joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a7450
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.10107480
mov eax, dword [0x101be8d0]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x44]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
mov bl, byte [esi]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x28]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x2c]
mov dword [esp + 0x24], edx
mov byte [esp + 0xf], bl
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
test bl, 0x40
jne 0x100a74a8
push ecx
lea ecx, [esi + 0x10]
push ecx
push esi
call eax
add esp, 0xc
movzx eax, bl
and eax, 7
mov ebx, 0xf
sub ebx, eax
mov byte [esi], al
mov eax, ebx
xor ecx, ecx
mov dword [esp + 0x20], ebx
cmp eax, 0xf
jae 0x100a74d7
movzx edx, byte [esi + eax]
or ecx, edx
mov byte [esi + eax], 0
inc eax
shl ecx, 8
cmp eax, 0xf
jb 0x100a74c4
movzx eax, byte [esi + 0xf]
mov ebp, dword [esp + 0x4c]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, ebp
je 0x100a74fe
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.101044ca
add esp, 0x30
ret
push edi
mov edi, ebp
shr edi, 4
test edi, edi
je 0x100a753f
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
lea ecx, [esi + 0x10]
push ecx
mov ecx, dword [esp + 0x20]
push esi
push edx
push edi
push eax
push ecx
call dword [esp + 0x40]
shl edi, 4
mov edx, edi
add dword [esp + 0x34], edx
add dword [esp + 0x30], edx
add esp, 0x18
sub ebp, edx
je 0x100a759a
shr edx, 4
mov ecx, esi
call fcn.100a7210
test ebp, ebp
je 0x100a759a
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
push esi
call dword [esp + 0x2c]
add esp, 0xc
xor eax, eax
test ebp, ebp
jbe 0x100a7589
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
mov edx, ecx
sub edi, ecx
sub ebx, edx
lea ecx, [ecx]
lea edx, [esp + eax + 0x2c]
mov cl, byte [edi + edx]
xor cl, byte [edx]
inc eax
mov byte [ebx + edx], cl
xor byte [esi + eax + 0xf], cl
cmp eax, ebp
jb 0x100a7570
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0x10]
push ecx
push eax
push eax
call dword [esp + 0x2c]
add esp, 0xc
pop edi
cmp ebx, 0x10
jae 0x100a75b6
mov edx, 0x10
sub edx, ebx
push edx
lea eax, [esi + ebx]
push 0
push eax
call fcn.10104ed0
add esp, 0xc
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [esp + 0x28]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
xor dword [esi + 0x14], eax
xor dword [esi + 0x10], edx
mov ecx, dword [esp + 0x3c]
xor dword [esi + 0x18], ecx
mov al, byte [esp + 0x1b]
mov edx, dword [esp + 0x40]
xor dword [esi + 0x1c], edx
mov ecx, dword [esp + 0x44]
add esp, 0xc
mov byte [esi], al
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.101044ca
add esp, 0x30
ret
Function at 0x100a7d70
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.10107480
push ebx
push ebp
mov ebp, dword [esp + 0x14]
mov ebx, dword [ebp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
cmp edi, ebx
jbe 0x100a7e1d
mov eax, dword [ebp + 0x18]
cmp edi, eax
jb 0x100a7dcb
mov edx, dword [ebp + 0x40]
mov ecx, edi
sub ecx, eax
add ecx, 4
and ecx, 0xfffffffc
add eax, ecx
push 0x7a
mov dword [ebp + 0x18], eax
push str.cryptomodesocb128.c
shl eax, 4
push eax
push edx
call fcn.100a11d0
add esp, 0x10
test eax, eax
jne 0x100a7dc8
pop edi
pop ebp
pop ebx
add esp, 8
ret
mov dword [ebp + 0x40], eax
cmp ebx, edi
jae 0x100a7e1a
push esi
mov esi, ebx
sub edi, ebx
shl esi, 4
add ebx, edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov ebx, 1
mov eax, dword [ebp + 0x40]
lea edx, [esi + eax]
mov al, byte [edx]
shr al, 7
mov cl, 0x87
imul cl
lea edi, [edx + 0x10]
