joyce8/EMBER2024-capa huggingface dataset:
Function at 0x61d1d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov cl, byte [esp + 0x10]
movzx eax, cl
push esi
mov esi, dword [esp + 0x10]
and eax, 1
test esi, esi
je 0x61d212
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
add edi, esi
add ebx, esi
movzx edx, byte [edi - 1]
lea edi, [edi - 1]
movzx ecx, cl
lea ebx, [ebx - 1]
xor edx, ecx
mov cl, byte [esp + 0x1c]
add eax, edx
mov byte [ebx], al
shr eax, 8
sub esi, 1
jne 0x61d1f1
pop edi
pop ebx
pop esi
ret

Function at 0x61fa80
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.006df660
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
call fcn.0061f6e0
mov ebx, eax
push ebx
push esi
call fcn.0061f5f0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x61faff
push 0xf0000040
push 1
xor edi, edi
lea eax, [esp + 0x18]
push edi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x61fae3
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.0061f680
push esi
call fcn.0061f7c0
add esp, 0x10
test eax, eax
jne 0x61fb79
push 1
push esi
call fcn.0061f6e0
mov ebx, eax
push ebx
push esi
call fcn.0061f5f0
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x61fb70
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
lea eax, [esp + 0x1c]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x61fb54
push ebp
push ebx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
push 0
push dword [esp + 0x14]
test eax, eax
cmovne edi, ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.0061f680
push esi
call fcn.0061f7c0
add esp, 0x10
test eax, eax
jne 0x61fb79
push esi
call fcn.0061f7c0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x623a90
Capabilities:
Connect socket
Set socket configuration

Disassembly:
mov eax, 4
call fcn.006df660
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 1
cmp edi, 0xffffffff
jne 0x623ad8
call fcn.005cc9b0
push str.BIO_connect
push 0x54
push str.crypto_bio_bio_sock2.c
call fcn.005ccab0
push 0
push 0x87
push 0x20
call fcn.005ccb60
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x18]
mov eax, ebx
shr eax, 3
push esi
and eax, 1
push eax
push edi
call fcn.005f8770
add esp, 8
test eax, eax
je 0x623b67
mov esi, dword [sym.imp.WS2_32.dll_setsockopt]
test bl, 4
je 0x623b6e
push 4
lea eax, [esp + 0x10]
push eax
push 8
push 0xffff
push edi
call esi
test eax, eax
je 0x623b6e
call fcn.005cc9b0
push str.BIO_connect
push 0x5e
push str.crypto_bio_bio_sock2.c
call fcn.005ccab0
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.005ccb60
call fcn.005cc9b0
push str.BIO_connect
push 0x60
push str.crypto_bio_bio_sock2.c
call fcn.005ccab0
push 0
push 0x89
push 0x20
call fcn.005ccb60
add esp, 0x24
pop esi
pop ebx
xor eax, eax
pop edi
pop ecx
ret
test bl, 0x10
je 0x623bdf
push 4
lea eax, [esp + 0x10]
push eax
push 1
push 6
push edi
call esi
test eax, eax
je 0x623bdf
call fcn.005cc9b0
push str.BIO_connect
push 0x68
push str.crypto_bio_bio_sock2.c
call fcn.005ccab0
add esp, 0xc
push str.calling_setsockopt__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.005ccb60
call fcn.005cc9b0
push str.BIO_connect
push 0x6a
push str.crypto_bio_bio_sock2.c
call fcn.005ccab0
push 0
push 0x8a
push 0x20
call fcn.005ccb60
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
mov esi, dword [esp + 0x18]
push esi
call fcn.005f5140
add esp, 4
push eax
push esi
call fcn.00462980
add esp, 4
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x623c6b
