joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1015e3e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x20]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0x10], ecx
mov esi, dword [esi]
test esi, esi
je 0x1015e418
mov edx, dword [ebp + 0x1c]
test edi, edi
je 0x1015e418
mov al, byte [esi + edx]
dec edi
xor al, byte [ecx]
inc esi
mov byte [ebx], al
inc ecx
inc ebx
mov dword [ebp + 0x10], ecx
and esi, 0xf
jne 0x1015e401
cmp edi, 0x10
jb 0x1015e4a4
mov edx, dword [ebp + 0x1c]
mov eax, ebx
sub eax, edx
mov dword [ebp - 0xc], eax
mov eax, ecx
sub eax, edx
mov dword [ebp - 4], eax
mov eax, edi
shr eax, 4
mov dword [ebp - 8], eax
shl eax, 4
add ebx, eax
add ecx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp + 0x10], ecx
jmp 0x1015e453
mov edx, dword [ebp + 0x1c]
push dword [ebp + 0x14]
push edx
push dword [ebp + 0x18]
call dword [ebp + 0x24]
push dword [ebp + 0x18]
call fcn.1015e680
add esp, 0x10
cmp esi, 0x10
jae 0x1015e490
mov eax, dword [ebp + 0x1c]
mov edx, 0xf
sub edx, esi
add eax, esi
mov esi, dword [ebp - 4]
shr edx, 2
inc edx
mov ecx, dword [esi + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [ebx + eax - 4], ecx
dec edx
jne 0x1015e480
add dword [ebp - 4], 0x10
sub edi, 0x10
add ebx, 0x10
xor esi, esi
dec dword [ebp - 8]
jne 0x1015e450
mov ebx, dword [ebp - 0x10]
test edi, edi
je 0x1015e4e0
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call dword [ebp + 0x24]
push dword [ebp + 0x18]
call fcn.1015e680
mov eax, dword [ebp + 0x1c]
add esp, 0x10
mov edx, dword [ebp + 0x10]
sub ebx, eax
sub edx, eax
lea ecx, [esi + eax]
add esi, edi
mov edi, edi
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
dec edi
jne 0x1015e4d0
mov eax, dword [ebp + 0x20]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1015e4f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov ebx, dword [ebx]
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edx
mov dword [ebp + 0x10], edi
test ebx, ebx
je 0x1015e537
mov ecx, dword [ebp + 0x1c]
test esi, esi
je 0x1015e534
mov al, byte [ebx + ecx]
dec esi
xor al, byte [edi]
inc ebx
mov byte [edx], al
inc edi
inc edx
mov dword [ebp + 0x10], edi
and ebx, 0xf
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], ebx
jne 0x1015e517
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
movzx ecx, byte [eax + 0xc]
movzx eax, byte [eax + 0xd]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 0x18]
shl ecx, 8
movzx eax, byte [eax + 0xe]
or ecx, eax
mov eax, dword [ebp + 0x18]
shl ecx, 8
movzx eax, byte [eax + 0xf]
or ecx, eax
mov dword [ebp - 4], ecx
cmp esi, 0x10
jb 0x1015e5ea
mov ebx, dword [ebp + 0x10]
mov edi, edi
mov edi, esi
shr edi, 4
add ecx, edi
mov dword [ebp - 4], ecx
cmp ecx, edi
jae 0x1015e585
sub edi, ecx
xor ecx, ecx
mov dword [ebp - 4], ecx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
push edx
push ebx
call dword [ebp + 0x24]
mov ecx, dword [ebp - 4]
add esp, 0x14
mov edx, dword [ebp + 0x18]
mov eax, ecx
shr eax, 0x18
mov byte [edx + 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [edx + 0xe], al
mov byte [edx + 0xf], cl
test ecx, ecx
jne 0x1015e5cd
mov ecx, 0xc
mov edi, edi
dec ecx
inc byte [ecx + edx]
jne 0x1015e5ca
test ecx, ecx
jne 0x1015e5c0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
shl edi, 4
sub esi, edi
