joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53af10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x24]
mov ebx, dword [eax]
movzx eax, byte [edi]
movzx ecx, byte [edi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [edi + 3]
shl eax, 0x18
or ecx, eax
movzx eax, byte [edi + 4]
movzx edx, byte [edi + 5]
shl edx, 8
or edx, eax
movzx eax, byte [edi + 6]
shl eax, 0x10
or edx, eax
movzx eax, byte [edi + 7]
shl eax, 0x18
or edx, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edx
mov byte [ebp - 0x20], cl
mov eax, ecx
shr eax, 8
mov byte [ebp - 0x1f], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0x1e], al
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], dl
mov eax, edx
shr eax, 8
mov byte [ebp - 0x1b], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0x1a], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 0x19], al
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x53b077
xor esi, esi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x3c], edi
jmp 0x53afd6
mov al, byte [ebp + ebx - 0x20]
mov edi, dword [ebp + 8]
xor al, byte [edi + esi]
mov edi, dword [ebp - 0x3c]
mov byte [edi + esi], al
inc ebx
and ebx, 7
inc esi
cmp dword [ebp + 0x10], esi
je 0x53b03c
test ebx, ebx
jne 0x53afbc
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0xc], eax
mov edi, dword [ebp + 0x18]
mov dword [esp + 8], edi
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
lea edi, [ebp - 0x28]
mov dword [esp], edi
call fcn.00539828
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov byte [ebp - 0x20], cl
mov eax, ecx
shr eax, 8
mov byte [ebp - 0x1f], al
mov eax, ecx
shr eax, 0x10
mov byte [ebp - 0x1e], al
mov eax, ecx
shr eax, 0x18
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], dl
mov eax, edx
shr eax, 8
mov byte [ebp - 0x1b], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0x1a], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 0x19], al
inc dword [ebp - 0x2c]
jmp 0x53afbc
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x53b077
mov byte [edi], cl
mov eax, ecx
shr eax, 8
mov byte [edi + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [edi + 2], al
shr ecx, 0x18
mov byte [edi + 3], cl
mov byte [edi + 4], dl
mov eax, edx
shr eax, 8
mov byte [edi + 5], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 6], al
shr edx, 0x18
mov byte [edi + 7], dl
mov eax, dword [ebp + 0x24]
mov dword [eax], ebx
add esp, 0x4c
pop ebx
pop esi
pop edi
leave
ret
Function at 0x53b134
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
movzx ecx, byte [edx]
shl ecx, 8
mov dword [eax], ecx
movzx ebx, byte [edx + 1]
or ebx, ecx
mov dword [eax], ebx
movzx ecx, byte [edx + 2]
shl ecx, 8
mov dword [eax + 4], ecx
movzx ebx, byte [edx + 3]
or ebx, ecx
mov dword [eax + 4], ebx
movzx ecx, byte [edx + 4]
shl ecx, 8
mov dword [eax + 8], ecx
movzx ebx, byte [edx + 5]
or ebx, ecx
mov dword [eax + 8], ebx
movzx ecx, byte [edx + 6]
shl ecx, 8
mov dword [eax + 0xc], ecx
movzx ebx, byte [edx + 7]
or ebx, ecx
mov dword [eax + 0xc], ebx
movzx ecx, byte [edx + 8]
shl ecx, 8
mov dword [eax + 0x10], ecx
movzx ebx, byte [edx + 9]
or ebx, ecx
mov dword [eax + 0x10], ebx
movzx ecx, byte [edx + 0xa]
shl ecx, 8
mov dword [eax + 0x14], ecx
movzx ebx, byte [edx + 0xb]
or ebx, ecx
mov dword [eax + 0x14], ebx
movzx ecx, byte [edx + 0xc]
shl ecx, 8
mov dword [eax + 0x18], ecx
movzx ebx, byte [edx + 0xd]
or ebx, ecx
mov dword [eax + 0x18], ebx
movzx ecx, byte [edx + 0xe]
shl ecx, 8
mov dword [eax + 0x1c], ecx
movzx edx, byte [edx + 0xf]
or edx, ecx
