joyce8/EMBER2024-capa huggingface dataset:
Function at 0x728ce750
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0xc]
mov edx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
dec ecx
push edi
mov edi, dword [esi + 4]
shr ecx, 0x1f
xor edx, edi
dec ecx
and edx, ecx
xor edi, edx
mov dword [esi + 4], edi
xor dword [eax + 4], edx
lea edx, [ebx - 1]
cmp edx, 9
ja case.default.0x728ce782
jmp dword [edx*4 + 0x728ce8ac]
mov edi, 0xa
cmp ebx, edi
jle case.0x728ce782.10
push ebp
mov edx, dword [esi]
mov ebx, dword [edx + edi*4]
lea ebp, [edx + edi*4]
mov edx, dword [eax]
mov edx, dword [edx + edi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + edi*4], edx
lea ebx, [ebx + edi*4]
inc edi
cmp edi, dword [esp + 0x20]
jl 0x728ce793
pop ebp
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x24]
mov edx, dword [edx + 0x24]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x24], edi
mov edi, dword [eax]
xor dword [edi + 0x24], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x20]
mov edx, dword [edx + 0x20]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x20], edi
mov edi, dword [eax]
xor dword [edi + 0x20], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x1c]
mov edx, dword [edx + 0x1c]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x1c], edi
mov edi, dword [eax]
xor dword [edi + 0x1c], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x18]
mov edx, dword [edx + 0x18]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x18], edi
mov edi, dword [eax]
xor dword [edi + 0x18], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x14]
mov edx, dword [edx + 0x14]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x14], edi
mov edi, dword [eax]
xor dword [edi + 0x14], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0x10]
mov edx, dword [edx + 0x10]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0x10], edi
mov edi, dword [eax]
xor dword [edi + 0x10], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 0xc]
mov edx, dword [edx + 0xc]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 0xc], edi
mov edi, dword [eax]
xor dword [edi + 0xc], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 8]
mov edx, dword [edx + 8]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 8], edi
mov edi, dword [eax]
xor dword [edi + 8], edx
mov ebx, dword [esi]
mov edx, dword [eax]
mov edi, dword [ebx + 4]
mov edx, dword [edx + 4]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [ebx + 4], edi
mov edi, dword [eax]
xor dword [edi + 4], edx
mov esi, dword [esi]
mov edx, dword [eax]
mov edi, dword [esi]
mov edx, dword [edx]
xor edx, edi
and edx, ecx
xor edi, edx
mov dword [esi], edi
mov eax, dword [eax]
xor dword [eax], edx
pop edi
pop esi
pop ebx
ret
Function at 0x728cf970
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
lea eax, [ecx + 1]
ret
Function at 0x728d4f80
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x728d4fa4
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
sub esi, eax
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc eax
or cl, dl
sub edi, 1
jne 0x728d4f96
pop esi
movzx eax, cl
pop edi
ret

Function at 0x728dd320
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x728dd367
mov al, byte [edx]
test al, al
je 0x728dd367
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x728dd337
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x728fdb60
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x728fdc43
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
movzx edx, byte [esi]
jl 0x728fdbde
movzx eax, byte [esi + 1]
shl edx, 8
or edx, eax
movzx eax, byte [esi + 2]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x728fdc30
shl edx, 0x10
cmp edi, 2
jne 0x728fdbef
movzx eax, byte [esi + 1]
shl eax, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x728fdc1d
lea edx, [edi + 0x3c]
jmp 0x728fdc2a
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x728fdb80
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x72900db7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.728b3b80
