ebx
shr esi, 2
add eax, esi
sub edx, ecx
xor ebx, eax
cmp edx, ecx
jae 0x432c3f
mov dword [esp + 0xc], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov edx, dword [eax + 8]
mov eax, dword [eax]
dec edx
and edx, ebx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x432cca
cmp dword [eax + 0xc], edi
jne 0x432cc4
mov esi, dword [ebp + 0xc]
mov ecx, edi
lea edx, [eax + 0x10]
cmp edi, 4
jb 0x432c9c
mov ebx, dword [esi]
cmp ebx, dword [edx]
jne 0x432cc0
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x432c88
test ecx, ecx
je 0x432ce3
mov bl, byte [edx]
cmp bl, byte [esi]
jne 0x432cc0
cmp ecx, 1
jbe 0x432ce3
mov bl, byte [edx + 1]
cmp bl, byte [esi + 1]
jne 0x432cc0
cmp ecx, 2
jbe 0x432ce3
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x432ce3
mov ebx, dword [esp + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x432c76
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
mov eax, ebx
call fcn.00432b70
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov edx, dword [edx + 0x10]
mov cl, byte [eax + 5]
movzx edx, byte [edx + 0x14]
movzx ebx, cl
not edx
and ebx, 3
test bl, dl
je 0x432cdc
pop edi
xor cl, 3
pop esi
mov byte [eax + 5], cl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x432e90
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
mov esi, dword [eax*4 + 0x4a3a28]
mov eax, esi
mov dword [esp + 0xc], esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x432eb8
sub eax, edx
mov edi, eax
mov ecx, edi
shr ecx, 5
inc ecx
mov ebx, edi
mov dword [esp + 0x14], edi
mov edx, edi
cmp edi, ecx
jb 0x432ef8
movzx eax, byte [esi + edx - 1]
mov esi, ebx
shl esi, 5
add eax, esi
mov esi, ebx
shr esi, 2
add eax, esi
mov esi, dword [esp + 0xc]
sub edx, ecx
xor ebx, eax
cmp edx, ecx
jae 0x432ed5
mov dword [esp + 0x14], ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x10]
mov edx, dword [eax + 8]
mov eax, dword [eax]
dec edx
and edx, ebx
mov eax, dword [eax + edx*4]
test eax, eax
je 0x432f66
lea ecx, [ecx]
cmp dword [eax + 0xc], edi
jne 0x432f60
mov ecx, edi
lea edx, [eax + 0x10]
cmp edi, 4
jb 0x432f34
nop
mov ebx, dword [esi]
cmp ebx, dword [edx]
jne 0x432f58
sub ecx, 4
add edx, 4
add esi, 4
cmp ecx, 4
jae 0x432f20
test ecx, ecx
je 0x432f98
mov bl, byte [edx]
cmp bl, byte [esi]
jne 0x432f58
cmp ecx, 1
jbe 0x432f98
mov bl, byte [edx + 1]
cmp bl, byte [esi + 1]
jne 0x432f58
cmp ecx, 2
jbe 0x432f98
mov cl, byte [edx + 2]
cmp cl, byte [esi + 2]
je 0x432f98
mov ebx, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
mov eax, dword [eax]
test eax, eax
jne 0x432f10
mov eax, dword [ebp + 8]
push esi
push eax
mov eax, ebx
call fcn.00432b70
add esp, 8
mov ecx, dword [esp + 0x10]
or byte [eax + 5], 0x20
lea edx, [ecx + 1]
inc ecx
mov byte [eax + 6], dl
mov dword [esp + 0x10], ecx
cmp ecx, 0x15
jl 0x432ea4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov cl, byte [eax + 5]
mov esi, dword [esi + 0x10]
movzx ebx, byte [esi + 0x14]
movzx edx, cl
and edx, 3
not ebx
test bl, dl
je 0x432f75
xor cl, 3
mov byte [eax + 5], cl
jmp 0x432f75
Function at 0x43d470
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4c6018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x20c]
push edi
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], 0
mov edi, 0x200
jmp 0x43d4c6
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x20c]
sub ecx, edx
mov dword [ebp - 0x224], ecx
je 0x43d530
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0x44]
mov esi, eax
cmp edx, dword [ecx + 0x40]
jb 0x43d4e8
call fcn.00430280
mov eax, dword [ebp - 0x224]
mov ebx, dword [esi + 8]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push esi
call fcn.00432c20
mov dword [ebx], eax
mov dword [ebx + 8], 4
add dword [esi + 8], 0x10
inc dword [ebp - 0x214]
lea eax, [ebp - 0x218]
