joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b47bdb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x3c], edi
xor edi, edi
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
mov ebx, dword [esp + 0x60]
mov esi, dword [esp + 0x64]
mov ebp, dword [ecx + 4]
mov edx, dword [ecx]
mov dword [esp + 0x14], eax
mov edi, dword [ecx]
mov eax, dword [esp + 0x74]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x68]
mov dword [esp + 0x30], ebp
mov ebp, dword [ecx + 4]
mov dword [esp + 0x18], eax
mov eax, dword [eax]
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], ebp
test edx, edx
je 0x6b47be9d
mov edi, dword [esp + 0x68]
xor ebp, ebp
mov dword [esp + 0x1c], ecx
mov edx, ebp
add edi, ebx
mov ebp, edi
mov edi, edx
lea esi, [esi]
test eax, eax
jne 0x6b47be6c
mov eax, dword [esp + 0x14]
add ebx, 1
add edi, 1
add esi, 1
mov dword [esp + 8], 1
mov dword [esp + 4], eax
lea eax, [esp + 0x2c]
mov dword [esp], eax
call sym.libcrypto_1_1.dll_DES_encrypt1
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x2c]
xor al, byte [ebx - 1]
mov dword [esp + 0x38], edx
mov byte [esi - 1], al
cmp ebx, ebp
je 0x6b47bec0
mov eax, 1
movzx edx, byte [ebx]
add ebx, 1
xor dl, byte [esp + eax + 0x34]
add eax, 1
add esi, 1
and eax, 7
mov byte [esi - 1], dl
cmp ebp, ebx
jne 0x6b47be20
mov ecx, dword [esp + 0x1c]
mov ebp, edi
test ebp, ebp
je 0x6b47be9d
mov esi, dword [esp + 0x2c]
mov edi, dword [esp + 0x30]
mov dword [ecx], esi
mov dword [ecx + 4], edi
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, dword [esp + 0x3c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b47becd
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [esp + 0x1c]
mov ebp, edi
mov eax, 1
jmp 0x6b47be8c
call sym.___stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x6b4ef5e0
Capabilities:
Hash data using sha1

Disassembly:
sub esp, 0x1c
mov eax, dword [esp + 0x20]
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_MD_CTX_md_data
mov dword [esp + 0x20], eax
add esp, 0x1c
jmp sym.libcrypto_1_1.dll_SHA1_Init

Function at 0x6b4ef770
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov ebx, dword [esp + 0x20]
mov dword [esp], 2
call dword [0x6b5c4f3c]
mov dword [esp + 8], 0x2e
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str._TEST_ENG_OPENSSL_RC4__test_init_key___called_n
call sym._fwrite
mov dword [esp], ebx
call sym.libcrypto_1_1.dll_EVP_CIPHER_CTX_key_length
mov dword [esp], ebx
mov esi, eax
call sym.libcrypto_1_1.dll_EVP_CIPHER_CTX_get_cipher_data
mov edx, dword [esp + 0x24]
mov dword [esp + 8], esi
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._memcpy
mov dword [esp], ebx
call sym.libcrypto_1_1.dll_EVP_CIPHER_CTX_get_cipher_data
mov dword [esp], ebx
mov edi, eax
call sym.libcrypto_1_1.dll_EVP_CIPHER_CTX_key_length
mov dword [esp], ebx
mov esi, eax
call sym.libcrypto_1_1.dll_EVP_CIPHER_CTX_get_cipher_data
mov dword [esp + 8], edi
add eax, 0x10
mov dword [esp + 4], esi
mov dword [esp], eax
call sym.libcrypto_1_1.dll_RC4_set_key
add esp, 0x10
mov eax, 1
pop ebx
pop esi
pop edi
ret
Function at 0x6b4f9c90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
call sym.libcrypto_1_1.dll_EVP_md4
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
call sym.libcrypto_1_1.dll_EVP_md5
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
mov dword [esp + 8], 0x6b5f5700
mov dword [esp + 4], 0x8001
mov dword [esp], str.ssl3_md5
call sym.libcrypto_1_1.dll_OBJ_NAME_add
call sym.libcrypto_1_1.dll_EVP_md5_sha1
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
call sym.libcrypto_1_1.dll_EVP_sha1
