joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005a19d
Capabilities:
Encode data using xor

Disassembly:
pop ebp
ret
push ebp
mov ebp, esp
push dword [ebp + 0xc]
pushfd
test byte [0x1005a29d], 0x57
jne 0x1005a29e
jno 0x1005a19b
test cl, bh
xor al, 0x70
jnp 0x1005a1ff
or byte [esi + 0x4177a7ce], bh
arpl word [ecx + 0x71fa6f5d], sp
mov dword [0xe9d4ba52], eax
mov ebx, 0x8a860701
stosb byte es:[edi], al
cmpsb byte [esi], byte es:[edi]
lds ebx, [ecx - 0x7ee7eb9c]
mov edi, 0x3f6318b1
ror dword [edx + 0x1932c6a2], 1
push edx
mov edx, 0x1bbe9d4
pop es
xchg byte [edx - 0x663a5956], cl
adc al, 0x18
cmp dword [edi + 0x3f6318b1], 0xc6a28ad1
xor bl, byte [ecx]
push ss
or eax, 0x18a03dc3
fptan
adc ebp, dword [ecx + 0x319880c]
stosb byte es:[edi], al
popal
jg 0x1005a1c6
mov cl, byte [ecx - 0x32f488f8]
mov dword [ebp + ebp*8 - 0x33], ebx
shl dword [ebx - 0x295d9658], 1
int 0xd1
mov dword [0xd6a269a8], eax
inc edi
enter 0x6ae9, 0x46
dec ebp
mov word [eax + ecx], gs
add dh, byte [ebx - 0x7f]
lodsb al, byte [esi]
dec ebx
salc
pop esp
push 0xffffffffffffffbe
xchg dword [esi], ebp
jbe 0x1005a1b1
mov eax, 0xabc83562
int1
fsubr dword [eax - 0x41]
jo 0x1005a277
dec edi
cmpsb byte [esi], byte es:[edi]
fcmovnbe st(0), st(0)
sbb byte [edx + edx*8 - 0x7b], bh
dec edx
xchg ebp, eax
sbb bh, ah
fld qword [edi]
xlatb
dec edi
bound ecx, qword [eax + 0x6057ad86]
pop ebx
dec ebx
inc eax
outsd dx, dword [esi]
lahf
repne insb byte es:[edi], dx
fsub qword [ebx - 0x67eb6dea]
pop esp
jmp [esi + 0x4e]
dec ebp
mov esi, 0x247a5154
pop ebx
inc edx
fidivr dword [eax - 0x36]
and al, 0xe0
push ds
test dword [eax + 0x52], edx
xchg edi, eax
daa
jbe 0x1005a225
out 0xfe, eax
mov byte [ebp - 0x5873db9c], ch
cmp al, 0x71
xchg byte [edx - 0x4c15497b], cl
popfd
push dword [ebp + 8]
call fcn.10121f0d
push eax
call fcn.100538bc
mov eax, dword [ebp + 8]
add esp, 0xc
pop ebp
pushfd
test byte [0x1005a3bd], 0x31
jne 0x1005a3be
jo 0x1005a2a8
pop edi
idiv ch
mov ch, 0x82
inc edi
jmp ecx
popfd
ret
Function at 0x1006e061
Capabilities:
Encode data using base64

Disassembly:
imul eax, dword [esi], 0x41fe0526
das
adc dl, ch
stc
push ebp
mov ebp, esp
pushfd
test byte [0x1006e0d9], 0xab
jne 0x1006e0da
jns 0x1006dff0
adc ecx, eax
or ecx, dword [eax]
push edi
imul eax, dword [ecx - 0x785d220a], 0x18
fbstp tbyte [ebp - 0x7d]
sahf
mov al, 0x48
xchg edx, eax
dec edx
and eax, 0xd36ea8a9
dec ebp
shr esp, 0xaa
int3
Function at 0x1007ac56
Capabilities:
Authenticate hmac
Check http status code
Encode data using base64
Encode data using xor
Encrypt data using aes mixcolumns step
Make an http request with a cookie
Parse pe header
Prepare http request
Read http header
Receive http response
Send data
Send http request
Set http header