mov byte [esp + 0x1c], al
call fcn.100a7c10
mov dl, byte [esp + 0x1c]
xor byte [edi + 0xf], dl
add esi, 0x10
sub dword [esp + 0x10], ebx
jne 0x100a7de6
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x20]
pop esi
mov dword [ebp + 0x14], ebx
mov eax, edi
shl eax, 4
add eax, dword [ebp + 0x40]
pop edi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x100a94c0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x100a9507
mov al, byte [edx]
test al, al
je 0x100a9507
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x100a94d7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x100b4f10
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
mov eax, 0x6c
call fcn.10107480
mov eax, dword [0x101be8d0]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push edi
push 0xf0000040
push 1
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
je 0x100b4f8d
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x34]
push ecx
push 0x40
push edx
call edi
test eax, eax
je 0x100b4f84
mov eax, 8
call fcn.10107480
fld qword [0x10185a78]
fstp qword [esp]
lea eax, [esp + 0x3c]
push 0x40
push eax
call fcn.100a2560
add esp, 0x10
mov ecx, dword [esp + 0xc]
push 0
push ecx
call ebx
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
lea edx, [esp + 0x1c]
push edx
call esi
test eax, eax
je 0x100b4fe3
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x34]
push eax
push 0x40
push ecx
call edi
test eax, eax
je 0x100b4fda
mov eax, 8
call fcn.10107480
fld qword [0x10185a78]
fstp qword [esp]
lea edx, [esp + 0x3c]
push 0x40
push edx
call fcn.100a2560
add esp, 0x10
mov eax, dword [esp + 0xc]
push 0
push eax
call ebx
call fcn.100b4e90
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, 8
call fcn.10107480
fld1
fstp qword [esp]
lea edx, [esp + 0x1c]
push 0x20
push edx
call fcn.100a2560
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 0x10], eax
mov eax, 8
call fcn.10107480
fld1
fstp qword [esp]
lea eax, [esp + 0x18]
push 4
push eax
call fcn.100a2560
mov ecx, dword [esp + 0x84]
add esp, 0x10
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.101044ca
add esp, 0x6c
ret
Function at 0x100b94b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [eax + 0x60]
mov eax, dword [edi + 0x70]
test eax, eax
je 0x100b9519
test ebp, ebp
je 0x100b94f5
lea esp, [esp]
cmp eax, 0x40
jae 0x100b94f5
mov dl, byte [eax + edi + 0x30]
mov ecx, dword [esp + 0x18]
xor dl, byte [ecx]
mov esi, dword [esp + 0x14]
mov byte [esi], dl
inc esi
inc ecx
inc eax
sub ebp, 1
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ecx
jne 0x100b94d0
mov dword [edi + 0x70], eax
test ebp, ebp
je 0x100b95c2
cmp eax, 0x40
jne 0x100b9519
mov eax, 1
add dword [edi + 0x20], eax
mov dword [edi + 0x70], 0
jne 0x100b9519
add dword [edi + 0x24], eax
mov eax, ebp
and eax, 0x3f
sub ebp, eax
push ebx
mov ebx, dword [edi + 0x20]
mov dword [esp + 0x14], eax
cmp ebp, 0x40
jb 0x100b9577
lea ecx, [ecx]
mov esi, ebp
shr esi, 6
add ebx, esi
cmp ebx, esi
jae 0x100b953f
sub esi, ebx
xor ebx, ebx
mov ecx, dword [esp + 0x18]
lea eax, [edi + 0x20]
push eax
mov eax, dword [esp + 0x20]
push edi
shl esi, 6
push esi
push eax
push ecx
call fcn.100cc710
add dword [esp + 0x30], esi
add dword [esp + 0x2c], esi
add esp, 0x14
sub ebp, esi
mov dword [edi + 0x20], ebx
test ebx, ebx
jne 0x100b956e
inc dword [edi + 0x24]
cmp ebp, 0x40
jae 0x100b9530
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100b95c1
push 0x40
lea esi, [edi + 0x30]
push 0
push esi
call fcn.10104ed0
lea eax, [edi + 0x20]
push eax
push edi
push 0x40
push esi
push esi
call fcn.100cc710