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
mov dword [esp + 8], 0x6b5f570d
mov dword [esp + 4], 0x8001
mov dword [esp], str.ssl3_sha1
call sym.libcrypto_1_1.dll_OBJ_NAME_add
mov dword [esp + 8], 0x6b5f571c
mov dword [esp + 4], 0x8001
mov dword [esp], 0x6b5f5725
call sym.libcrypto_1_1.dll_OBJ_NAME_add
call sym.libcrypto_1_1.dll_EVP_mdc2
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
call sym.libcrypto_1_1.dll_EVP_ripemd160
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
mov dword [esp + 8], 0x6b5f5730
mov dword [esp + 4], 0x8001
mov dword [esp], str.ripemd
call sym.libcrypto_1_1.dll_OBJ_NAME_add
mov dword [esp + 8], 0x6b5f5730
mov dword [esp + 4], 0x8001
mov dword [esp], str.rmd160
call sym.libcrypto_1_1.dll_OBJ_NAME_add
call sym.libcrypto_1_1.dll_EVP_sha224
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
call sym.libcrypto_1_1.dll_EVP_sha256
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
call sym.libcrypto_1_1.dll_EVP_sha384
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
call sym.libcrypto_1_1.dll_EVP_sha512
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
call sym.libcrypto_1_1.dll_EVP_sha512_224
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
call sym.libcrypto_1_1.dll_EVP_sha512_256
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
call sym.libcrypto_1_1.dll_EVP_whirlpool
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
call sym.libcrypto_1_1.dll_EVP_sm3
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
call sym.libcrypto_1_1.dll_EVP_blake2b512
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
call sym.libcrypto_1_1.dll_EVP_blake2s256
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
call sym.libcrypto_1_1.dll_EVP_sha3_224
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
call sym.libcrypto_1_1.dll_EVP_sha3_256
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
call sym.libcrypto_1_1.dll_EVP_sha3_384
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
call sym.libcrypto_1_1.dll_EVP_sha3_512
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
call sym.libcrypto_1_1.dll_EVP_shake128
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
call sym.libcrypto_1_1.dll_EVP_shake256
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_add_digest
add esp, 0x1c
ret
Function at 0x6b506d20
Capabilities:
Encode data using base64

Disassembly:
push ebp
push edi
push esi
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
push ebx
sub esp, 4
mov edi, dword [esp + 0x18]
test eax, eax
je 0x6b506d40
test byte [eax + 0x5c], 2
mov eax, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
cmovne esi, eax
xor ebp, ebp
test edi, edi
jg 0x6b506da6
jmp 0x6b506de8
movzx ebx, byte [ecx + 1]
sub edi, 3
add ebp, 4
add ecx, 3
shl ebx, 8
or eax, ebx
movzx ebx, byte [ecx - 1]
or ebx, eax
mov dword [esp], ebx
mov ebx, eax
shr eax, 0xc
shr ebx, 0x12
and eax, 0x3f
movzx ebx, byte [esi + ebx]
mov byte [edx - 4], bl
mov ebx, dword [esp]
movzx eax, byte [esi + eax]
mov byte [edx - 3], al
mov eax, ebx
shr eax, 6
and eax, 0x3f
movzx eax, byte [esi + eax]
mov byte [edx - 2], al
mov eax, ebx
and eax, 0x3f
movzx eax, byte [esi + eax]
mov byte [edx - 1], al
test edi, edi
jle 0x6b506de8
movzx eax, byte [ecx]
add edx, 4
shl eax, 0x10
cmp edi, 2
jg 0x6b506d50
je 0x6b506df8
mov ebx, eax
shr eax, 0xc
shr ebx, 0x12
and eax, 0x3f
movzx ebx, byte [esi + ebx]
mov byte [edx - 4], bl
movzx eax, byte [esi + eax]
mov byte [edx - 3], al
mov eax, 0x3d
sub edi, 3
mov byte [edx - 2], al
add ebp, 4
add ecx, 3
mov byte [edx - 1], 0x3d
