joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100204c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [0x10077880]
push ebx
push esi
push edi
xor edi, edi
mov ebx, edx
mov dword [ebp - 8], ebx
cmp dword [ecx + 0x3c], edi
jne 0x10020525
cmp dword [ecx + 0x94], edi
je 0x100204fb
cmp dword [ecx + 0x9c], edi
je 0x100204fb
cmp dword [ecx + 0xa0], edi
je 0x100204fb
cmp dword [ecx + 0x98], edi
jne 0x10020525
push str.got_no_pre_shared_key
push 0xe47
push str.C:UserspentesterDownloadsxxxxxxxcs4.5externalmbedtls_2.14.1library_ssl_srv.c
push 1
push 0x10077880
call fcn.10012320
mov eax, 0xffff8a00
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov edx, dword [ebx]
sub eax, edx
cmp eax, 2
jge 0x10020540
push str.bad_client_key_exchange_message
push 0xe50
jmp 0x1002061e
movzx eax, byte [edx]
movzx esi, byte [edx + 1]
add edx, 2
shl eax, 8
or esi, eax
mov dword [ebx], edx
cmp esi, 1
jb 0x10020614
mov eax, dword [ebp + 8]
sub eax, edx
cmp esi, eax
ja 0x10020614
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x10020589
push esi
push edx
push 0x10077880
push dword [ecx + 0x40]
call eax
add esp, 0x10
neg eax
sbb edi, edi
and edi, 0xffff9380
jmp 0x100205c0
cmp esi, dword [ecx + 0xa0]
jne 0x100205d7
mov edi, dword [ecx + 0x9c]
mov ebx, esi
mov byte [ebp - 1], 0
sub edi, edx
nop
mov al, byte [edi + edx]
lea edx, [edx + 1]
mov cl, byte [edx - 1]
xor cl, al
or cl, byte [ebp - 1]
mov byte [ebp - 1], cl
sub ebx, 1
jne 0x100205a0
cmp byte [ebp - 1], bl
mov edi, ebx
mov ebx, dword [ebp - 8]
jne 0x100205d7
mov eax, dword [ebx]
cmp edi, 0xffff9380
je 0x100205d9
add eax, esi
mov dword [ebx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
push esi
push eax
push str.Unknown_PSK_identity
push 0xe6f
push str.C:UserspentesterDownloadsxxxxxxxcs4.5externalmbedtls_2.14.1library_ssl_srv.c
mov edx, 3
mov ecx, 0x10077880
call fcn.100123e0
add esp, 0x14
mov dl, 2
push 0x73
call fcn.1000a220
add esp, 4
mov eax, 0xffff9380
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.bad_client_key_exchange_message
push 0xe59
push str.C:UserspentesterDownloadsxxxxxxxcs4.5externalmbedtls_2.14.1library_ssl_srv.c
push 1
push 0x10077880
call fcn.10012320
add esp, 0x14
mov eax, 0xffff8400
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002d0b0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov eax, ecx
mov dword [ebp - 4], eax
push edi
mov edi, 0x100609f0
mov edx, edi
test eax, eax
je 0x1002d134
cmp dword [0x100609f0], 0
je 0x1002d134
mov ebx, dword [eax + 4]
cmp dword [edx + 4], ebx
jne 0x1002d12a
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [eax + 8]
sub esi, 4
jb 0x1002d0f5
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x1002d0fa
add edx, 4
add eax, 4
sub esi, 4
jae 0x1002d0e4
cmp esi, 0xfffffffc
je 0x1002d13d
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x1002d127
cmp esi, 0xfffffffd
je 0x1002d13d
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x1002d127
cmp esi, 0xfffffffe
je 0x1002d13d
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x1002d127
cmp esi, 0xffffffff
je 0x1002d13d
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x1002d13d
mov eax, dword [ebp - 4]
add edi, 0x18
mov edx, edi
cmp dword [edi], 0
jne 0x1002d0d3
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002eec0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0xc
xorps xmm0, xmm0
movq qword [eax], xmm0
push eax
mov dword [eax + 8], 0
lea eax, [ebp - 0xc]