Disassembly:
push 0xd7c
mov eax, 0x10141163
call fcn.1011e502
mov eax, dword [ebp + 8]
pushfd
test byte [0x1007ad1f], 0xa6
jne 0x1007ad20
adc edi, ecx
cmp eax, 0xc9889f30
dec esi
clc
daa
fnstcw word [edx]
salc
mov dword [esi], ebp
push cs
inc byte [esi + 0x4f]
int 0x63
push ss
push edi
xchg esp, eax
stosd dword es:[edi], eax
adc byte [ebx], bh
fcomp dword [edi - 0x49345eaa]
das
cmpsd dword [esi], dword es:[edi]
pop ebx
std
mov cl, 0x52
test dword [edx], 0x29870681
mov ah, 0x3a
mov bl, 0xc9
push ds
mov al, byte [0xa1c492f3]
add dh, byte [edx - 0xd]
Function at 0x10089fd5
Capabilities:
Check for software breakpoints
Check http status code
Delete file
Encode data using base64

Disassembly:
pushfd
test byte [0x1008a01a], 9
je 0x1008a01b
inc ebx
fucomp st(7)
Function at 0x1009377b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push str.Entering_CHYNODE::TransferNetCmd.....

Function at 0x1009665e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x10170c30]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
pushfd
Function at 0x100a0fb3
Capabilities:
Encode data using xor

Disassembly:
push 0x24
mov eax, 0x101425ac
call fcn.1011e502
mov esi, ecx
mov dword [ebp - 0x30], esi
call fcn.100b07e4
and dword [ebp - 4], 0
lea ecx, [esi + 0x194]
mov dword [esi], vtable.HttpClient.0
call fcn.10001000
pushfd
test byte [0x100a1005], 0x3f
jne 0x100a1006
xor edi, esi
and ch, byte [edx + 0x26]
cmp byte [edi], cl
xor byte [eax + eax*2 - 0x10f8d5f1], bl
push ebx
nop
pop dword [edx + 0x17]
loop 0x100a0fea
shr al, cl
push ebx
arpl word [edi - 0x76], bx
inc esp
in al, dx
popfd
push 0x10146825
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.10005af6
push 0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [esi + 0x198]
mov byte [ebp - 4], 2
call fcn.1007562f
push 0
pushfd
test byte [0x100a1078], 0xb3
jne 0x100a1079
mov ch, 0xb4
pop esp
cmp al, 0x39
std
pop ss
stc
pushfd
std
inc esp
ror dword [ebx - 0x4c], 0x59
pop ss
xchg ebx, eax
enter 0xfffffffffffff073, 0x61
and dh, byte [ecx + 0x4f]
adc byte [eax - 0x14b928bd], dl
aas
outsb dx, byte [esi]
sub bl, byte [esi]
dec eax
aad 0x77
xchg edx, eax
push esi
shl bl, cl
pop ss
dec ebx
loop 0x100a1060
lodsb al, byte [esi]
aam 0xcc
push es
std
pop esi
stosd dword es:[edi], eax
xor al, 0xce
mov ecx, 0x614b302d
xchg ebp, eax
mov ah, byte [edx + 0x3c]
popfd
push 1
lea ecx, [ebp - 0x2c]
call fcn.10002a9a
mov dword [esi + 0x380], 1
mov eax, esi
call fcn.1011e585
ret
Function at 0x100a283b
Capabilities:
Check http status code
Encode data using base64
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101428d0
pushfd
test byte [0x100a2901], 0xc8
jne 0x100a2902
mov esi, dword [ecx + 0x2d4bf26d]
scasb al, byte es:[edi]
xchg edx, eax
push ebp
clc
Function at 0x100ac8a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pushfd
test byte [0x100ac98c], 0xef
Function at 0x100adaf3
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ecx + 8]
push ebx
push esi
pushfd
test byte [0x100adb33], 0x89
jne 0x100adb34
dec ebp
pextrw esp, mm1, 0xba
dec edx
mov edi, 0xfa0a33ff
adc bh, bh
inc ecx
movsb byte es:[edi], byte [esi]
and byte [edi - 0x2f], dh
sbb dword [eax - 0x700d5324], edx
out 0xe0, al
outsb dx, byte [esi]
cli
cdq
sal ebx, cl
pop ecx
sbb edx, eax
loop fcn.100adaf3
aad 0x41
lds ecx, [ebp - 0x643716f4]
popfd
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push edi
pushfd
test byte [0x100adb81], 0xcc
jne 0x100adb82

