joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d7da0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.1005d3c0
mov eax, dword [0x101c10e0]
xor eax, esp
mov dword [esp + 0x88], eax
mov edx, dword [esp + 0xa0]
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0xa0]
mov dword [esp + 4], edx
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [esp + 0xa8]
mov eax, dword [esi]
test ebx, ebx
je 0x100d7e08
cmp ebx, eax
je 0x100d7dff
test ebp, ebp
je 0x100d7f89
test edi, edi
js 0x100d7f89
mov ecx, 1
mov dword [esi], ebx
jmp 0x100d7e12
test eax, eax
je 0x100d7f89
mov ebx, eax
test ebp, ebp
je 0x100d7f80
push ebx
call fcn.100b6480
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x100d7e46
push 0x28
push str.cryptohmachmac.c
push str.assertion_failed:_j____int_sizeof_ctx__key_
call fcn.100c1260
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, edi
jge 0x100d7e97
push dword [esp + 0x10]
push ebx
push dword [esi + 4]
call fcn.100b1da0
add esp, 0xc
test eax, eax
je 0x100d7f89
push edi
push ebp
push dword [esi + 4]
call fcn.100b1f40
add esp, 0xc
test eax, eax
je 0x100d7f89
lea eax, [esi + 0x10]
push eax
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.100b1d00
add esp, 0xc
test eax, eax
je 0x100d7f89
mov edi, dword [esi + 0x10]
jmp 0x100d7eb4
cmp edi, 0x80
ja 0x100d7f89
push edi
lea eax, [esi + 0x14]
push ebp
push eax
call fcn.1005ec70
add esp, 0xc
mov dword [esi + 0x10], edi
cmp edi, 0x80
je 0x100d7ed4
mov eax, 0x80
sub eax, edi
push eax
lea eax, [esi + 0x14]
add eax, edi
push 0
push eax
call fcn.1005e5b0
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
nop word [eax + eax]
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x100d7ee0
push edx
push ebx
push dword [esi + 8]
call fcn.100b1da0
add esp, 0xc
test eax, eax
je 0x100d7f89
push ebx
call fcn.100b6480
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call fcn.100b1f40
add esp, 0x10
test eax, eax
je 0x100d7f89
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x100d7f25
push dword [esp + 0x10]
push ebx
push dword [esi + 0xc]
call fcn.100b1da0
add esp, 0xc
test eax, eax
je 0x100d7f89
push ebx
call fcn.100b6480
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.100b1f40
add esp, 0x10
test eax, eax
je 0x100d7f89
push dword [esi + 8]
push dword [esi + 4]
call fcn.100b20b0
add esp, 8
test eax, eax
je 0x100d7f89
mov eax, 1
jmp 0x100d7f8b
test ecx, ecx
je 0x100d7f67
jmp 0x100d7ed8
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1005cef4
add esp, 0x8c
ret
Function at 0x100dd600
Capabilities:
Resolve dns

Disassembly:
mov eax, 0x20
call fcn.1005d3c0
push esi
push edi
mov edi, dword [esp + 0x38]
xor esi, esi
mov eax, edi
sub eax, esi
je 0x100dd648
sub eax, 2
je 0x100dd648
sub eax, 0x15
je 0x100dd648
push 0x288
push str.crypto_bio_b_addr.c
push 0x83
push 0x87
push 0x20
call fcn.100b9ee0
add esp, 0x14
pop edi
xor eax, eax
pop esi
add esp, 0x20
ret
call fcn.100e0ee0
cmp eax, 1
jne 0x100dd640
cmp dword [esp + 0x34], 1
xorps xmm0, xmm0
mov eax, dword [esp + 0x3c]
movups xmmword [esp + 8], xmm0
mov dword [esp + 0xc], edi
movups xmmword [esp + 0x18], xmm0
mov dword [esp + 0x10], eax
jne 0x100dd677
or dword [esp + 8], 1
push dword [esp + 0x40]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x38]