push eax
call fcn.1002e130
add esp, 8
test eax, eax
je 0x1002eef1
add eax, 0xffffc580
mov esp, ebp
pop ebp
ret
cmp dword [0x10060cd0], 0
push ebx
push esi
push edi
mov edi, 0x10060cd0
mov edx, edi
je 0x1002ef65
mov ebx, dword [ebp - 8]
cmp dword [edx + 4], ebx
jne 0x1002ef5b
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [ebp - 4]
sub esi, 4
jb 0x1002ef29
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x1002ef2e
add edx, 4
add eax, 4
sub esi, 4
jae 0x1002ef18
cmp esi, 0xfffffffc
je 0x1002ef71
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x1002ef5b
cmp esi, 0xfffffffd
je 0x1002ef71
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x1002ef5b
cmp esi, 0xfffffffe
je 0x1002ef71
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x1002ef5b
cmp esi, 0xffffffff
je 0x1002ef71
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x1002ef71
add edi, 0x14
mov edx, edi
cmp dword [edi], 0
jne 0x1002ef07
pop edi
pop esi
mov eax, 0xffffc380
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x1002ef65
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 0x10]
mov dword [eax], ecx
cmp ecx, 1
jne 0x1002efaf
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
cmp eax, 5
je 0x1002ef9c
test eax, eax
je 0x1002ef9c
pop edi
pop esi
mov eax, 0xffffc580
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 0xffffc580
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f210
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edx, 1
xor esi, esi
nop dword [eax]
mov eax, edx
mov dword [ebp + esi*4 - 0x804], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x404], esi
movzx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor ecx, edx
movzx edx, cl
cmp esi, 0x100
jl 0x1002f230
mov esi, 1
mov edx, 0x10075c30
nop dword [eax]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movzx ecx, al
lea eax, [esi + esi]
neg ecx
sbb ecx, ecx
add edx, 4
and ecx, 0x1b
xor ecx, eax
movzx esi, cl
cmp edx, 0x10075c58
jl 0x1002f270
mov eax, 1
mov byte [0x10075630], 0x63
mov byte [0x10075b93], 0
mov dword [ebp - 0x808], eax
nop dword [eax]
mov ecx, dword [ebp + eax*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
shr ecx, 7
add eax, eax
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
add eax, eax
shr ecx, 7
or ecx, eax
movzx edx, cl
mov ecx, edx
shr ecx, 7
lea eax, [edx + edx]
or ecx, eax
xor ecx, 0x63
movzx eax, cl
xor eax, edx
xor ebx, eax
mov eax, dword [ebp - 0x808]
mov byte [eax + 0x10075630], bl
mov byte [ebx + 0x10075b30], al
inc eax
mov dword [ebp - 0x808], eax
cmp eax, 0x100
jl 0x1002f2b0
xor edi, edi
mov dword [ebp - 0x80c], 0xff
nop dword [eax]
movzx esi, byte [edi + 0x10075630]
mov eax, esi
movzx ebx, byte [edi + 0x10075b30]
and al, 0x80
mov dword [ebp - 0x808], ebx
movzx ecx, al
neg ecx
lea eax, [esi + esi]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
movzx eax, cl
mov ecx, eax
xor ecx, esi
mov edx, ecx
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, eax
mov dword [edi*4 + 0x10077058], edx
shl edx, 8
or edx, ecx
mov dword [edi*4 + 0x10076c58], edx
shl edx, 8
or edx, esi
mov dword [edi*4 + 0x10076058], edx
shl edx, 8
or edx, esi
mov dword [edi*4 + 0x10075c58], edx
test ebx, ebx
je 0x1002f410
mov eax, dword [ebp + ebx*4 - 0x404]
mov esi, 0xff
add eax, dword [ebp - 0x3d8]
cdq
idiv esi
mov eax, dword [ebp + ebx*4 - 0x404]
add eax, dword [ebp - 0x3d0]
mov ecx, dword [ebp + edx*4 - 0x804]
cdq
idiv esi
mov eax, dword [ebp + ebx*4 - 0x404]
