joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409cf0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x8048
call fcn.0047e630
mov eax, dword [0x4d9700]
xor eax, esp
mov dword [esp + 0x8044], eax
mov eax, dword [esp + 0x804c]
push ebx
push ebp
mov ebp, dword [esp + 0x8058]
push esi
push edi
xor ebx, ebx
push 0x38
lea ecx, [esp + 0x1c]
push str.1.2.3
push ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call fcn.004542d0
mov edi, eax
add esp, 0xc
cmp edi, ebx
jne 0x409e37
jmp 0x409d60
mov esi, dword [esp + 0x8064]
cmp esi, ebx
je 0x409e20
mov eax, 0x4000
cmp esi, 0x4000
ja 0x409d7e
mov eax, esi
mov ecx, dword [esp + 0x14]
push ebx
lea edx, [esp + 0x20]
push edx
push eax
lea eax, [esp + 0x5c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x409e52
mov eax, dword [esp + 0x1c]
sub esi, eax
mov dword [esp + 0x8064], esi
cmp eax, ebx
je 0x409e20
lea edx, [esp + 0x50]
mov dword [esp + 0x18], edx
lea ecx, [esp + 0x18]
lea eax, [esp + 0x4050]
push ebx
mov esi, 0x4000
push ecx
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], eax
call fcn.004543e0
mov edi, eax
add esp, 8
cmp edi, 0xfffffffc
jl 0x409ded
cmp edi, 0xfffffffd
jle 0x409e69
cmp edi, 2
je 0x409e64
sub esi, dword [esp + 0x28]
push ebx
lea edx, [esp + 0x14]
push edx
push esi
lea eax, [esp + 0x405c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x409e7a
cmp esi, dword [esp + 0x10]
jne 0x409e52
cmp dword [esp + 0x28], ebx
je 0x409db6
cmp edi, 1
jne 0x409d60
lea edx, [esp + 0x18]
push edx
call fcn.004559e0
mov eax, edi
dec eax
add esp, 4
neg eax
sbb eax, eax
and eax, 0xfffffffd
mov ecx, dword [esp + 0x8054]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047bc57
add esp, 0x8048
ret 0xc
lea ecx, [esp + 0x18]
push ecx
call fcn.00455a80
add esp, 4
or eax, 0xffffffff
jmp 0x409e37
mov edi, 0xfffffffd
lea edx, [esp + 0x18]
push edx
call fcn.004559e0
add esp, 4
mov eax, edi
jmp 0x409e37
lea eax, [esp + 0x18]
push eax
call fcn.004559e0
add esp, 4
or eax, 0xffffffff
jmp 0x409e37
Function at 0x40a440
Capabilities:
Copy file
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x4a0ad8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebp
push esi
push edi
mov eax, dword [0x4d9700]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
sub eax, 0x10
push eax
call fcn.0040bba0
lea ebp, [eax + 0x10]
add esp, 4
mov dword [esp + 0x14], ebp
mov dword [esp + 0x24], 0
call fcn.0046416b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40a49f
push 0x80004005
call fcn.00405a40
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x10], edi
mov byte [esp + 0x24], 1
mov eax, dword [esi]
push 0x5c
push eax
call fcn.0047d203
add esp, 8
test eax, eax
je 0x40a5c3
sub eax, dword [esi]
cmp eax, 0xffffffff
je 0x40a5c3
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, esi
call fcn.0040b2d0
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], 2
call fcn.0040bb00
mov byte [esp + 0x24], 1
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a515
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [esp + 0x10]
push ecx
call fcn.0040a5d0
add esp, 4
push 6
push str..xnbak
lea ecx, [esp + 0x1c]
call fcn.0040b5e0
mov ebp, dword [esp + 0x14]
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push ebp
push eax
call edi
mov esi, dword [esi]
mov ecx, dword [esp + 0x2c]
mov eax, dword [ecx]
push 0
push esi
push eax
call edi
test eax, eax
jne 0x40a569
push eax
push eax
push 0x4cbe58
call fcn.00463c48
mov byte [esp + 0x24], 0
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a58e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov dword [esp + 0x24], edx
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a5ae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x18
ret 4
mov byte [esp + 0x24], 0
lea eax, [edi - 0x10]
jmp 0x40a575
Function at 0x40b8f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40b909
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40b944
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40b940
lea ebx, [ebx]
cmp esi, eax
jae 0x40b944
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x40b930
cmp esi, eax
jb 0x40b94a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x40c230
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, eax
mov eax, dword [ebx]
sub eax, 0x10
or esi, 0xffffffff
cmp dword [eax + 0xc], 1
jle 0x40c24d