Function at 0x100adb33
Capabilities:
Encode data using xor
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ecx + 8]
push ebx
push esi
pushfd
test byte [0x100adb33], 0x89
jne 0x100adb34
dec ebp
pextrw esp, mm1, 0xba
dec edx
mov edi, 0xfa0a33ff
adc bh, bh
inc ecx
movsb byte es:[edi], byte [esi]
and byte [edi - 0x2f], dh
sbb dword [eax - 0x700d5324], edx
out 0xe0, al
outsb dx, byte [esi]
cli
cdq
sal ebx, cl
pop ecx
sbb edx, eax
loop fcn.100adaf3
aad 0x41
lds ecx, [ebp - 0x643716f4]
popfd
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
push edi
pushfd
test byte [0x100adb81], 0xcc
jne 0x100adb82
Function at 0x100b979d
Capabilities:
Read file on windows
Read pipe

Disassembly:
sub esp, eax
fsub qword [edx]
enter 0x2829, 0x11
sahf
pushfd
test byte [0x100b97f2], 0x3c
jne 0x100b97f3
lodsd eax, dword [esi]
popfd
ror byte [ebx + 0x2ba7e06f], cl
mov cl, 0x45
out 0x11, al
mov byte [eax - 0x6f6bfa85], ch
jnp 0x100b978a
Function at 0x100ba342
Capabilities:
Check http status code
Create a process with modified i/o handles and window
Create pipe
Create two anonymous pipes
Encode data using base64
Query environment variable
Write and execute a file
Write file on windows
Write pipe

Disassembly:
push ebp
pushfd
test byte [0x100ba394], 0x81
jne 0x100ba395
mov ecx, 0x376211a7
Function at 0x100be27e
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x10172dcc]
push esi
test eax, eax
je 0x100be57e
pushfd
test byte [0x100be387], 0x36
jne 0x100be388
dec edi
adc byte [ebx - 0x52], 0x17
imul ecx, dword [eax + ebp*8 + 0x13df53ae], 0xb21ce566
Function at 0x100c44c4
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
xor edi, edi
push edi
push 0x80
push 4
Function at 0x100d4bd0
Capabilities:
Access the windows event log

Disassembly:
mov eax, pe_nt_image_headers32
call fcn.1011f220
mov eax, dword [0x10170c30]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x100d4c35
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x100d4c35
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.10122cc6
add eax, 0x40
push eax
call fcn.10122ca7
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1011e48a
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.101205f0
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x100d4cc4
call fcn.100d4a90
test eax, eax
jle 0x100d4cc4
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1011e48a
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1011e48a
add esp, 0x108
ret