add edx, edi
add ebx, edi
mov dword [ebp - 8], edx
cmp esi, 0x10
jae 0x1015e570
mov dword [ebp + 0x10], ebx
mov ebx, dword [ebp - 0xc]
mov edi, dword [ebp + 0x10]
test esi, esi
je 0x1015e667
push dword [ebp + 0x18]
mov eax, dword [ebp + 0x1c]
xorps xmm0, xmm0
push dword [ebp + 0x14]
push 1
push eax
push eax
movdqu xmmword [eax], xmm0
call dword [ebp + 0x24]
mov ecx, dword [ebp - 4]
add esp, 0x14
mov edx, dword [ebp + 0x18]
inc ecx
mov eax, ecx
shr eax, 0x18
mov byte [edx + 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [edx + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [edx + 0xe], al
mov byte [edx + 0xf], cl
test ecx, ecx
jne 0x1015e63d
mov ecx, 0xc
dec ecx
inc byte [ecx + edx]
jne 0x1015e63d
test ecx, ecx
jne 0x1015e633
mov eax, dword [ebp + 0x1c]
sub edi, eax
mov edx, dword [ebp - 8]
sub edx, eax
mov dword [ebp + 0x10], edi
lea ecx, [ebx + eax]
add ebx, esi
mov dword [ebp - 0xc], ebx
mov ebx, edi
mov al, byte [ebx + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [edx + ecx - 1], al
dec esi
jne 0x1015e654
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x20]
pop edi
pop esi
mov dword [eax], ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1015e6a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x1c]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp + 0x10], ecx
mov esi, dword [esi]
test esi, esi
je 0x1015e6d8
mov edx, dword [ebp + 0x18]
test edi, edi
je 0x1015e6d8
mov al, byte [esi + edx]
dec edi
xor al, byte [ecx]
inc esi
mov byte [ebx], al
inc ecx
inc ebx
mov dword [ebp + 0x10], ecx
and esi, 0xf
jne 0x1015e6c1
cmp edi, 0x10
jb 0x1015e754
mov edx, dword [ebp + 0x18]
mov eax, ebx
sub eax, edx
mov dword [ebp - 0xc], eax
mov eax, ecx
sub eax, edx
mov dword [ebp - 4], eax
mov eax, edi
shr eax, 4
mov dword [ebp - 8], eax
shl eax, 4
add ebx, eax
add ecx, eax
mov dword [ebp - 0x10], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp + 0x10], ecx
jmp 0x1015e70b
mov edx, dword [ebp + 0x18]
push dword [ebp + 0x14]
push edx
push edx
call dword [ebp + 0x20]
add esp, 0xc
cmp esi, 0x10
jae 0x1015e740
mov eax, dword [ebp + 0x18]
mov edx, 0xf
sub edx, esi
add eax, esi
mov esi, dword [ebp - 4]
shr edx, 2
inc edx
mov edi, edi
mov ecx, dword [esi + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [ebx + eax - 4], ecx
dec edx
jne 0x1015e730
add dword [ebp - 4], 0x10
sub edi, 0x10
add ebx, 0x10
xor esi, esi
dec dword [ebp - 8]
jne 0x1015e708
mov ebx, dword [ebp - 0x10]
test edi, edi
je 0x1015e785
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
push eax
push eax
call dword [ebp + 0x20]
mov eax, dword [ebp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 0x10]
sub ebx, eax
sub edx, eax
lea ecx, [esi + eax]
add esi, edi
mov al, byte [ecx + edx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
dec edi
jne 0x1015e775
mov eax, dword [ebp + 0x1c]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1015ec00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x38]
or eax, dword [ebx + 0x3c]
je 0x1015ec1c
mov eax, 0xfffffffe
pop ebx
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [ebp + 0x10]
xor ecx, ecx
mov eax, esi
add eax, dword [ebx + 0x30]
adc ecx, dword [ebx + 0x34]
cmp ecx, 0x20000000
ja 0x1015ece0
jb 0x1015ec40
test eax, eax
jne 0x1015ece0
push edi