push dword [esp + 0x38]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, eax
test edi, edi
je 0x100dd6c5
push 0x2b3
push str.crypto_bio_b_addr.c
push 2
push 0x87
push 0x20
call fcn.100b9ee0
push edi
call fcn.100ddac0
push eax
push 1
call fcn.100b9430
add esp, 0x20
pop edi
mov eax, esi
pop esi
add esp, 0x20
ret
mov esi, 1
pop edi
mov eax, esi
pop esi
add esp, 0x20
ret
Function at 0x100e0f60
Capabilities:
Set socket configuration

Disassembly:
mov eax, dword [esp + 8]
push esi
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
push 0x8004667e
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x100e0fa0
push 0xce
push 0x10195508
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call fcn.100b9ee0
add esp, 0x14
xor eax, eax
test esi, esi
pop esi
sete al
ret

Function at 0x100ef5f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ebp
push edi
sub ecx, 4
jb 0x100ef621
nop dword [eax]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x100ef628
add edx, 4
add esi, 4
sub ecx, 4
jae 0x100ef610
xor edi, edi
cmp ecx, 0xfffffffc
je 0x100ef663
movzx edi, byte [edx]
movzx eax, byte [esi]
sub edi, eax
jne 0x100ef663
cmp ecx, 0xfffffffd
je 0x100ef663
movzx edi, byte [edx + 1]
movzx eax, byte [esi + 1]
sub edi, eax
jne 0x100ef663
cmp ecx, 0xfffffffe
je 0x100ef663
movzx edi, byte [edx + 2]
movzx eax, byte [esi + 2]
sub edi, eax
jne 0x100ef663
cmp ecx, 0xffffffff
je 0x100ef663
movzx edi, byte [edx + 3]
movzx eax, byte [esi + 3]
sub edi, eax
test edi, edi
jle 0x100ef67e
push 0x157
push str.cryptox509v3_v3_addr.c
push str.assertion_failed:_memcmp_min__max__length____0
call fcn.100c1260
add esp, 0xc
mov edi, dword [esp + 0x14]
xor ecx, ecx
test ebx, ebx
jle 0x100ef69d
mov esi, edi
mov edx, ebp
sub esi, ebp
nop
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x100ef69d
inc ecx
inc edx
cmp ecx, ebx
jl 0x100ef690
lea edx, [ebx - 1]
test edx, edx
js 0x100ef6c1
mov esi, edi
lea eax, [edx + ebp]
sub esi, ebp
nop dword [eax + eax]
cmp byte [eax + esi], 0
jne 0x100ef6c1
cmp byte [eax], 0xff
jne 0x100ef6c1
dec eax
sub edx, 1
jns 0x100ef6b0
cmp ecx, edx
jl case.0x100ef6ed.2
jle 0x100ef6d3
pop edi
pop esi
pop ebp
lea eax, [ecx*8]
pop ebx
ret
mov bl, byte [ecx + ebp]
mov dh, byte [ecx + edi]
mov dl, bl
xor dl, dh
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x100ef6ed.2
movzx eax, byte [eax + 0x100ef760]
jmp dword [eax*4 + 0x100ef740]
mov eax, 7
jmp 0x100ef723
mov eax, 6
jmp 0x100ef723
mov eax, 5
jmp 0x100ef723
mov eax, 4
jmp 0x100ef723
mov eax, 3
jmp 0x100ef723
mov eax, 2
jmp 0x100ef723
mov eax, 1
test dl, dh
jne case.0x100ef6ed.2
and bl, dl
cmp bl, dl
jne case.0x100ef6ed.2
pop edi
pop esi
pop ebp
lea eax, [eax + ecx*8]
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x100fbc60
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [esp + 0xc]
push ebp
xor ebp, ebp
test edx, edx
jle 0x100fbd42
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
inc edi
nop dword [eax + eax]
movzx eax, byte [edi - 1]
cmp edx, 3
jl 0x100fbcd3
movzx ecx, byte [edi]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 1]
shl eax, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], cl
mov ecx, eax
shr ecx, 0xc
inc esi
and ecx, 0x3f
mov ebx, esi
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], cl
mov ecx, eax
and ecx, 0x3f
shr eax, 6