Function at 0x100d4d20
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
je 0x100d4d42
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
dec edi
jne 0x100d4d36
pop esi
movzx eax, cl
pop edi
ret
Function at 0x100d9960
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 8
call fcn.1011f220
mov eax, dword [esp + 0xc]
movzx edx, byte [eax + 1]
movzx ecx, byte [eax]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 2]
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 3]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax + 4]
mov dword [esp], ecx
movzx ecx, byte [eax + 7]
push esi
movzx esi, byte [eax + 5]
movzx eax, byte [eax + 6]
shl ecx, 8
shl esi, 8
or ecx, eax
or edx, esi
shl ecx, 0x10
or ecx, edx
cmp dword [esp + 0x24], 0
mov dword [esp + 8], ecx
pop esi
je 0x100d99d6
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.10133a40
jmp 0x100d99ef
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.10133b70
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov byte [eax], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 2], dl
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, dword [esp + 0x14]
mov edx, ecx
shr edx, 8
mov byte [eax + 4], cl
mov byte [eax + 5], dl
mov edx, ecx
shr edx, 0x10
add esp, 0x10
shr ecx, 0x18
mov byte [eax + 6], dl
mov byte [eax + 7], cl
add esp, 8
ret
Function at 0x100e3fa0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x100e3fe4
mov al, byte [edx]
test al, al
je 0x100e3fe4
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
inc edx
xor esi, eax
mov al, byte [edx]
test al, al
jne 0x100e3fb7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x100e6760
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x130
call fcn.1011f220
mov eax, dword [0x10170c30]
xor eax, esp
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0x13c]
push ebx
mov ebx, dword [esp + 0x138]
push esi
mov esi, dword [esp + 0x158]
push edi
mov edi, dword [esp + 0x154]
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], 1
call fcn.100d9590
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
jns 0x100e67d2
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.1011e48a
add esp, 0x130
ret
lea ecx, [esp + 0x28]
push ebp
push ecx
call fcn.100f6b30
mov ebp, esi
mov esi, dword [esp + 0x160]
add esp, 4
mov eax, esi
mov dword [esp + 0x10], eax
test ebx, ebx
jne 0x100e67fc
mov dword [esp + 0x148], ebx
jmp 0x100e6822
cmp dword [esp + 0x148], 0xffffffff
jne 0x100e6822
mov eax, ebx
lea edx, [eax + 1]
jmp 0x100e6810
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100e6810
sub eax, edx
mov dword [esp + 0x148], eax
mov eax, esi
test esi, esi
jne 0x100e6855
lea ecx, [esp + 0x2c]
push ecx
call fcn.100f6bd0
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x13c]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1011e48a
add esp, 0x130
ret
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x20]
cmp eax, esi
jg 0x100e685f
mov esi, eax
mov eax, dword [esp + 0x18]
mov edx, eax
shr edx, 0x18
push 0
mov byte [esp + 0x18], dl
mov ecx, eax
mov edx, eax
mov byte [esp + 0x1b], al
mov eax, dword [esp + 0x14c]
push edi
shr ecx, 0x10
push eax
mov byte [esp + 0x21], cl
lea ecx, [esp + 0x38]
shr edx, 8
push ebx
push ecx
mov byte [esp + 0x2a], dl
call fcn.100f6870
add esp, 0x14
test eax, eax
je 0x100e6988
mov edx, dword [esp + 0x150]
mov eax, dword [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.100f6a70
add esp, 0xc
test eax, eax
je 0x100e6988
push 4
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x34]
push eax
call fcn.100f6a70
add esp, 0xc
test eax, eax
je 0x100e6988
push 0
lea ecx, [esp + 0x100]
push ecx
lea edx, [esp + 0x34]
push edx
call fcn.100f6a80
add esp, 0xc
test eax, eax
je 0x100e6988
push esi
lea eax, [esp + 0x100]
push eax
push ebp
call fcn.1011d7d0
mov eax, dword [esp + 0x160]
add esp, 0xc
cmp eax, 1
jle 0x100e696b
dec eax
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x100]
push ecx
push edx
mov eax, ecx
mov ecx, dword [esp + 0x154]
push eax
push ecx
push ebx
push edi
call fcn.100f6c40
add esp, 0x1c
test esi, esi
jle 0x100e6965
lea ecx, [esp + 0xfc]
mov eax, ebp
sub ecx, ebp
mov edi, esi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec edi
jne 0x100e6958
mov edi, dword [esp + 0x24]
dec dword [esp + 0x1c]
jne 0x100e6923
mov eax, dword [esp + 0x10]
inc dword [esp + 0x18]
sub eax, esi
add ebp, esi
mov dword [esp + 0x10], eax
test eax, eax
jne 0x100e6851
jmp 0x100e6826
lea eax, [esp + 0x2c]
push eax
call fcn.100f6bd0
add esp, 4
xor eax, eax
jmp 0x100e6838
Function at 0x100e7e10
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.1011f220
mov eax, dword [0x10170c30]
xor eax, esp
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x2c]
dec ebx
push edi
mov edi, dword [esp + 0x38]
mov dword [esp + 8], ecx
lea ecx, [ebx - 0x29]
mov dword [esp + 0xc], edx
cmp edi, ecx
jle 0x100e7e73
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.100d5c70
add esp, 0x14
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1011e48a
add esp, 0x20
ret
cmp ebx, 0x29
jge 0x100e7ea0
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.100d5c70
add esp, 0x14
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1011e48a
add esp, 0x20
ret
push ebp
push esi
push 0
mov byte [eax], 0
lea esi, [eax + 1]
lea ebp, [eax + 0x15]
call fcn.100f01d0
mov edx, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x1c]
push 0
push ebp
push edx
push eax
call fcn.100f5f00
add esp, 0x18
test eax, eax
je 0x100e7f39
mov ecx, ebx
sub ecx, edi
sub ecx, 0x29
push ecx
lea edx, [ebp + 0x14]
push 0
push edx
call fcn.1011df60
mov ecx, dword [esp + 0x1c]
mov eax, ebp
sub eax, edi
add eax, ebx
push edi
mov byte [eax - 0x15], 1
push ecx
add eax, 0xffffffec
push eax
call fcn.1011d7d0
push 0x14
push esi
call fcn.100d4ee0
add esp, 0x20
test eax, eax
jle 0x100e7f39
push 0x49
add ebx, 0xffffffec
push str..crypto_rsa_rsa_oaep.c
push ebx
call fcn.100d9340
mov edi, eax
add esp, 0xc
mov dword [esp + 0x14], edi
test edi, edi
jne 0x100e7f4e
push 0x4c
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.100d5c70
add esp, 0x14
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.1011e48a
add esp, 0x20
ret
push 0x14
push esi
push ebx
push edi
call fcn.100e7de0
add esp, 0x10
test eax, eax
js 0x100e7f39
test ebx, ebx
jle 0x100e7f79
mov eax, ebp
sub edi, ebp
mov ecx, ebx
lea esp, [esp]
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x100e7f70
call fcn.100f01d0
push eax
push ebx
push ebp
lea eax, [esp + 0x24]
push 0x14
push eax
call fcn.100e7c60
add esp, 0x14
test eax, eax
js 0x100e7f39
lea ecx, [esp + 0x18]
lea edi, [esp + 0x19]
lea ebp, [esp + 0x1a]
lea edx, [esp + 0x1b]
sub ecx, esi
sub edi, esi
sub ebp, esi
sub edx, esi
lea ebx, [esp + 0x1c]
sub ebx, esi
mov eax, esi
mov dword [esp + 0x10], ebx
mov esi, 4
lea ecx, [ecx]
movzx ebx, byte [ecx + eax]
xor byte [eax], bl
movzx ebx, byte [edi + eax]
xor byte [eax + 1], bl
movzx ebx, byte [eax + ebp]
xor byte [eax + 2], bl
movzx ebx, byte [edx + eax]
xor byte [eax + 3], bl
mov ebx, dword [esp + 0x10]
movzx ebx, byte [ebx + eax]
xor byte [eax + 4], bl
add eax, 5
dec esi
jne 0x100e7fc0
mov ecx, dword [esp + 0x14]
push ecx
call fcn.100d94e0
mov ecx, dword [esp + 0x30]
add esp, 4
lea eax, [esi + 1]
pop esi
pop ebp
pop edi
pop ebx
xor ecx, esp
call fcn.1011e48a
add esp, 0x20
ret
Function at 0x100e8600
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x100e86cc
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x100e8621
cmp al, 0x6b
jne 0x100e86cc
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x100e868d