mov ebp, dword [esp + 0x34]
add esp, 0x20
xor eax, eax
test ebp, ebp
jbe 0x100b95be
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub edx, ecx
lea ecx, [ecx]
mov bl, byte [edx + ecx]
xor bl, byte [esi + eax]
inc eax
mov byte [ecx], bl
inc ecx
cmp eax, ebp
jb 0x100b95b0
mov dword [edi + 0x70], ebp
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret

Function at 0x100bae80
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.10104ed0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret
Function at 0x100bcdc0
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
push ebx
call fcn.100de8c0
push 0x62
push esi
mov edi, eax
mov ebp, 1
call fcn.1010b650
add esp, 0x10
test eax, eax
jne 0x100bcdec
lea ebp, [eax + 0x11]
test edi, edi
jne 0x100bce67
push 0x4a
push str.crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.100a2040
push 0x1018de60
push esi
push 0x1018de5c
push ebx
push str.fopen_
push 5
call fcn.100a2340
add esp, 0x2c
call fcn.10107215
cmp dword [eax], 2
jne 0x100bce4b
push 0x4d
push str.crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.100a2040
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x4f
push str.crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.100a2040
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x1018de14
call fcn.100b3300
mov esi, eax
add esp, 4
test esi, esi
jne 0x100bce8a
push edi
call fcn.101077ab
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.100b3490
push edi
push ebp
push 0x6a
push esi
call fcn.100b3810
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x100caa30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, edx
push ebx
mov esi, ecx
call fcn.100e6b60
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
add esp, 4
cmp eax, 0x72
mov eax, dword [esp + 0x14]
jne 0x100cab0c
push ebp
push edi
mov ebx, esi
push eax
shr ebx, 1
and esi, 1
push ecx
lea ebp, [esi + ebx]
push ebp
push edx
call fcn.100bad90
mov ecx, dword [esp + 0x30]
mov edx, eax
call fcn.100ca7b0
add esp, 0x14
test eax, eax
je 0x100caad0
push 0xf8
push str.cryptokdf_tls1_prf.c
push edi
call fcn.100a10c0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x100caad0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push edi
push eax
push ecx
add ebx, edx
push ebp
push ebx
call fcn.100b4d20
mov ecx, esi
mov edx, eax
call fcn.100ca7b0
add esp, 0x14
test eax, eax
jne 0x100caad6
push 0xfd
push str.cryptokdf_tls1_prf.c
push edi
push esi
call fcn.100a1180
add esp, 0x10
pop ebp
pop esi
xor eax, eax
pop ebx
ret
test edi, edi
jbe 0x100caaef
mov eax, dword [esp + 0x1c]
mov ecx, esi
sub ecx, eax
mov ebp, edi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub ebp, 1
jne 0x100caae4
push 0x102
push str.cryptokdf_tls1_prf.c
push edi
push esi
call fcn.100a1180
add esp, 0x10
pop ebp
pop esi
mov eax, 1
pop ebx
ret
push edi
push eax
push ecx
mov ecx, dword [esp + 0x24]
push esi
push edx
mov edx, ebx
call fcn.100ca7b0
add esp, 0x14
neg eax
sbb eax, eax
pop esi
neg eax
pop ebx
ret
Function at 0x100cc710
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, 0x88
call fcn.10107480
mov eax, dword [0x101be8d0]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x98]
mov edx, dword [eax]
mov ecx, dword [esp + 0x9c]
mov dword [esp + 0x14], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x18], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x1c], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x20], edx
mov edx, dword [eax + 0x10]
mov dword [esp + 0x24], edx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x28], edx
mov edx, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x2c], edx
mov edx, dword [ecx]
mov dword [esp + 0x30], eax
mov eax, dword [ecx + 4]
push ebx
mov ebx, dword [esp + 0x98]
push ebp
mov ebp, dword [esp + 0x94]
mov dword [esp + 0x3c], edx
mov edx, dword [ecx + 8]
mov dword [esp + 0x40], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 8], ebp
mov dword [esp + 0xc], 0x61707865
mov dword [esp + 0x10], 0x3320646e
mov dword [esp + 0x14], 0x79622d32
mov dword [esp + 0x18], 0x6b206574
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], eax
test ebx, ebx
jbe 0x100cc824
push esi
push edi
mov esi, 0x40
cmp ebx, esi
jae 0x100cc7cd
mov esi, ebx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x58]
push edx
call fcn.100cc470
add esp, 8
xor ecx, ecx
test esi, esi
jbe 0x100cc807
mov edi, dword [esp + 0xa0]
lea eax, [esp + 0x54]
mov edx, eax
sub edi, eax
sub ebp, edx
lea eax, [esp + ecx + 0x54]
mov dl, byte [edi + eax]
xor dl, byte [eax]
inc ecx
mov byte [eax + ebp], dl
cmp ecx, esi
jb 0x100cc7f6
mov ebp, dword [esp + 0x10]
add dword [esp + 0xa0], esi
inc dword [esp + 0x44]
add ebp, esi
sub ebx, esi
mov dword [esp + 0x10], ebp
test ebx, ebx
ja 0x100cc7c2
pop edi
pop esi
mov ecx, dword [esp + 0x8c]
pop ebp
pop ebx
xor ecx, esp
call fcn.101044ca
add esp, 0x88
ret
Function at 0x100cd070
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x100cd084
mov dword [esp + 0x18], fcn.100cdc10
jmp fcn.100a4540
mov dword [esp + 0x18], fcn.100ce9d0
jmp fcn.100a46e0
Function at 0x100cf790
Capabilities:
Hash data using sha256

Disassembly:
push edi
push 0x74
push 0
push esi
mov edi, ecx
call fcn.10104ed0
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov eax, dword [edi]
xor dword [esi], eax
mov eax, dword [edi + 4]
xor dword [esi + 4], eax
mov eax, dword [edi + 8]
xor dword [esi + 8], eax
mov eax, dword [edi + 0xc]
xor dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
xor dword [esi + 0x10], eax
mov eax, dword [edi + 0x14]
xor dword [esi + 0x14], eax
mov eax, dword [edi + 0x18]
xor dword [esi + 0x18], eax
mov edi, dword [edi + 0x1c]
xor dword [esi + 0x1c], edi
add esp, 0xc
pop edi
ret
Function at 0x100e72d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.10107480
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
mov edi, edx
push ebp
mov esi, 1
push eax
mov ebx, ecx
shl esi, cl
mov dword [esp + 0x18], edi
call fcn.100b6810
add esp, 8
test eax, eax
jne 0x100e730b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
cmp ebx, 3
jg 0x100e736d
xor ebx, ebx
test ebp, ebp
jle 0x100e74d0
lea ebx, [ebx]
xor edx, edx
xor ecx, ecx
test esi, esi
jle 0x100e734f
mov eax, ecx
xor eax, dword [esp + 0x44]
inc ecx
lea ebp, [eax - 1]
shr ebp, 0x1f
not eax
shr eax, 0x1f
and ebp, eax
mov eax, dword [edi + ecx*4 - 4]
neg ebp
and ebp, 1
neg ebp
and ebp, eax
or edx, ebp
cmp ecx, esi
jl 0x100e7328
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx]
mov dword [eax + ebx*4], edx
lea eax, [esi*4]
inc ebx
add edi, eax
cmp ebx, dword [esp + 0x40]
jl 0x100e7320
jmp 0x100e74d0
mov edx, dword [esp + 0x44]
lea ecx, [ebx - 2]
mov eax, edx
sar eax, cl
mov edi, 1
shl edi, cl
lea ebx, [eax - 1]
shr ebx, 0x1f
lea ecx, [edi - 1]
and edx, ecx
mov dword [esp + 0x44], edx
mov edx, eax
not edx
shr edx, 0x1f
and ebx, edx
mov ecx, eax
xor ecx, 1
lea edx, [ecx - 1]
not ecx
shr ecx, 0x1f
shr edx, 0x1f
and edx, ecx
mov ecx, eax
xor ecx, 2
lea ebp, [ecx - 1]
not ecx
shr ecx, 0x1f
shr ebp, 0x1f
and ebp, ecx
xor eax, 3
lea ecx, [eax - 1]
shr ecx, 0x1f
not eax
shr eax, 0x1f
and ecx, eax
neg ebx
neg edx
neg ebp
neg ecx