test edi, edi
jg 0x6b506da6
mov byte [edx], 0
add esp, 4
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
movzx ebx, byte [ecx + 1]
shl ebx, 8
or ebx, eax
shr eax, 0x12
movzx eax, byte [esi + eax]
mov byte [edx - 4], al
mov eax, ebx
shr ebx, 6
shr eax, 0xc
and ebx, 0x3f
and eax, 0x3f
movzx eax, byte [esi + eax]
mov byte [edx - 3], al
movzx eax, byte [esi + ebx]
jmp 0x6b506dd4

Function at 0x6b507320
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [esp + 4], eax
xor eax, eax
jmp sym._evp_encodeblock_int
Function at 0x6b5126a0
Capabilities:
Encrypt data using chaskey
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8c
mov eax, dword [esp + 0xa4]
mov ebx, dword [esp + 0xa0]
mov dword [esp + 0x34], 0
mov edi, dword [esp + 0xa8]
mov esi, dword [esp + 0xac]
mov dword [esp + 0x24], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x7c], eax
xor eax, eax
mov dword [edi], 0
mov dword [esp + 4], 0x200
mov dword [esp], ebx
call sym.libcrypto_1_1.dll_EVP_MD_CTX_test_flags
test eax, eax
je 0x6b5127f0
lea eax, [esp + 0x34]
mov dword [esp], ebx
mov dword [esp + 8], eax
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
mov dword [esp + 0x28], eax
call sym.libcrypto_1_1.dll_EVP_DigestFinal_ex
test eax, eax
je 0x6b5127c0
mov dword [esp], esi
call sym.libcrypto_1_1.dll_EVP_PKEY_size
mov dword [esp], esi
mov dword [esp + 4], 0
mov dword [esp + 0x38], eax
call sym.libcrypto_1_1.dll_EVP_PKEY_CTX_new
mov esi, eax
test eax, eax
je 0x6b5127c0
mov dword [esp], eax
xor ebp, ebp
call sym.libcrypto_1_1.dll_EVP_PKEY_sign_init
test eax, eax
jle 0x6b5127c4
mov dword [esp], ebx
call sym.libcrypto_1_1.dll_EVP_MD_CTX_md
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0xf8
mov dword [esp + 4], 0xffffffff
mov dword [esp], esi
call sym.libcrypto_1_1.dll_EVP_PKEY_CTX_ctrl
test eax, eax
jle 0x6b5127c4
mov eax, dword [esp + 0x34]
mov dword [esp], esi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x38]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 4], eax
call sym.libcrypto_1_1.dll_EVP_PKEY_sign
test eax, eax
jle 0x6b5127c4
mov eax, dword [esp + 0x38]
mov ebp, 1
mov dword [edi], eax
jmp 0x6b5127c4
xor esi, esi
xor ebp, ebp
mov dword [esp], esi
call sym.libcrypto_1_1.dll_EVP_PKEY_CTX_free
mov eax, dword [esp + 0x7c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b512891
add esp, 0x8c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, eax
call sym.libcrypto_1_1.dll_EVP_MD_CTX_new
test eax, eax
je 0x6b512860
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 0x28], eax
call sym.libcrypto_1_1.dll_EVP_MD_CTX_copy_ex
mov ecx, dword [esp + 0x28]
test eax, eax
mov ebp, eax
jne 0x6b512820
mov dword [esp], ecx
call sym.libcrypto_1_1.dll_EVP_MD_CTX_free
jmp 0x6b5127cc
lea eax, [esp + 0x34]
mov dword [esp], ecx
mov dword [esp + 8], eax
lea eax, [esp + 0x3c]
mov dword [esp + 4], eax
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], eax
call sym.libcrypto_1_1.dll_EVP_DigestFinal_ex
mov ecx, dword [esp + 0x2c]
mov ebp, eax
mov dword [esp], ecx
call sym.libcrypto_1_1.dll_EVP_MD_CTX_free
test ebp, ebp
jne 0x6b51271f
jmp 0x6b5127cc
mov dword [esp + 0x10], 0x22
mov dword [esp + 0xc], str.crypto_evp_p_sign.c
mov dword [esp + 8], 0x41
mov dword [esp + 4], 0x6b
mov dword [esp], 6
call sym.libcrypto_1_1.dll_ERR_put_error
jmp 0x6b5127cc
call sym.___stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x6b5128a0
Capabilities:
Encrypt data using chaskey
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8c
mov ebx, dword [esp + 0xa0]
mov eax, dword [esp + 0xa4]
mov dword [esp + 4], 0x200