mov ebx, 0xff
add eax, dword [ebp - 0x3e0]
mov esi, dword [ebp + edx*4 - 0x804]
cdq
idiv ebx
mov eax, dword [ebp - 0x808]
mov eax, dword [ebp + eax*4 - 0x404]
add eax, dword [ebp - 0x3cc]
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv dword [ebp - 0x80c]
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x1002f418
xor ecx, ecx
xor esi, esi
xor ebx, ebx
xor eax, eax
shl ecx, 8
xor ecx, esi
shl ecx, 8
xor ecx, ebx
shl ecx, 8
xor ecx, eax
mov edx, ecx
mov dword [edi*4 + 0x10076858], ecx
shr edx, 0x18
shl ecx, 8
or edx, ecx
mov eax, edx
mov dword [edi*4 + 0x10076458], edx
shr eax, 0x18
shl edx, 8
or eax, edx
mov dword [edi*4 + 0x10077458], eax
ror eax, 0x18
mov dword [edi*4 + 0x10075730], eax
inc edi
cmp edi, 0x100
jl 0x1002f330
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10045387
mov esp, ebp
pop ebp
ret
Function at 0x10031170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], ecx
mov eax, edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
test cl, 0xf
je 0x1003118f
mov eax, 0xffffffde
mov esp, ebp
pop ebp
ret
test ecx, ecx
je 0x100312dd
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
test eax, eax
jne 0x10031231
mov eax, dword [ebp + 0xc]
mov edi, eax
mov ebx, dword [ebp + 0x10]
sub edi, esi
lea edx, [eax + 0xf]
lea eax, [ecx - 1]
mov dword [ebp - 0xc], edx
shr eax, 4
inc eax
mov dword [ebp + 8], eax
nop
movups xmm0, xmmword [ebx]
mov ecx, dword [ebp - 4]
mov edx, ebx
push esi
movups xmmword [ebp - 0x20], xmm0
call fcn.10030be0
add esp, 4
cmp esi, dword [ebp - 0xc]
ja 0x10031203
lea eax, [esi + 0xf]
cmp eax, dword [ebp + 0xc]
jb 0x10031203
mov eax, esi
mov edx, 0x10
nop dword [eax]
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x100311f0
mov eax, dword [ebp + 0xc]
jmp 0x10031212
mov eax, dword [ebp + 0xc]
movups xmm0, xmmword [esi]
movups xmm1, xmmword [eax]
xorps xmm1, xmm0
movups xmmword [esi], xmm1
movups xmm0, xmmword [ebp - 0x20]
add esi, 0x10
add ebx, 0x10
sub edi, 0x10
sub dword [ebp + 8], 1
movups xmmword [eax], xmm0
jne 0x100311c0
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
lea eax, [ecx - 1]
mov edi, dword [ebp + 0x10]
mov ebx, edx
sub ebx, edi
shr eax, 4
inc eax
mov dword [ebp + 8], ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], esi
nop dword [eax + eax]
lea eax, [edi + 0xf]
lea ecx, [esi + 0xf]
cmp esi, eax
ja 0x1003125e
cmp ecx, edi
jae 0x10031269
lea eax, [edx + 0xf]
cmp esi, eax
ja 0x10031291
cmp ecx, edx
jb 0x10031291
mov ebx, esi
mov ecx, edi
mov esi, dword [ebp + 8]
sub ebx, edi
mov edx, 0x10
mov al, byte [esi + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub edx, 1
jne 0x10031277
mov esi, dword [ebp - 8]
mov ebx, dword [ebp + 8]
jmp 0x1003129d
movups xmm1, xmmword [edx]
movups xmm0, xmmword [edi]
xorps xmm1, xmm0
movups xmmword [esi], xmm1
cmp dword [ebp - 0x10], 1
mov edx, esi
mov ecx, dword [ebp - 4]
push esi
jne 0x100312b0
call fcn.10030650
jmp 0x100312b5
call fcn.10030be0
movups xmm0, xmmword [esi]
mov edx, dword [ebp + 0xc]
sub ebx, 0x10
add esi, 0x10
mov dword [ebp + 8], ebx
add esp, 4
mov dword [ebp - 8], esi
add edi, 0x10
sub dword [ebp - 0xc], 1
movups xmmword [edx], xmm0
jne 0x10031250
pop edi
pop esi
pop ebx
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10033d10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
mov eax, edx
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x24]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