mov dword [eax + 0x1c], edx
lea ebx, [eax + 0xa0]
jmp 0x53b207
mov ecx, edx
shr ecx, 7
shl edi, 9
or ecx, edi
and ecx, 0xffff
mov dword [eax + 0x38], ecx
shr esi, 7
shl edx, 9
or esi, edx
and esi, 0xffff
mov dword [eax + 0x3c], esi
add eax, 0x20
mov esi, dword [eax + 4]
mov ecx, dword [eax + 8]
mov edx, ecx
shr edx, 7
mov edi, esi
shl edi, 9
or edx, edi
and edx, 0xffff
mov dword [eax + 0x20], edx
mov edi, dword [eax + 0xc]
mov edx, edi
shr edx, 7
shl ecx, 9
or edx, ecx
and edx, 0xffff
mov dword [eax + 0x24], edx
mov ecx, dword [eax + 0x10]
mov edx, ecx
shr edx, 7
shl edi, 9
or edx, edi
and edx, 0xffff
mov dword [eax + 0x28], edx
mov edi, dword [eax + 0x14]
mov edx, edi
shr edx, 7
shl ecx, 9
or edx, ecx
and edx, 0xffff
mov dword [eax + 0x2c], edx
mov ecx, dword [eax + 0x18]
mov edx, ecx
shr edx, 7
shl edi, 9
or edx, edi
and edx, 0xffff
mov dword [eax + 0x30], edx
mov edi, dword [eax + 0x1c]
mov edx, edi
shr edx, 7
shl ecx, 9
or edx, ecx
and edx, 0xffff
mov dword [eax + 0x34], edx
mov edx, dword [eax]
cmp eax, ebx
jne 0x53b1e0
pop ebx
pop esi
pop edi
leave
ret
Function at 0x53b440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 0x18]
mov eax, dword [ebp + 0x1c]
mov ebx, dword [eax]
movzx eax, byte [edi]
shl eax, 0x18
movzx ecx, byte [edi + 1]
shl ecx, 0x10
or ecx, eax
movzx eax, byte [edi + 2]
shl eax, 8
or ecx, eax
movzx eax, byte [edi + 3]
or ecx, eax
movzx esi, byte [edi + 4]
shl esi, 0x18
movzx eax, byte [edi + 5]
shl eax, 0x10
or eax, esi
movzx esi, byte [edi + 6]
shl esi, 8
or eax, esi
movzx esi, byte [edi + 7]
or eax, esi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
mov esi, ecx
shr esi, 0x18
mov edx, esi
mov byte [ebp - 0x20], dl
mov esi, ecx
shr esi, 0x10
mov edx, esi
mov byte [ebp - 0x1f], dl
mov esi, ecx
shr esi, 8
mov edx, esi
mov byte [ebp - 0x1e], dl
mov byte [ebp - 0x1d], cl
mov ecx, eax
shr ecx, 0x18
mov byte [ebp - 0x1c], cl
mov ecx, eax
shr ecx, 0x10
mov byte [ebp - 0x1b], cl
mov ecx, eax
shr ecx, 8
mov byte [ebp - 0x1a], cl
mov byte [ebp - 0x19], al
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x53b5a9
xor esi, esi
mov dword [ebp - 0x2c], 0
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x30], edi
mov edi, dword [ebp + 8]
jmp 0x53b504
mov al, byte [ebp + ebx - 0x20]
xor al, byte [edi + esi]
mov byte [edx + esi], al
inc ebx
and ebx, 7
inc esi
cmp esi, dword [ebp + 0x10]
je 0x53b564
test ebx, ebx
jne 0x53b4f0
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov dword [ebp - 0x34], edx
call fcn.0053b77c
mov eax, dword [ebp - 0x28]
mov ecx, eax
shr ecx, 0x18
mov byte [ebp - 0x20], cl
mov ecx, eax
shr ecx, 0x10
mov byte [ebp - 0x1f], cl
mov ecx, eax
shr ecx, 8
mov byte [ebp - 0x1e], cl
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x24]
mov ecx, eax
shr ecx, 0x18
mov byte [ebp - 0x1c], cl
mov ecx, eax
shr ecx, 0x10
mov byte [ebp - 0x1b], cl
mov ecx, eax
shr ecx, 8
mov byte [ebp - 0x1a], cl
mov byte [ebp - 0x19], al
inc dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
jmp 0x53b4f0
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x53b5a9
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov ecx, edx
shr ecx, 0x18
mov byte [edi], cl
mov ecx, edx
shr ecx, 0x10
mov byte [edi + 1], cl
mov ecx, edx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 3], dl
mov edx, eax
shr edx, 0x18
mov byte [edi + 4], dl
mov edx, eax
shr edx, 0x10
mov byte [edi + 5], dl
mov edx, eax
shr edx, 8
mov byte [edi + 6], dl
mov byte [edi + 7], al
mov edx, dword [ebp + 0x1c]
mov dword [edx], ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