mov edi, dword [ebx + 0x16c]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], ecx
test edi, edi
je 0x1015ec87
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test esi, esi
je 0x1015ec6e
mov al, byte [ecx]
dec esi
xor byte [edi + ebx + 0x40], al
inc ecx
inc edi
mov dword [ebp - 4], ecx
and edi, 0xf
jne 0x1015ec57
jmp 0x1015ec72
test edi, edi
jne 0x1015ecd1
lea eax, [ebx + 0x60]
push eax
lea eax, [ebx + 0x40]
push eax
call fcn.1015fef0
mov eax, dword [ebp - 4]
add esp, 8
jmp 0x1015ec8d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov ecx, esi
and ecx, 0xfffffff0
mov dword [ebp - 8], ecx
je 0x1015ecb1
push ecx
push eax
lea eax, [ebx + 0x60]
push eax
lea eax, [ebx + 0x40]
push eax
call fcn.1015fcc0
mov eax, dword [ebp - 8]
add esp, 0x10
add dword [ebp - 4], eax
sub esi, eax
test esi, esi
je 0x1015ecd1
xor ecx, ecx
mov edi, esi
test esi, esi
je 0x1015ecd1
lea edx, [ebx + 0x40]
mov ebx, dword [ebp - 4]
mov al, byte [ecx + ebx]
xor byte [edx + ecx], al
inc ecx
cmp ecx, esi
jb 0x1015ecc3
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x16c], edi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10160740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1041f700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov bl, byte [esi]
mov ecx, dword [esi + 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 0x34], esi
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
test bl, 0x40
jne 0x1016078b
push eax
lea eax, [esi + 0x10]
push eax
push esi
call ecx
add esp, 0xc
movzx eax, bl
mov edx, 0xf
and eax, 7
xor ecx, ecx
sub edx, eax
mov byte [esi], al
mov dword [ebp - 0x30], edx
cmp edx, 0xf
jae 0x101607b7
movzx eax, byte [esi + edx]
or ecx, eax
mov byte [esi + edx], 0
inc edx
shl ecx, 8
cmp edx, 0xf
jb 0x101607a4
movzx eax, byte [esi + 0xf]
mov ebx, dword [ebp + 0x14]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, ebx
je 0x101607db
pop esi
or eax, 0xffffffff
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101c7f5c
mov esp, ebp
pop ebp
ret
push edi
mov edi, ebx
shr edi, 4
test edi, edi
je 0x10160814
lea eax, [esi + 0x10]
push eax
push esi
push dword [ebp - 0x24]
push edi
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
call dword [ebp - 0x2c]
shl edi, 4
add esp, 0x18
add dword [ebp - 0x20], edi
add dword [ebp - 0x1c], edi
sub ebx, edi
je 0x10160873
shr edi, 4
push edi
push esi
call fcn.10160f60
add esp, 8
test ebx, ebx
je 0x10160873
push dword [ebp - 0x24]
lea eax, [ebp - 0x14]
push eax
push esi
call dword [ebp - 0x28]
add esp, 0xc
xor edi, edi
test ebx, ebx
je 0x10160862
lea eax, [ebp - 0x14]
sub dword [ebp - 0x20], eax
sub dword [ebp - 0x1c], eax
lea eax, [esi + 0x10]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov edi, edi
lea ecx, [ebp - 0x14]
add ecx, edi
movzx edx, byte [esi + ecx]
movzx eax, byte [ecx]
xor edx, eax
mov eax, dword [ebp - 0x1c]
mov byte [eax + ecx], dl
mov eax, dword [ebp - 0x2c]
xor byte [eax + edi], dl
inc edi
cmp edi, ebx
jb 0x10160840
mov esi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x24]
lea eax, [esi + 0x10]
push ebx
push eax
push eax
call dword [ebp - 0x28]
add esp, 0xc
jmp 0x10160876
mov ebx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x30]
cmp edx, 0x10
jae 0x10160898
mov ecx, 0x10
lea edi, [edx + esi]
sub ecx, edx