test edi, edi
jne 0x10033d5a
lea eax, [edi - 0xd]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10045387
mov esp, ebp
pop ebp
ret
push edi
lea ebx, [ebp - 0x14]
push ebx
push ecx
push dword [ebp - 0x18]
push ecx
push dword [ebp - 0x1c]
mov ecx, esi
push dword [ebp + 0xc]
push edx
push eax
mov edx, 1
call fcn.10032580
mov ebx, dword [ebp + 0x20]
add esp, 0x24
test eax, eax
jne 0x10033e74
xor esi, esi
xor dl, dl
test edi, edi
je 0x10033e22
cmp edi, 8
jb 0x10033e22
mov ecx, edi
xorps xmm4, xmm4
and ecx, 0xfffffff8
xorps xmm3, xmm3
xor eax, eax
nop dword [eax + eax]
movd xmm2, dword [eax + ebx]
xorps xmm0, xmm0
movd xmm1, dword [ebp + eax - 0x14]
lea eax, [edx + 4]
punpcklbw xmm2, xmm0
add dl, 8
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movzx eax, al
orps xmm4, xmm2
movd xmm2, dword [ebx + eax]
movd xmm1, dword [ebp + eax - 0x14]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
movzx eax, dl
xorps xmm2, xmm1
orps xmm3, xmm2
cmp eax, ecx
jb 0x10033db0
orps xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd esi, xmm3
movzx eax, dl
cmp eax, edi
jae 0x10033e46
nop dword [eax]
movzx ecx, byte [eax + ebx]
inc dl
movzx eax, byte [ebp + eax - 0x14]
xor ecx, eax
movzx eax, dl
or esi, ecx
cmp eax, edi
jb 0x10033e30
test esi, esi
je 0x10033e72
push dword [ebp - 0x20]
mov eax, dword [fcn.10046690]
push 0
push dword [ebp - 0x24]
call eax
add esp, 0xc
mov eax, 0xfffffff1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10045387
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10045387
mov esp, ebp
pop ebp
ret
Function at 0x100343c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
mov ebx, edx
mov esi, ecx
test edi, edi
jne 0x100343e0
mov eax, 0xffffffa9
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
push 1
call fcn.10033f20
add esp, 4
test eax, eax
jne 0x10034509
test esi, esi
je 0x100343d4
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x100343d4
cmp dword [esi + 0xe0], 1
je 0x10034415
mov eax, 0xffffffac
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
add dword [esi + 0xd0], 0xd
lea ecx, [esi + 0x84]
push 0xd
adc dword [esi + 0xd4], 0
call fcn.10041840
add esp, 4
test eax, eax
jne 0x10034509
push dword [ebp + 0x1c]
mov edx, ebx
mov ecx, esi
push dword [ebp + 0x18]
call fcn.10033ff0
add esp, 8
test eax, eax
jne 0x10034509
lea edx, [ebp - 0x10]
mov ecx, esi
call fcn.10034110
test eax, eax
jne 0x10034509
lea eax, [ebp - 0x10]
xorps xmm4, xmm4
lea ecx, [ebp - 0xc]
sub eax, edi
xorps xmm3, xmm3
sub ecx, edi
mov edx, 2
nop dword [eax]
movd xmm2, dword [eax + edi]
xorps xmm0, xmm0
movd xmm1, dword [edi]
lea edi, [edi + 8]
punpcklbw xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [edi - 4]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [ecx + edi - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
sub edx, 1
jne 0x10034480
orps xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
test eax, eax
je 0x10034507
mov eax, dword [fcn.10046690]
push ebx
push edx
push dword [ebp + 0x1c]
call eax
add esp, 0xc
mov eax, 0xffffffaa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10034b00
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0x10062424]
push edi
mov edi, ecx
test esi, esi
je 0x10034b3c
mov ebx, dword [ebp + 0xc]
mov ecx, 0x10062424
nop word [eax + eax]
mov eax, dword [esi + 0x1c]
cmp dword [eax], edx
jne 0x10034b32
cmp dword [esi + 8], ebx
jne 0x10034b32
cmp dword [esi + 4], 1
je 0x10034b46
mov esi, dword [ecx + 8]
add ecx, 8
test esi, esi
jne 0x10034b20
mov eax, 0xffffffec
pop edi
pop esi
pop ebx
pop ebp
ret
test esi, esi
je 0x10034b3c
cmp dword [esi + 0x18], 0x10
jne 0x10034b3c
test edi, edi
je 0x10034bf5
mov ecx, dword [edi + 0x3c]
test ecx, ecx
je 0x10034b6d
mov eax, dword [edi]
push ecx
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 0x2c]
call eax
add esp, 4
mov eax, dword [fcn.10046690]
push 0x40
push 0
push edi
call eax
push 0x40
push 0
push edi
call fcn.10046690
mov eax, dword [esi + 0x1c]
add esp, 0x18
mov eax, dword [eax + 0x28]
call eax
mov dword [edi + 0x3c], eax
test eax, eax
jne 0x10034b9f
pop edi
pop esi
mov eax, 0xffff9e80
pop ebx
pop ebp
ret
mov dword [edi], esi
cmp dword [esi + 4], 2
jne 0x10034bb5
mov dword [edi + 0xc], 0x1001b600
mov dword [edi + 0x10], 0x1001b6d0
mov eax, esi
test eax, eax
je 0x10034bf5
test byte [eax + 0x14], 2
jne 0x10034bc6
cmp dword [eax + 8], ebx
jne 0x10034bf5
mov dword [edi + 4], ebx
mov dword [edi + 8], 1
mov eax, dword [eax + 0x1c]
push ebx
push dword [ebp + 8]
push dword [edi + 0x3c]
mov eax, dword [eax + 0x20]
call eax
add esp, 0xc
test eax, eax
jne 0x10034b41
mov ecx, edi
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.10034510
pop edi
pop esi
mov eax, 0xffff9f00
pop ebx
pop ebp
ret
Function at 0x100354c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x14], edx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x140]
mov ecx, dword [esi + 0x144]
mov ebx, dword [esi + 0x148]
shld ecx, eax, 3
shl eax, 3
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x14c]
shld eax, ebx, 3
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
lea eax, [edi - 4]
shl ebx, 3
cmp eax, 0xc
ja 0x1003561d
push edi
lea eax, [esi + 0x150]
push eax
push edx
call fcn.10047450
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov ecx, dword [ebp - 8]
mov eax, edx
or eax, dword [ebp - 0xc]
jne 0x10035534
mov eax, ebx
or eax, ecx
je 0x10035614
mov eax, ecx
mov byte [ebp - 0x21], cl
shr eax, 0x18
mov byte [ebp - 0x24], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0x23], al
mov eax, ecx
shr eax, 8
mov ecx, ebx
mov byte [ebp - 0x22], al
mov eax, dword [ebp - 8]
shrd ecx, eax, 0x18
mov eax, dword [ebp - 8]
mov byte [ebp - 0x20], cl
mov ecx, ebx
shrd ecx, eax, 0x10
mov eax, ebx
mov byte [ebp - 0x1d], bl
mov ebx, dword [ebp - 0xc]
mov byte [ebp - 0x1f], cl
mov ecx, dword [ebp - 8]
shrd eax, ecx, 8
mov ecx, edx
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x1e], al
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 0x1c], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp - 0x1b], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0x1a], al
mov eax, ebx
shrd ecx, eax, 0x18
mov eax, ebx
mov byte [ebp - 0x15], dl
mov byte [ebp - 0x18], cl
mov ecx, edx
shrd ecx, eax, 0x10
mov eax, edx
lea edx, [ebp - 0x23]
shrd eax, ebx, 8
mov byte [ebp - 0x17], cl
mov ebx, 4
mov byte [ebp - 0x16], al
lea eax, [esi + 0x171]
movzx ecx, byte [edx - 1]
lea edx, [edx + 4]
xor byte [eax - 1], cl
lea eax, [eax + 4]
movzx ecx, byte [edx - 4]
xor byte [eax - 4], cl
movzx ecx, byte [edx - 3]
xor byte [eax - 3], cl
movzx ecx, byte [edx - 2]
xor byte [eax - 2], cl
sub ebx, 1
jne 0x100355c4
lea edx, [esi + 0x170]
mov ecx, esi
push edx
call fcn.10034c00
add esp, 4
xor ecx, ecx
test edi, edi
je 0x10035614
mov edx, dword [ebp - 0x14]
mov al, byte [esi + ecx + 0x170]
xor byte [edx + ecx], al
inc ecx
cmp ecx, edi