push eax
call fcn.005cb570
add esp, 4
test eax, eax
jne 0x623b67
call fcn.005cc9b0
push str.BIO_connect
push 0x72
push str.crypto_bio_bio_sock2.c
call fcn.005ccab0
add esp, 0xc
push str.calling_connect__
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 2
call fcn.005ccb60
call fcn.005cc9b0
push str.BIO_connect
push 0x74
push str.crypto_bio_bio_sock2.c
call fcn.005ccab0
push 0
push 0x67
push 0x20
call fcn.005ccb60
add esp, 0x24
xor eax, eax
pop esi
pop ebx
pop edi
pop ecx
ret
pop esi
pop ebx
mov eax, 1
pop edi
pop ecx
ret
Function at 0x646780
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x646849
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x6467a1
cmp al, 0x6b
jne 0x646849
inc ecx
cmp al, 0x6b
jne 0x646802
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x6467c2
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x6467c2
cmp dl, 0xbb
jne 0x6467d6
inc eax
cmp eax, esi
jl 0x6467b0
sub esi, eax
test eax, eax
jne 0x646805
call fcn.005cc9b0
push str.RSA_padding_check_X931
push 0x56
jmp 0x6467e2
call fcn.005cc9b0
push str.RSA_padding_check_X931
push 0x4e
push str.crypto_rsa_rsa_x931.c
call fcn.005ccab0
push 0
push 0x8a
push 4
call fcn.005ccb60
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x646837
call fcn.005cc9b0
push str.RSA_padding_check_X931
push 0x5f
push str.crypto_rsa_rsa_x931.c
call fcn.005ccab0
push 0
push 0x8b
push 4
call fcn.005ccb60
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call fcn.006e0e90
add esp, 0xc
mov eax, esi
pop esi
ret
call fcn.005cc9b0
push str.RSA_padding_check_X931
push 0x43
push str.crypto_rsa_rsa_x931.c
call fcn.005ccab0
push 0
push 0x89
push 4
call fcn.005ccb60
add esp, 0x18
or eax, 0xffffffff
pop esi
ret
Function at 0x652a00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.006df660
mov eax, dword [0x7f9c40]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xa4]
push ebx
mov ebx, dword [esp + 0xcc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xb0]
push ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xbc]
push esi
mov esi, dword [esp + 0xc4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xcc]
push edi
mov edi, dword [esp + 0xc0]
push ecx
mov ebp, dword [eax]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], ebx
call fcn.0060f820
push ebp
push 0
push ebx
mov dword [esp + 0x2c], eax
call fcn.00679c80
add esp, 0x10
test eax, eax
je 0x652bf1
mov ebx, dword [esp + 0xcc]
inc ebp
test ebx, ebx
mov ebx, dword [esp + 0x10]
je 0x652ab4
push 0
push esi
push ebx
push dword [esp + 0x28]
call fcn.005bfa50
add esp, 0x10
test eax, eax
jle 0x652bf2
push esi
push ebx
push edi
call fcn.006e0e90
push esi
lea eax, [esp + 0x7c]
push ebx
push eax
call fcn.006e0e90
lea eax, [esi - 1]
add esp, 0x18
test eax, eax
js 0x652add
add byte [edi + eax], 1
jne 0x652add
sub eax, 1
jns 0x652ad2
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x34]
push 0
push eax
push esi
push ebx
call fcn.005b2ba0
add esp, 0x18
test eax, eax
je 0x652bf2
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x74]
push 0
push eax
push esi
push edi
call fcn.005b2ba0
add esp, 0x18
test eax, eax
je 0x652bf2
xor eax, eax
test esi, esi
jle 0x652b9d
cmp esi, 0x40
jb 0x652b90
mov ecx, esi
and ecx, 0xffffffc0
nop dword [eax + eax]
movups xmm0, xmmword [esp + eax + 0x2c]
movups xmm1, xmmword [esp + eax + 0x6c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x2c], xmm1
movups xmm0, xmmword [esp + eax + 0x3c]