and eax, 0x3f
mov ch, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x100fbd1c
shl eax, 0x10
cmp edx, 2
jne 0x100fbce3
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
lea ebx, [esi + 1]
shr ecx, 0x12
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [esi], cl
mov ecx, eax
shr ecx, 0xc
mov esi, ebx
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx], cl
cmp edx, 1
jne 0x100fbd0e
mov cl, 0x3d
jmp 0x100fbd1a
shr eax, 6
and eax, 0x3f
mov cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ch, 0x3d
lea eax, [esi + 2]
mov byte [ebx + 1], cl
sub edx, 3
mov byte [eax], ch
add ebp, 4
lea esi, [eax + 1]
add edi, 3
test edx, edx
jg 0x100fbc80
pop edi
mov byte [esi], 0
mov eax, ebp
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esp + 8]
mov byte [eax], 0
mov eax, ebp
pop ebp
ret
Function at 0x100ff960
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
cmp ebx, 2
je 0x100ff9bc
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100ff9ad
push eax
push 0
lea eax, [esp + 0x24]
push eax
push 0
call fcn.100ea0b0
add esp, 0x10
cmp dword [esp + 0x1c], 0xffffffff
je 0x100ff9ad
push 0x2f
push str.cryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call fcn.100b9ee0
add esp, 0x14
xor eax, eax
pop edi
pop ebx
ret
test edi, edi
je 0x100ff9b8
cmp dword [esp + 0x18], 0x20
je 0x100ff9bc
push 0x35
jmp 0x100ff992
push esi
push 0x3a
push str.cryptoececx_meth.c
push 0x24
call fcn.100ac950
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x100ff9f2
push 0x3c
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.100b9ee0
add esp, 0x14
xor eax, eax
pop esi
pop edi
pop ebx
ret
test ebx, ebx
jne 0x100ffa09
push dword [esp + 0x1c]
push edi
push esi
call fcn.1005ec70
add esp, 0xc
jmp 0x100ffab3
push 0x43
push str.cryptoececx_meth.c
push 0x20
call fcn.100fa150
add esp, 0xc
mov dword [esi + 0x20], eax
test eax, eax
jne 0x100ffa4c
push 0x45
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.100b9ee0
push 0x46
push str.cryptoececx_meth.c
push esi
call fcn.100ac740
add esp, 0x20
xor eax, eax
pop esi
pop edi
pop ebx
ret
cmp ebx, 2
jne 0x100ffa99
push 0x20
push eax
call fcn.100b7490
mov ecx, dword [esi + 0x20]
add esp, 8
test eax, eax
jg 0x100ffa86
push 0x4b
push str.cryptoececx_meth.c
push ecx
call fcn.100fa140
push 0x4c
push str.cryptoececx_meth.c
push esi
call fcn.100ac740
add esp, 0x18
xor eax, eax
pop esi
pop edi
pop ebx
ret
and byte [ecx], 0xf8
mov eax, dword [esi + 0x20]
and byte [eax + 0x1f], 0x7f
mov eax, dword [esi + 0x20]
or byte [eax + 0x1f], 0x40
jmp 0x100ffaa7
movups xmm0, xmmword [edi]
movups xmmword [eax], xmm0
movups xmm0, xmmword [edi + 0x10]
movups xmmword [eax + 0x10], xmm0
push dword [esi + 0x20]
push esi
call fcn.1012bd40
add esp, 8
push esi
push 0x40a
push dword [esp + 0x18]
call fcn.100b2660
add esp, 0xc
mov eax, 1
pop esi
pop edi
pop ebx
ret
Function at 0x10110d70
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.1005d3c0
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x34]
mov edi, dword [edi]
mov dword [esp + 0x14], edi
test edi, edi
je 0x10110db9
mov ecx, dword [esp + 0x30]
nop dword [eax]
test esi, esi
je 0x10110db9
mov al, byte [edi + ecx]
dec esi
xor al, byte [ebp]
inc edi
mov byte [ebx], al
inc ebp
inc ebx
and edi, 0xf
mov dword [esp + 0x14], edi