Function at 0x53d794
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov byte [eax], 0
mov edx, dword [ebp + 0xc]
cmp edx, 0x80
jle 0x53d7b6
mov edx, 0x80
test ecx, ecx
jle 0x53d8ad
cmp ecx, 0x400
jle 0x53d8ce
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xff
xor edi, edi
mov ebx, 0x80
mov dword [ebp - 0x1c], 0xffffffff
test edx, edx
jle 0x53d8f8
xor ecx, ecx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 0x10]
nop
mov bl, byte [esi + ecx]
mov byte [eax + ecx], bl
inc ecx
cmp ecx, edx
jne 0x53d7f8
mov ebx, dword [ebp - 0x10]
mov cl, byte [eax + edx - 1]
cmp edx, 0x80
je 0x53d840
movzx esi, cl
mov ecx, eax
mov dword [ebp - 0x10], ebx
mov eax, esi
mov esi, ecx
nop
add al, byte [ecx]
movzx eax, al
mov bl, byte [eax + 0x6bb600]
movzx eax, bl
mov byte [esi + edx], bl
inc edx
inc ecx
cmp edx, 0x80
jne 0x53d820
mov ebx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [ebp - 0x18]
lea ecx, [eax + ecx]
movzx edx, byte [ecx]
and edx, dword [ebp - 0x14]
mov dl, byte [edx + 0x6bb600]
mov byte [ecx], dl
test edi, edi
je 0x53d87a
movzx esi, dl
mov edx, dword [ebp - 0x1c]
lea edx, [eax + edx]
lea edi, [eax - 1]
movzx ecx, byte [edx + ebx]
xor ecx, esi
mov cl, byte [ecx + 0x6bb600]
movzx esi, cl
mov byte [edx], cl
dec edx
cmp edx, edi
jne 0x53d864
lea esi, [eax + 0xfc]
mov edx, 0x7f
lea esi, [esi]
movzx ecx, byte [eax + edx]
shl ecx, 8
movzx ebx, byte [eax + edx - 1]
or ecx, ebx
mov dword [esi + edx*2 - 0xfe], ecx
sub edx, 2
cmp edx, 0xffffffff
jne 0x53d888
add esp, 0x10
pop ebx
pop esi
pop edi
leave
ret
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xff
mov dword [ebp - 0x1c], 0xffffffff
xor edi, edi
mov ebx, 0x80
jmp 0x53d7e6
lea ebx, [ecx + 7]
sar ebx, 3
mov edi, 0x80
sub edi, ebx
lea esi, [edi - 1]
mov dword [ebp - 0x1c], esi
neg ecx
and ecx, 7
mov dword [ebp - 0x14], 0xff
sar dword [ebp - 0x14], cl
mov dword [ebp - 0x18], edi
jmp 0x53d7e6
mov cl, byte [eax + edx - 1]
jmp 0x53d812
Function at 0x53d9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x18]
mov eax, dword [ebp + 0x1c]
mov ebx, dword [eax]
movzx ecx, byte [esi]
movzx eax, byte [esi + 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 2]
shl ecx, 0x10
or eax, ecx
movzx ecx, byte [esi + 3]
shl ecx, 0x18
or eax, ecx
movzx ecx, byte [esi + 4]
movzx edx, byte [esi + 5]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 6]
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [esi + 7]
shl ecx, 0x18
or edx, ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov byte [ebp - 0x20], al
mov ecx, eax
shr ecx, 8
mov byte [ebp - 0x1f], cl
mov ecx, eax
shr ecx, 0x10
mov byte [ebp - 0x1e], cl
shr eax, 0x18
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], dl
mov eax, edx
shr eax, 8
mov byte [ebp - 0x1b], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0x1a], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 0x19], al
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x53db1d
xor eax, eax
mov dword [ebp - 0x2c], 0
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x30], esi
mov esi, eax
jmp 0x53da80
mov al, byte [ebp + ebx - 0x20]
xor al, byte [edi + esi]
mov byte [edx + esi], al
inc ebx
and ebx, 7
inc esi
cmp esi, dword [ebp + 0x10]
je 0x53dadc
test ebx, ebx
jne 0x53da6c
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov dword [ebp - 0x34], edx
call fcn.0053cfbc
mov eax, dword [ebp - 0x28]
mov byte [ebp - 0x20], al
mov ecx, eax
shr ecx, 8
mov byte [ebp - 0x1f], cl
mov ecx, eax
shr ecx, 0x10
mov byte [ebp - 0x1e], cl
shr eax, 0x18