mov dword [esp + 0x38], 0
mov dword [esp], ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xac]
mov dword [esp + 0x24], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x7c], eax
xor eax, eax
call sym.libcrypto_1_1.dll_EVP_MD_CTX_test_flags
test eax, eax
je 0x6b5129d0
lea eax, [esp + 0x38]
lea esi, [esp + 0x3c]
mov dword [esp], ebx
xor edi, edi
mov dword [esp + 8], eax
mov dword [esp + 4], esi
call sym.libcrypto_1_1.dll_EVP_DigestFinal_ex
mov ebp, eax
test eax, eax
je 0x6b5129a8
mov eax, dword [esp + 0x24]
mov dword [esp + 4], 0
mov ebp, 0xffffffff
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_PKEY_CTX_new
mov edi, eax
test eax, eax
je 0x6b5129a8
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_PKEY_verify_init
test eax, eax
jle 0x6b5129a8
mov dword [esp], ebx
call sym.libcrypto_1_1.dll_EVP_MD_CTX_md
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0xf8
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call sym.libcrypto_1_1.dll_EVP_PKEY_CTX_ctrl
test eax, eax
jle 0x6b5129a8
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], esi
mov dword [esp], edi
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 4], eax
call sym.libcrypto_1_1.dll_EVP_PKEY_verify
mov ebp, eax
lea esi, [esi]
mov dword [esp], edi
call sym.libcrypto_1_1.dll_EVP_PKEY_CTX_free
mov eax, dword [esp + 0x7c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b512a61
add esp, 0x8c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebp, eax
call sym.libcrypto_1_1.dll_EVP_MD_CTX_new
test eax, eax
je 0x6b512a30
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 0x2c], eax
call sym.libcrypto_1_1.dll_EVP_MD_CTX_copy_ex
mov ecx, dword [esp + 0x2c]
test eax, eax
mov ebp, eax
jne 0x6b512a00
mov dword [esp], ecx
call sym.libcrypto_1_1.dll_EVP_MD_CTX_free
jmp 0x6b5129b0
lea eax, [esp + 0x38]
lea esi, [esp + 0x3c]
mov dword [esp], ecx
mov dword [esp + 8], eax
mov dword [esp + 4], esi
call sym.libcrypto_1_1.dll_EVP_DigestFinal_ex
mov ecx, dword [esp + 0x2c]
mov ebp, eax
mov dword [esp], ecx
call sym.libcrypto_1_1.dll_EVP_MD_CTX_free
test ebp, ebp
jne 0x6b512916
jmp 0x6b5129b0
mov dword [esp + 0x10], 0x20
mov dword [esp + 0xc], str.crypto_evp_p_verify.c
mov dword [esp + 8], 0x41
mov dword [esp + 4], 0x6c
mov dword [esp], 6
call sym.libcrypto_1_1.dll_ERR_put_error
jmp 0x6b5129b0
call sym.___stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x6b5174e0
Capabilities:
Query environment variable

Disassembly:
push ebx
sub esp, 8
mov ebx, dword [esp + 0x10]
call sym.libcrypto_1_1.dll_OPENSSL_issetugid
test eax, eax
jne 0x6b517500
mov dword [esp + 0x10], ebx
add esp, 8
pop ebx
jmp sym._getenv
add esp, 8
xor eax, eax
pop ebx
ret
Function at 0x6b519730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x28
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x1c], eax
xor eax, eax
mov edx, dword [esp + 0x30]
mov ebx, dword [esp + 0x34]
mov eax, dword [edx]
bswap eax
mov dword [esp + 0x14], eax
mov eax, dword [edx + 4]
bswap eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
lea eax, [esp + 0x14]
mov dword [esp], eax
call sym.libcrypto_1_1.dll_IDEA_encrypt
mov eax, dword [esp + 0x14]
bswap eax
mov dword [ebx], eax
mov eax, dword [esp + 0x18]
bswap eax
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x1c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b51978e
add esp, 0x28
pop ebx
ret
call sym.___stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x6b5197a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x3c], edi
xor edi, edi
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