mov eax, dword [0x7299f330]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x34]
push ebp
mov ebp, dword [esp + 0x30]
dec ebp
lea edx, [ebp - 0x29]
cmp ebx, edx
push edi
mov edi, dword [esp + 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ecx
jle 0x72900d65
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.728ca3c0
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.728ad351
add esp, 0x20
ret
cmp ebp, 0x29
jge 0x72900d93
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.728ca3c0
add esp, 0x14
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.728ad351
add esp, 0x20
ret
push esi
mov byte [edi], 0
lea esi, [edi + 1]
push 0
add edi, 0x15
call fcn.728dfdb0
mov ecx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x50]
push 0
push edi
push eax
push ecx
call fcn.728d53b0
mov edx, ebp
sub edx, ebx
sub edx, 0x29
push edx
lea eax, [edi + 0x14]
push 0
push eax
call fcn.728b08c0
mov edx, dword [esp + 0x34]
mov ecx, edi
sub ecx, ebx
lea eax, [ecx + ebp]
push ebx
mov byte [eax - 0x15], 1
push edx
add eax, 0xffffffec
push eax
call fcn.728b12c0
push 0x14
push esi
call fcn.728c4e70
add esp, 0x38
test eax, eax
jle 0x72900e25
push 0x48
add ebp, 0xffffffec
push str..crypto_rsa_rsa_oaep.c
push ebp
call fcn.728ca9f0
mov ebx, eax
add esp, 0xc
mov dword [esp + 0x14], ebx
test ebx, ebx
jne 0x72900e3a
push 0x4b
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.728ca3c0
add esp, 0x14
pop esi
pop edi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.728ad351
add esp, 0x20
ret
call fcn.728dfdb0
push eax
push 0x14
push esi
push ebp
push ebx
call fcn.72900bc0
add esp, 0x14
test ebp, ebp
jle 0x72900e62
mov eax, edi
sub ebx, edi
mov ecx, ebp
mov dl, byte [ebx + eax]
xor byte [eax], dl
inc eax
sub ecx, 1
jne 0x72900e57
call fcn.728dfdb0
push eax
push ebp
push edi
lea eax, [esp + 0x24]
push 0x14
push eax
call fcn.72900bc0
lea ecx, [esp + 0x2c]
lea edi, [esp + 0x2d]
lea ebp, [esp + 0x2e]
lea edx, [esp + 0x2f]
sub ecx, esi
sub edi, esi
sub ebp, esi
sub edx, esi
lea ebx, [esp + 0x30]
add esp, 0x14
sub ebx, esi
mov eax, esi
mov dword [esp + 0x10], ebx
mov esi, 4
movzx ebx, byte [ecx + eax]
xor byte [eax], bl
movzx ebx, byte [edi + eax]
xor byte [eax + 1], bl
movzx ebx, byte [eax + ebp]
xor byte [eax + 2], bl
movzx ebx, byte [edx + eax]
xor byte [eax + 3], bl
mov ebx, dword [esp + 0x10]
movzx ebx, byte [ebx + eax]
xor byte [eax + 4], bl
add eax, 5
sub esi, 1
jne 0x72900ea2
mov ecx, dword [esp + 0x14]
push ecx
call fcn.728caba0
mov ecx, dword [esp + 0x30]
add esp, 4
lea eax, [esi + 1]
pop esi
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.728ad351
add esp, 0x20
ret
Function at 0x72906ce0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xe4
call fcn.728b3b80
mov eax, dword [0x7299f330]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xf0]
push ebx
push ebp
mov ebp, dword [esp + 0x108]
push esi
push edi
mov edi, dword [esp + 0xf8]
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], eax
mov ebx, 1
call fcn.72915200
mov esi, dword [esp + 0x110]
add esp, 4
mov dword [esp + 0x18], esi
test edi, edi
jne 0x72906d43
mov dword [esp + 0xfc], edi
jmp 0x72906d62
cmp dword [esp + 0xfc], 0xffffffff
jne 0x72906d62
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x72906d52
sub eax, edx
mov dword [esp + 0xfc], eax
test esi, esi
je 0x72906e82
jmp 0x72906d74
mov esi, dword [esp + 0x18]
cmp esi, 0x14
jle 0x72906d7e
mov esi, 0x14
mov eax, ebx
mov ecx, ebx
mov edx, ebx
shr eax, 0x18
shr ecx, 0x10
shr edx, 8
push 0
mov byte [esp + 0x18], al
mov byte [esp + 0x19], cl
mov byte [esp + 0x1a], dl
mov byte [esp + 0x1b], bl
call fcn.728dfdb0
push eax
mov eax, dword [esp + 0x104]
push eax
lea ecx, [esp + 0x30]
push edi
push ecx
call fcn.72914fb0
mov edx, dword [esp + 0x118]
mov eax, dword [esp + 0x30]
push edx
push eax
lea ecx, [esp + 0x40]
push ecx
call fcn.72915170
push 4
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x4c]
push eax
call fcn.72915170
push 0
lea ecx, [esp + 0x10c]