mov eax, dword [eax + 4]
push eax
mov ecx, ebx
call fcn.004058f0
mov eax, dword [ebx]
test edi, edi
je 0x40c270
movzx edx, byte [eax]
mov ecx, esi
and ecx, 0xff
xor ecx, edx
shr esi, 8
xor esi, dword [ecx*4 + 0x4cc5d8]
dec edi
inc eax
test edi, edi
jne 0x40c253
mov eax, esi
pop edi
not eax
pop esi
ret
Function at 0x40c280
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4a08c8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4d9700]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax]
push 0
push 0x8000000
push 3
push 0
push 3
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40c3b4
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
call fcn.0046416b
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40c2f3
push 0x80004005
call fcn.00405a40
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0x24], esi
mov dword [esp + 0x1c], 0
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x40c32a
push edi
lea ecx, [esp + 0x28]
call fcn.004059c0
mov esi, dword [esp + 0x24]
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi - 8]
push eax
push esi
call fcn.0047e14a
add esp, 8
test eax, eax
jl 0x40c3aa
cmp eax, dword [esi - 8]
jg 0x40c3aa
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
mov eax, edi
lea ebx, [esp + 0x24]
call fcn.0040c230
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c393
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
push 0x80070057
call fcn.00405a40
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x40c660
Capabilities:
Check for peb beingdebugged flag
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x4a03f1
mov eax, dword fs:[0]
push eax
sub esp, 0x94
mov eax, dword [0x4d9700]
xor eax, esp
mov dword [esp + 0x90], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d9700]
xor eax, esp
push eax
lea eax, [esp + 0xa8]
mov dword fs:[0], eax
mov eax, dword [esp + 0xbc]
mov ebp, dword [esp + 0xb8]
push 7
lea esi, [esp + 0x28]
mov dword [esp + 0x24], eax
lea edi, [ebp + 0x54]
call fcn.0040de50
lea ebx, [ebp + 0xc068]
push ebx
lea ecx, [ebp + 0xc058]
push ecx
mov edx, esi
push edx
lea eax, [esp + 0x24]
mov dword [esp + 0xbc], 0
call fcn.0040df40
lea esi, [esp + 0x2c]
call fcn.0040e020
mov eax, esi
mov byte [esp + 0xb0], 2
call fcn.0040e030
push 0
push ebx
lea eax, [ebp + 0xc060]
push eax
mov ebx, esi
call fcn.0040e050
add esp, 0xc
mov eax, esi
call fcn.0040e090
lea eax, [esp + 0x18]
mov byte [edi + 2], 0x64
call fcn.0040df80
mov dword [edi + 3], eax
lea eax, [esp + 0x18]
call fcn.0040df80
push eax
lea esi, [esp + 0x1c]
call fcn.0040dfa0
push eax
lea ecx, [edi + 7]
push 0x5ff9
push ecx
call fcn.0047bcb7
add esp, 0x10
mov eax, esi
call fcn.0040df80
add eax, 7
movzx esi, ax
movzx edx, si
add esi, 4
mov dword [edx + edi], 0x14
movzx eax, si
push 0x14
lea ecx, [esp + 0x90]
push ecx
mov edx, 0x6000
sub edx, eax
push edx
add eax, edi
push eax
call fcn.0047bcb7
mov ecx, dword [esp + 0x30]
add esp, 0x10
push 0
add esi, 0x14
push ecx
movzx eax, si
push ebp
mov ecx, edi
mov word [edi], si
call fcn.0040c3d0
mov bl, al
lea eax, [esp + 0x2c]
call fcn.0040e030
lea esi, [esp + 0x18]
call fcn.0040de80
lea esi, [esp + 0x24]
call fcn.0040de80
mov al, bl
mov ecx, dword [esp + 0xa8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.0047bc57
add esp, 0xa0
ret 8

Function at 0x412850
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.0047e5b0
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret
Function at 0x4152c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c
call fcn.0047e630
mov eax, dword [0x4d9700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 0x18], eax
mov eax, ebx
push edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4152e8
push 0
push 0
sub eax, esi
lea edi, [eax + 1]
push edi
push ebx
push 8
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
jle 0x415386
lea eax, [esi + esi]
call fcn.00480540
mov eax, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push edi
push ebx
push 8
push 0xfde9
mov dword [ebp - 0x1c], eax
call esi
test eax, eax
je 0x4153aa
mov edi, dword [ebp - 0x18]
mov eax, edi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415340
push 8
sub eax, edx
lea ecx, [ebp - 0x14]
push ecx
inc eax
push eax
push edi
push 0
push 0xfde9
call esi
test eax, eax
je 0x4153aa
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.0048051c