mov ebp, dword [esp + 0x68]
mov ebx, dword [esp + 0x60]
mov edi, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x74]
mov esi, dword [esp + 0x64]
bswap edi
bswap edx
mov dword [esp + 0x2c], edi
bswap edi
mov dword [esp + 0x18], eax
mov eax, dword [eax]
mov dword [esp + 0x30], edx
bswap edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edx
test ebp, ebp
je 0x6b519889
lea edi, [ebx + ebp]
mov dword [esp + 0x1c], ecx
xor ebp, ebp
mov edx, ebp
mov ebp, edi
mov edi, edx
lea esi, [esi]
test eax, eax
jne 0x6b519854
mov eax, dword [esp + 0x14]
add ebx, 1
add edi, 1
add esi, 1
mov dword [esp + 4], eax
lea eax, [esp + 0x2c]
mov dword [esp], eax
call sym.libcrypto_1_1.dll_IDEA_encrypt
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
bswap eax
mov dword [esp + 0x34], eax
xor al, byte [ebx - 1]
bswap edx
mov byte [esi - 1], al
mov dword [esp + 0x38], edx
cmp ebx, ebp
je 0x6b5198a8
mov eax, 1
movzx edx, byte [ebx]
add ebx, 1
xor dl, byte [esp + eax + 0x34]
add eax, 1
add esi, 1
and eax, 7
mov byte [esi - 1], dl
cmp ebp, ebx
jne 0x6b519810
mov ecx, dword [esp + 0x1c]
mov ebp, edi
test ebp, ebp
je 0x6b519889
mov ebx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
bswap ebx
bswap edx
mov dword [ecx], ebx
mov dword [ecx + 4], edx
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, dword [esp + 0x3c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b5198b5
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [esp + 0x1c]
mov ebp, edi
mov eax, 1
jmp 0x6b519874
call sym.___stack_chk_fail
nop
nop
nop
nop
nop
nop
Function at 0x6b51d740
Capabilities:
Encode data using xor

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x20]
test esi, esi
je 0x6b51d7a0
movsx edx, byte [esi]
xor eax, eax
test dl, dl
je 0x6b51d792
mov edi, 0x100
xor ebx, ebx
nop
mov dword [esp], edx
add esi, 1
call sym._ossl_tolower
movsx edx, byte [esi]
or eax, edi
add edi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol ebx, cl
xor ebx, eax
test dl, dl
jne 0x6b51d760
mov eax, ebx
shr eax, 0x10
xor eax, ebx
add esp, 0x10
pop ebx
pop esi
pop edi
ret
add esp, 0x10
xor eax, eax
pop ebx
pop esi
pop edi
ret

Function at 0x6b51d7f0
Capabilities:
Hash data with md5

Disassembly:
push edi
mov edx, dword [esp + 8]
xor eax, eax
lea edi, [edx + 0x14]
lea ecx, [edx + 0x10]
mov dword [edx + 0x10], 0
and edi, 0xfffffffc
mov dword [edx + 0x58], 0
sub ecx, edi
add ecx, 0x4c
shr ecx, 2
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
pop edi
ret
Function at 0x6b51ea80
Capabilities:
Hash data with md5

Disassembly:
push edi
mov edx, dword [esp + 8]
xor eax, eax
lea edi, [edx + 0x14]
lea ecx, [edx + 0x10]
mov dword [edx + 0x10], 0
and edi, 0xfffffffc
mov dword [edx + 0x58], 0
sub ecx, edi
add ecx, 0x4c
shr ecx, 2
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
pop edi
ret

Function at 0x6b51ebf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, eax
push esi
push ebx
sub esp, 0xcc
mov ebx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0xbc], ebx
xor ebx, ebx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x6b51ed0e
lea ebx, [edi + 0xc]
movzx eax, byte [eax + 0xc]
movzx ecx, byte [edi + 0x14]
xor ebp, ebp
mov dword [esp + 0x10], ebx
lea ebx, [edi + 0x14]
mov dword [esp + 0x14], ebx
lea esi, [esi]
nop
mov edx, dword [esp + 0x18]
and eax, 0xffffff9f
and ecx, 0xffffff9f
or eax, 0x40
or ecx, 0x20
mov ebx, dword [edx + ebp]
mov esi, dword [edx + ebp + 4]
mov byte [edi + 0xc], al
add ebp, 8
mov eax, dword [esp + 0x10]
mov byte [edi + 0x14], cl
mov dword [esp + 0x34], ebx
mov dword [esp], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], esi
mov dword [esp + 0x30], esi
call sym.libcrypto_1_1.dll_DES_set_odd_parity
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x3c]
mov dword [esp + 4], ecx
mov dword [esp], eax
call sym.libcrypto_1_1.dll_DES_set_key_unchecked
lea eax, [esp + 0x3c]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
lea eax, [esp + 0x2c]
mov dword [esp], eax
call sym.libcrypto_1_1.dll_DES_encrypt1
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym.libcrypto_1_1.dll_DES_set_odd_parity
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x3c]
mov dword [esp + 4], edx
mov dword [esp], eax
call sym.libcrypto_1_1.dll_DES_set_key_unchecked
lea eax, [esp + 0x3c]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
lea eax, [esp + 0x34]
mov dword [esp], eax
call sym.libcrypto_1_1.dll_DES_encrypt1
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
xor edx, ebx
xor ecx, esi
xor ebx, dword [esp + 0x2c]
xor esi, dword [esp + 0x30]
mov dword [edi + 0x10], ecx
mov eax, ebx
mov ecx, edx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x14], edx
mov dword [edi + 0x18], esi
cmp dword [esp + 0x1c], ebp
ja 0x6b51ec38
mov eax, dword [esp + 0xbc]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b51ed28
add esp, 0xcc
pop ebx
pop esi
pop edi
pop ebp
ret
call sym.___stack_chk_fail
lea esi, [esi]
Function at 0x6b5228c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov edi, dword [esp + 0x7c]
mov edx, dword [esp + 0x78]
mov esi, dword [esp + 0x70]
mov eax, dword [esp + 0x74]
mov dword [esp + 0x10], edi
mov edi, dword [esp + 0x8c]
mov ebx, dword [esp + 0x80]
mov dword [esp + 0x14], edi
mov edi, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x4c], edi
xor edi, edi
test edx, edx
je 0x6b52298b
lea edi, [esi + edx]
mov edx, dword [esp + 0x88]
lea ebp, [esp + 0x2b]
mov dword [esp + 0x1c], edi
lea edi, [esp + 0x2c]
test edx, edx
je 0x6b5229a0
mov ecx, edi
mov edi, eax
lea esi, [esi]
nop
mov edx, dword [ebx]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
add esi, 1
add edi, 1
mov dword [ebp], edx
mov edx, dword [ebx + 4]
mov dword [ebp + 4], edx
mov edx, dword [ebx + 8]
mov dword [ebp + 8], edx
mov edx, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], ebx
mov dword [esp], ebx
call eax
mov ecx, dword [esp + 0x18]
movzx edx, byte [esi - 1]
xor dl, byte [ebx]
mov byte [edi - 1], dl
mov byte [esp + 0x3b], dl
mov edx, dword [ecx]
mov dword [ebx], edx
mov edx, dword [ecx + 4]
mov dword [ebx + 4], edx
mov edx, dword [ecx + 8]
mov dword [ebx + 8], edx
mov edx, dword [ecx + 0xc]
mov dword [ebx + 0xc], edx
cmp esi, dword [esp + 0x1c]
jne 0x6b522928
mov eax, dword [esp + 0x4c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b522a0a
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebx]
mov dword [esp + 0x18], eax
add esi, 1
mov eax, dword [esp + 0x10]
mov dword [ebp], edx
mov edx, dword [ebx + 4]
mov dword [ebp + 4], edx
mov edx, dword [ebx + 8]
mov dword [ebp + 8], edx
mov edx, dword [ebx + 0xc]
mov dword [ebp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], ebx
mov dword [esp], ebx
call eax
movzx edx, byte [esi - 1]
movzx ecx, byte [ebx]
mov eax, dword [esp + 0x18]
mov byte [esp + 0x3b], dl
xor ecx, edx
mov edx, dword [edi]
mov byte [eax], cl
add eax, 1
mov dword [ebx], edx
mov edx, dword [edi + 4]
mov dword [ebx + 4], edx
mov edx, dword [edi + 8]
mov dword [ebx + 8], edx
mov edx, dword [edi + 0xc]
mov dword [ebx + 0xc], edx
cmp esi, dword [esp + 0x1c]
jne 0x6b5229a0
jmp 0x6b52298b
call sym.___stack_chk_fail
nop