and ebx, 1
and edx, 1
and ebp, 1
and ecx, 1
xor eax, eax
neg edx
neg ebp
neg ecx
neg ebx
cmp dword [esp + 0x40], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
jle 0x100e74d0
lea edx, [esi*4]
mov dword [esp + 0x34], edx
mov edi, edi
xor esi, esi
cmp edi, esi
mov dword [esp + 0x20], esi
jle 0x100e74ac
mov eax, dword [esp + 0x10]
lea edx, [eax + edi*4]
mov dword [esp + 0x1c], edx
lea edx, [eax + edi*8]
mov dword [esp + 0x18], edx
lea edx, [edi + edi*2]
lea eax, [eax + edx*4]
mov dword [esp + 0x14], eax
lea ebx, [ebx]
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
and edx, ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx]
and ecx, ebp
or ecx, edx
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
and edx, dword [esp + 0x30]
mov ebp, dword [esp + 0x24]
or edx, ecx
mov eax, esi
xor eax, dword [esp + 0x44]
inc esi
lea ecx, [eax - 1]
not eax
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + esi*4 - 4]
neg ecx
and ecx, 1
and eax, ebx
neg ecx
or eax, edx
and ecx, eax
or dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x28]
mov eax, 4
add dword [esp + 0x14], eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
cmp esi, edi
jl 0x100e7440
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x3c]
mov edx, dword [edx]
mov esi, dword [esp + 0x20]
mov dword [edx + eax*4], esi
mov edx, dword [esp + 0x34]
add dword [esp + 0x10], edx
inc eax
cmp eax, dword [esp + 0x40]
mov dword [esp + 0x2c], eax
jl 0x100e7410
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
push eax
mov dword [eax + 4], ecx
call fcn.100b6440
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x28
ret
Function at 0x100e8700
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5c
call fcn.10107480
mov eax, dword [0x101be8d0]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x70]
push ebx
mov ebx, dword [esp + 0x64]
push ebp
mov ebp, dword [esp + 0x74]
push esi
mov esi, dword [esp + 0x88]
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x88]
dec edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
test eax, eax
jne 0x100e875d
call fcn.100b4d20
mov dword [esp + 0x18], eax
test esi, esi
jne 0x100e8765
mov dword [esp + 0x14], eax
push eax
call fcn.100a2740
mov esi, eax
lea eax, [esi + esi]
sub edi, eax
lea edx, [edi - 1]
add esp, 4
cmp ebp, edx
jle 0x100e87a9
push 0x3c
push str.crypto_rsa_rsa_oaep.c
push 0x6e
push 0x9a
push 4
call fcn.100a2040
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.101044ca
add esp, 0x5c
ret
inc eax
cmp dword [esp + 0x10], eax
jge 0x100e87bb
push 0x42
push str.crypto_rsa_rsa_oaep.c
push 0x78
jmp 0x100e8785
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x84]
push 0
push ecx
lea eax, [ebx + 1]
mov byte [ebx], 0
push 0
lea ebx, [ebx + esi + 1]
push ebx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x34]
push edx
push eax
call fcn.100b4af0
add esp, 0x18
test eax, eax
je 0x100e8794
sub edi, ebp
dec edi
push edi
lea ecx, [ebx + esi]
push 0
push ecx
call fcn.10104ed0
mov ecx, dword [esp + 0x2c]
mov edi, dword [esp + 0x1c]
mov edx, ebx
sub edx, ebp
sub edx, esi
push ebp
lea eax, [edx + edi]
push ecx
push eax
mov byte [eax - 1], 1
call fcn.10105350
mov ebp, dword [esp + 0x34]
push esi
push ebp
call fcn.100a25d0
add esp, 0x20
test eax, eax
jle 0x100e8794
push 0x57
sub edi, esi
push str.crypto_rsa_rsa_oaep.c
push edi
call fcn.100a10c0
add esp, 0xc
mov dword [esp + 0x10], eax
test eax, eax
jne 0x100e8856
push 0x59
push str.crypto_rsa_rsa_oaep.c
push 0x41
jmp 0x100e8785
mov edx, dword [esp + 0x14]
push edx
push esi
push ebp
push edi