mov esi, eax
add esp, 8
test esi, esi
jne 0x41544b
call fcn.0048040d
cmp dword [eax], 2
jne 0x4153a2
push edi
jmp 0x415397
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x4153aa
mov ecx, dword [ebp - 0x18]
push ecx
push ebx
call fcn.0047fd34
mov esi, eax
add esp, 8
test esi, esi
jne 0x41544b
push 0xa3
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.00414540
mov edx, dword [ebp - 0x18]
push 0x4a2fac
push edx
push 0x4a2fa8
push ebx
push str.fopen_
push 5
call fcn.00414240
add esp, 0x2c
call fcn.0048040d
cmp dword [eax], 2
jne 0x41541d
push 0xa6
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.00414540
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047bc57
mov esp, ebp
pop ebp
ret
push 0xa8
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.00414540
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047bc57
mov esp, ebp
pop ebp
ret
push 0x4d72c0
call fcn.00414d70
mov edi, eax
add esp, 4
test edi, edi
jne 0x41547d
push esi
call fcn.0047f505
add esp, 4
xor eax, eax
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047bc57
mov esp, ebp
pop ebp
ret
push 0
push edi
call fcn.00414800
push esi
push 1
push 0x6a
push edi
call fcn.00414b60
add esp, 0x18
mov eax, edi
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0047bc57
mov esp, ebp
pop ebp
ret
Function at 0x417380
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.0047e630
mov eax, dword [0x4d9700]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x4173e5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x4173e5
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.00480b67
add eax, 0x40
push eax
call fcn.00480b48
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047bc57
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.00480a10
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x417474
call fcn.00417240
test eax, eax
jle 0x417474
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047bc57
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0047bc57
add esp, 0x108
ret

Function at 0x4178b0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x4178f7
mov al, byte [edx]
test al, al
je 0x4178f7
push edi
mov edi, pe_nt_image_headers32
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x4178c7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x423b20
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.0047e630
mov eax, dword [0x4d9700]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebp, ebp
je 0x423b6f
mov eax, 1
mov dword [esi], ebp
jmp 0x423b71
mov ebp, dword [esi]
test ecx, ecx
je 0x423c54
push ebp
call fcn.00425320
mov ebx, eax
add esp, 4
cmp ebx, 0x80
jle 0x423ba0
push str.j____int_sizeof_ctx__key_
push 0x52
push str..cryptohmachmac.c
call fcn.004174a0
add esp, 0xc
mov edi, dword [esp + 0xa8]
cmp ebx, edi
jge 0x423bf7
mov ecx, dword [esp + 0x10]
push ecx
lea ebx, [esi + 4]
push ebp
push ebx
call fcn.0041a1e0
add esp, 0xc
test eax, eax
je 0x423cf6
mov edx, dword [esp + 0x14]
push edi
push edx
push ebx
call fcn.0041a390
add esp, 0xc
test eax, eax
je 0x423cf6
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.0041a3a0
add esp, 0xc
test eax, eax
je 0x423cf6
jmp 0x423c31
cmp edi, 0x80
jbe 0x423c13
push str.len_0__len__int_sizeof_ctx__key_
push 0x5f
push str..cryptohmachmac.c
call fcn.004174a0
add esp, 0xc
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edx, [esi + 0x50]
push edx
call fcn.0047e960
mov eax, dword [esp + 0xb4]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], eax
mov edi, dword [edi]
cmp edi, 0x80
je 0x423c5c
mov ecx, 0x80
sub ecx, edi
push ecx
lea edx, [edi + esi + 0x50]
push 0
push edx
call fcn.0047e5b0
add esp, 0xc
jmp 0x423c5c
test eax, eax
je 0x423ce2
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x423c60
mov edi, dword [esp + 0x10]
push edi
lea ebx, [esi + 0x1c]
push ebp
push ebx
call fcn.0041a1e0
add esp, 0xc
test eax, eax
je 0x423cf6
push ebp
call fcn.00425320
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.0041a390
add esp, 0x10
test eax, eax
je 0x423cf6
xor eax, eax
mov cl, byte [esi + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x423ca4
push edi
lea ebx, [esi + 0x34]
push ebp
push ebx
call fcn.0041a1e0
add esp, 0xc
test eax, eax
je 0x423cf6
push ebp
call fcn.00425320
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.0041a390
add esp, 0x10
test eax, eax