movups xmm1, xmmword [esp + eax + 0x7c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x3c], xmm1
movups xmm0, xmmword [esp + eax + 0x4c]
movups xmm1, xmmword [esp + eax + 0x8c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x4c], xmm1
movups xmm0, xmmword [esp + eax + 0x5c]
movups xmm1, xmmword [esp + eax + 0x9c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x5c], xmm1
add eax, 0x40
cmp eax, ecx
jl 0x652b30
cmp eax, esi
jge 0x652b9d
nop dword [eax]
mov cl, byte [esp + eax + 0x6c]
xor byte [esp + eax + 0x2c], cl
inc eax
cmp eax, esi
jl 0x652b90
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0x2c]
or byte [esp + 0x2c], 0x80
or byte [esp + esi + 0x2b], 1
push ebx
push esi
push eax
call fcn.005ada70
add esp, 0xc
test eax, eax
je 0x652bf2
push dword [esp + 0x18]
push dword [esp + 0x28]
push ebx
call fcn.00679cd0
add esp, 0xc
test eax, eax
jg 0x652c13
jne 0x652bf2
push ebp
push 0
push dword [esp + 0x20]
mov ebx, 1
call fcn.00679c80
add esp, 0xc
test eax, eax
jne 0x652a93
inc ebp
xor eax, eax
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword [ecx], ebp
mov ecx, dword [esp + 0xa4]
pop ebp
pop ebx
xor ecx, esp
call fcn.006def69
add esp, 0xa0
ret
mov eax, 1
jmp 0x652bf4
Function at 0x655230
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp ebp, 2
je 0x655309
mov esi, dword [esp + 0x10]
test esi, esi
je 0x6552be
push esi
push 0
lea eax, [esp + 0x28]
push eax
push 0
call fcn.005bb8a0
add esp, 0x10
cmp dword [esp + 0x20], 0xffffffff
je 0x655292
call fcn.005cc9b0
push str.ossl_ecx_key_op
push 0xad
push str.cryptoececx_backend.c
call fcn.005ccab0
push 0
push 0x66
push 0x10
call fcn.005ccb60
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
ret
mov eax, dword [esi]
mov esi, dword [esp + 0x1c]
push eax
call fcn.005b1ff0
add esp, 4
test esi, esi
jne 0x6552a9
mov esi, eax
jmp 0x6552c2
cmp esi, eax
je 0x6552c2
call fcn.005cc9b0
push str.ossl_ecx_key_op
push 0xb3
jmp 0x655274
mov esi, dword [esp + 0x1c]
test edi, edi
je 0x6552f5
test esi, esi
je 0x6552f5
cmp esi, 0x40a
je 0x6552ea
cmp esi, 0x43f
je 0x6552ea
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x6552ef
mov eax, 0x20
cmp dword [esp + 0x18], eax
je 0x65530d
call fcn.005cc9b0
push str.ossl_ecx_key_op
push 0xb9
jmp 0x655274
mov esi, dword [esp + 0x1c]
cmp esi, 0x40a
je 0x655331
cmp esi, 0x43f
je 0x655331
xor eax, eax
cmp esi, 0x40b
setne al
lea eax, [eax*2 + 1]
jmp 0x655341
xor ecx, ecx
mov eax, 2
cmp esi, 0x40a
cmove eax, ecx
push ebx
push dword [esp + 0x2c]
push 1
push eax
push dword [esp + 0x34]
call fcn.00605950
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x65538b
call fcn.005cc9b0
push str.ossl_ecx_key_op
push 0xc0
push str.cryptoececx_backend.c
call fcn.005ccab0
push ebx
push 0xc0100
push 0x10
call fcn.005ccb60
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
test ebp, ebp
jne 0x6553a7
push dword [esp + 0x1c]
lea eax, [ebx + 0xc]
push edi
push eax
call fcn.006e0e90
add esp, 0xc
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
push ebx
call fcn.006058d0
mov edi, eax
add esp, 4
test edi, edi
jne 0x6553da
call fcn.005cc9b0
push str.ossl_ecx_key_op
push 0xca
push str.cryptoececx_backend.c
call fcn.005ccab0
push edi
push 0xc0100
jmp 0x6554b0
cmp ebp, 2
jne 0x65544c
test esi, esi
je 0x65547f
cmp esi, 0x40a
je 0x655407
cmp esi, 0x43f
je 0x655407
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x65540c
mov eax, 0x20
push 0
push eax
push edi