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push ebx
lea eax, [ebp - 0x14]
push eax
push esi
call dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor dword [esi + 0x10], eax
mov eax, dword [ebp - 0x10]
xor dword [esi + 0x14], eax
mov eax, dword [ebp - 0xc]
xor dword [esi + 0x18], eax
mov eax, dword [ebp - 8]
xor dword [esi + 0x1c], eax
mov al, byte [ebp - 0x15]
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi], al
xor ecx, ebp
pop esi
xor eax, eax
pop ebx
call fcn.101c7f5c
mov esp, ebp
pop ebp
ret
Function at 0x10161370
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x1c], 0
je 0x10161386
mov dword [ebp + 0x1c], fcn.101612d0
pop ebp
jmp fcn.1015e240
mov dword [ebp + 0x1c], fcn.101612b0
pop ebp
jmp fcn.1015dfd0
Function at 0x10161980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi + 0x80]
test al, al
je 0x10161a6e
movzx eax, al
sub esi, eax
push ebx
mov ebx, dword [ebp + 0x14]
sub esi, 0xffffff80
cmp ebx, eax
push edi
cmova ebx, eax
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 4], edi
test ebx, ebx
jle 0x10161a4d
cmp ebx, 0x20
jb 0x10161a36
lea ecx, [edx - 1]
mov dword [ebp - 4], edi
add ecx, ebx
cmp eax, ecx
ja 0x101619d5
lea ecx, [eax - 1]
add ecx, ebx
cmp ecx, edx
jae 0x10161a36
lea ecx, [esi - 1]
add ecx, ebx
cmp eax, ecx
ja 0x101619e7
lea ecx, [eax - 1]
add ecx, ebx
cmp ecx, esi
jae 0x10161a36
mov ecx, ebx
and ecx, 0x8000001f
jns 0x101619f6
dec ecx
or ecx, 0xffffffe0
inc ecx
mov dword [ebp - 4], ebx
sub dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
nop
movdqu xmm0, xmmword [edx]
add edi, 0x20
movdqu xmm1, xmmword [esi]
pxor xmm1, xmm0
movdqu xmmword [eax], xmm1
movdqu xmm1, xmmword [esi + 0x10]
add esi, 0x20
movdqu xmm0, xmmword [edx + 0x10]
add edx, 0x20
pxor xmm1, xmm0
movdqu xmmword [eax + 0x10], xmm1
add eax, 0x20
cmp edi, ecx
jl 0x10161a00
mov dword [ebp - 4], edi
cmp edi, ebx
jge 0x10161a4d
mov edi, ebx
sub esi, eax
sub edi, dword [ebp - 4]
mov cl, byte [esi + eax]
xor cl, byte [edx]
inc edx
mov byte [eax], cl
inc eax
dec edi
jne 0x10161a41
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
pop edi
sub ecx, ebx
sub byte [esi + 0x80], bl
pop ebx
push ecx
push eax
push edx
push esi
call fcn.10161ad0
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push ecx
push eax
push edx
push esi
call fcn.10161ad0
add esp, 0x10
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10162620
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x10], ecx
movzx ecx, byte [edx + 7]
movzx eax, byte [edx + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x14], ecx
movzx ecx, byte [edx + 0xb]
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x18], ecx
movzx ecx, byte [edx + 0xf]
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
cmp dword [ebp + 0x10], 0x100
mov dword [esi + 0x1c], ecx
jne 0x101626c5
add edx, 0x10
mov edi, str.expand_32_byte_kexpand_16_byte_k
jmp 0x101626ca
mov edi, 0x102ea3f8
movzx ecx, byte [edx + 3]
shl ecx, 8
movzx eax, byte [edx + 2]
or ecx, eax
movzx eax, byte [edx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x20], ecx
movzx ecx, byte [edx + 7]
shl ecx, 8
movzx eax, byte [edx + 6]
or ecx, eax
movzx eax, byte [edx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 4]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x24], ecx
movzx ecx, byte [edx + 0xb]
