joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b7a60
Capabilities:
Query environment variable

Disassembly:
mov eax, 8
call fcn.0066af60
cmp dword [0x754fd0], 0
jne 0x5b7b8d
push ebx
push edi
push str.OPENSSL_ia32cap
mov dword [0x754fd0], 1
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
mov edi, eax
add esp, 4
test edi, edi
je 0x5b7b5f
mov bl, byte [edi]
lea eax, [esp + 8]
xor ecx, ecx
cmp bl, 0x7e
push esi
sete cl
push eax
push str._I64i
lea esi, [ecx + edi]
push esi
call fcn.0047a620
add esp, 0xc
test eax, eax
jne 0x5b7ad6
push eax
push eax
push esi
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 0
cmp bl, 0x7e
jne 0x5b7afa
push 0x759060
call section..text
mov esi, dword [esp + 0x10]
add esp, 4
mov ecx, dword [esp + 0x10]
not esi
not ecx
and eax, esi
and edx, ecx
jmp 0x5b7b0c
cmp byte [edi], 0x3a
jne 0x5b7b14
push 0x759060
call section..text
add esp, 4
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
push 0x3a
push edi
mov dword [0x759068], 0
call sub.VCRUNTIME140.dll_strchr
add esp, 8
pop esi
test eax, eax
je 0x5b7b74
mov bl, byte [eax + 1]
inc eax
xor ecx, ecx
cmp bl, 0x7e
push 0
sete cl
add ecx, eax
push 0
push ecx
call sub.api_ms_win_crt_convert_l1_1_0.dll_strtoul
add esp, 0xc
cmp bl, 0x7e
jne 0x5b7b58
not eax
and dword [0x759068], eax
jmp 0x5b7b74
mov dword [0x759068], eax
jmp 0x5b7b74
push 0x759060
call section..text
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov eax, dword [esp + 8]
or eax, 0x400
mov dword [0x759060], eax
mov eax, dword [esp + 0xc]
pop edi
mov dword [0x759064], eax
pop ebx
add esp, 8
ret
Function at 0x5b7d00
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.0066af60
mov eax, dword [0x74b738]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x5b7d9f
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x5b7d9f
lea eax, [esp + 0x114]
push eax
push 0
push dword [esp + 0x118]
lea eax, [esp + 0x14]
push 0x100
push eax
call fcn.00422680
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call sub.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf
add esp, 0x1c
or ecx, 0xffffffff
test eax, eax
cmovs eax, ecx
lea ecx, [esp + 4]
push 0
push ecx
test eax, eax
mov ecx, 0x100
cmovs eax, ecx
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00669a1e
add esp, 0x108
ret
lea eax, [esp + 0x114]
push eax
push 0
push dword [esp + 0x118]
lea eax, [esp + 0x14]
push 0xff
push eax
call fcn.00422680
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call sub.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vsprintf
add esp, 0x1c
mov byte [esp + 0x107], 0
call fcn.005b7bc0
test eax, eax
jle 0x5b7e33
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x5b7e47
push 0
lea eax, [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00669a1e
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.00669a1e
add esp, 0x108
ret
Function at 0x5ec520
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x6c
call fcn.0066af60
mov eax, dword [0x74b738]
xor eax, esp
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x74]
push ebx
mov dword [esp + 0xc], eax
xor ebx, ebx
mov eax, dword [esp + 0x7c]
push ebp
mov ebp, dword [esp + 0x78]
push esi
mov dword [esp + 0x10], eax
xor esi, esi
mov dword [eax], ebx
lea eax, [esp + 0x1c]
push edi
mov edi, dword [esp + 0x8c]
push eax
call fcn.005c19b0
lea eax, [esp + 0x24]
push ebp
push eax
call fcn.005c1810
add esp, 0xc
test eax, eax
je 0x5ec622
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x28]
push eax
call fcn.005c13c0
add esp, 0xc
test eax, eax
je 0x5ec622
lea eax, [esp + 0x20]
push eax
call fcn.005c1610
mov esi, dword [ebp]