push dword [esp + 0x34]
call fcn.005c0040
add esp, 0x10
test eax, eax
jle 0x6554ba
cmp esi, 0x40a
jne 0x65543b
mov al, byte [edi + 0x1f]
and byte [edi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
jmp 0x65547f
cmp esi, 0x40b
jne 0x65547f
and byte [edi], 0xfc
or byte [edi + 0x37], 0x80
jmp 0x65547f
cmp esi, 0x40a
je 0x65546c
cmp esi, 0x43f
je 0x65546c
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x655471
mov eax, 0x20
push eax
push dword [esp + 0x1c]
push edi
call fcn.006e0e90
add esp, 0xc
push ebx
call fcn.006554d0
add esp, 4
test eax, eax
jne 0x6553a0
call fcn.005cc9b0
push str.ossl_ecx_key_op
push 0xde
push str.cryptoececx_backend.c
call fcn.005ccab0
push 0
push 0xa6
push 0x10
call fcn.005ccb60
add esp, 0x18
push ebx
call fcn.006058f0
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x659ec0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0xe4
call fcn.006df660
mov eax, dword [0x7f9c40]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xe8]
push ebx
mov ebx, dword [esp + 0xf0]
push esi
mov esi, dword [esp + 0xf8]
push edi
push eax
push str.SHA512
push ecx
call fcn.005b38b0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x659f42
push 0
push edi
push 0
lea eax, [esp + 0xb8]
push eax
push 0x20
push esi
call fcn.005b2ba0
push edi
mov esi, eax
call fcn.005b38e0
add esp, 0x1c
test esi, esi
jne 0x659f5c
lea eax, [esp + 0xac]
push 0x40
push eax
call fcn.00401320
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xe0]
xor ecx, esp
call fcn.006def69
add esp, 0xe4
ret
mov al, byte [esp + 0xcb]
and byte [esp + 0xac], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esp + 0xcb], al
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.00659700
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.00659680
lea eax, [esp + 0xbc]
push 0x40
push eax
call fcn.00401320
mov ecx, dword [esp + 0x104]
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.006def69
add esp, 0xe4
ret
Function at 0x659fd0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x174
call fcn.006df660
mov eax, dword [0x7f9c40]
xor eax, esp
mov dword [esp + 0x170], eax
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x18c]
push ebx
mov ebx, dword [esp + 0x18c]
push ebp
mov ebp, dword [esp + 0x180]
push esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x190]
push edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1a0]
push eax
push str.SHA512
push ecx
call fcn.005b38b0
add esp, 0xc
mov edi, eax
call fcn.005b3820
mov dword [esp + 0x18], 0
mov esi, eax
test edi, edi
je 0x65a1de
test esi, esi
je 0x65a1de
push 0
push edi
push esi
call fcn.005b3010
add esp, 0xc
test eax, eax
je 0x65a1de
push 0x20
push ebx
push esi
call fcn.005b3050
add esp, 0xc
test eax, eax
je 0x65a1de
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0xc4]
push eax
push esi
call fcn.005b2ee0
add esp, 0xc
test eax, eax
je 0x65a1de
mov al, byte [esp + 0xdf]
and byte [esp + 0xc0], 0xf8
and al, 0x3f
push 0
or al, 0x40
push edi
push esi
mov byte [esp + 0xeb], al
call fcn.005b3010
add esp, 0xc
test eax, eax
je 0x65a1de
push 0x20
lea eax, [esp + 0xe4]
push eax
push esi
call fcn.005b3050
add esp, 0xc
test eax, eax
je 0x65a1de
mov ebx, dword [esp + 0x190]
push ebx
push dword [esp + 0x14]
push esi
call fcn.005b3050
add esp, 0xc
test eax, eax
je 0x65a1de
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x104]
push eax
push esi
call fcn.005b2ee0
add esp, 0xc
test eax, eax
je 0x65a1de