push ecx
lea edx, [esp + 0x58]
push edx
call fcn.72915180
push esi
lea eax, [esp + 0x118]
push eax
push ebp
call fcn.728b12c0
mov eax, dword [esp + 0x14c]
add esp, 0x44
cmp eax, 1
jle 0x72906e6d
dec eax
mov dword [esp + 0x10], eax
jmp 0x72906e20
mov eax, dword [esp + 0xfc]
push 0
lea ecx, [esp + 0xe0]
push ecx
push 0x14
mov edx, ecx
push edx
push eax
push edi
call fcn.728dfdb0
push eax
call fcn.729152a0
add esp, 0x1c
test esi, esi
jle 0x72906e66
lea ecx, [esp + 0xdc]
mov eax, ebp
sub ecx, ebp
mov edi, esi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x72906e57
mov edi, dword [esp + 0x20]
sub dword [esp + 0x10], 1
jne 0x72906e20
mov eax, dword [esp + 0x18]
sub eax, esi
inc ebx
add ebp, esi
mov dword [esp + 0x18], eax
test eax, eax
jne 0x72906d70
lea eax, [esp + 0x24]
push eax
call fcn.72915230
mov ecx, dword [esp + 0xf4]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.728ad351
add esp, 0xe4
ret
Function at 0x7290837b
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push ebx
push eax
push ecx
call fcn.72907e00
add esp, 0xc
test eax, eax
jl 0x72908578
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x729083ad
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea ebx, [ebx]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x72908370
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x72908574
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x7297bcb0]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x7297bcb0]
and esi, 0xff
mov esi, dword [esi*4 + 0x7297c8b0]
and edi, 0xff
xor esi, dword [edi*4 + 0x7297d0b0]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x7297bcb0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x7297d4b0]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x7297bcb0]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x7297ccb0]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x7297bcb0]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x7297bcb0]
and esi, 0xff
mov esi, dword [esi*4 + 0x7297c8b0]
and edi, 0xff
xor esi, dword [edi*4 + 0x7297d0b0]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x7297bcb0]
and edi, 0xff
xor esi, dword [edi*4 + 0x7297ccb0]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x7297bcb0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x7297d4b0]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x7297bcb0]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x7297bcb0]
and esi, 0xff
mov esi, dword [esi*4 + 0x7297c8b0]
and edi, 0xff
xor esi, dword [edi*4 + 0x7297d0b0]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x7297bcb0]
and edi, 0xff
xor esi, dword [edi*4 + 0x7297ccb0]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x7297bcb0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x7297d4b0]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x7297bcb0]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x7297bcb0]
and esi, 0xff
mov esi, dword [esi*4 + 0x7297c8b0]
and edi, 0xff
xor esi, dword [edi*4 + 0x7297d0b0]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x7297bcb0]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x7297bcb0]
and edi, 0xff
xor esi, dword [edi*4 + 0x7297ccb0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x7297d4b0]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x729083c1
pop edi
xor eax, eax
pop esi
pop ebx
ret
Function at 0x7290c67d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 8
call fcn.728b3b80
cmp dword [esp + 0x24], 0
mov eax, dword [esp + 0x20]
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [eax]
push edi
je 0x7290c64d
test ebp, ebp
je 0x7290c735
mov edi, dword [esp + 0x2c]
nop
dec ebp
test esi, esi
jne 0x7290c617
movzx ecx, byte [edi]
lea ebx, [edi + 1]
shl ecx, 0x18
mov eax, ebx
movzx edx, byte [eax]
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 1]
inc eax
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 1]
or ecx, edx
inc eax
inc eax
movzx edx, byte [eax + 1]
mov dword [esp + 0x10], ecx
movzx ecx, byte [eax]