add esp, 4
test byte [esi + 0xc], 4
je 0x5ec640
push edi
call fcn.00593580
push ebx
push edi
mov dword [esp + 0x1c], eax
call fcn.005eccd0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x5ec622
push esi
call fcn.005eda00
add esp, 4
test eax, eax
jle 0x5ec622
push dword [ebp]
push ebx
push 1
push 0xf8
push 0xffffffffffffffff
push esi
call fcn.005ec8a0
add esp, 0x18
test eax, eax
jle 0x5ec622
push dword [esp + 0x1c]
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x24]
push esi
call fcn.005ed920
add esp, 0x14
test eax, eax
jle 0x5ec622
mov ecx, dword [esp + 0x14]
mov ebx, 1
mov eax, dword [esp + 0x10]
mov dword [ecx], eax
push esi
call fcn.005ecc20
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00669a1e
add esp, 0x6c
ret
xor eax, eax
lea ecx, [esi + 0x2c]
mov edx, dword [ecx]
test edx, edx
je 0x5ec658
cmp dword [edi], edx
je 0x5ec682
inc eax
add ecx, 4
cmp eax, 4
jl 0x5ec645
push 0x7b
push str..cryptoevpp_sign.c
push 0x6e
push 0x6b
push 6
call fcn.0059e890
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00669a1e
add esp, 0x6c
ret
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x5ec6b6
push 0x80
push str..cryptoevpp_sign.c
push 0x68
push 0x6b
push 6
call fcn.0059e890
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.00669a1e
add esp, 0x6c
ret
push dword [edi + 0x14]
mov ecx, dword [esp + 0x18]
push ecx
push dword [esp + 0x20]
lea ecx, [esp + 0x44]
push dword [esp + 0x28]
push ecx
push dword [esi]
call eax
mov ecx, dword [esp + 0x90]
add esp, 0x18
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00669a1e
add esp, 0x6c
ret
Function at 0x5ef970
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
push dword [esp + 0x10]
call fcn.005efa90
mov edi, eax
add esp, 8
test edi, edi
jne 0x5efa01
push 0xaf
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.0059e890
push 0x6ac67c
push esi
push 0x6b4444
push dword [esp + 0x2c]
push str.fopen_
push 5
call fcn.0059d720
add esp, 0x2c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
cmp dword [eax], 2
je 0x5ef9df
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
cmp dword [eax], 6
je 0x5ef9df
lea eax, [edi + 2]
mov ecx, 0xb8
jmp 0x5ef9e9
mov eax, 0x80
mov ecx, 0xb6
push ecx
push str..crypto_bio_bss_file.c
push eax
push 0x6d
push 0x20
call fcn.0059e890
add esp, 0x14
xor eax, eax
pop edi
pop esi
ret
push 0x745060
call fcn.005ab000
mov esi, eax
add esp, 4
test esi, esi
jne 0x5efa22
push edi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
add esp, 4
xor eax, eax
pop edi
pop esi
ret
push 0
push esi
call fcn.005aa930
push edi
push 1
push 0x6a
push esi
call fcn.005aa960
add esp, 0x18
mov eax, esi
pop edi
pop esi
ret
Function at 0x60be30
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.0066af60
mov eax, dword [0x74b738]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
push ebp
push esi
mov esi, dword [esp + 0xbc]
xor ebp, ebp
push edi
mov edi, dword [esp + 0xc4]
mov dword [esp + 0x30], eax
mov esi, dword [esi + 4]
mov dword [esp + 0x1c], esi
sub esi, edi
mov dword [esp + 0x10], esi
cmp dword [esp + 0xc8], edi
jae 0x60be94
push str.orig_len___md_size
push 0xf8
push str.._ssl_s3_cbc.c
call fcn.005b7e70
add esp, 0xc
cmp edi, 0x40
jbe 0x60beb0
push str.md_size___EVP_MAX_MD_SIZE
push 0xf9
push str.._ssl_s3_cbc.c
call fcn.005b7e70
add esp, 0xc
mov ecx, dword [esp + 0xc8]
lea eax, [esp + 0x34]
neg eax
lea ebx, [esp + 0x34]
and eax, 0x3f
add ebx, eax
lea eax, [edi + 0x100]
mov dword [esp + 0x20], ebx
cmp ecx, eax
jbe 0x60bede
mov ebp, ecx
sub ebp, edi
sub ebp, 0x100
mov eax, edi
xor edx, edx