lea eax, [esp + 0x100]
push eax
call fcn.0065ec60
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.00659700
lea eax, [esp + 0x2c]
push eax
push ebp
call fcn.00659680
push 0
push edi
push esi
call fcn.005b3010
add esp, 0x20
test eax, eax
je 0x65a1de
push 0x20
push ebp
push esi
call fcn.005b3050
add esp, 0xc
test eax, eax
je 0x65a1de
push 0x20
push dword [esp + 0x20]
push esi
call fcn.005b3050
add esp, 0xc
test eax, eax
je 0x65a1de
push ebx
push dword [esp + 0x14]
push esi
call fcn.005b3050
add esp, 0xc
test eax, eax
je 0x65a1de
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x144]
push eax
push esi
call fcn.005b2ee0
add esp, 0xc
test eax, eax
je 0x65a1de
lea eax, [esp + 0x140]
push eax
call fcn.0065ec60
lea eax, [esp + 0x104]
push eax
lea eax, [esp + 0xc8]
push eax
lea eax, [esp + 0x14c]
push eax
lea eax, [ebp + 0x20]
push eax
call fcn.0065a700
add esp, 0x14
mov dword [esp + 0x18], 1
lea eax, [esp + 0x100]
push 0x40
push eax
call fcn.00401320
lea eax, [esp + 0xc8]
push 0x40
push eax
call fcn.00401320
push edi
call fcn.005b38e0
push esi
call fcn.005b3790
mov ecx, dword [esp + 0x198]
add esp, 0x18
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.006def69
add esp, 0x174
ret
Function at 0x671200
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.006df660
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [eax + 0x64]
push esi
mov esi, dword [esp + 0x28]
push edi
mov ecx, dword [ebp + 0x70]
mov edi, dword [esp + 0x30]
mov dword [esp + 0x10], ebp
test ecx, ecx
je 0x671269
test edi, edi
je 0x671249
lea edx, [ebp + 0x30]
add edx, ecx
cmp ecx, 0x40
jae 0x671249
mov al, byte [edx]
inc ecx
xor al, byte [esi]
inc edx
mov byte [ebx], al
inc esi
inc ebx
sub edi, 1
jne 0x671235
mov dword [ebp + 0x70], ecx
test edi, edi
je 0x671324
cmp ecx, 0x40
jne 0x671269
mov dword [ebp + 0x70], 0
add dword [ebp + 0x20], 1
jne 0x671269
inc dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
mov eax, edi
and eax, 0x3f
sub edi, eax
mov dword [esp + 0x1c], eax
lea eax, [ebp + 0x20]
mov dword [esp + 0x24], eax
cmp edi, 0x40
jb 0x6712d7
push dword [esp + 0x24]
mov ecx, edi
xor ebp, ebp
shr ecx, 6
lea eax, [ecx + edx]
cmp eax, ecx
cmovae ebp, eax
neg edx
cmp eax, ecx
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x14]
cmovae edx, ecx
shl edx, 6
push ebp
push edx
push esi
push ebx
mov dword [esp + 0x28], edx
call fcn.00442ac0
mov eax, dword [esp + 0x28]
add esp, 0x14
sub edi, eax
add esi, eax
add ebx, eax
mov eax, dword [esp + 0x18]
mov dword [ebp + 0x20], eax
test eax, eax
jne 0x6712d0
inc dword [ebp + 0x24]
mov edx, eax
cmp edi, 0x40
jae 0x671283
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x671324
push 0x40
lea eax, [ebp + 0x30]
push 0
push eax
call fcn.006e1410
lea eax, [ebp + 0x20]
push eax
push ebp
lea eax, [ebp + 0x30]
push 0x40
push eax
push eax
call fcn.00442ac0
add esp, 0x20
xor edx, edx
test edi, edi
je 0x671321
sub esi, ebx
nop dword [eax + eax]
mov al, byte [edx + ebp + 0x30]
lea ecx, [edx + ebx]
xor al, byte [esi + ecx]
inc edx
mov byte [ecx], al
cmp edx, edi
jb 0x671310
mov dword [ebp + 0x70], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
Function at 0x67c730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.006df660
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x67c778
call fcn.005cc9b0
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5c
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.005ccab0
push 0
