joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10074dc0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x58
push ebx
xor eax, eax
push ebp
mov dword [esp + 0xc], eax
push esi
mov dword [esp + 0x14], eax
push edi
mov edi, ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea ebp, [edi + 0x10]
mov ecx, ebp
mov dword [esp + 0x24], eax
call fcn.10001070
mov esi, dword [esp + 0x70]
test esi, esi
mov dword [esp + 0x24], eax
mov dword [esp + 0x70], esi
je 0x10074e60
mov ebx, dword [esp + 0x6c]
lea ecx, [ecx]
mov eax, dword [edi]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push esi
push ebx
push eax
call sub.KERNEL32.dll_WriteFile
test eax, eax
jne 0x10074e54
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x3e5
jne 0x10074e6e
mov ecx, dword [edi + 8]
push ecx
mov ecx, ebp
call fcn.10001070
push eax
call sub.KERNEL32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x10074e91
mov ecx, dword [edi]
push 0
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
push ecx
call sub.KERNEL32.dll_GetOverlappedResult
test eax, eax
je 0x10074eb3
mov eax, dword [esp + 0x10]
sub esi, eax
add ebx, eax
test esi, esi
jne 0x10074e00
mov eax, dword [esp + 0x70]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret 8
call sub.KERNEL32.dll_GetLastError
push eax
push 0x10145784
lea ecx, [esp + 0x30]
call fcn.1006e6d0
push 0x10180678
lea edx, [esp + 0x2c]
push edx
call fcn.10056f02
push 0x5b4
push 0x10145784
lea ecx, [esp + 0x30]
call fcn.1006e6d0
push 0x10180678
lea eax, [esp + 0x2c]
push eax
call fcn.10056f02
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x3e4
jne 0x10074eea
mov ecx, dword [edi]
push ecx
call sub.KERNEL32.dll_CancelIo
call sub.KERNEL32.dll_GetLastError
push eax
push 0x10145784
lea ecx, [esp + 0x30]
call fcn.1006e6d0
push 0x10180678
lea edx, [esp + 0x2c]
push edx
call fcn.10056f02
call sub.KERNEL32.dll_GetLastError
push eax
push 0x10145784
lea ecx, [esp + 0x30]
call fcn.1006e6d0
push 0x10180678
lea eax, [esp + 0x2c]
push eax
call fcn.10056f02
int3
Function at 0x10075170
Capabilities:
Enumerate process modules

Disassembly:
push 0xffffffffffffffff
push 0x10130448
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x120
mov eax, dword [0x10194180]
xor eax, esp
push ebx
push ebp
mov ebp, dword [esp + 0x138]
push esi
push edi
push 0
mov dword [esp + 0x130], eax
mov eax, dword [esp + 0x148]
push 0x410
push eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x1c], 0
call fcn.100750b0
mov dword [esp + 0x138], 1
mov eax, dword [esp + 0x18]
push 0x101457d0
lea ecx, [esp + 0x28]
push ecx
push 4
lea edx, [esp + 0x28]
push edx
push eax
call sub.PSAPI.DLL_EnumProcessModules
push eax
call fcn.1006e9e0
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
add esp, 8
push str.GetModuleBaseNameExA
push 0x104
lea ecx, [esp + 0x30]
push ecx
push edx
push eax
call sub.PSAPI.DLL_GetModuleFileNameExA
push eax
call fcn.1006ea20
lea eax, [esp + 0x30]
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10075225
sub eax, edx
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.10001520
mov edi, dword [ebp]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
lea esi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp]
mov byte [ebx + eax], 0
mov dword [esp + 0x10], 1
mov dword [esp + 0x138], 0
lea ecx, [esp + 0x14]
call fcn.1006e300
mov ecx, dword [esp + 0x130]
pop edi
pop esi
mov eax, ebp
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x120]
pop ebx
xor ecx, esp
call fcn.100571c6
add esp, 0x12c
ret

Function at 0x10077dbf
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x10194180]
push esi
mov dword [ebp + 0x74], eax
mov esi, ecx
call fcn.10077d8f
mov eax, 0x10000000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.1005a0e0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x10077e21
cmp dword [ebp - 0x1c], 5
jb 0x10077e39
jmp 0x10077e35
cmp dword [ebp - 0x10], 1
jne 0x10077e39
cmp dword [ebp - 0x1c], 4
ja 0x10077e35
jne 0x10077e39
cmp dword [ebp - 0x18], 0
jbe 0x10077e39
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x710
mov dword [esi + 0x14], 0x10145928
call fcn.10025830
test eax, eax
jge 0x10077e5a
mov byte [0x101a5bf0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
pop esi
call fcn.100571c6
add ebp, 0x78
leave
ret
Function at 0x10078d50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10130878
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov eax, dword [esp + 0x2c]
push esi
push str.:_Nonblocking_input_is_not_implemented_by_this_object.