jne 0x10110da0
mov ecx, dword [esp + 0x2c]
movzx edx, byte [ecx + 0xc]
movzx eax, byte [ecx + 0xd]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xe]
shl edx, 8
or edx, eax
movzx eax, byte [ecx + 0xf]
shl edx, 8
or edx, eax
mov dword [esp + 0x24], edx
cmp esi, 0x10
jb 0x10110e88
mov edi, ecx
nop dword [eax + eax]
mov ecx, esi
shr ecx, 4
push edi
push dword [esp + 0x2c]
lea eax, [ecx + edx]
neg edx
cmp eax, ecx
cmovae edx, ecx
mov dword [esp + 0x18], edx
xor edx, edx
push dword [esp + 0x18]
cmp eax, ecx
push ebx
cmovae edx, eax
push ebp
mov dword [esp + 0x38], edx
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, edx
mov byte [edi + 0xf], dl
shr eax, 0x18
mov byte [edi + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 0xd], al
mov eax, edx
shr eax, 8
mov byte [edi + 0xe], al
test edx, edx
jne 0x10110e66
mov edx, 0xc
mov eax, 1
nop dword [eax]
movzx ecx, byte [edx + edi - 1]
dec edx
add eax, ecx
mov byte [edx + edi], al
shr eax, 8
test edx, edx
jne 0x10110e50
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
shl eax, 4
sub esi, eax
add ebx, eax
add ebp, eax
cmp esi, 0x10
jae 0x10110df0
mov edi, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x24], edx
test esi, esi
je 0x10110ef6
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
push ecx
push dword [esp + 0x2c]
push 1
push eax
push eax
movups xmmword [eax], xmm0
call dword [esp + 0x4c]
mov ecx, dword [esp + 0x38]
add esp, 0x14
mov edx, dword [esp + 0x2c]
inc ecx
mov eax, ecx
shr eax, 0x18
mov byte [edx + 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [edx + 0xe], al
mov byte [edx + 0xf], cl
test ecx, ecx
jne 0x10110ed7
push edx
call fcn.10110f40
add esp, 4
mov eax, dword [esp + 0x30]
sub ebp, eax
sub ebx, eax
lea ecx, [edi + eax]
add edi, esi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ebx + ecx - 1], al
sub esi, 1
jne 0x10110ee4
mov eax, dword [esp + 0x34]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10111510
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.1005d3c0
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x38]
or eax, dword [ebp + 0x3c]
je 0x1011152f
mov eax, 0xfffffffe
pop ebp
pop ecx
ret
push esi
mov esi, dword [esp + 0x18]
xor ecx, ecx
mov eax, esi
add eax, dword [ebp + 0x30]
adc ecx, dword [ebp + 0x34]
cmp ecx, 0x20000000
ja 0x101115f9
jb 0x10111554
test eax, eax
jne 0x101115f9
push ebx
mov ebx, dword [esp + 0x18]
push edi
mov edi, dword [ebp + 0x16c]
mov dword [ebp + 0x34], ecx
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x30], eax
test edi, edi
je 0x101115a5
nop dword [eax]
test esi, esi
je 0x1011158a
mov al, byte [ebx]
lea ecx, [ebp + 0x40]
xor byte [ecx + edi], al
inc ebx
inc edi
mov dword [esp + 0x18], ecx
dec esi
and edi, 0xf
jne 0x10111570
jmp 0x10111592
mov dword [esp + 0x18], ecx
test edi, edi
jne 0x101115eb
lea eax, [ebp + 0x60]
push eax
push ecx
call fcn.10112970
mov ecx, dword [esp + 0x20]
add esp, 8
jmp 0x101115a9
mov dword [esp + 0x18], ecx
mov eax, esi
lea edx, [ebp + 0x60]
and eax, 0xfffffff0
mov dword [esp + 0x10], eax
je 0x101115cb
push eax
push ebx
push edx
push ecx
call fcn.10112740
add ebx, dword [esp + 0x20]
add esp, 0x10
sub esi, dword [esp + 0x10]
test esi, esi
je 0x101115eb
xor ecx, ecx
mov edi, esi
test esi, esi
je 0x101115eb
mov edx, dword [esp + 0x18]