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x24]
mov byte [ebp - 0x1c], al
mov ecx, eax
shr ecx, 8
mov byte [ebp - 0x1b], cl
mov ecx, eax
shr ecx, 0x10
mov byte [ebp - 0x1a], cl
shr eax, 0x18
mov byte [ebp - 0x19], al
inc dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
jmp 0x53da6c
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x53db1d
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov byte [esi], dl
mov ecx, edx
shr ecx, 8
mov byte [esi + 1], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 2], cl
shr edx, 0x18
mov byte [esi + 3], dl
mov byte [esi + 4], al
mov edx, eax
shr edx, 8
mov byte [esi + 5], dl
mov edx, eax
shr edx, 0x10
mov byte [esi + 6], dl
shr eax, 0x18
mov byte [esi + 7], al
mov edx, dword [ebp + 0x1c]
mov dword [edx], ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
Function at 0x53e320
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x53e340
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x54152c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
cmp dword [ebp + 0x14], 0
jne 0x541550
mov dword [ebp + 0x10], ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], eax
leave
jmp fcn.00542c28
leave
jmp fcn.00541fbc
Function at 0x54391c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
cmp dword [ebp + 0x1c], 0
jne 0x543954
mov dword [ebp + 0x1c], fcn.00542c28
mov dword [ebp + 0x18], esi
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x10], ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], eax
pop ebx
pop esi
leave
jmp fcn.00566140
mov dword [ebp + 0x1c], fcn.00541fbc
pop ebx
pop esi
leave
jmp fcn.0056604c
Function at 0x54835c
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 4
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jle 0x548479
mov edx, ecx
mov dword [ebp - 0x10], 0
jmp 0x5483e7
movzx ecx, byte [esi]
shl ecx, 0x10
movzx edi, byte [esi + 1]
shl edi, 8
or ecx, edi
movzx edi, byte [esi + 2]
or ecx, edi
mov edi, ecx
shr edi, 0x12
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
mov edi, ecx
shr edi, 0xc
and edi, 0x3f
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], al
mov edi, ecx
shr edi, 6
and edi, 0x3f
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 2], al
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 3], cl
add edx, 4
mov ecx, edx
add dword [ebp - 0x10], 4
sub ebx, 3
test ebx, ebx
jle 0x548434
add esi, 3
cmp ebx, 2
jg 0x548384
movzx ecx, byte [esi]
shl ecx, 0x10
cmp ebx, 2
je 0x548440
mov edi, ecx
shr edi, 0x12
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
shr ecx, 0xc
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], cl
lea ecx, [edx + 2]
mov edi, 0x3d
mov eax, edi
mov byte [ecx], al
mov byte [ecx + 1], 0x3d
add ecx, 2
add edx, 4
add dword [ebp - 0x10], 4
sub ebx, 3
test ebx, ebx
jg 0x5483e4
mov byte [ecx], 0
mov eax, dword [ebp - 0x10]
pop edx
pop ebx
pop esi
pop edi
leave
ret
movzx edi, byte [esi + 1]
shl edi, 8
or edi, ecx
mov ecx, edi
shr ecx, 0x12
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
mov ecx, edi
shr ecx, 0xc
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], cl
lea ecx, [edx + 2]
shr edi, 6
and edi, 0x3f
movzx edi, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x54841b
mov dword [ebp - 0x10], 0
jmp 0x548434
Function at 0x559704
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea edi, [esi - 1]
lea eax, [esi - 0x29]
cmp eax, dword [ebp + 0x14]
jle 0x559894
cmp edi, 0x28
jle 0x559850
mov byte [ebx], 0
lea eax, [ebx + 1]
mov dword [ebp - 0x44], eax
lea eax, [ebx + 0x15]
mov dword [ebp - 0x40], eax