mov esi, ecx
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.10002ce0
add esp, 0xc
push eax
push 0
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.10002510
cmp dword [esp + 0x1c], 0x10
mov dword [esi], vtable.CryptoPP::NotImplemented.0
jb 0x10078dae
mov edx, dword [esp + 8]
push edx
call fcn.101209d7
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [esi], 0x10146150
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x1007b0d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10130aa8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push 0x45
mov esi, ecx
push str.BufferedTransformation:_this_object_doesnt_support_multiple_channels
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.100020c0
lea eax, [esp + 4]
push eax
push 0
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.10002510
cmp dword [esp + 0x1c], 0x10
mov dword [esi], vtable.CryptoPP::NotImplemented.0
jb 0x1007b140
mov ecx, dword [esp + 8]
push ecx
call fcn.101209d7
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [esi], 0x10146150
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret

Function at 0x1007bd00
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x14]
mov ecx, ebx
push esi
shr ecx, 2
xor eax, eax
test ecx, ecx
push edi
mov edi, dword [esp + 0x18]
jbe 0x1007bd36
mov esi, edi
mov eax, edx
sub esi, edx
mov dword [esp + 0xc], ecx
push ebp
mov ebp, dword [esi + eax]
xor dword [eax], ebp
add eax, 4
dec ecx
jne 0x1007bd26
mov eax, dword [esp + 0x10]
pop ebp
shl eax, 2
sub ebx, eax
je 0x1007bd59
add edx, eax
add edi, eax
test ebx, ebx
jbe 0x1007bd59
mov ecx, edi
mov eax, edx
sub ecx, edx
mov esi, ebx
lea ecx, [ecx]
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
dec esi
jne 0x1007bd50
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x1007bd60
Capabilities:
Encode data using xor

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x20]
mov edx, edi
shr edx, 2
xor ecx, ecx
test edx, edx
jbe 0x1007bdac
mov edi, ebx
sub esi, eax
mov ecx, eax
sub edi, eax
mov dword [esp + 0xc], edx
push ebp
lea esp, [esp]
mov ebp, dword [esi + ecx]
xor ebp, dword [ecx]
add ecx, 4
dec edx
mov dword [edi + ecx - 4], ebp
jne 0x1007bd90
mov edi, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
pop ebp
shl ecx, 2
sub edi, ecx
je 0x1007bdd1
add ebx, ecx
add esi, ecx
add eax, ecx
test edi, edi
jbe 0x1007bdd1
mov ecx, esi
mov esi, ebx
sub ecx, eax
sub esi, eax
mov dl, byte [eax + ecx]
xor dl, byte [eax]
mov byte [eax + esi], dl
inc eax
dec edi
jne 0x1007bdc5
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x1007d100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10130c28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push 0x1d
mov esi, ecx
push str.FileStore:_error_reading_file
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.100020c0
lea eax, [esp + 4]
push eax
push 5
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.10002510
cmp dword [esp + 0x1c], 0x10
mov dword [esi], 0x10146314
jb 0x1007d170
mov ecx, dword [esp + 8]
push ecx
call fcn.101209d7
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [esi], 0x101463fc
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x1007d210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10130c28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push 0x1c
mov esi, ecx
push str.FileSink:_error_writing_file
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
call fcn.100020c0
lea eax, [esp + 4]
push eax
push 5
mov ecx, esi
mov dword [esp + 0x30], 0
call fcn.10002510
cmp dword [esp + 0x1c], 0x10
mov dword [esi], 0x10146314
jb 0x1007d280
mov ecx, dword [esp + 8]
push ecx
call fcn.101209d7
add esp, 4
mov ecx, dword [esp + 0x20]
mov dword [esi], 0x101463fc
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret
Function at 0x10082b90
Capabilities:
Hash data using sha256

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov ecx, 8
mov esi, 0x10148050
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
ret
Function at 0x10086a30