add esp, 0xc
lea edx, [ebp - 0x20c]
push eax
mov dword [ebp - 0x218], edx
call fcn.0042ab20
add esp, 4
mov ebx, dword [ebp + 0xc]
cmp edi, ebx
jbe 0x43d539
mov edi, ebx
mov ecx, dword [ebp - 0x21c]
push ecx
push edi
lea edx, [ebp - 0x20c]
push 1
push edx
call dword [sym.imp.MSVCR100.dll_fread]
mov ecx, dword [ebp - 0x218]
add ecx, eax
add esp, 0x10
sub ebx, eax
mov dword [ebp - 0x218], ecx
mov dword [ebp + 0xc], ebx
je 0x43d570
cmp eax, edi
je 0x43d4c0
lea eax, [ebp - 0x20c]
sub ecx, eax
mov edi, ecx
je 0x43d5ca
mov eax, dword [ebp - 0x210]
mov ecx, dword [eax + 0x10]
mov edx, dword [ecx + 0x44]
mov esi, eax
cmp edx, dword [ecx + 0x40]
jb 0x43d594
call fcn.00430280
mov ebx, dword [esi + 8]
push edi
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.00432c20
mov dword [ebx], eax
mov dword [ebx + 8], 4
add dword [esi + 8], 0x10
mov ebx, dword [ebp + 0xc]
lea ecx, [ebp - 0x20c]
add esp, 0xc
inc dword [ebp - 0x214]
mov dword [ebp - 0x218], ecx
mov eax, dword [ebp - 0x214]
mov esi, dword [ebp - 0x210]
call fcn.004294f0
mov dword [ebp - 0x214], 1
test ebx, ebx
je 0x43d647
mov edi, dword [ebp - 0x220]
mov esi, dword [edi + 8]
mov eax, dword [esi - 8]
sub esi, 0x10
add eax, 0xfffffffd
cmp eax, 4
ja case.0x43d600.6
jmp dword [eax*4 + 0x43d660]
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
jmp 0x43d630
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
jmp 0x43d630
mov eax, dword [esi]
call fcn.0042eda0
jmp 0x43d630
call fcn.004304b0
test eax, eax
je 0x43d62e
mov ecx, dword [esi]
mov eax, dword [ecx + 0xc]
jmp 0x43d630
xor eax, eax
test eax, eax
jne 0x43d647
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449013
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00449013
mov esp, ebp
pop ebp
ret
Function at 0x43da70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x38
push ebx
mov ebx, dword [esi + 8]
sub ebx, dword [esi + 0xc]
push edi
sar ebx, 4
dec ebx
mov edi, 1
je 0x43db20
mov eax, dword [ebp + 0xc]
mov ecx, esi
dec ebx
call fcn.00428890
cmp eax, 0x4a3b58
je 0x43db53
cmp dword [eax + 8], 3
jne 0x43db53
test edi, edi
je 0x43db13
mov eax, dword [ebp + 0xc]
mov ecx, esi
call fcn.00428890
mov ecx, dword [eax + 8]
cmp ecx, 3
je 0x43daf5
cmp ecx, 4
jne 0x43db4f
mov eax, dword [eax]
add eax, 0x10
lea edi, [esp + 0x28]
call fcn.0042c570
test eax, eax
je 0x43db4f
fld qword [esp + 0x28]
mov dword [esp + 0x38], 3
fstp qword [esp + 0x30]
lea eax, [esp + 0x30]
fld qword [eax]
mov eax, dword [ebp + 8]
sub esp, 8
fstp qword [esp]
push str._.14g
push eax
call dword [sym.imp.MSVCR100.dll_fprintf]
add esp, 0x10
test eax, eax
jg 0x43db83
xor edi, edi
inc dword [ebp + 0xc]
test ebx, ebx
jne 0x43da90
call dword [sym.imp.MSVCR100.dll__errno]
mov eax, dword [eax]
mov dword [esp + 0x24], eax
test edi, edi
je 0x43db8a
mov eax, dword [esi + 8]
mov dword [eax], 1
mov dword [eax + 8], 1
add dword [esi + 8], 0x10
mov eax, 1
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
fldz
jmp 0x43daf7
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 0x24]
push ecx
push edx
mov eax, esi
call fcn.0042a0b0
add esp, 8
test edi, edi
je 0x43db13
mov ecx, dword [ebp + 8]
mov edi, dword [esp + 0x24]
push ecx
push edi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp eax, edi
jne 0x43db13
mov edi, 1
jmp 0x43db15
mov edx, dword [esi + 8]
mov dword [edx + 8], 0
mov edi, 0x10
add dword [esi + 8], edi
push eax
call dword [sym.imp.MSVCR100.dll_strerror]
add esp, 4
push eax
push 0x4bbe18
push esi
call fcn.00428d30
fild dword [esp + 0x30]
mov eax, dword [esi + 8]
add esp, 0xc
fstp qword [eax]
mov dword [eax + 8], 3
add dword [esi + 8], edi
lea eax, [edi - 0xd]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x440c30
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push esi
mov esi, dword [ebp + 8]
push edi
push eax
mov edi, ecx
call dword [sym.imp.MSVCR100.dll_getenv]
add esp, 4
test eax, eax
jne 0x440c59
push edi
call fcn.00428cc0
add esp, 4
jmp 0x440caf
push 0x4be194
push 0x4be198
mov edx, eax
mov ecx, esi
call fcn.0042a6a0
push edi
push 0x4be19c
mov edx, eax
mov ecx, esi
call fcn.0042a6a0
mov ecx, dword [esi + 8]
lea eax, [ecx - 0x10]
add esp, 0x10
cmp eax, ecx
jae 0x440cab
lea ecx, [eax - 0x10]
jmp 0x440c90
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [ecx + 0x18]
mov dword [ecx + 8], edx
add eax, 0x10
add ecx, 0x10
cmp eax, dword [esi + 8]
jb 0x440c90
add dword [esi + 8], 0xfffffff0
mov ecx, esi
call fcn.0043f1b0
mov edi, dword [esi + 8]
mov eax, ebx
sub edi, 0x20
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x440cc1
sub eax, edx
push eax
push ebx
push esi
call fcn.00432c20
mov dword [esp + 0x14], eax
mov eax, dword [esi + 8]
add esp, 0xc
sub eax, 0x10
push eax
lea ecx, [esp + 0xc]
push ecx
push edi
push esi
mov dword [esp + 0x20], 4
call fcn.00430820
add esp, 0x10
add dword [esi + 8], 0xfffffff0
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x449013
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4c6018]
jne 0x44901d
repz ret
jmp fcn.0044955e

Function at 0x44c9a0
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push ebx
call dword [sym.imp.MSVCR100.dll_fopen]
mov edi, eax
add esp, 8
test edi, edi
jne 0x44ca32
push 0x7a
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.00458550
push 0x4912a0
push esi
push 0x49129c
push ebx
push str.fopen_
push 5
call fcn.00458a30
add esp, 0x2c
call dword [sym.imp.MSVCR100.dll__errno]
cmp dword [eax], 2
jne 0x44ca17
push 0x7d
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.00458550
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x7f
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.00458550
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x4c60a8
call fcn.0044c510
mov esi, eax
add esp, 4
test esi, esi
jne 0x44ca55
push edi
call dword [sym.imp.MSVCR100.dll_fclose]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push esi
call fcn.0044c640
push edi
push 1
push 0x6a
push esi
call fcn.0044c900
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x44ea20
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
mov eax, 1
ret
Function at 0x45db20
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.0048a1d0
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x45db6f
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x45db6f
mov edx, dword [sym.imp.MSVCR100.dll__iob]
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
add edx, 0x40
push eax
push ecx
push edx
call dword [sym.imp.MSVCR100.dll_vfprintf]
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x104]
push 0xff
push edx
call dword [sym.imp.MSVCR100.dll__vsnprintf]
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x45dc73
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x45dc2e
lea eax, [ebp - 4]
push eax
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x45dc2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x45dc2e
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x45dc2e
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.0048a1d0
lea ecx, [ebp - 4]
mov edi, esp
push ecx
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x45dc2e
mov edx, dword [ebp - 4]
push str.Service_0x
push edi
lea eax, [edx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call dword [sym.imp.MSVCR100.dll_wcsstr]
add esp, 8
test eax, eax
je 0x45dc73
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
lea ecx, [ebp - 4]
push 0
push ecx
push 0
push 1
push 0
push 0
mov esi, eax
push 0
lea eax, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea edx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4626e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x462741
mov al, byte [edi]
test al, al
je 0x462741
push ebx
push ebp
mov ebx, pe_nt_image_headers32
movsx eax, al
or eax, ebx
mov ebp, esi
mov edx, eax
mov ecx, eax
shr edx, 2
and edx, 0xf
and ecx, 0xf
xor edx, ecx
mov ecx, 0x20
sub ecx, edx
add ebx, 0x100
shr ebp, cl
mov ecx, edx
mov edx, eax
imul edx, eax
shl esi, cl
mov al, byte [edi + 1]
or ebp, esi
xor ebp, edx
inc edi
test al, al
mov esi, ebp
jne 0x4626f9
mov eax, esi
pop ebp
shr eax, 0x10
pop ebx
xor eax, esi
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret

Function at 0x4683c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x18
call fcn.0048a1d0
mov eax, dword [esp + 0x20]
push ebx
push ebp
push esi
lea esi, [eax - 1]
push edi
mov edi, dword [esp + 0x38]
lea ecx, [esi - 0x29]
cmp edi, ecx
jle 0x4683ff
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.00458550
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
cmp esi, 0x29
jge 0x468423
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.00458550
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
lea eax, [esi - 0x14]
push 0x37
push str..crypto_rsa_rsa_oaep.c
push eax
mov dword [esp + 0x1c], eax
call fcn.00457c10
add esp, 0xc
mov dword [esp + 0x30], eax
test eax, eax
jne 0x468461
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.00458550
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov ebx, dword [esp + 0x2c]
push 0
mov byte [ebx], 0
lea ebp, [ebx + 1]
add ebx, 0x15
call fcn.0046f2b0
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push 0
push ebx
push edx
push eax
call fcn.00461f40
mov ecx, esi
xor eax, eax
sub ecx, edi
lea edi, [ebx + 0x14]
sub ecx, 0x29
push 0x14
mov edx, ecx
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x58]
mov eax, ebx
sub eax, ecx
mov edx, ecx
add eax, esi
mov esi, dword [esp + 0x54]
shr ecx, 2
lea edi, [eax - 0x14]
mov byte [eax - 0x15], 1
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0045e080
add esp, 0x20
test eax, eax
jg 0x4684de
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
call fcn.0046f2b0
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x30]
push eax
push 0x14
push ebp
push edi
push esi
call fcn.00468740
add esp, 0x14
test edi, edi
jle 0x468510
mov eax, ebx
sub esi, ebx
mov ecx, edi
mov dl, byte [esi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x468503
mov esi, dword [esp + 0x30]
call fcn.0046f2b0
push eax
push edi
push ebx
lea eax, [esp + 0x20]
push 0x14
push eax
call fcn.00468740
lea eax, [esp + 0x28]
add esp, 0x14
sub eax, ebp
mov ecx, 0x14
mov dl, byte [eax + ebp]
mov bl, byte [ebp]
xor bl, dl
mov byte [ebp], bl
inc ebp
dec ecx
jne 0x468532
push esi
call fcn.00457e90
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x468560
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2c
call fcn.0048a1d0
mov eax, dword [esp + 0x40]
push ebx
xor ebx, ebx
dec eax
push ebp
push esi
cmp eax, 0x29
push edi
mov dword [esp + 0x10], ebx
jl 0x468704
mov ecx, dword [esp + 0x4c]
mov edi, eax
sub edi, ecx
jns 0x468596
mov dword [esp + 0x10], 1
xor edi, edi
mov esi, dword [esp + 0x48]
lea ebp, [eax - 0x14]
push 0x7a
sub esi, edi
push str..crypto_rsa_rsa_oaep.c
push ebp
add esi, 0x14
call fcn.00457c10
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x4685d8
push 0x7d
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x7a
push 4
call fcn.00458550
add esp, 0x14
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
call fcn.0046f2b0
push eax
push ebp
push esi
lea eax, [esp + 0x20]
push 0x14
push eax
call fcn.00468740
add esp, 0x14
cmp edi, 0x14
mov eax, edi
jge 0x468611
mov edx, dword [esp + 0x48]
mov ecx, eax
sub ecx, edi
mov cl, byte [ecx + edx]
mov dl, byte [esp + eax + 0x14]
xor dl, cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x14