jb 0x10035605
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0xffffffec
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10035630
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x20]
mov esi, ecx
mov ecx, dword [ebp + 8]
mov ebx, edx
mov edx, dword [ebp + 0x24]
push ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
xor edx, edx
push ecx
mov ecx, esi
mov dword [ebp - 0x20], ebx
call fcn.10034dd0
add esp, 0x10
test eax, eax
jne 0x1003579a
push dword [ebp - 0x18]
mov edx, ebx
mov ecx, esi
push edi
call fcn.10035330
add esp, 8
test eax, eax
jne 0x1003579a
mov edi, dword [ebp + 0x1c]
lea edx, [ebp - 0x14]
push edi
mov ecx, esi
call fcn.100354c0
add esp, 4
test eax, eax
jne 0x1003579a
xor esi, esi
test edi, edi
je 0x10035798
mov ebx, dword [ebp + 0x18]
cmp edi, 8
jb 0x10035752
mov edx, edi
lea esi, [ebp - 0x14]
sub esi, ebx
lea edi, [ebp - 0x10]
and edx, 0xfffffff8
mov ecx, ebx
sub edi, ebx
xorps xmm4, xmm4
mov dword [ebp - 0x1c], edi
xorps xmm3, xmm3
mov edi, dword [ebp + 0x1c]
mov ebx, dword [ebp - 0x1c]
nop word [eax + eax]
movd xmm2, dword [ecx + esi]
lea ecx, [ecx + 8]
movd xmm1, dword [ecx - 8]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
add eax, 8
punpcklbw xmm1, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [ecx - 4]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [ebx + ecx - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp eax, edx
jb 0x100356e0
mov ebx, dword [ebp + 0x18]
orps xmm3, xmm4
movaps xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movups xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd esi, xmm3
cmp eax, edi
jae 0x1003576c
lea ecx, [ebp - 0x14]
sub ebx, ecx
lea ecx, [ebp - 0x14]
add ecx, eax
inc eax
movzx edx, byte [ebx + ecx]
movzx ecx, byte [ecx]
xor edx, ecx
or esi, edx
cmp eax, edi
jb 0x10035757
test esi, esi
je 0x10035798
push dword [ebp - 0x20]
mov eax, dword [fcn.10046690]
push 0
push dword [ebp - 0x18]
call eax
add esp, 0xc
mov eax, 0xffffffee
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10045387
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10045387
mov esp, ebp
pop ebp
ret
Function at 0x10036a10
Capabilities:
Encrypt data using salsa20 or chacha
Enumerate pe sections

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x10036b51
test edx, edx
je 0x10036b51
mov dword [esi], 0x61707865
mov dword [esi + 4], 0x3320646e
mov dword [esi + 8], 0x79622d32
mov dword [esi + 0xc], 0x6b206574
movzx ecx, byte [edx + 3]
shl ecx, 8
movzx eax, byte [edx + 2]
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x10], ecx
movzx ecx, byte [edx + 7]
shl ecx, 8
movzx eax, byte [edx + 6]
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x14], ecx
movzx ecx, byte [edx + 0xb]
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x18], ecx
movzx ecx, byte [edx + 0xf]
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x1c], ecx
movzx ecx, byte [edx + 0x13]
movzx eax, byte [edx + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x20], ecx
movzx ecx, byte [edx + 0x17]
movzx eax, byte [edx + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x24], ecx
movzx ecx, byte [edx + 0x1b]
movzx eax, byte [edx + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x28], ecx
movzx ecx, byte [edx + 0x1f]
movzx eax, byte [edx + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0x1c]
shl ecx, 8
or ecx, eax
xor eax, eax
mov dword [esi + 0x2c], ecx
pop esi
ret
mov eax, 0xffffffaf
pop esi
ret