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x100e8641
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x100e8641
cmp al, 0xbb
jne 0x100e866a
inc ecx
cmp ecx, esi
jl 0x100e8631
sub esi, ecx
test ecx, ecx
jne 0x100e8690
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.100d5c70
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.100d5c70
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x100e86b9
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.100d5c70
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.1011d7d0
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.100d5c70
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x100eddb0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x100ede93
push esi
mov esi, dword [esp + 0x14]
inc esi
lea ebx, [ebx]
movzx edx, byte [esi - 1]
cmp edi, 3
jl 0x100ede2d
movzx eax, byte [esi]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], al
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 3], dl
jmp 0x100ede7e
shl edx, 0x10
cmp edi, 2
jne 0x100ede3d
movzx eax, byte [esi]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
cmp edi, 1
jne 0x100ede6a
lea edx, [edi + 0x3c]
jmp 0x100ede77
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 2], dl
mov byte [ecx + 3], 0x3d
sub edi, 3
add ecx, 4
add ebp, 4
add esi, 3
test edi, edi
jg 0x100eddd0
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x100f6870
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.1011f220
mov eax, dword [0x10170c30]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebp, ebp
je 0x100f68bf
mov eax, 1
mov dword [esi], ebp
jmp 0x100f68c1
mov ebp, dword [esi]
test ecx, ecx
je 0x100f69a4
push ebp
call fcn.100f2690
mov ebx, eax
add esp, 4
cmp ebx, 0x80
jle 0x100f68f0
push str.j____int_sizeof_ctx__key_
push 0x68
push str..cryptohmachmac.c
call fcn.100d4cf0
add esp, 0xc
mov edi, dword [esp + 0xa8]
cmp ebx, edi
jge 0x100f6947
mov ecx, dword [esp + 0x10]
push ecx
lea ebx, [esi + 4]
push ebp
push ebx
call fcn.100f5ab0
add esp, 0xc
test eax, eax
je 0x100f6a46
mov edx, dword [esp + 0x14]
push edi
push edx
push ebx
call fcn.100f5c60
add esp, 0xc
test eax, eax
je 0x100f6a46
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.100f5c70
add esp, 0xc
test eax, eax
je 0x100f6a46
jmp 0x100f6981
cmp edi, 0x80
jbe 0x100f6963
push str.len_0__len__int_sizeof_ctx__key_
push 0x75
push str..cryptohmachmac.c
call fcn.100d4cf0
add esp, 0xc
mov ecx, dword [esp + 0x14]
push edi
push ecx
lea edx, [esi + 0x50]
push edx
call fcn.1011d7d0
mov eax, dword [esp + 0xb4]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], eax
mov edi, dword [edi]
cmp edi, 0x80
je 0x100f69ac
mov ecx, 0x80
sub ecx, edi
push ecx
lea edx, [edi + esi + 0x50]
push 0
push edx
call fcn.1011df60
add esp, 0xc
jmp 0x100f69ac
test eax, eax
je 0x100f6a32
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x50]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x100f69b0
mov edi, dword [esp + 0x10]
push edi
lea ebx, [esi + 0x1c]
push ebp
push ebx
call fcn.100f5ab0
add esp, 0xc
test eax, eax
je 0x100f6a46
push ebp
call fcn.100f2690
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.100f5c60
add esp, 0x10
test eax, eax
je 0x100f6a46
xor eax, eax
mov cl, byte [esi + eax + 0x50]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x100f69f4
push edi
lea ebx, [esi + 0x34]
push ebp
push ebx
call fcn.100f5ab0
add esp, 0xc
test eax, eax
je 0x100f6a46
push ebp
call fcn.100f2690
push eax
lea edx, [esp + 0x20]
push edx
push ebx
call fcn.100f5c60
add esp, 0x10
test eax, eax
je 0x100f6a46
lea eax, [esi + 0x1c]
push eax
add esi, 4
push esi
call fcn.100f5da0
add esp, 8
test eax, eax
jne 0x100f6a4a
xor eax, eax
jmp 0x100f6a4f
mov eax, 1
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1011e48a
add esp, 0x8c
ret