inc eax
shl edx, 0x10
shl ecx, 0x18
or ecx, edx
movzx edx, byte [eax + 1]
inc eax
movzx eax, byte [eax + 1]
shl edx, 8
or edx, eax
or edx, ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], edx
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.7290b7f0
mov ecx, dword [esp + 0x18]
mov eax, ecx
shr eax, 0x18
mov byte [edi], al
mov edx, ecx
shr edx, 0x10
mov eax, ebx
mov byte [eax], dl
inc eax
mov edx, ecx
shr edx, 8
mov byte [eax], dl
mov byte [eax + 1], cl
mov ecx, dword [esp + 0x1c]
inc eax
inc eax
mov edx, ecx
shr edx, 0x18
mov byte [eax], dl
inc eax
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
inc eax
mov edx, ecx
add esp, 8
shr edx, 8
mov byte [eax], dl
mov byte [eax + 1], cl
mov ecx, dword [esp + 0x1c]
mov al, byte [ecx]
xor al, byte [esi + edi]
inc ecx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x20]
mov byte [ecx], al
mov byte [esi + edi], al
inc esi
inc ecx
and esi, 7
mov dword [esp + 0x20], ecx
test ebp, ebp
jne 0x7290c570
mov eax, dword [esp + 0x30]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
test ebp, ebp
je 0x7290c735
mov edi, dword [esp + 0x2c]
lea esp, [esp]
dec ebp
test esi, esi
jne 0x7290c707
movzx ecx, byte [edi]
lea ebx, [edi + 1]
shl ecx, 0x18
mov eax, ebx
movzx edx, byte [eax]
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 1]
inc eax
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 1]
or ecx, edx
inc eax
inc eax
movzx edx, byte [eax + 1]
mov dword [esp + 0x10], ecx
movzx ecx, byte [eax]
inc eax
shl edx, 0x10
shl ecx, 0x18
or ecx, edx
movzx edx, byte [eax + 1]
inc eax
movzx eax, byte [eax + 1]
shl edx, 8
or edx, eax
or edx, ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], edx
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.7290b7f0
mov ecx, dword [esp + 0x18]
mov eax, ecx
shr eax, 0x18
mov byte [edi], al
mov edx, ecx
shr edx, 0x10
mov eax, ebx
mov byte [eax], dl
inc eax
mov edx, ecx
shr edx, 8
mov byte [eax], dl
mov byte [eax + 1], cl
mov ecx, dword [esp + 0x1c]
inc eax
inc eax
mov edx, ecx
shr edx, 0x18
mov byte [eax], dl
inc eax
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
inc eax
mov edx, ecx
add esp, 8
shr edx, 8
mov byte [eax], dl
mov byte [eax + 1], cl
mov ecx, dword [esp + 0x1c]
mov al, byte [ecx]
inc ecx
mov dword [esp + 0x1c], ecx
mov cl, byte [esi + edi]
mov byte [esi + edi], al
xor al, cl
mov ecx, dword [esp + 0x20]
inc esi
mov byte [ecx], al
inc ecx
and esi, 7
mov dword [esp + 0x20], ecx
test ebp, ebp
jne 0x7290c660
mov eax, dword [esp + 0x30]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x729144c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x729144d9
mov edi, ebx
mov ebx, eax
jmp 0x729144db
mov edi, eax
mov eax, dword [edi + 4]
mov esi, dword [esp + 0x10]
cmp eax, dword [esi + 8]
jg 0x729144eb
mov eax, esi
jmp 0x729144f5
push eax
push esi
call fcn.728ce180
add esp, 8
test eax, eax
jne 0x729144fd
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x72914519
mov edx, dword [edi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 4]
jl 0x72914504
cmp eax, dword [edi + 4]
jge 0x72914530
mov edi, edi
mov edx, dword [edi]
mov edx, dword [edx + eax*4]
mov ecx, dword [esi]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x72914520
mov edi, dword [edi + 4]
mov dword [esi + 4], edi
test edi, edi
jle 0x72914554
mov eax, dword [esi]
lea eax, [eax + edi*4 - 4]
or ecx, 0xffffffff
mov edx, dword [eax]
sub eax, 4
test edx, edx
jne 0x72914554
add dword [esi + 4], ecx
cmp dword [esi + 4], edx
jg 0x72914543
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x72914fb0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.728b3b80
mov eax, dword [0x7299f330]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
mov ebx, dword [esp + 0xa0]
push ebp
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
push edi
mov dword [esp + 0x14], ecx
test ebx, ebx
je 0x72914fff
mov eax, 1
mov dword [esi], ebx
jmp 0x72915001
mov ebx, dword [esi]
test ecx, ecx
je 0x729150c8
push ebx
call fcn.728d7c10