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x14]
push edi
push ebx
call fcn.10057566
mov esi, eax
add esp, 8
test esi, esi
jne 0x10086ac0
push 0x7a
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.10085780
push 0x1014aa44
push edi
push 0x1014aa40
push ebx
push str.fopen_
push 5
call fcn.10085360
add esp, 0x2c
call fcn.1005a508
cmp dword [eax], 2
jne 0x10086aa5
push 0x7d
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.10085780
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x7f
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.10085780
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x10195a34
call fcn.10086480
add esp, 4
mov edi, eax
test edi, edi
push esi
jne 0x10086ae2
call fcn.10057448
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 1
push 0x6a
push edi
call fcn.10086270
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x10087720
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call sub.WS2_32.dll_WSASetLastError
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov edx, dword [edi + 0x1c]
push 0
push eax
push ecx
push edx
call sub.WS2_32.dll_send
mov ecx, dword [edi + 0x14]
mov esi, eax
and ecx, 0xfffffff0
test esi, esi
mov dword [edi + 0x14], ecx
jg 0x10087772
je 0x10087758
cmp esi, 0xffffffff
jne 0x10087772
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 4
je 0x1008776e
cmp eax, 0xb
je 0x1008776e
cmp eax, 0x2733
jne 0x10087772
or dword [edi + 0x14], 0xa
pop edi
mov eax, esi
pop esi
ret
Function at 0x1008ddb0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.10057f70
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x1008ddf5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x1008ddf5
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x101946b8
call fcn.10105e33
add esp, 0xc
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.1005731f
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1008de6e
call fcn.1008dcf0
test eax, eax
je 0x1008de6e
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [ebp - 0x104]
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [ebp - 0x104]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1008e260
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x1008e2c3
mov al, byte [edi]
test al, al
je 0x1008e2c3
push ebx
push ebp
mov ebx, 0x100
lea esp, [esp]
movsx eax, al
or eax, ebx
mov edx, eax
shr edx, 2
xor edx, eax
and edx, 0xf
mov ecx, 0x20
sub ecx, edx
mov ebp, esi
shr ebp, cl
mov ecx, edx
shl esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edi + 1]
or ebp, esi
xor ebp, ecx
add ebx, 0x100
inc edi
test al, al
mov esi, ebp
jne 0x1008e280
pop ebp
mov eax, esi
pop ebx
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x100a1dd0
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x100a1eac
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
jl 0x100a1e46
movzx eax, byte [esi + 2]
xor edx, edx
mov dh, byte [esi]
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
inc ecx
mov eax, edx
shr eax, 6
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x100a1e99
movzx edx, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x100a1e58
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edi, 1
jne 0x100a1e86
mov edx, 0x3d
jmp 0x100a1e93
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
inc ecx
mov byte [ecx], 0x3d
sub edi, 3
inc ecx
add ebp, 4
add esi, 3
test edi, edi
jg 0x100a1df0
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x100b0500
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x18
call fcn.10057f70
push esi
mov esi, dword [esp + 0x24]
dec esi
push edi
mov edi, dword [esp + 0x30]
lea eax, [esi - 0x29]
cmp edi, eax
jle 0x100b0539
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.10085780
add esp, 0x14
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
cmp esi, 0x29
jge 0x100b055b
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.10085780
add esp, 0x14
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
push 0x37
lea eax, [esi - 0x14]
push str..crypto_rsa_rsa_oaep.c
push eax
mov dword [esp + 0x14], eax
call fcn.10087830
add esp, 0xc
test eax, eax
mov dword [esp + 0x28], eax
jne 0x100b0597
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.10085780
add esp, 0x14
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
mov byte [ebp], 0
lea ebx, [ebp + 1]
push 0
add ebp, 0x15
call fcn.1008c980
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push eax
push 0
push ebp
push ecx
push edx
call fcn.1008c8b0
mov ecx, esi
sub ecx, edi
sub ecx, 0x29
mov edx, ecx
shr ecx, 2
xor eax, eax
lea edi, [ebp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x50]
mov eax, ebp
sub eax, ecx
add eax, esi
mov esi, dword [esp + 0x4c]
mov edx, ecx
shr ecx, 2
mov byte [eax - 0x15], 1
lea edi, [eax - 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push 0x14
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.100847b0
add esp, 0x20
test eax, eax
jg 0x100b0617
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
call fcn.1008c980
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x30]
push eax
push 0x14
push ebx
push esi
push edi
call fcn.100b03f0
add esp, 0x14
test esi, esi
jle 0x100b0649
mov eax, ebp
sub edi, ebp
mov ecx, esi
lea esp, [esp]
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x100b0640
call fcn.1008c980
push eax
push esi
push ebp
lea eax, [esp + 0x20]
push 0x14
push eax
call fcn.100b03f0
lea ecx, [esp + 0x28]
lea esi, [esp + 0x29]
lea ebp, [esp + 0x2a]
lea edi, [esp + 0x2b]
lea edx, [esp + 0x2c]
add esp, 0x14
sub ecx, ebx
sub esi, ebx
sub ebp, ebx
sub edi, ebx
mov eax, ebx
sub edx, ebx
mov dword [esp + 0x38], 4
mov bl, byte [ecx + eax]
xor byte [eax], bl
mov bl, byte [esi + eax]
xor byte [eax + 1], bl
mov bl, byte [eax + ebp]
xor byte [eax + 2], bl
mov bl, byte [edi + eax]
xor byte [eax + 3], bl
mov bl, byte [edx + eax]
xor byte [eax + 4], bl
mov ebx, dword [esp + 0x38]
add eax, 5
dec ebx
mov dword [esp + 0x38], ebx
jne 0x100b0688
mov ecx, dword [esp + 0x30]
push ecx
call fcn.100879f0
add esp, 4
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x18
ret
Function at 0x100b06d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x2c
call fcn.10057f70
push ebx
push ebp
mov ebp, dword [esp + 0x48]
xor ebx, ebx
dec ebp
cmp ebp, 0x29
push esi
push edi
mov dword [esp + 0x10], ebx
jl 0x100b087a
mov eax, dword [esp + 0x4c]
mov edi, ebp
sub edi, eax
jns 0x100b0706
mov dword [esp + 0x10], 1
xor edi, edi
mov esi, dword [esp + 0x48]
push 0x7a
sub esi, edi
lea eax, [esi + 0x14]
add ebp, 0xffffffec
push str..crypto_rsa_rsa_oaep.c
push ebp
mov dword [esp + 0x5c], eax
call fcn.10087830
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x100b074c
push 0x7d
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x7a
push 4
call fcn.10085780
add esp, 0x14
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2c
ret
call fcn.1008c980
mov ecx, dword [esp + 0x50]
push eax
push ebp
push ecx
lea edx, [esp + 0x20]
push 0x14
push edx
call fcn.100b03f0
add esp, 0x14
cmp edi, 0x14
mov eax, edi
jge 0x100b0783
mov edi, edi
mov dl, byte [esp + eax + 0x14]
mov cl, byte [esi + eax]
xor dl, cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x14
jl 0x100b0770
call fcn.1008c980
push eax
push 0x14
lea edx, [esp + 0x1c]
push edx
push ebp
push ebx
call fcn.100b03f0
add esp, 0x14
test ebp, ebp
jle 0x100b07b1
mov esi, dword [esp + 0x50]
mov eax, ebx
sub esi, ebx
mov edi, ebp
mov cl, byte [esi + eax]
xor byte [eax], cl
inc eax
dec edi
jne 0x100b07a8
push 0
call fcn.1008c980
mov ecx, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x60]
push 0
lea edx, [esp + 0x34]
push edx
push eax
push ecx
call fcn.1008c8b0
add esp, 0x18
mov ecx, 5
lea edi, [esp + 0x28]
mov esi, ebx
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x100b087a
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x100b087a
mov eax, 0x14
cmp ebp, eax
jle 0x100b080b
lea esp, [esp]
cmp byte [eax + ebx], 0
jne 0x100b080b
inc eax
cmp eax, ebp
jl 0x100b0800