push eax
call fcn.100e8590
add esp, 0x14
test eax, eax
jl 0x100e8794
test edi, edi
jle 0x100e888f
mov ebp, dword [esp + 0x10]
mov eax, ebx
sub ebp, ebx
mov ecx, edi
lea ecx, [ecx]
mov dl, byte [eax + ebp]
xor byte [eax], dl
inc eax
sub ecx, 1
jne 0x100e8880
mov ebp, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
push eax
push edi
push ebx
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.100e8590
add esp, 0x14
test eax, eax
jl 0x100e8794
test esi, esi
jle 0x100e88c3
lea ecx, [esp + 0x28]
mov eax, ebp
sub ecx, ebp
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub esi, 1
jne 0x100e88b8
mov eax, dword [esp + 0x10]
push 0x67
push str.crypto_rsa_rsa_oaep.c
push eax
call fcn.100a1160
mov ecx, dword [esp + 0x74]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.101044ca
add esp, 0x5c
ret
Function at 0x100e90f0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x100e91b3
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x100e9111
cmp al, 0x6b
jne 0x100e91b3
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x100e9177
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x100e9131
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x100e9131
cmp al, 0xbb
jne 0x100e9157
inc ecx
cmp ecx, esi
jl 0x100e9121
sub esi, ecx
test ecx, ecx
jne 0x100e917a
push 0x50
push str.crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.100a2040
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x48
push str.crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.100a2040
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x100e91a0
push 0x58
push str.crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.100a2040
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.10105350
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x3d
push str.crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.100a2040
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x100ea6b0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov edx, dword [edi + 0x1c]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.100b3490
add esp, 8
test esi, esi
jg 0x100ea70e
je 0x100ea6ec
cmp esi, 0xffffffff
jne 0x100ea70e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 4
je 0x100ea703
cmp eax, 0xb
je 0x100ea703
cmp eax, 0x2733
jne 0x100ea70e
push 0xa
push edi
call fcn.100b34b0
add esp, 8
pop edi
mov eax, esi
pop esi
ret

Function at 0x100ec7d0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x84], 0xffffffff
jne 0x100ec7e2
xor eax, eax
pop edi
ret
mov eax, dword [edi]
push ebx
push esi
push eax
call fcn.100a2690
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add esp, 4
mov esi, eax
mov dword [ecx], esi
test ebx, ebx
je 0x100ec891
mov eax, dword [edi + 0x84]
push ebp
cmp eax, esi
jne 0x100ec830
test esi, esi
jle 0x100ec86e
mov ecx, ebx
lea eax, [edi + 4]
mov ebp, esi
lea esp, [esp]
mov dl, byte [eax + 0x60]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x100ec820
jmp 0x100ec86e
mov ecx, esi
sub ecx, eax
cmp ecx, 1
mov byte [eax + edi + 0x64], 0x80
jle 0x100ec84f
dec ecx
push ecx
lea eax, [eax + edi + 0x65]
push 0
push eax
call fcn.10104ed0
add esp, 0xc
test esi, esi
jle 0x100ec86e
mov ecx, ebx
lea eax, [edi + 0x24]
mov ebp, esi
lea ebx, [ebx]
mov dl, byte [eax + 0x40]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x100ec860
mov eax, dword [edi]
push esi
push ebx
push ebx
push eax
call fcn.100a26a0
add esp, 0x10
pop ebp
test eax, eax
jne 0x100ec891
push esi
push ebx
call fcn.100a1350
add esp, 8
pop esi
pop ebx
xor eax, eax
pop edi
ret
pop esi
pop ebx
mov eax, 1
pop edi
ret