movzx eax, byte [edx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 8]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x28], ecx
movzx ecx, byte [edx + 0xf]
movzx eax, byte [edx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [edx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [esi + 0x2c], ecx
movsx ecx, byte [edi + 3]
movsx eax, byte [edi + 2]
shl ecx, 8
or ecx, eax
movsx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
movsx eax, byte [edi]
shl ecx, 8
or ecx, eax
mov dword [esi], ecx
movsx ecx, byte [edi + 7]
movsx eax, byte [edi + 6]
shl ecx, 8
or ecx, eax
movsx eax, byte [edi + 5]
shl ecx, 8
or ecx, eax
movsx eax, byte [edi + 4]
shl ecx, 8
or ecx, eax
mov dword [esi + 4], ecx
movsx ecx, byte [edi + 0xb]
movsx eax, byte [edi + 0xa]
shl ecx, 8
or ecx, eax
movsx eax, byte [edi + 9]
shl ecx, 8
or ecx, eax
movsx eax, byte [edi + 8]
shl ecx, 8
or ecx, eax
mov dword [esi + 8], ecx
movsx ecx, byte [edi + 0xf]
movsx eax, byte [edi + 0xe]
shl ecx, 8
or ecx, eax
movsx eax, byte [edi + 0xd]
shl ecx, 8
or ecx, eax
movsx eax, byte [edi + 0xc]
shl ecx, 8
or ecx, eax
pop edi
mov dword [esi + 0xc], ecx
pop esi
pop ebp
ret
Function at 0x101750d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
test esi, esi
jle 0x101751bd
push edi
mov edi, dword [ebp + 0xc]
inc edi
lea ebx, [ebx]
movzx edx, byte [edi - 1]
cmp esi, 3
jl 0x1017514e
movzx ecx, byte [edi]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
mov ecx, edx
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + 0x102eca88]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x102eca88]
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 6
and ecx, 0x3f
and edx, 0x3f
movzx ecx, byte [ecx + 0x102eca88]
mov byte [eax + 2], cl
movzx ecx, byte [edx + 0x102eca88]
mov byte [eax + 3], cl
jmp 0x1017519f
shl edx, 0x10
cmp esi, 2
jne 0x1017515e
movzx ecx, byte [edi]
shl ecx, 8
or edx, ecx
mov ecx, edx
shr ecx, 0x12
and ecx, 0x3f
movzx ecx, byte [ecx + 0x102eca88]
mov byte [eax], cl
mov ecx, edx
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + 0x102eca88]
mov byte [eax + 1], cl
cmp esi, 1
jne 0x1017518b
lea ecx, [esi + 0x3c]
jmp 0x10175198
shr edx, 6
and edx, 0x3f
movzx ecx, byte [edx + 0x102eca88]
mov byte [eax + 2], cl
mov byte [eax + 3], 0x3d
sub esi, 3
add eax, 4
add ebx, 4
add edi, 3
test esi, esi
jg 0x101750f0
pop edi
mov byte [eax], 0
mov eax, ebx
pop esi
pop ebx
pop ebp
ret
mov byte [eax], bl
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x10175430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
test edi, edi
je 0x10175463
push ebx
mov ebx, dword [ebp + 0xc]
sub ebx, eax
jmp 0x10175450
movzx edx, byte [ebx + eax]
lea eax, [eax + 1]
movzx ecx, byte [eax - 1]
xor edx, ecx
or esi, edx
dec edi
jne 0x10175450
pop ebx
xor eax, eax
test esi, esi
pop edi
setne al
pop esi
pop ebp
ret
Function at 0x101767b0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
cmp dword [ebp + 0x18], esi
jne 0x10176849
mov ecx, dword [ebp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x101767cd
cmp al, 0x6b
jne 0x10176849
inc ecx
cmp al, 0x6b
jne 0x10176819
add esi, 0xfffffffd
xor eax, eax
test esi, esi
jle 0x10176808
jmp 0x101767e0
mov dl, byte [ecx]
inc ecx
cmp dl, 0xba
je 0x101767f2
cmp dl, 0xbb
jne 0x101767fa
inc eax