push 0x78
push 4
call fcn.005ccb60
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.0067c450
add esp, 4
test eax, eax
jne 0x67c7b4
call fcn.005cc9b0
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x61
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.005ccab0
push 0
push 0xb2
push 4
call fcn.005ccb60
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.0060f720
push esi
call fcn.0060f4d0
push esi
mov dword [esp + 0x2c], eax
call fcn.0060f4d0
push esi
mov ebp, eax
call fcn.0060f4d0
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x67c916
test ebp, ebp
je 0x67c8ed
test ebx, ebx
je 0x67c8e4
push 4
push ebp
call fcn.005ae670
push 4
push ebx
call fcn.005ae670
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x67c81e
call fcn.005ae540
mov dword [esi + 0x20], eax
cmp dword [esi + 0x24], 0
jne 0x67c82c
call fcn.005ae540
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x67c8e0
cmp dword [esi + 0x24], 0
je 0x67c8e0
push 4
push eax
call fcn.005ae670
push 4
push dword [esi + 0x24]
call fcn.005ae670
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.006cd450
add esp, 0x3c
test eax, eax
je 0x67c8e0
nop word [eax + eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.006cd450
add esp, 0x2c
test eax, eax
je 0x67c8e0
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.0067c3e0
add esp, 0x10
test eax, eax
js 0x67c8e0
je 0x67c880
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.0067c3e0
add esp, 0x10
test eax, eax
js 0x67c8e0
je 0x67c880
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
push ebp
call fcn.005adc30
add esp, 4
test ebx, ebx
je 0x67c8fa
push ebx
call fcn.005adc30
add esp, 4
push dword [esp + 0x20]
call fcn.005adc30
push esi
call fcn.0060f3d0
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x67c8ed
jmp 0x67c8e4
Function at 0x680020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.006df660
mov eax, dword [0x7f9c40]
xor eax, esp
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
push esi
mov esi, dword [ecx]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test esi, esi
jns 0x680071
mov dword [ecx], 0xffffffff
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.006def69
add esp, 0x28
ret
push ebx
movzx ebx, byte [eax]
push ebp
lea ebp, [eax + 1]
shl ebx, 0x18
mov edx, ebp
mov dword [esp + 0x1c], ebp
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x10], ebx
movzx eax, byte [edx + 6]
mov dword [esp + 0x28], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x28]
shl ecx, 8
or ecx, eax
mov byte [esp + 0x2b], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [esp + 0x28], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x29], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2a], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, dword [esp + 0x40]
mov dword [esp + 0x14], edx
mov byte [esp + 0x2f], dl
test eax, eax
je 0x6801e0
mov ecx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x680188
push dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
call fcn.0067f610
mov ebx, dword [esp + 0x1c]
add esp, 8
mov edx, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x680123
test ebp, ebp
mov ebp, dword [esp + 0x20]
pop edi
je 0x6801e0
mov ecx, dword [esp + 0x20]
mov eax, ebx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 6], dl
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
pop ebp
pop ebx
mov dword [eax], esi
pop esi
xor ecx, esp
call fcn.006def69
add esp, 0x28
ret