jl 0x4685f6
call fcn.0046f2b0
push eax
lea edx, [esp + 0x18]
push 0x14
push edx
push ebp
push ebx
call fcn.00468740
add esp, 0x14
test ebp, ebp
jle 0x46863f
mov eax, ebx
sub esi, ebx
mov edi, ebp
mov cl, byte [esi + eax]
mov dl, byte [eax]
xor dl, cl
mov byte [eax], dl
inc eax
dec edi
jne 0x468632
push 0
call fcn.0046f2b0
mov ecx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x60]
lea edx, [esp + 0x30]
push 0
push edx
push eax
push ecx
call fcn.00461f40
add esp, 0x18
mov ecx, 5
lea edi, [esp + 0x28]
mov esi, ebx
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x468704
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x468704
mov eax, 0x14
cmp ebp, eax
jle 0x468695
cmp byte [eax + ebx], 0
jne 0x468695
inc eax
cmp eax, ebp
jl 0x46868a
cmp byte [eax + ebx], 1
jne 0x468704
mov ecx, eax
inc eax
cmp ecx, ebp
jge 0x468704
mov ecx, dword [esp + 0x44]
sub ebp, eax
cmp ecx, ebp
jge 0x4686da
push 0x9b
push str..crypto_rsa_rsa_oaep.c
push 0x6d
push 0x7a
push 4
call fcn.00458550
add esp, 0x14
or ebp, 0xffffffff
push ebx
call fcn.00457e90
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
mov edi, dword [esp + 0x40]
mov ecx, ebp
mov edx, ecx
lea esi, [eax + ebx]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00457e90
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
push 0xa8
push str..crypto_rsa_rsa_oaep.c
push 0x79
push 0x7a
push 4
call fcn.00458550
add esp, 0x14
test ebx, ebx
je 0x468729
push ebx
call fcn.00457e90
add esp, 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2c
ret
Function at 0x468bf0
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp eax, edx
push esi
jne 0x468cc5
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x468c13
cmp al, 0x6b
jne 0x468cc5
cmp al, 0x6b
lea esi, [ecx + 1]
jne 0x468c81
lea eax, [edx - 3]
xor edx, edx
test eax, eax
jle 0x468c35
mov cl, byte [esi]
inc esi
cmp cl, 0xba
je 0x468c35
cmp cl, 0xbb
jne 0x468c5e
inc edx
cmp edx, eax
jl 0x468c23
sub eax, edx
test edx, edx
jne 0x468c84
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00458550
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00458550
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
lea eax, [edx - 2]
cmp byte [eax + esi], 0xcc
je 0x468cad
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.00458550
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov ecx, eax
push edi
mov edi, dword [esp + 0xc]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.00458550
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x46e850
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
mov eax, 1
ret
Function at 0x474960
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov ecx, dword [eax + 4]
push edi
cmp ecx, dword [ebx + 4]
jge 0x474979
mov edi, ebx
mov ebx, eax
jmp 0x47497b
mov edi, eax
mov esi, dword [esp + 0x10]
mov eax, dword [edi + 4]
cmp eax, dword [esi + 8]
jle 0x474991
push eax
push esi
call fcn.0044bd50
add esp, 8
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
jle 0x4749b5
push ebp
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
mov ebp, dword [ecx + eax*4]
mov ecx, dword [esi]
xor edx, ebp
mov dword [ecx + eax*4], edx
mov ecx, dword [ebx + 4]
inc eax
cmp eax, ecx
jl 0x47499b
pop ebp
cmp eax, dword [edi + 4]
jge 0x4749cc
mov edx, dword [edi]
mov ecx, dword [esi]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
mov ecx, dword [edi + 4]
inc eax
cmp eax, ecx
jl 0x4749ba
mov edi, dword [edi + 4]
test edi, edi
mov dword [esi + 4], edi
jle 0x4749f2
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
mov ecx, dword [eax]
sub eax, 4
test ecx, ecx
jne 0x4749f2
mov edx, dword [esi + 4]
dec edx
mov ecx, edx
mov dword [esi + 4], edx
test ecx, ecx
jg 0x4749dc
pop edi
pop esi
mov eax, 1
pop ebx
ret