cmp eax, esi
jl 0x101767e0
test eax, eax
je 0x10176808
sub esi, eax
jmp 0x1017681c
push 0x7b
push str.Z:metasploit_payloadscmeterpreterdepslibresslcrypto_rsa_rsa_x931.c
push 0x8a
jmp 0x10176855
push 0x81
push str.Z:metasploit_payloadscmeterpreterdepslibresslcrypto_rsa_rsa_x931.c
push 0x8a
jmp 0x10176855
add esi, 0xfffffffe
test esi, esi
js 0x10176838
cmp byte [esi + ecx], 0xcc
jne 0x10176838
push esi
push ecx
push dword [ebp + 8]
call fcn.101b8700
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret
push 0x8a
push str.Z:metasploit_payloadscmeterpreterdepslibresslcrypto_rsa_rsa_x931.c
push 0x8b
jmp 0x10176855
push 0x70
push str.Z:metasploit_payloadscmeterpreterdepslibresslcrypto_rsa_rsa_x931.c
push 0x89
push 0xfff
push 4
call fcn.10112080
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
Function at 0x101780a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x10c], 0xffffffff
jne 0x101780b5
xor eax, eax
pop edi
pop ebp
ret
push ebx
push esi
push edi
call fcn.1010f690
mov ecx, dword [ebp + 0x10]
add esp, 4
mov ebx, dword [ebp + 0xc]
mov esi, eax
mov dword [ecx], esi
test ebx, ebx
je 0x1017816c
mov ecx, dword [edi + 0x10c]
cmp ecx, esi
jne 0x10178104
test esi, esi
jle 0x1017814b
mov edx, ebx
lea ecx, [edi + 0x8c]
mov ebx, esi
lea ebx, [ebx]
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
dec ebx
jne 0x101780f0
jmp 0x10178148
sub eax, ecx
mov byte [ecx + edi + 0xec], 0x80
cmp eax, 1
jle 0x10178128
dec eax
push eax
lea eax, [edi + 0xed]
add eax, ecx
push 0
push eax
call fcn.101b9cb0
add esp, 0xc
test esi, esi
jle 0x1017814b
mov edx, ebx
lea ecx, [edi + 0xac]
mov ebx, esi
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
dec ebx
jne 0x10178136
mov ebx, dword [ebp + 0xc]
push esi
push ebx
push ebx
push edi
call fcn.1010fa70
add esp, 0x10
test eax, eax
jne 0x1017816c
push esi
push ebx
call fcn.10123ce0
add esp, 8
xor eax, eax
pop esi
pop ebx
pop edi
pop ebp
ret
pop esi
pop ebx
mov eax, 1
pop edi
pop ebp
ret
Function at 0x1018d240
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push ebx
push edi
mov eax, dword [ecx + 4]
cmp eax, dword [edx + 4]
jge 0x1018d257
mov edi, edx
jmp 0x1018d25e
mov edi, ecx
mov ecx, edx
mov dword [ebp + 0xc], ecx
mov ebx, dword [ebp + 8]
mov eax, dword [edi + 4]
cmp eax, dword [ebx + 8]
jg 0x1018d26d
mov eax, ebx
jmp 0x1018d27a
push eax
push ebx
call fcn.10125d30
mov ecx, dword [ebp + 0xc]
add esp, 8
test eax, eax
jne 0x1018d282
pop edi
pop ebx
pop ebp
ret
push esi
xor esi, esi
cmp dword [ecx + 4], esi
jle 0x1018d2a8
lea ebx, [ebx]
mov eax, dword [edi]
mov ecx, dword [ecx]
mov edx, dword [eax + esi*4]
xor edx, dword [ecx + esi*4]
mov eax, dword [ebx]
mov ecx, dword [ebp + 0xc]
mov dword [eax + esi*4], edx
inc esi
cmp esi, dword [ecx + 4]
jl 0x1018d290
cmp esi, dword [edi + 4]
jge 0x1018d2c0
lea ecx, [ecx]
mov eax, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [eax + esi*4]
mov dword [ecx + esi*4], eax
inc esi
cmp esi, dword [edi + 4]
jl 0x1018d2b0
mov ecx, dword [edi + 4]
mov dword [ebx + 4], ecx
pop esi
test ecx, ecx
jle 0x1018d2e4
mov edx, dword [ebx]
add edx, 0xfffffffc
lea edx, [edx + ecx*4]
mov eax, dword [edx]
lea edx, [edx - 4]
test eax, eax
jne 0x1018d2e1
dec ecx
test ecx, ecx
jg 0x1018d2d3
mov dword [ebx + 4], ecx
pop edi
mov eax, 1
pop ebx
pop ebp
ret