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x72915030
push str.j____int_sizeof_ctx__key_
push 0x54
push str..cryptohmachmac.c
call fcn.728d4f50
add esp, 0xc
mov ebp, dword [esp + 0xa8]
cmp edi, ebp
jge 0x72915069
mov ecx, dword [esp + 0x10]
push ecx
lea edi, [esi + 4]
push ebx
push edi
call fcn.728d50b0
mov edx, dword [esp + 0x20]
push ebp
push edx
push edi
call fcn.728d5160
lea ebp, [esi + 0x34]
push ebp
lea eax, [esi + 0x38]
push eax
push edi
call fcn.728d5170
add esp, 0x24
jmp 0x729150a4
cmp ebp, 0x80
jbe 0x72915085
push str.len_0__len__int_sizeof_ctx__key_
push 0x5e
push str..cryptohmachmac.c
call fcn.728d4f50
add esp, 0xc
mov ecx, dword [esp + 0x14]
push ebp
push ecx
lea edx, [esi + 0x38]
push edx
call fcn.728b12c0
mov eax, dword [esp + 0xb4]
lea ebp, [esi + 0x34]
add esp, 0xc
mov dword [ebp], eax
mov ebp, dword [ebp]
cmp ebp, 0x80
je 0x729150cc
mov ecx, 0x80
sub ecx, ebp
push ecx
lea edx, [esi + ebp + 0x38]
push 0
push edx
call fcn.728b08c0
add esp, 0xc
jmp 0x729150cc
test eax, eax
je 0x72915143
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x729150d0
mov ebp, dword [esp + 0x10]
push ebp
lea edi, [esi + 0x14]
push ebx
push edi
call fcn.728d50b0
push ebx
call fcn.728d7c10
push eax
lea edx, [esp + 0x2c]
push edx
push edi
call fcn.728d5160
add esp, 0x1c
xor eax, eax
lea esp, [esp]
mov cl, byte [esi + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
inc eax
cmp eax, 0x80
jl 0x72915110
push ebp
lea edi, [esi + 0x24]
push ebx
push edi
call fcn.728d50b0
push ebx
call fcn.728d7c10
push eax
lea edx, [esp + 0x2c]
push edx
push edi
call fcn.728d5160
add esp, 0x1c
lea eax, [esi + 0x14]
push eax
add esi, 4
push esi
call fcn.728d5290
mov ecx, dword [esp + 0xa0]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.728ad351
add esp, 0x8c
ret
Function at 0x7292c920
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x98
call fcn.728b3b80
mov eax, dword [0x7299f330]
xor eax, esp
mov dword [esp + 0x94], eax
mov ecx, dword [esp + 0xa0]
mov eax, dword [esp + 0x9c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0xb0]
push edi
mov edi, dword [ecx + 4]
mov dword [esp + 0x10], edi
sub edi, esi
xor ebx, ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], edi
cmp dword [esp + 0xb8], esi
jae 0x7292c984
push str.orig_len___md_size
push 0x10c
push str.._ssl_s3_cbc.c
call fcn.728d4f50
add esp, 0xc
cmp esi, 0x40
jbe 0x7292c9a0
push str.md_size___EVP_MAX_MD_SIZE
push 0x10d
push str.._ssl_s3_cbc.c
call fcn.728d4f50
add esp, 0xc
mov eax, dword [esp + 0xb8]
lea ebp, [esp + 0x24]
neg ebp
and ebp, 0x3f
lea edx, [esi + 0x100]
lea ebp, [esp + ebp + 0x24]
cmp eax, edx
jbe 0x7292c9c8
mov ebx, eax
sub ebx, esi
sub ebx, 0x100
mov eax, esi
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebx
add eax, edi
xor edx, edx
div esi
push esi
push 0
push ebp
mov edi, edx
mov dword [esp + 0x28], edi
call fcn.728b08c0
add esp, 0xc
xor ecx, ecx
cmp ebx, dword [esp + 0xb8]
jae 0x7292ca65
mov eax, dword [esp + 0xb0]
mov eax, dword [eax + 0xc]
mov edx, dword [esp + 0x10]
add eax, ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xb8]
mov edi, ebx
sub edi, edx
sub edx, dword [esp + 0x14]
sub eax, ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
jmp 0x7292ca28
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov bl, byte [ebx]
mov eax, edi
not eax
sar eax, 0x1f
add edx, edi
not al
and al, bl
not edx
sar edx, 0x1f
and al, dl
or byte [ecx + ebp], al
mov edx, 1
add dword [esp + 0x18], edx
add ecx, edx
mov eax, ecx
sub eax, esi
sar eax, 0x1f
and ecx, eax
add edi, edx
sub dword [esp + 0x10], edx
jne 0x7292ca24
mov edi, dword [esp + 0x1c]
xor eax, eax
test esi, esi
jbe 0x7292ca91
jmp 0x7292ca70
mov ecx, edi
xor ecx, 0x20
mov dl, byte [ecx + ebp]
mov cl, byte [edi + ebp]
mov edx, dword [esp + 0x20]
mov byte [edx + eax], cl
inc edi
mov ecx, edi
sub ecx, esi
sar ecx, 0x1f
inc eax
and edi, ecx
cmp eax, esi
jb 0x7292ca70
mov ecx, dword [esp + 0xa4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.728ad351
add esp, 0x98
ret