cmp byte [eax + ebx], 1
jne 0x100b087a
mov ecx, eax
inc eax
cmp ecx, ebp
jge 0x100b087a
mov ecx, dword [esp + 0x44]
sub ebp, eax
cmp ecx, ebp
jge 0x100b0850
push 0x9b
push str..crypto_rsa_rsa_oaep.c
push 0x6d
push 0x7a
push 4
call fcn.10085780
add esp, 0x14
push ebx
or ebp, 0xffffffff
call fcn.100879f0
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x2c
ret
mov edi, dword [esp + 0x40]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
lea esi, [eax + ebx]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.100879f0
add esp, 4
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x2c
ret
push 0xa8
push str..crypto_rsa_rsa_oaep.c
push 0x79
push 0x7a
push 4
call fcn.10085780
add esp, 0x14
test ebx, ebx
je 0x100b089f
push ebx
call fcn.100879f0
add esp, 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x2c
ret
Function at 0x100b0c50
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 0x10]
cmp dword [esp + 0x14], edx
jne 0x100b0d07
mov ecx, dword [esp + 0xc]
mov al, byte [ecx]
cmp al, 0x6a
je 0x100b0c70
cmp al, 0x6b
jne 0x100b0d07
cmp al, 0x6b
push esi
lea esi, [ecx + 1]
jne 0x100b0cc3
lea eax, [edx - 3]
xor edx, edx
test eax, eax
jle 0x100b0c93
mov cl, byte [esi]
inc esi
cmp cl, 0xba
je 0x100b0c93
cmp cl, 0xbb
jne 0x100b0ca0
inc edx
cmp edx, eax
jl 0x100b0c81
sub eax, edx
test edx, edx
jne 0x100b0cc6
push 0x8a
jmp 0x100b0ca5
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.10085780
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
lea eax, [edx - 2]
cmp byte [eax + esi], 0xcc
je 0x100b0cef
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.10085780
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push edi
mov edi, dword [esp + 0xc]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.10085780
add esp, 0x14
or eax, 0xffffffff
ret
Function at 0x100bb280
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc8
call fcn.10057f70
push ebx
push ebp
push esi
lea eax, [ecx + 0x54]
lea esi, [ecx + 0x14]
mov ecx, dword [esi + 0x3c]
push edi
lea ebp, [esp + 0x58]
lea edi, [esp + 0x98]
xor ebx, ebx
sub ebp, eax
sub edi, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
sub esi, eax
mov edx, dword [eax]
mov ecx, dword [esp + 0xdc]
movzx ecx, byte [ebx + ecx]
mov dword [eax + ebp - 0x40], edx
xor edx, ecx
mov dword [edi + eax], edx
mov edx, dword [esp + 0x10]
mov dword [eax + ebp], ecx
xor ecx, edx
mov edx, dword [ecx*4 + str._.C]
mov ecx, dword [esi + eax]
xor ecx, edx
mov dword [esi + eax], ecx
inc ebx
add eax, 4
cmp ebx, 0x10
mov dword [esp + 0x10], ecx
jl 0x100bb2b2
xor ecx, ecx
xor edx, edx
xor eax, eax
jmp 0x100bb300
mov ecx, dword [ecx*4 + str._.C]
mov edi, dword [esp + eax*4 + 0x18]
mov esi, dword [esp + eax*4 + 0x1c]
mov ebp, dword [esp + eax*4 + 0x20]
xor edi, ecx
mov ebx, dword [esp + eax*4 + 0x24]
mov ecx, edi
mov ecx, dword [ecx*4 + str._.C]
xor esi, ecx
mov ecx, esi
mov ecx, dword [ecx*4 + str._.C]
xor ebp, ecx
mov ecx, ebp
mov ecx, dword [ecx*4 + str._.C]
xor ebx, ecx
mov ecx, ebx
mov ecx, dword [ecx*4 + str._.C]
mov dword [esp + eax*4 + 0x18], edi
mov edi, dword [esp + eax*4 + 0x28]
xor edi, ecx
mov dword [esp + eax*4 + 0x1c], esi
mov esi, dword [esp + eax*4 + 0x2c]
mov ecx, edi
mov ecx, dword [ecx*4 + str._.C]
xor esi, ecx
mov dword [esp + eax*4 + 0x20], ebp
mov ebp, dword [esp + eax*4 + 0x30]
mov ecx, esi
mov ecx, dword [ecx*4 + str._.C]
xor ebp, ecx
mov dword [esp + eax*4 + 0x24], ebx
mov ebx, dword [esp + eax*4 + 0x34]
mov ecx, ebp
mov ecx, dword [ecx*4 + str._.C]
xor ebx, ecx
mov dword [esp + eax*4 + 0x28], edi
mov dword [esp + eax*4 + 0x2c], esi
mov dword [esp + eax*4 + 0x30], ebp
mov dword [esp + eax*4 + 0x34], ebx
add eax, 8
cmp eax, 0x30
mov ecx, ebx
jl 0x100bb300
add ecx, edx
and ecx, 0xff
inc edx
cmp edx, 0x12
jl 0x100bb2f1
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x18]
push 0xc0
mov ecx, 0x10
lea esi, [esp + 0x1c]
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.1008d7a0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc8
ret