nop dword [eax + eax]
mov al, byte [ecx + ebx]
xor byte [edx + ecx], al
inc ecx
cmp ecx, esi
jb 0x101115e0
mov dword [ebp + 0x16c], edi
xor eax, eax
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret
pop esi
or eax, 0xffffffff
pop ebp
pop ecx
ret
Function at 0x10112150
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.1005d3c0
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
push edi
mov eax, dword [ebx + 0x30]
mov esi, dword [ebx + 0x34]
mov ecx, dword [ebx + 0x38]
mov edi, dword [ebx + 0x3c]
shld esi, eax, 3
shld edi, ecx, 3
shl eax, 3
shl ecx, 3
cmp dword [ebx + 0x168], 0
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], ecx
jne 0x1011219e
cmp dword [ebx + 0x16c], 0
je 0x101121b6
lea eax, [ebx + 0x60]
push eax
lea eax, [ebx + 0x40]
push eax
call fcn.10112970
mov eax, dword [esp + 0x1c]
add esp, 8
mov ecx, dword [esp + 0x10]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x38], ecx
mov ecx, eax
mov dword [ebx + 0x34], esi
mov eax, esi
shrd ecx, eax, 8
mov dword [ebx + 0x3c], edi
movzx eax, cl
cdq
mov ebx, eax
mov ecx, dword [esp + 0x14]
mov ebp, edx
movzx eax, cl
cdq
shld edx, eax, 8
shl eax, 8
or ebp, edx
or ebx, eax
mov eax, esi
shrd ecx, eax, 0x10
shld ebp, ebx, 8
movzx eax, cl
mov ecx, dword [esp + 0x14]
cdq
shl ebx, 8
or ebp, edx
or ebx, eax
mov eax, esi
shrd ecx, eax, 0x18
shld ebp, ebx, 8
movzx eax, cl
mov ecx, dword [esp + 0x1c]
cdq
shl ebx, 8
or ebp, edx
or ebx, eax
movzx eax, cl
cdq
shld ebp, ebx, 8
shl ebx, 8
or ebp, edx
or ebx, eax
mov eax, ecx
shr eax, 8
movzx eax, al
cdq
shld ebp, ebx, 8
shl ebx, 8
or ebp, edx
or ebx, eax
mov eax, ecx
shr eax, 0x10
movzx eax, al
cdq
shld ebp, ebx, 8
shr ecx, 0x18
shl ebx, 8
or ebp, edx
or ebx, eax
mov eax, edi
shld ebp, ebx, 8
shl ebx, 8
or ebx, ecx
mov ecx, dword [esp + 0x10]
shrd ecx, eax, 8
movzx eax, cl
mov ecx, dword [esp + 0x10]
cdq
mov esi, eax
mov edi, edx
movzx eax, cl
cdq
shld edx, eax, 8
shl eax, 8
or edi, edx
or esi, eax
mov eax, dword [esp + 0x18]
shld edi, esi, 8
shl esi, 8
shrd ecx, eax, 0x10
movzx eax, cl
mov ecx, dword [esp + 0x10]
cdq
or esi, eax
or edi, edx
mov eax, dword [esp + 0x18]
shrd ecx, eax, 0x18
shld edi, esi, 8
movzx eax, cl
mov ecx, dword [esp + 0x18]
cdq
shl esi, 8
or edi, edx
or esi, eax
movzx eax, cl
shld edi, esi, 8
cdq
shl esi, 8
or edi, edx
or esi, eax
mov eax, ecx
shld edi, esi, 8
shr eax, 8
movzx eax, al
cdq
shl esi, 8
or edi, edx
or esi, eax
mov eax, ecx
shld edi, esi, 8
shr eax, 0x10
movzx eax, al
shl esi, 8
cdq
or esi, eax
shr ecx, 0x18
or edi, edx
shld edi, esi, 8
shl esi, 8
or esi, ecx
mov ecx, dword [esp + 0x24]
add ecx, 0x40
xor dword [ecx], ebx
mov ebx, dword [esp + 0x24]
xor dword [ecx + 4], ebp
xor dword [ebx + 0x48], esi
lea eax, [ebx + 0x60]
xor dword [ebx + 0x4c], edi
push eax
push ecx
call fcn.10112970
mov eax, dword [ebx + 0x20]
lea ecx, [ebx + 0x40]
xor dword [ecx], eax
add esp, 8
mov eax, dword [ebx + 0x24]
xor dword [ecx + 4], eax
mov eax, dword [ebx + 0x28]
xor dword [ebx + 0x48], eax
mov eax, dword [ebx + 0x2c]
xor dword [ebx + 0x4c], eax
mov edx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
test edx, edx
je 0x1011235e
mov eax, dword [esp + 0x1c]
cmp eax, 0x10
ja 0x1011235e
add esp, 0x10
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