call fcn.004f0d80
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x40]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call fcn.004fdf28
mov edx, edi
sub edx, dword [ebp + 0x14]
lea ecx, [edx - 0x29]
lea eax, [ebx + 0x29]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov edi, dword [ebp - 0x3c]
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x40]
mov byte [eax + edx - 0x15], 1
sub esi, 0x15
mov dword [ebp - 0x3c], esi
mov eax, esi
sub eax, dword [ebp + 0x14]
add eax, dword [ebp - 0x40]
mov edi, eax
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 4], 0x14
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call fcn.004f9278
test eax, eax
jle 0x559888
mov dword [esp + 8], 0x48
mov dword [esp + 4], str.crypto_rsa_rsa_oaep.c
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.004f3b10
mov edi, eax
test eax, eax
je 0x5598ca
mov dword [esp], 0x14
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x3c]
call fcn.00559458
test eax, eax
js 0x559888
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov dl, byte [edi + eax]
xor byte [ebx + eax + 0x15], dl
inc eax
cmp ecx, eax
jg 0x559800
lea esi, [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x40]
mov edx, 0x14
mov eax, esi
call fcn.00559458
test eax, eax
js 0x559888
xor eax, eax
nop
mov dl, byte [esi + eax]
xor byte [ebx + eax + 1], dl
inc eax
cmp eax, 0x14
jne 0x55982c
mov dword [esp], edi
call fcn.004f3df0
mov eax, 1
add esp, 0x5c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 0x10], 0x33
mov dword [esp + 0xc], str.crypto_rsa_rsa_oaep.c
mov dword [esp + 8], 0x78
mov dword [esp + 4], 0x79
mov dword [esp], 4
call fcn.004f33a4
xor eax, eax
add esp, 0x5c
pop ebx
pop esi
pop edi
leave
ret
xor eax, eax
add esp, 0x5c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 0x10], 0x2d
mov dword [esp + 0xc], str.crypto_rsa_rsa_oaep.c
mov dword [esp + 8], 0x6e
mov dword [esp + 4], 0x79
mov dword [esp], 4
call fcn.004f33a4
xor eax, eax
add esp, 0x5c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 0x10], 0x4b
mov dword [esp + 0xc], str.crypto_rsa_rsa_oaep.c
mov dword [esp + 8], 0x41
mov dword [esp + 4], 0x79
mov dword [esp], 4
call fcn.004f33a4
xor eax, eax
jmp 0x55987e
Function at 0x559eb0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp + 0x14]
jne 0x559f38
mov bl, byte [ecx]
lea esi, [ebx - 0x6a]
mov edx, esi
cmp dl, 1
ja 0x559f38
lea esi, [ecx + 1]
cmp bl, 0x6b
je 0x559ef4
sub eax, 2
cmp byte [esi + eax], 0xcc
jne 0x559fac
mov edi, dword [ebp + 8]
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
sub eax, 3
test eax, eax
jle 0x559fe2
mov bl, byte [ecx + 1]
cmp bl, 0xba
je 0x559fe2
cmp bl, 0xbb
jne 0x559f74
lea esi, [ecx + 2]
xor ecx, ecx
jmp 0x559f25
mov bl, byte [esi]
inc esi
cmp bl, 0xba
je 0x559f32
cmp bl, 0xbb
jne 0x559f74
inc ecx
cmp eax, ecx
jg 0x559f18
test ecx, ecx
je 0x559fe2
sub eax, ecx
jmp 0x559edb
mov dword [esp + 0x10], 0x72
mov dword [esp + 0xc], str.crypto_rsa_rsa_x931.c
mov dword [esp + 8], 0x89
mov dword [esp + 4], 0x80
mov dword [esp], 4
call fcn.004f33a4
mov eax, 0xffffffff
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 0x10], 0x81
mov dword [esp + 0xc], str.crypto_rsa_rsa_x931.c
mov dword [esp + 8], 0x8a
mov dword [esp + 4], 0x80
mov dword [esp], 4
call fcn.004f33a4
mov eax, 0xffffffff
jmp 0x559eec
mov dword [esp + 0x10], 0x93
mov dword [esp + 0xc], str.crypto_rsa_rsa_x931.c
mov dword [esp + 8], 0x8b
mov dword [esp + 4], 0x80
mov dword [esp], 4
call fcn.004f33a4
mov eax, 0xffffffff
jmp 0x559eec
mov dword [esp + 0x10], 0x8a
jmp 0x559f7c