je 0x423cf6
lea eax, [esi + 0x1c]
push eax
add esi, 4
push esi
call fcn.0041a500
add esp, 8
test eax, eax
jne 0x423cfa
xor eax, eax
jmp 0x423cff
mov eax, 1
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0047bc57
add esp, 0x8c
ret
Function at 0x428810
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.0047e630
mov eax, dword [esp + 0x38]
push ebx
push edi
xor edi, edi
push eax
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], edi
call fcn.0041c460
mov ebx, eax
add esp, 4
cmp ebx, edi
jl 0x428a51
push esi
mov esi, dword [esp + 0x48]
cmp esi, 0xffffffff
jne 0x4288d7
mov esi, ebx
mov edi, dword [esp + 0x38]
mov ecx, dword [edi + 0x10]
push ebp
push ecx
call fcn.0040e100
mov ebp, eax
dec ebp
and ebp, 7
push edi
mov dword [esp + 0x24], ebp
call fcn.00420d40
add esp, 8
mov edi, eax
mov dword [esp + 0x18], eax
test ebp, ebp
jne 0x428889
mov eax, dword [esp + 0x40]
mov byte [eax], 0
inc eax
dec edi
mov dword [esp + 0x40], eax
mov dword [esp + 0x18], edi
cmp esi, 0xfffffffe
jne 0x42890b
mov esi, edi
sub esi, ebx
sub esi, 2
test esi, esi
jle 0x428949
push 0xda
push str..crypto_rsa_rsa_pss.c
push esi
call fcn.004138b0
mov ebp, eax
add esp, 0xc
mov dword [esp + 0x10], ebp
test ebp, ebp
jne 0x428937
push 0xde
push str..crypto_rsa_rsa_pss.c
push 0x41
push 0x7d
push 4
call fcn.00414540
add esp, 0x14
jmp 0x428a34
cmp esi, 0xfffffffe
jne 0x4288e1
jmp 0x42884d
jge 0x42884d
push 0xc3
push str..crypto_rsa_rsa_pss.c
push 0x88
push 0x7d
push 4
call fcn.00414540
add esp, 0x14
pop esi
mov eax, edi
pop edi
pop ebx
add esp, 0x28
ret
lea edx, [ebx + esi + 2]
cmp edi, edx
jge 0x428895
push 0xd5
push str..crypto_rsa_rsa_pss.c
push 0x6e
push 0x7d
push 4
call fcn.00414540
add esp, 0x14
mov eax, dword [esp + 0x14]
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x28
ret
push esi
push ebp
call fcn.00415570
add esp, 8
test eax, eax
jle 0x428a30
lea eax, [esp + 0x20]
sub edi, ebx
push eax
lea ebp, [edi - 1]
call fcn.0041a190
mov ecx, dword [esp + 0x4c]
push 0
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.0041a1e0
push 8
lea eax, [esp + 0x34]
push 0x4b68bc
push eax
call fcn.0041a390
mov ecx, dword [esp + 0x60]
push ebx
push ecx
lea edx, [esp + 0x44]
push edx
call fcn.0041a390
add esp, 0x28
test esi, esi
je 0x4289a4
mov eax, dword [esp + 0x10]
push esi
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.0041a390
add esp, 0xc
mov edx, dword [esp + 0x40]
lea eax, [edx + ebp]
push 0
push eax
lea eax, [esp + 0x28]
push eax
call fcn.0041a4d0
lea ecx, [esp + 0x2c]
push ecx
call fcn.0041a420
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x50]
push edx
push ebx
add eax, ebp
push eax
push ebp
mov ebp, dword [esp + 0x60]
push ebp
call fcn.00435cc0
add esp, 0x24
test eax, eax
jne 0x428a30
sub edi, esi
xor byte [edi + ebp - 2], 1
lea eax, [edi + ebp - 2]
inc eax
test esi, esi
jle 0x428a06
xor ecx, ecx
test esi, esi
jle 0x428a06
mov edx, dword [esp + 0x10]
mov dl, byte [ecx + edx]
xor byte [eax], dl
inc ecx
inc eax
cmp ecx, esi
jl 0x4289f7
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x428a1f
mov ecx, 8
sub ecx, eax
mov eax, 0xff
sar eax, cl
and byte [ebp], al
mov ecx, dword [esp + 0x18]
mov byte [ecx + ebp - 1], 0xbc
mov dword [esp + 0x14], 1
mov ebp, dword [esp + 0x10]
test ebp, ebp
je 0x42892b
push ebp
call fcn.00413a50
mov eax, dword [esp + 0x18]
add esp, 4
pop ebp
pop esi
pop edi
pop ebx
add esp, 0x28
ret
mov eax, edi
pop edi
pop ebx
add esp, 0x28
ret
Function at 0x428ae0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x428bac
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x428b01
cmp al, 0x6b
jne 0x428bac
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x428b6d
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x428b21
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x428b21
cmp al, 0xbb
jne 0x428b4a
inc ecx
cmp ecx, esi
jl 0x428b11
sub esi, ecx
test ecx, ecx
jne 0x428b70
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00414540
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00414540
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x428b99
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.00414540
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.0047e960
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.00414540
add esp, 0x14
or eax, 0xffffffff
pop esi
ret