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, esi
div edi
push edi
mov esi, edx
push 0
push ebx
mov dword [esp + 0x38], esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 0x18], 0
cmp ebp, dword [esp + 0xc8]
jae 0x60bfbb
mov ecx, dword [esp + 0x1c]
mov esi, ebx
mov edx, dword [esp + 0x10]
mov eax, ecx
shr eax, 0x1f
sub ebp, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc0]
shr edx, 0x1f
mov dword [esp + 0x10], edx
mov eax, dword [eax + 0xc]
add eax, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
lea ebx, [ecx + ebp]
shr ebx, 0x1f
lea ecx, [edi + ebp]
shr ecx, 0x1f
xor cl, dl
xor dl, bl
or cl, dl
mov edx, ebp
xor cl, bl
shr edx, 0x1f
xor dl, byte [esp + 0x14]
dec cl
mov dword [esp + 0x28], ecx
mov cl, byte [eax + ebp]
mov al, bl
xor al, byte [esp + 0x14]
inc ebp
or dl, al
xor dl, bl
mov ebx, dword [esp + 0x18]
neg dl
and dl, cl
and dl, byte [esp + 0x28]
or byte [ebx + esi], dl
inc ebx
mov edx, dword [esp + 0x10]
mov ecx, ebx
sub ecx, edi
mov eax, ebx
xor ecx, edi
xor eax, edi
or ecx, eax
xor ecx, ebx
shr ecx, 0x1f
neg ecx
and ebx, ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x18], ebx
lea eax, [ecx + ebp]
cmp eax, dword [esp + 0xc8]
jb 0x60bf41
mov esi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x20]
xor edx, edx
test edi, edi
je 0x60bfef
mov ebp, dword [esp + 0x30]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + ebx]
movzx eax, byte [esi + ebx]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, edi
mov eax, esi
xor ecx, edi
xor eax, edi
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, edi
jb 0x60bfc5
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00669a1e
add esp, 0xa8
ret
Function at 0x60caf0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.0066af60
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x14]
inc ebx
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x24], ebx
mov eax, dword [esi + 8]
mov ecx, dword [edi + 4]
mov eax, dword [eax + 0x64]
test byte [eax + 0x38], 1
je 0x60cbbc
mov edx, dword [esp + 0x20]
lea eax, [ebx + edx]
cmp eax, ecx
ja 0x60cbc4
add dword [edi + 0xc], edx
add dword [edi + 0x10], edx
sub ecx, edx
mov dword [edi + 4], ecx
test dword [esi + 0x100], 0x200
mov eax, dword [edi + 0xc]
movzx ebx, byte [eax + ecx - 1]
je 0x60cb8a
cmp dword [esi + 0x88], 0
jne 0x60cb8a
mov eax, dword [esi + 0x58]
push 8
add eax, 8
push 0x6badec
push eax
call fcn.005b79a0
add esp, 0xc
test eax, eax
jne 0x60cb7d
test bl, 1
jne 0x60cb7d
mov eax, dword [esi + 0x58]
or dword [eax], 8
mov eax, dword [esi + 0x58]
test byte [eax], 8
je 0x60cb8a
test ebx, ebx
je 0x60cb8a
dec ebx
mov eax, dword [esi + 0x80]
push ebp
push dword [eax]
call fcn.005d3350
mov ebp, dword [edi + 4]
add esp, 4
mov dword [esp + 0x14], ebp
and eax, 0x200000
je 0x60cbcd
sub ebp, ebx
mov eax, 1
dec ebp
mov dword [edi + 4], ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp ebx, ecx
jbe 0x60cb3b
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x28]
mov edx, ebp
add ecx, ebx
mov eax, ebp
sub edx, ecx
xor eax, ecx
xor edx, ecx
mov ecx, 0xff
or edx, eax
lea eax, [ebp - 1]
xor edx, ebp
shr edx, 0x1f
dec edx
cmp eax, ecx
mov dword [esp + 0x1c], edx
cmovb ecx, eax
xor esi, esi
test ecx, ecx
je 0x60cc53
mov eax, ebx
shr eax, 0x1f
mov dword [esp + 0x28], eax
mov eax, dword [edi + 0xc]
lea edi, [ebp - 1]
add edi, eax
mov ebp, ecx
nop
mov al, byte [esp + 0x28]
lea edi, [edi - 1]
mov edx, ebx
mov ecx, esi
sub edx, esi
shr ecx, 0x1f
shr edx, 0x1f
xor al, cl
xor dl, cl
inc esi
or dl, al
movzx eax, byte [edi + 1]
xor dl, byte [esp + 0x28]
xor eax, ebx
dec dl
movzx ecx, dl
mov edx, dword [esp + 0x1c]
and ecx, eax
not ecx
and edx, ecx
mov dword [esp + 0x1c], edx
cmp esi, ebp
jb 0x60cc10
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x14]
not edx
lea eax, [ebx + 1]
movzx ecx, dl
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub ebp, eax
shl eax, 8
or dword [edi], eax
mov eax, ecx
mov dword [edi + 4], ebp
and eax, 1
pop ebp
pop edi
not ecx
pop esi
or eax, ecx
pop ebx
add esp, 8
ret
Function at 0x60f2d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x90
call fcn.0066af60
mov eax, dword [0x74b738]
xor eax, esp
mov dword [esp + 0x8c], eax
mov edx, dword [esp + 0xa4]
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0xa4]
mov dword [esp + 4], edx
push ebp
mov ebp, dword [esp + 0xa0]
mov dword [esp + 0x10], ebp
push esi
mov esi, dword [esp + 0xa0]
push edi
mov edi, dword [esp + 0xac]
mov eax, dword [esi]
test ebx, ebx
je 0x60f33c
cmp ebx, eax
je 0x60f333
test ebp, ebp
je 0x60f4b9
test edi, edi
js 0x60f4b9
mov ecx, 1
mov dword [esi], ebx
jmp 0x60f346
test eax, eax
je 0x60f4b9
mov ebx, eax
test ebp, ebp
je 0x60f4b0
push ebx
call fcn.005d37a0
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x60f37a
push str.j____int_sizeof_ctx__key_
push 0x74
push str..cryptohmachmac.c
call fcn.005b7e70
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, edi
jge 0x60f3cb
push dword [esp + 0x10]
lea ebp, [esi + 4]
push ebx
push ebp
call fcn.005c1460
add esp, 0xc
test eax, eax
je 0x60f4b9
push edi
push dword [esp + 0x1c]
push ebp
call fcn.005c1600
add esp, 0xc
test eax, eax
je 0x60f4b9
lea eax, [esi + 0x4c]
push eax
lea eax, [esi + 0x50]
push eax
push ebp
call fcn.005c13c0
add esp, 0xc
test eax, eax
je 0x60f4b9
mov edi, dword [esi + 0x4c]
jmp 0x60f3e8
cmp edi, 0x80
ja 0x60f4b9
push edi
lea eax, [esi + 0x50]
push ebp
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esi + 0x4c], edi
cmp edi, 0x80
je 0x60f408
mov eax, 0x80
sub eax, edi
push eax
lea eax, [esi + 0x50]
add eax, edi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
nop
mov al, byte [esi + ecx + 0x50]
xor al, 0x36
mov byte [esp + ecx + 0x1c], al
inc ecx
cmp ecx, 0x80
jl 0x60f410
push edx
lea edi, [esi + 0x1c]
push ebx
push edi
call fcn.005c1460
add esp, 0xc
test eax, eax
je 0x60f4b9
push ebx
call fcn.005d37a0
push eax
lea eax, [esp + 0x24]
push eax
push edi
call fcn.005c1600
add esp, 0x10
test eax, eax
je 0x60f4b9
xor ecx, ecx
mov al, byte [esi + ecx + 0x50]
xor al, 0x5c
mov byte [esp + ecx + 0x1c], al
inc ecx
cmp ecx, 0x80
jl 0x60f454
push dword [esp + 0x10]
lea edi, [esi + 0x34]
push ebx
push edi
call fcn.005c1460
add esp, 0xc
test eax, eax
je 0x60f4b9
push ebx
call fcn.005d37a0
push eax
lea eax, [esp + 0x24]
push eax
push edi
call fcn.005c1600
add esp, 0x10
test eax, eax
je 0x60f4b9
lea eax, [esi + 0x1c]
push eax
lea eax, [esi + 4]
push eax
call fcn.005c1810
add esp, 8
test eax, eax
je 0x60f4b9
mov eax, 1
jmp 0x60f4bb
test ecx, ecx
je 0x60f495
jmp 0x60f40c
xor eax, eax
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00669a1e
add esp, 0x90
ret
Function at 0x61c3b0
Capabilities:
Encode data using base64

Disassembly:
mov edx, dword [esp + 0xc]
push ebp
xor ebp, ebp
test edx, edx
jle 0x61c492
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x18]
inc edi
nop dword [eax + eax]
movzx eax, byte [edi - 1]
cmp edx, 3
jl 0x61c423
movzx ecx, byte [edi]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 1]
shl eax, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
mov cl, byte [ecx + 0x6bd4d0]
mov byte [esi], cl
mov ecx, eax
shr ecx, 0xc
inc esi
and ecx, 0x3f
mov ebx, esi
mov cl, byte [ecx + 0x6bd4d0]
mov byte [esi], cl
mov ecx, eax
and ecx, 0x3f
shr eax, 6
and eax, 0x3f
mov ch, byte [ecx + 0x6bd4d0]
mov cl, byte [eax + 0x6bd4d0]
jmp 0x61c46c
shl eax, 0x10
cmp edx, 2
jne 0x61c433
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
lea ebx, [esi + 1]
shr ecx, 0x12
mov cl, byte [ecx + 0x6bd4d0]
mov byte [esi], cl
mov ecx, eax
shr ecx, 0xc
mov esi, ebx
and ecx, 0x3f
mov cl, byte [ecx + 0x6bd4d0]
mov byte [ebx], cl
cmp edx, 1
jne 0x61c45e
mov cl, 0x3d
jmp 0x61c46a
shr eax, 6
and eax, 0x3f
mov cl, byte [eax + 0x6bd4d0]
mov ch, 0x3d
lea eax, [esi + 2]
mov byte [ebx + 1], cl
sub edx, 3
mov byte [eax], ch
add ebp, 4
lea esi, [eax + 1]
add edi, 3
test edx, edx
jg 0x61c3d0
pop edi
mov byte [esi], 0
mov eax, ebp
pop esi
pop ebx
pop ebp
ret
mov eax, dword [esp + 8]
mov byte [eax], 0
mov eax, ebp
pop ebp
ret
Function at 0x6360d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.0066af60
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x34]
mov ebx, dword [esi + 0x38]
mov ecx, dword [esi + 0x3c]
mov edx, dword [esi + 0x160]
shld eax, edi, 3
shld ecx, ebx, 3
shl edi, 3
shl ebx, 3
cmp dword [esi + 0x168], 0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
jne 0x636125
cmp dword [esi + 0x16c], 0
jne 0x636125
lea ebp, [esi + 0x60]
jmp 0x63613a
lea ebp, [esi + 0x60]
lea eax, [esi + 0x40]
push ebp
push eax
call edx
mov eax, dword [esp + 0x24]
add esp, 8
mov ecx, dword [esp + 0x10]
lea edx, [esi + 0x40]
bswap eax
xor dword [edx], eax
bswap ecx
xor dword [esi + 0x48], ecx
push ebp
bswap edi
xor dword [edx + 4], edi
bswap ebx
xor dword [esi + 0x4c], ebx
push edx
call dword [esp + 0x1c]
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x40]
xor dword [ecx], eax
add esp, 8
mov eax, dword [esi + 0x24]
xor dword [ecx + 4], eax
mov eax, dword [esi + 0x28]
xor dword [esi + 0x48], eax
mov eax, dword [esi + 0x2c]
xor dword [esi + 0x4c], eax
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
test edx, edx
je 0x63619c
mov eax, dword [esp + 0x14]
cmp eax, 0x10
ja 0x63619c
add esp, 8
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
jmp fcn.005b79a0
or eax, 0xffffffff
add esp, 8
ret
Function at 0x6363b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.0066af60
push ebx
mov ebx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esi + 0x160]
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esp + 0x14], edi
mov dword [esi + 0x16c], 0
mov dword [esi + 0x168], 0
cmp ebx, 0xc
jne 0x636459
mov eax, dword [esp + 0x18]
lea edi, [ebx - 0xb]
movq xmm0, qword [eax]
movq qword [esi], xmm0
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov byte [esi + 0xf], 1
jmp 0x6365a3
mov dword [esp + 0xc], ebx
push ebp
mov ebp, dword [esp + 0x1c]
cmp ebx, 0x10
jb 0x6364d1
mov edi, ebp
lea ecx, [esi + 0xf]
mov eax, ebx
sub edi, esi
shr eax, 4
mov dword [esp + 0x20], eax
lea eax, [edi + ecx]
cmp esi, eax
ja 0x6364a0
cmp ecx, ebp
jb 0x6364a0
mov eax, esi
mov edx, 0x10
nop dword [eax]
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor byte [eax - 1], cl
sub edx, 1
jne 0x636490
jmp 0x6364ae
movups xmm1, xmmword [esi]
movups xmm0, xmmword [ebp]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
lea eax, [esi + 0x60]
push eax
push esi
call dword [esp + 0x20]
add esp, 8
lea ecx, [esi + 0xf]
add ebp, 0x10
add edi, 0x10
sub ebx, 0x10
sub dword [esp + 0x20], 1
jne 0x636477
mov edi, dword [esp + 0x18]
test ebx, ebx
je 0x63657c
xor edx, edx
test ebx, ebx
je 0x636572
cmp ebx, 0x40
jb 0x636552
lea eax, [ebp - 1]
lea ecx, [esi - 1]
add eax, ebx
add ecx, ebx
cmp esi, eax
ja 0x6364fa
cmp ecx, ebp
jae 0x636552
mov ecx, ebx
mov edi, ebp
and ecx, 0xffffffc0
mov eax, esi
sub edi, esi
movups xmm0, xmmword [eax]
lea eax, [eax + 0x40]
movups xmm1, xmmword [eax + edi - 0x40]
pxor xmm1, xmm0
movups xmmword [eax - 0x40], xmm1
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [edx + ebp + 0x10]
pxor xmm1, xmm0
movups xmmword [eax - 0x30], xmm1
movups xmm0, xmmword [eax - 0x20]
movups xmm1, xmmword [edx + ebp + 0x20]
pxor xmm1, xmm0
movups xmmword [eax - 0x20], xmm1
movups xmm0, xmmword [eax - 0x10]
movups xmm1, xmmword [edx + ebp + 0x30]
add edx, 0x40
pxor xmm1, xmm0
movups xmmword [eax - 0x10], xmm1
cmp edx, ecx
jb 0x636505
cmp edx, ebx
jae 0x63656e
sub ebp, esi
lea ecx, [edx + esi]
sub ebx, edx
nop dword [eax]
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
sub ebx, 1
jne 0x636560
mov edi, dword [esp + 0x18]
lea eax, [esi + 0x60]
push eax
push esi
call edi
add esp, 8
mov eax, dword [esp + 0x10]
xor ecx, ecx
shld ecx, eax, 3
shl eax, 3
bswap eax
xor dword [esi + 0xc], eax
lea eax, [esi + 0x60]
push eax
bswap ecx
xor dword [esi + 8], ecx
push esi
call edi
mov edi, dword [esi + 0xc]
add esp, 8
bswap edi
pop ebp
push dword [esi + 0x174]
lea eax, [esi + 0x20]
push eax
mov eax, dword [esi + 0x170]
push esi
call eax
add esp, 0xc
inc edi
bswap edi
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x63a160
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 0x18], 0
je 0x63a174
mov dword [esp + 0x18], fcn.00638940
jmp fcn.00634940
mov dword [esp + 0x18], fcn.00637be0
jmp fcn.00634680
Function at 0x641380
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x10c], 0xffffffff
jne 0x641392
xor eax, eax
pop edi
ret
push ebp
push esi
push edi
call fcn.005d31d0
mov ecx, dword [esp + 0x1c]
add esp, 4
mov ebp, dword [esp + 0x14]
mov esi, eax
mov dword [ecx], esi
test ebp, ebp
je 0x641455
mov ecx, dword [edi + 0x10c]
push ebx
cmp ecx, esi
jne 0x6413e6
test esi, esi
jle 0x641434
mov edx, ebp
lea ecx, [edi + 0x8c]
mov ebx, esi
nop word [eax + eax]
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x6413d0
jmp 0x641434
sub eax, ecx
mov byte [ecx + edi + 0xec], 0x80
cmp eax, 1
jle 0x64140a
dec eax
push eax
lea eax, [edi + 0xed]
add eax, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test esi, esi
jle 0x641434
mov edx, ebp
lea ecx, [edi + 0xac]
mov ebx, esi
nop dword [eax + eax]
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x641420
push esi
push ebp
push ebp
push edi
call fcn.005d3750
add esp, 0x10
pop ebx
test eax, eax
jne 0x641455
push esi
push ebp
call fcn.00401360
add esp, 8
xor eax, eax
pop esi
pop ebp
pop edi
ret
pop esi
pop ebp
mov eax, 1
pop edi
ret
Function at 0x643370
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x643439
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x643391
cmp al, 0x6b
jne 0x643439
inc ecx
cmp al, 0x6b
jne 0x6433fb
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x6433b2
nop
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x6433b2
cmp dl, 0xbb
jne 0x6433db
inc eax
cmp eax, esi
jl 0x6433a0
sub esi, eax
test eax, eax
jne 0x6433fe
push 0x83
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.0059e890
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x7b
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.0059e890
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + ecx], 0xcc
je 0x643427
push 0x8b
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.0059e890
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push esi
push ecx
push dword [esp + 0x10]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x70
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.0059e890
add esp, 0x14
or eax, 0xffffffff
pop esi
ret