jmp fcn.100c1230
or eax, 0xffffffff
add esp, 0x10
ret
Function at 0x10115400
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.1005d3c0
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
mov ebx, dword [ebp + 0x14]
cmp esi, ebx
jbe 0x101154ad
mov ecx, dword [ebp + 0x18]
cmp esi, ecx
jb 0x1011545a
mov eax, esi
sub eax, ecx
add eax, 4
and eax, 0xfffffffc
add eax, ecx
push 0x7a
mov dword [ebp + 0x18], eax
push str.cryptomodesocb128.c
shl eax, 4
push eax
push dword [ebp + 0x40]
call fcn.100ac760
add esp, 0x10
test eax, eax
jne 0x10115457
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov dword [ebp + 0x40], eax
cmp ebx, esi
jae 0x101154aa
mov eax, ebx
shl eax, 4
mov dword [esp + 0xc], eax
mov eax, esi
mov esi, dword [esp + 0xc]
sub eax, ebx
mov dword [esp + 0x18], eax
push edi
mov ecx, dword [ebp + 0x40]
add ecx, esi
mov al, byte [ecx]
lea edi, [ecx + 0x10]
push edi
shr al, 7
movzx eax, al
push 1
push ecx
imul ebx, eax, 0x87
call fcn.10115240
xor byte [edi + 0xf], bl
add esp, 0xc
add esi, 0x10
sub dword [esp + 0x1c], 1
jne 0x10115474
mov esi, dword [esp + 0x20]
mov ebx, esi
pop edi
mov dword [ebp + 0x14], ebx
shl esi, 4
add esi, dword [ebp + 0x40]
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10115580
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, 0x88
call fcn.1005d3c0
mov eax, dword [0x101c10e0]
xor eax, esp
mov dword [esp + 0x84], eax
mov ecx, dword [esp + 0x98]
push edi
mov edi, dword [esp + 0x90]
mov dword [esp + 0x48], 0x61707865
mov eax, dword [ecx]
mov dword [esp + 0x58], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x5c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x60], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x64], eax
mov eax, dword [ecx + 0x10]
mov dword [esp + 0x68], eax
mov eax, dword [ecx + 0x14]
mov dword [esp + 0x6c], eax
mov eax, dword [ecx + 0x18]
mov dword [esp + 0x70], eax
mov eax, dword [ecx + 0x1c]
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0x74], eax
mov dword [esp + 0x4c], 0x3320646e
mov dword [esp + 0x50], 0x79622d32
mov eax, dword [ecx]
mov dword [esp + 0x78], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x7c], eax
mov eax, dword [ecx + 8]
mov dword [esp + 0x80], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x98]
mov dword [esp + 0x54], 0x6b206574
test eax, eax
je 0x10115757
push ebx
mov ebx, dword [esp + 0x98]
push ebp
push esi
nop
mov esi, 0x40
cmp eax, esi
cmovb esi, eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.10115770
add esp, 8
xor eax, eax
test esi, esi
je 0x1011572a
cmp esi, 0x40
jb 0x101156f1
lea edx, [edi - 1]
lea ecx, [esp + esi + 0x13]
add edx, esi
cmp edi, ecx
ja 0x10115684
lea ecx, [esp + 0x14]
cmp edx, ecx
jae 0x101156f1
lea ecx, [ebx - 1]
add ecx, esi
cmp edi, ecx
ja 0x10115691
cmp edx, ebx
jae 0x101156f1
mov edx, esi
lea ecx, [edi + 0x10]
mov ebp, ebx
and edx, 0xffffffc0
sub ebp, edi
nop dword [eax]
movups xmm0, xmmword [esp + eax + 0x14]
lea ecx, [ecx + 0x40]
movups xmm1, xmmword [ebx + eax]
pxor xmm1, xmm0
movups xmm0, xmmword [esp + eax + 0x24]
movups xmmword [edi + eax], xmm1
movups xmm1, xmmword [ecx + ebp - 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [esp + eax + 0x34]
movups xmmword [ecx - 0x40], xmm1
movups xmm1, xmmword [ebx + eax + 0x20]
pxor xmm1, xmm0
