joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a8b1330
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa8
call fcn.2a8b8f90
mov eax, dword [0x2a9b0720]
xor eax, esp
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0xac]
push ebx
mov ebx, dword [esp + 0xb8]
push ebp
push esi
mov esi, dword [esp + 0xbc]
xor ebp, ebp
mov dword [esp + 0x28], eax
push edi
mov eax, dword [esi + 8]
mov dword [esp + 0x20], eax
sub eax, ebx
mov dword [esp + 0x24], eax
cmp dword [esi + 0xc], ebx
jae 0x2a8b1390
push 0x4d4
push 0x2a95eec0
push str.assertion_failed:_rec__orig_len___md_size
call fcn.2a8baf90
add esp, 0xc
cmp ebx, 0x40
jbe 0x2a8b13ac
push 0x4d5
push 0x2a95eec0
push str.assertion_failed:_md_size___EVP_MAX_MD_SIZE
call fcn.2a8baf90
add esp, 0xc
mov ecx, dword [esi + 0xc]
lea eax, [esp + 0x34]
neg eax
mov dword [esp + 0x10], ecx
and eax, 0x3f
lea edi, [esp + 0x34]
add edi, eax
lea eax, [ebx + 0x100]
mov dword [esp + 0x28], edi
cmp ecx, eax
jbe 0x2a8b13da
mov ebp, ecx
sub ebp, ebx
sub ebp, 0x100
push ebx
xor esi, esi
mov dword [esp + 0x20], 0
push esi
push edi
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [esp + 0x14], esi
cmp ebp, dword [esp + 0x10]
jae 0x2a8b148d
mov eax, dword [esp + 0xc0]
mov ecx, ebp
sub ecx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov eax, dword [eax + 0x14]
mov dword [esp + 0x30], eax
mov eax, ebp
mov edx, ecx
xor eax, dword [esp + 0x24]
xor edx, dword [esp + 0x20]
lea edi, [eax - 1]
not eax
shr eax, 0x1f
shr edi, 0x1f
and edi, eax
mov eax, ebp
xor eax, dword [esp + 0x20]
neg edi
or edx, eax
mov eax, dword [esp + 0x30]
xor edx, ebp
shr edx, 0x1f
neg edx
mov cl, byte [eax + ebp]
mov eax, edi
or eax, dword [esp + 0x1c]
inc ebp
and eax, edx
mov edx, dword [esp + 0x14]
and edi, edx
mov dword [esp + 0x1c], eax
and al, cl
or esi, edi
mov edi, dword [esp + 0x28]
or byte [edx + edi], al
inc edx
mov ecx, edx
mov eax, edx
sub ecx, ebx
xor eax, ebx
xor ecx, ebx
or ecx, eax
xor ecx, edx
shr ecx, 0x1f
neg ecx
and edx, ecx
mov ecx, dword [esp + 0x18]
inc ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
cmp ebp, dword [esp + 0x10]
jb 0x2a8b1415
xor edx, edx
test ebx, ebx
je 0x2a8b14c1
mov ebp, dword [esp + 0x2c]
mov eax, esi
xor eax, 0x20
mov al, byte [eax + edi]
movzx eax, byte [esi + edi]
inc esi
mov byte [edx + ebp], al
mov ecx, esi
sub ecx, ebx
mov eax, esi
xor ecx, ebx
xor eax, ebx
or ecx, eax
inc edx
xor ecx, esi
shr ecx, 0x1f
neg ecx
and esi, ecx
cmp edx, ebx
jb 0x2a8b1497
mov ecx, dword [esp + 0xb4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.2a84c0e0
add esp, 0xa8
ret
Function at 0x2a8b2000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.2a8b8f90
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push edi
mov eax, dword [ebx + 4]
mov edi, dword [esp + 0x20]
inc edi
mov eax, dword [eax + 0x64]
test byte [eax + 0x34], 1
je 0x2a8b204b
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 8]
lea eax, [edi + ecx]
cmp eax, edx
jbe 0x2a8b203b
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
add dword [esi + 0x14], ecx
sub edx, ecx
add dword [esi + 0x18], ecx
sub dword [esi + 0xc], ecx
mov dword [esi + 8], edx
jmp 0x2a8b2050
cmp edi, dword [esi + 8]
ja 0x2a8b2034
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 8]
push ebp
push dword [ebx + 0xb0]
movzx ebp, byte [ecx + eax - 1]
call fcn.2a914e10
push eax
call fcn.2a8bf330
add esp, 8
test eax, 0x200000
je 0x2a8b208a
or eax, 0xffffffff
sub eax, ebp
add dword [esi + 8], eax
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
mov edx, dword [esi + 8]
lea ecx, [edi + ebp]
mov edi, edx
mov dword [esp + 0x10], edx
sub edi, ecx
mov eax, edx
xor edi, ecx
xor eax, ecx
or edi, eax
mov eax, 0x100
xor edi, edx
shr edi, 0x1f
dec edi
cmp edx, eax
cmovb eax, edx
xor ebx, ebx
mov dword [esp + 0x18], eax
test eax, eax
je 0x2a8b210d
mov eax, dword [esi + 0x14]
mov ecx, ebp
shr ecx, 0x1f
lea esi, [edx - 1]
mov dword [esp + 0x24], ecx
add esi, eax
jmp 0x2a8b20d0
mov al, byte [esp + 0x24]
lea esi, [esi - 1]
mov edx, ebp
mov ecx, ebx
sub edx, ebx
shr ecx, 0x1f
shr edx, 0x1f
xor al, cl
xor dl, cl
inc ebx
or dl, al
movzx eax, byte [esi + 1]
xor dl, byte [esp + 0x24]
xor eax, ebp
dec dl
movzx ecx, dl
and ecx, eax
not ecx
and edi, ecx
cmp ebx, dword [esp + 0x18]
jb 0x2a8b20d0
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
not edi
lea eax, [ebp + 1]
and edi, 0xff
pop ebp
lea ecx, [edi - 1]
not edi
shr ecx, 0x1f
shr edi, 0x1f
and ecx, edi
neg ecx
and eax, ecx
sub edx, eax
mov eax, ecx
pop edi
mov dword [esi + 8], edx
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebx
pop ecx
ret

Function at 0x2a8b8712
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x2a952813
call fcn.2a84b884
mov edi, ecx
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call sub.MSVCR120.dll_memset
push 0x10
mov dword [ebp - 0x54], esi
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x2a8b8757
push 0x10
push ebx
push esi
call sub.MSVCR120.dll_memset
add esp, 0xc
jmp 0x2a8b8759
mov esi, ebx
or dword [ebp - 4], 0xffffffff
mov ecx, edi
mov dword [edi + 0x24], esi
call fcn.2a8b7a99
push dword [edi + 0x24]
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
call fcn.2a84ba86
ret
Function at 0x2a8bc0c0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov edi, dword [esp + 0xc]
push 0
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [edi + 0x1c]
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.2a8bb820
add esp, 8
test esi, esi
jg 0x2a8bc117
je 0x2a8bc0f9
cmp esi, 0xffffffff
jne 0x2a8bc117
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.2a8bc340
add esp, 4
test eax, eax
je 0x2a8bc117
push 0xa
push edi
call fcn.2a8bbf50
add esp, 8
pop edi
mov eax, esi
pop esi
ret

Function at 0x2a8cd650
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.2a8b8f90
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ecx, dword [eax + 0x60]
mov ebp, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x28]
mov edx, dword [ecx + 0x70]
mov dword [esp + 0x1c], ecx
test edx, edx
je 0x2a8cd6b3
test edi, edi
je 0x2a8cd694
nop
cmp edx, 0x40
jae 0x2a8cd694
mov al, byte [edx + ecx + 0x30]
inc edx
xor al, byte [ebx]
inc ebx
mov byte [ebp], al
inc ebp
dec edi
jne 0x2a8cd680
mov dword [ecx + 0x70], edx
test edi, edi
je 0x2a8cd76c
cmp edx, 0x40
jne 0x2a8cd6b3
mov dword [ecx + 0x70], 0
inc dword [ecx + 0x20]
jne 0x2a8cd6b3
inc dword [ecx + 0x24]
mov eax, edi
lea edx, [ecx + 0x20]
and eax, 0x3f
mov dword [esp + 0x14], edx
sub edi, eax
mov dword [esp + 0xc], eax
mov eax, dword [edx]
push esi
cmp edi, 0x40
jb 0x2a8cd719
lea ecx, [ecx]
mov esi, edi
shr esi, 6
add eax, esi
mov dword [esp + 0x14], eax
cmp eax, esi
jae 0x2a8cd6e9
sub esi, eax
mov dword [esp + 0x14], 0
push edx
push ecx
shl esi, 6
push esi
push ebx
push ebp
call fcn.2a80d440
mov edx, dword [esp + 0x2c]
add esp, 0x14
mov eax, dword [esp + 0x14]
sub edi, esi
mov ecx, dword [esp + 0x20]
add ebx, esi
add ebp, esi
mov dword [edx], eax
test eax, eax
jne 0x2a8cd714
inc dword [ecx + 0x24]
cmp edi, 0x40
jae 0x2a8cd6d0
cmp dword [esp + 0x10], 0
je 0x2a8cd76b
push 0x40
lea edi, [ecx + 0x30]
push 0
push edi
call sub.MSVCR120.dll_memset
push dword [esp + 0x24]
mov esi, dword [esp + 0x30]
push esi
push 0x40
push edi
push edi
call fcn.2a80d440
mov eax, dword [esp + 0x30]
add esp, 0x20
xor edx, edx
test eax, eax
je 0x2a8cd768
sub ebx, ebp
mov esi, eax
lea ecx, [edx + ebp]
mov al, byte [ebx + ecx]
xor al, byte [edi + edx]
inc edx
mov byte [ecx], al
cmp edx, esi
jb 0x2a8cd750
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov dword [esi + 0x70], eax
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x2a8ce600
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
mov edi, dword [esp + 0x1c]
lea ebx, [ebx - 1]
mov ecx, dword [ebp + 4]
shr ebx, 0x1f
dec ebx
mov eax, dword [edi + 4]
xor eax, ecx
and eax, ebx
xor ecx, eax
mov dword [ebp + 4], ecx
xor dword [edi + 4], eax
mov eax, dword [esp + 0x20]
lea ecx, [eax - 1]
cmp ecx, 9
ja case.default.0x2a8ce635
jmp dword [ecx*4 + 0x2a8ce778]
mov ecx, 0xa
mov dword [esp + 0x14], ecx
cmp eax, ecx
jle case.0x2a8ce635.10
lea esp, [esp]
mov eax, dword [ebp]
mov esi, dword [esp + 0x14]
lea edx, [eax + ecx*4]
mov eax, dword [edi]
mov ecx, dword [edx]
mov esi, dword [eax + esi*4]
xor esi, ecx
and esi, ebx
xor ecx, esi
mov dword [edx], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [edi]
xor dword [eax + ecx*4], esi
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, dword [esp + 0x20]
jl 0x2a8ce650
mov eax, dword [edi]
mov esi, dword [ebp]
mov edx, dword [eax + 0x24]
mov ecx, dword [esi + 0x24]
xor edx, ecx
and edx, ebx
xor ecx, edx
mov dword [esi + 0x24], ecx
mov eax, dword [edi]
xor dword [eax + 0x24], edx
mov eax, dword [edi]
mov esi, dword [ebp]
mov edx, dword [eax + 0x20]
mov ecx, dword [esi + 0x20]
xor edx, ecx
and edx, ebx
xor ecx, edx
mov dword [esi + 0x20], ecx
mov eax, dword [edi]
xor dword [eax + 0x20], edx
mov eax, dword [edi]
mov esi, dword [ebp]
mov edx, dword [eax + 0x1c]
mov ecx, dword [esi + 0x1c]
xor edx, ecx
and edx, ebx
xor ecx, edx
mov dword [esi + 0x1c], ecx
mov eax, dword [edi]
xor dword [eax + 0x1c], edx
mov eax, dword [edi]
mov esi, dword [ebp]
mov edx, dword [eax + 0x18]
mov ecx, dword [esi + 0x18]
xor edx, ecx
and edx, ebx
xor ecx, edx
mov dword [esi + 0x18], ecx
mov eax, dword [edi]
xor dword [eax + 0x18], edx
mov eax, dword [edi]
mov esi, dword [ebp]
mov edx, dword [eax + 0x14]
mov ecx, dword [esi + 0x14]
xor edx, ecx
and edx, ebx
xor ecx, edx
mov dword [esi + 0x14], ecx
mov eax, dword [edi]
xor dword [eax + 0x14], edx
mov eax, dword [edi]
mov esi, dword [ebp]
mov edx, dword [eax + 0x10]
mov ecx, dword [esi + 0x10]
xor edx, ecx
and edx, ebx
xor ecx, edx
mov dword [esi + 0x10], ecx
mov eax, dword [edi]
xor dword [eax + 0x10], edx
mov eax, dword [edi]
mov esi, dword [ebp]
mov edx, dword [eax + 0xc]
mov ecx, dword [esi + 0xc]
xor edx, ecx
and edx, ebx
xor ecx, edx
mov dword [esi + 0xc], ecx
mov eax, dword [edi]
xor dword [eax + 0xc], edx
mov eax, dword [edi]
mov esi, dword [ebp]
mov edx, dword [eax + 8]
mov ecx, dword [esi + 8]
xor edx, ecx
and edx, ebx
xor ecx, edx
mov dword [esi + 8], ecx
mov eax, dword [edi]
xor dword [eax + 8], edx
mov eax, dword [edi]
mov esi, dword [ebp]
mov edx, dword [eax + 4]
mov ecx, dword [esi + 4]
xor edx, ecx
and edx, ebx
xor ecx, edx
mov dword [esi + 4], ecx
mov eax, dword [edi]
xor dword [eax + 4], edx
mov eax, dword [edi]
mov esi, dword [ebp]
mov ecx, dword [eax]
mov edx, dword [esi]
xor ecx, edx
and ecx, ebx
xor edx, ecx
mov dword [esi], edx
mov eax, dword [edi]
pop edi
pop esi
pop ebp
xor dword [eax], ecx
pop ebx
ret
Function at 0x2a8d1640
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push dword [esp + 0x14]
call fcn.2a885f04
push 0x62
push esi
mov edi, eax
mov ebx, 1
call sub.MSVCR120.dll_strchr
add esp, 0x10
mov ecx, 0x11
test eax, eax
cmove ebx, ecx
test edi, edi
jne 0x2a8d16f7
push 0x4a
push str.crypto_bio_bss_file.c
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
push 1
push 2
call fcn.2a8bdb20
push 0x2a958ffc
push esi
push 0x2a974894
push dword [esp + 0x30]
push str.fopen_
push 5
call fcn.2a8bd340
add esp, 0x2c
call sub.MSVCR120.dll__errno
cmp dword [eax], 2
je 0x2a8d16d9
call sub.MSVCR120.dll__errno
cmp dword [eax], 6
je 0x2a8d16d9
push 0x53
push str.crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.2a8bdb20
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x51
push str.crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.2a8bdb20
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x2a974844
call fcn.2a8bbc20
mov esi, eax
add esp, 4
test esi, esi
jne 0x2a8d1719
push edi
call sub.MSVCR120.dll_fclose
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0
push esi
call fcn.2a8bb820
push edi
push ebx
push 0x6a
push esi
call fcn.2a8bb850
add esp, 0x18
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x2a8d7050
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.2a8b8f90
mov eax, dword [0x2a9b0720]
xor eax, esp
mov dword [esp + 0x88], eax
mov edx, dword [esp + 0xa0]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [esp + 0xac]
mov dword [esp + 0x10], edx
test edi, edi
je 0x2a8d70b6
cmp edi, dword [esi]
je 0x2a8d70ad
test ebp, ebp
je 0x2a8d7130
test ebx, ebx
js 0x2a8d7130
mov eax, 1
mov dword [esi], edi
jmp 0x2a8d70bc
mov edi, dword [esi]
test edi, edi
je 0x2a8d7130
test ebp, ebp
je 0x2a8d724a
push edi
call fcn.2a8bf370
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x2a8d70f0
push 0x28
push str.cryptohmachmac.c
push str.assertion_failed:_j____int_sizeof_ctx__key_
call fcn.2a8baf90
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
jge 0x2a8d714b
push dword [esp + 0x10]
push edi
push dword [esi + 4]
call fcn.2a8bf560
add esp, 0xc
test eax, eax
je 0x2a8d7130
push ebx
push ebp
push dword [esi + 4]
call fcn.2a8bf710
add esp, 0xc
test eax, eax
je 0x2a8d7130
lea ebp, [esi + 0x10]
push ebp
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call fcn.2a8bf4c0
add esp, 0xc
test eax, eax
jne 0x2a8d7167
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.2a84c0e0
add esp, 0x8c
ret
cmp ebx, 0x80
ja 0x2a8d7130
push ebx
lea eax, [esi + 0x14]
push ebp
push eax
call sub.MSVCR120.dll_memcpy
lea ebp, [esi + 0x10]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x80
je 0x2a8d718a
mov eax, 0x80
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x2a8d7190
push edx
push edi
push dword [esi + 8]
call fcn.2a8bf560
add esp, 0xc
test eax, eax
je 0x2a8d7130
push edi
call fcn.2a8bf370
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call fcn.2a8bf710
add esp, 0x10
test eax, eax
je 0x2a8d7130
xor ecx, ecx
lea esp, [esp]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x2a8d71e0
push dword [esp + 0x10]
push edi
push dword [esi + 0xc]
call fcn.2a8bf560
add esp, 0xc
test eax, eax
je 0x2a8d7130
push edi
call fcn.2a8bf370
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call fcn.2a8bf710
add esp, 0x10
test eax, eax
je 0x2a8d7130
push dword [esi + 8]
push dword [esi + 4]
call fcn.2a8bf740
add esp, 8
test eax, eax
je 0x2a8d7130
mov eax, 1
jmp 0x2a8d7132
test eax, eax
je 0x2a8d722a
jmp 0x2a8d718e
Function at 0x2a8d9840
Capabilities:
Query environment variable

Disassembly:
push str.OPENSSL_CONF
call sub.MSVCR120.dll_getenv
add esp, 4
test eax, eax
je 0x2a8d9865
push 0x1e3
push str.cryptoconfconf_mod.c
push eax
call fcn.2a8bab40
add esp, 0xc
ret
call fcn.2a8e4840
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x2a8d9870
push esi
push edi
sub eax, edx
push 0x1eb
push str.cryptoconfconf_mod.c
lea edi, [eax + 0xd]
push edi
call fcn.2a8ba810
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x2a8d989a
pop edi
pop esi
ret
push edi
call fcn.2a8e4840
push eax
push esi
call fcn.2a8baf10
push edi
push 0x2a953c3c
push esi
call fcn.2a8baeb0
push edi
push str.openssl.cnf
push esi
call fcn.2a8baeb0
add esp, 0x24
mov eax, esi
pop edi
pop esi
ret
Function at 0x2a8ed690
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ebp
push edi
sub ecx, 4
jb 0x2a8ed6c1
lea esp, [esp]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x2a8ed6c8
add edx, 4
add esi, 4
sub ecx, 4
jae 0x2a8ed6b0
xor edi, edi
cmp ecx, 0xfffffffc
je 0x2a8ed703
movzx edi, byte [edx]
movzx eax, byte [esi]
sub edi, eax
jne 0x2a8ed703
cmp ecx, 0xfffffffd
je 0x2a8ed703
movzx edi, byte [edx + 1]
movzx eax, byte [esi + 1]
sub edi, eax
jne 0x2a8ed703
cmp ecx, 0xfffffffe
je 0x2a8ed703
movzx edi, byte [edx + 2]
movzx eax, byte [esi + 2]
sub edi, eax
jne 0x2a8ed703
cmp ecx, 0xffffffff
je 0x2a8ed703
movzx edi, byte [edx + 3]
movzx eax, byte [esi + 3]
sub edi, eax
test edi, edi
jle 0x2a8ed71e
push 0x159
push str.cryptox509v3_v3_addr.c
push str.assertion_failed:_memcmp_min__max__length____0
call fcn.2a8baf90
add esp, 0xc
mov edi, dword [esp + 0x14]
xor ecx, ecx
test ebx, ebx
jle 0x2a8ed73d
mov esi, edi
mov edx, ebp
sub esi, ebp
mov edi, edi
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x2a8ed73d
inc ecx
inc edx
cmp ecx, ebx
jl 0x2a8ed730
lea edx, [ebx - 1]
test edx, edx
js 0x2a8ed75f
mov esi, edi
lea eax, [edx + ebp]
sub esi, ebp
jmp 0x2a8ed750
cmp byte [eax + esi], 0
jne 0x2a8ed75f
cmp byte [eax], 0xff
jne 0x2a8ed75f
dec eax
dec edx
jns 0x2a8ed750
cmp ecx, edx
jl case.0x2a8ed78b.2
jle 0x2a8ed771
pop edi
pop esi
pop ebp
lea eax, [ecx*8]
pop ebx
ret
mov bl, byte [ecx + ebp]
mov dh, byte [ecx + edi]
mov dl, bl
xor dl, dh
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x2a8ed78b.2
movzx eax, byte [eax + 0x2a8ed7fc]
jmp dword [eax*4 + 0x2a8ed7dc]
mov eax, 7
jmp 0x2a8ed7c1
mov eax, 6
jmp 0x2a8ed7c1
mov eax, 5
jmp 0x2a8ed7c1
mov eax, 4
jmp 0x2a8ed7c1
mov eax, 3
jmp 0x2a8ed7c1
mov eax, 2
jmp 0x2a8ed7c1
mov eax, 1
test dl, dh
jne case.0x2a8ed78b.2
and bl, dl
cmp bl, dl
jne case.0x2a8ed78b.2
pop edi
pop esi
pop ebp
lea eax, [eax + ecx*8]
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
Function at 0x2a8ee830
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push esi
push edi
mov edi, dword [esp + 0x10]
xor ecx, ecx
xor dl, dl
test edi, edi
je 0x2a8ee89a
mov eax, dword [esp + 0x14]
test eax, eax
je 0x2a8ee89a
movzx esi, byte [edi]
cmp dword [esp + 0x18], ecx
jne 0x2a8ee85f
cmp esi, 0x7f
jbe 0x2a8ee895
mov ecx, 1
lea ebp, [ecx + eax]
jmp 0x2a8ee8a1
or dl, 0xff
cmp esi, 0x80
jbe 0x2a8ee874
mov ecx, 1
lea ebp, [ecx + eax]
jmp 0x2a8ee8a1
jne 0x2a8ee895
xor edx, edx
lea esi, [edx + 1]
cmp eax, esi
jbe 0x2a8ee88b
nop
movzx ecx, byte [esi + edi]
inc esi
or edx, ecx
cmp esi, eax
jb 0x2a8ee880
neg edx
sbb dl, dl
movzx ecx, dl
and ecx, 1
lea ebp, [ecx + eax]
jmp 0x2a8ee8a1
mov ebp, 1
xor eax, eax
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x2a8ee8eb
mov esi, dword [esi]
test esi, esi
je 0x2a8ee8eb
mov byte [esi], dl
push ebx
movzx edx, dl
lea ebx, [esi + ecx]
mov dword [esp + 0x14], edx
lea esi, [edi + eax]
and edx, 1
add ebx, eax
test eax, eax
je 0x2a8ee8e4
mov edi, dword [esp + 0x14]
sub ebx, esi
mov edi, edi
movzx ecx, byte [esi - 1]
lea esi, [esi - 1]
xor ecx, edi
add edx, ecx
mov byte [ebx + esi], dl
shr edx, 8
dec eax
jne 0x2a8ee8d0
mov eax, dword [esp + 0x20]
pop ebx
add dword [eax], ebp
pop edi
pop esi
mov eax, ebp
pop ebp
ret

Function at 0x2a8ee980
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ebx
push esi
mov esi, dword [esp + 0xc]
movzx ebx, al
add esi, edx
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
and eax, 1
add edi, edx
test edx, edx
je 0x2a8ee9b9
movzx ecx, byte [edi - 1]
lea edi, [edi - 1]
xor ecx, ebx
lea esi, [esi - 1]
add eax, ecx
mov byte [esi], al
shr eax, 8
dec edx
jne 0x2a8ee9a3
pop edi
pop esi
pop ebx
ret
Function at 0x2a8f54f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.2a8b8f90
mov eax, dword [0x2a9b0720]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
push ebx
push ebp
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
mov dword [esp + 0x20], ebp
push esi
push edi
mov edi, dword [esp + 0x50]
movzx eax, byte [edx]
shl eax, 8
or ebx, eax
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 1]
shl eax, 0x10
or ebx, eax
mov esi, dword [edi]
movzx eax, byte [edx + 2]
shl eax, 0x18
or ebx, eax
mov dword [esp + 0x14], edi
movzx eax, byte [edx + 4]
shl eax, 8
or ecx, eax
mov dword [esp + 0x18], ebx
movzx eax, byte [edx + 5]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 6]
mov edx, dword [esp + 0x2c]
shl ecx, 8
or ecx, eax
mov byte [esp + 0x2c], bl
mov eax, ebx
shl ecx, 0x10
shr eax, 8
or edx, ecx
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2e], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2f], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x32], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x33], al
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edx
mov byte [esp + 0x30], dl
test eax, eax
je 0x2a8f56b3
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
lea esp, [esp]
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x2a8f5647
push 1
push dword [esp + 0x24]
lea eax, [esp + 0x20]
push eax
call fcn.2a8024c0
mov ebx, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2d], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2e], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2f], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x32], al
mov eax, edx
shr eax, 0x18
inc ebp
mov byte [esp + 0x2c], bl
mov byte [esp + 0x30], dl
mov byte [esp + 0x33], al
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x2a8f55e0
test ebp, ebp
mov ebp, dword [esp + 0x28]
je 0x2a8f569a
mov eax, dword [esp + 0x24]
mov byte [eax], bl
mov eax, ebx
shr eax, 8
mov byte [ebp], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp + 1], al
mov eax, edx
shr ebx, 0x18
mov byte [ebp + 2], bl
shr eax, 8
mov byte [ebp + 3], dl
mov byte [ebp + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.2a84c0e0
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.2a84c0e0
add esp, 0x28
ret