movups xmm0, xmmword [esp + eax + 0x44]
movups xmmword [ecx - 0x30], xmm1
movups xmm1, xmmword [ebx + eax + 0x30]
add eax, 0x40
pxor xmm1, xmm0
movups xmmword [ecx - 0x20], xmm1
cmp eax, edx
jb 0x101156a0
cmp eax, esi
jae 0x1011572a
mov ebp, ebx
lea ecx, [esp + 0x14]
sub ebp, ecx
lea edx, [esp + 0x14]
mov ecx, edi
sub ecx, edx
mov dword [esp + 0x10], ecx
mov ebx, ecx
nop dword [eax + eax]
lea edx, [esp + 0x14]
add edx, eax
inc eax
mov cl, byte [edx + ebp]
xor cl, byte [edx]
mov byte [ebx + edx], cl
cmp eax, esi
jb 0x10115710
mov ebx, dword [esp + 0xa0]
mov eax, dword [esp + 0xa4]
add ebx, esi
inc dword [esp + 0x84]
sub eax, esi
add edi, esi
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], eax
test eax, eax
jne 0x10115640
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x88]
pop edi
xor ecx, esp
call fcn.1005cef4
add esp, 0x88
ret
Function at 0x101187e0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x101187f4
mov dword [esp + 0x18], fcn.10116fb0
jmp fcn.10110ab0
mov dword [esp + 0x18], fcn.10116250
jmp fcn.101107f0
Function at 0x1011d6f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
call fcn.100855a0
add esp, 4
cmp eax, 0x72
jne 0x1011d85c
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov edi, eax
push esi
push dword [esp + 0x2c]
and eax, 1
shr edi, 1
push dword [esp + 0x2c]
push dword [esp + 0x2c]
lea ebp, [eax + edi]
push ebp
push dword [esp + 0x2c]
call fcn.100b2370
push eax
call fcn.1011d480
add esp, 0x1c
test eax, eax
je 0x1011d791
push 0xf8
push str.cryptokdf_tls1_prf.c
push esi
call fcn.100ac710
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1011d791
mov ecx, dword [esp + 0x18]
push esi
push ebx
push dword [esp + 0x2c]
add ecx, edi
push dword [esp + 0x2c]
push ebp
push ecx
call fcn.100b2610
push eax
call fcn.1011d480
add esp, 0x1c
test eax, eax
jne 0x1011d798
push 0xfd
push str.cryptokdf_tls1_prf.c
push esi
push ebx
call fcn.100ac810
add esp, 0x10
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
xor edi, edi
test esi, esi
je 0x1011d83e
mov edx, dword [esp + 0x28]
cmp esi, 0x40
jb 0x1011d81d
lea eax, [esi - 1]
lea ecx, [edx - 1]
add eax, ebx
add ecx, esi
cmp edx, eax
ja 0x1011d7bd
cmp ecx, ebx
jae 0x1011d81d
mov ecx, esi
mov ebp, ebx
and ecx, 0xffffffc0
mov eax, edx
sub ebp, edx
nop dword [eax + eax]
movups xmm0, xmmword [eax]
lea eax, [eax + 0x40]
movups xmm1, xmmword [eax + ebp - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [ebx + edi + 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm0, xmmword [eax - 0x20]
movups xmm1, xmmword [ebx + edi + 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm0, xmmword [eax - 0x10]
movups xmm1, xmmword [ebx + edi + 0x30]
add edi, 0x40
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edi, ecx
jb 0x1011d7d0
cmp edi, esi
jae 0x1011d83e
mov ebp, ebx
lea ecx, [edi + edx]
sub ebp, edx
mov edx, esi
sub edx, edi
nop dword [eax]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub edx, 1
jne 0x1011d830
push 0x102
push str.cryptokdf_tls1_prf.c
push esi
push ebx
call fcn.100ac810
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
ret
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push esi
call fcn.1011d480
add esp, 0x1c
test eax, eax
je 0x1011d791
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret