joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b5130
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
push eax
push ebx
cmp ecx, 0
je 0x6b520f
and ebp, 0xfffffff8
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
je 0x6b51a5
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.006b4800
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b516f
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x6b52c6
call 0x6b51b7
pop edx
lea ecx, [edx + 0x149]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x6b5267
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.006b4ca0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b521c
mov ebp, dword [esp + 0x34]
and ebp, 7
je 0x6b52c6
mov eax, dword [esi]
mov ebx, dword [esi + 4]
bswap eax
bswap ebx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call fcn.006b4ca0
mov eax, dword [esp + 8]
mov ebx, dword [esp + 0xc]
bswap eax
bswap ebx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x6b52c4
jmp 0x6b52c6
mov ecx, dword [esp + 0x3c]
add esp, 0x18
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6bae60
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x6baf30
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x6baece
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.006baac0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6baea0
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x6bafd7
call 0x6baee0
pop edx
lea ecx, [edx + 0x120]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x6baf80
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.006baac0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6baf3d
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x6bafd7
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call fcn.006baac0
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x6bafd5
jmp 0x6bafd7
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6bb040
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x6bb119
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x6bb0b7
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.006bac00
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6bb089
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x6bb1c0
call 0x6bb0c9
pop edx
lea ecx, [edx + 0x137]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x6bb169
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.006bad30
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6bb126
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x6bb1c0
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call fcn.006bad30
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x6bb1be
jmp 0x6bb1c0
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6bbac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
mov edi, dword [eax]
movzx esi, byte [edx]
movzx eax, byte [edx + 1]
movzx ecx, byte [edx + 2]
mov dword [esp + 0x1c], ecx
movzx ebx, byte [edx + 3]
movzx ecx, byte [edx + 4]
mov dword [esp + 0x14], ecx
movzx ebp, byte [edx + 5]
movzx ecx, byte [edx + 6]
mov dword [esp + 0x18], ecx
movzx ecx, byte [edx + 7]
mov dword [esp + 0x10], ecx
mov ecx, esi
mov byte [esp], cl
mov byte [esp + 1], al
mov esi, eax
shl esi, 8
or esi, ecx
mov edx, dword [esp + 0x1c]
mov byte [esp + 2], dl
mov byte [esp + 3], bl
mov ecx, dword [esp + 0x14]
mov byte [esp + 4], cl
mov eax, ebp
mov byte [esp + 5], al
shl eax, 8
or eax, ecx
shl edx, 0x10
or edx, esi
mov ecx, ebx
shl ecx, 0x18
or ecx, edx
mov ebx, dword [esp + 0x18]
mov byte [esp + 6], bl
shl ebx, 0x10
or ebx, eax
mov eax, dword [esp + 0x10]
mov byte [esp + 7], al
shl eax, 0x18
or eax, ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
cmp dword [esp + 0x3c], 0
je 0x6bbc17
xor ebp, ebp
xor ebx, ebx
jmp 0x6bbb8d
movzx edx, byte [esp + edi]
mov esi, dword [esp + 0x34]
xor dl, byte [esi + ebp]
mov esi, dword [esp + 0x38]
mov byte [esi + ebp], dl
inc edi
and edi, 7
inc ebp
cmp dword [esp + 0x3c], ebp
je 0x6bbbe8
test edi, edi
jne 0x6bbb70
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x48]
lea eax, [esp + 0x14]
push eax
call fcn.006bac00
add esp, 0x10
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov byte [esp], cl
mov byte [esp + 1], ch
mov edx, ecx
shr edx, 0x10
mov byte [esp + 2], dl
mov edx, ecx
shr edx, 0x18
mov byte [esp + 3], dl
mov byte [esp + 4], al
mov byte [esp + 5], ah
mov edx, eax
shr edx, 0x10
mov byte [esp + 6], dl
mov edx, eax
shr edx, 0x18
mov byte [esp + 7], dl
inc ebx
jmp 0x6bbb70
test ebx, ebx
je 0x6bbc17
mov esi, dword [esp + 0x4c]
mov byte [esi], cl
mov byte [esi + 1], ch
mov edx, ecx
shr edx, 0x10
mov byte [esi + 2], dl
shr ecx, 0x18
mov byte [esi + 3], cl
mov byte [esi + 4], al
mov byte [esi + 5], ah
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 6], cl
shr eax, 0x18
mov byte [esi + 7], al
mov eax, dword [esp + 0x50]
mov dword [eax], edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6bbc30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
mov edi, dword [eax]
movzx esi, byte [edx]
movzx eax, byte [edx + 1]
movzx ecx, byte [edx + 2]
mov dword [esp + 0x1c], ecx
movzx ebx, byte [edx + 3]
movzx ecx, byte [edx + 4]
mov dword [esp + 0x14], ecx
movzx ebp, byte [edx + 5]
movzx ecx, byte [edx + 6]
mov dword [esp + 0x18], ecx
movzx ecx, byte [edx + 7]
mov dword [esp + 0x10], ecx
mov ecx, esi
mov byte [esp], cl
mov byte [esp + 1], al
mov esi, eax
shl esi, 8
or esi, ecx
mov edx, dword [esp + 0x1c]
mov byte [esp + 2], dl
mov byte [esp + 3], bl
mov ecx, dword [esp + 0x14]
mov byte [esp + 4], cl
mov eax, ebp
mov byte [esp + 5], al
shl eax, 8
or eax, ecx
shl edx, 0x10
or edx, esi
mov ecx, ebx
shl ecx, 0x18
or ecx, edx
mov ebx, dword [esp + 0x18]
mov byte [esp + 6], bl
shl ebx, 0x10
or ebx, eax
mov eax, dword [esp + 0x10]
mov byte [esp + 7], al
shl eax, 0x18
or eax, ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
cmp dword [esp + 0x3c], 0
je 0x6bbd55
xor ebp, ebp
xor ebx, ebx
jmp 0x6bbcfd
movzx edx, byte [esp + edi]
mov esi, dword [esp + 0x34]
xor dl, byte [esi + ebp]
mov esi, dword [esp + 0x38]
mov byte [esi + ebp], dl
inc edi
and edi, 7
inc ebp
cmp dword [esp + 0x3c], ebp
je 0x6bbd26
test edi, edi
jne 0x6bbce0
push 1
push dword [esp + 0x44]
lea eax, [esp + 0x10]
push eax
call fcn.006baac0
add esp, 0xc
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esp], ecx
mov dword [esp + 4], eax
inc ebx
jmp 0x6bbce0
test ebx, ebx
je 0x6bbd55
mov esi, dword [esp + 0x44]
mov byte [esi], cl
mov byte [esi + 1], ch
mov edx, ecx
shr edx, 0x10
mov byte [esi + 2], dl
shr ecx, 0x18
mov byte [esi + 3], cl
mov byte [esi + 4], al
mov byte [esi + 5], ah
mov ecx, eax
shr ecx, 0x10
mov byte [esi + 6], cl
shr eax, 0x18
mov byte [esi + 7], al
mov eax, dword [esp + 0x48]
mov dword [eax], edi
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6cc910
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x178
push dword [esp + 0x198]
push str.SHA512
push dword [esp + 0x194]
call fcn.005bb2e0
add esp, 0xc
test eax, eax
je 0x6cc9fc
mov ebx, esp
push 0
push eax
push 0
push ebx
push 0x20
push dword [esp + 0x1a8]
mov edi, eax
call fcn.005bb180
add esp, 0x18
mov esi, eax
push edi
call fcn.005b9d90
add esp, 4
test esi, esi
je 0x6cca00
and byte [esp], 0xf8
movzx eax, byte [esp + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [esp + 0x1f], al
lea ebp, [esp + 0xd8]
mov edx, esp
mov ecx, ebp
call fcn.006c6840
lea edx, [esp + 0x128]
mov esi, ebx
lea ebx, [esp + 0xb0]
mov ecx, ebx
call fcn.006cd990
lea edi, [esp + 0x88]
mov ecx, edi
mov edx, ebp
push ebx
call fcn.006cdfe0
add esp, 4
lea edx, [esp + 0x100]
lea ebp, [esp + 0x60]
mov ecx, ebp
push ebx
mov ebx, esi
call fcn.006cdfe0
add esp, 4
mov esi, dword [esp + 0x190]
mov ecx, esi
mov edx, ebp
call fcn.006cefa0
lea ecx, [esp + 0x40]
mov edx, edi
call fcn.006cefa0
movzx eax, byte [esp + 0x40]
shl al, 7
xor byte [esi + 0x1f], al
mov esi, 1
jmp 0x6cca02
xor esi, esi
jmp 0x6cca0d
xor esi, esi
push 0x40
push ebx
call fcn.005e9a90
add esp, 8
mov eax, esi
add esp, 0x178
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6cd770
Capabilities:
Encrypt data using curve25519
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x174
mov eax, dword [esp + 0x18c]
movups xmm0, xmmword [eax]
movups xmm1, xmmword [eax + 0x10]
movups xmmword [esp + 0x8c], xmm0
movups xmmword [esp + 0x9c], xmm1
and byte [esp + 0x8c], 0xf8
movzx eax, byte [esp + 0xab]
and al, 0x3f
or al, 0x40
mov byte [esp + 0xab], al
lea ecx, [esp + 0xac]
lea edx, [esp + 0x8c]
call fcn.006c6840
mov edx, dword [esp + 0xfc]
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0xd8]
mov dword [esp + 0x34], ecx
add eax, edx
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x100]
mov dword [esp + 0x30], eax
lea eax, [ecx + eax]
mov dword [esp + 0x68], eax
mov ecx, dword [esp + 0x104]
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0xdc]
mov dword [esp + 0x28], eax
lea eax, [eax + ecx]
mov dword [esp + 0x6c], eax
mov ecx, dword [esp + 0x108]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0xe0]
mov dword [esp + 0x20], eax
lea eax, [eax + ecx]
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x10c]
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xe4]
mov dword [esp + 0x18], eax
lea eax, [eax + ecx]
mov dword [esp + 0x74], eax
mov ebx, dword [esp + 0x110]
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x14], eax
lea eax, [eax + ebx]
mov dword [esp + 0x78], eax
mov edi, dword [esp + 0x114]
mov eax, dword [esp + 0xec]
mov dword [esp + 0x10], eax
lea eax, [eax + edi]
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0xf0]
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0x118]
lea eax, [eax + edx]
mov dword [esp + 0x80], eax
mov esi, dword [esp + 0x11c]
mov eax, dword [esp + 0xf4]
mov dword [esp + 4], eax
add eax, esi
mov dword [esp + 0x84], eax
mov ecx, dword [esp + 0x120]
mov eax, dword [esp + 0xf8]
mov dword [esp], eax
lea ebp, [eax + ecx]
mov dword [esp + 0x88], ebp
mov ebp, dword [esp + 0x2c]
sub ebp, dword [esp + 0x38]
mov dword [esp + 0x3c], ebp
mov ebp, dword [esp + 0x30]
sub ebp, dword [esp + 0x34]
mov dword [esp + 0x40], ebp
mov ebp, dword [esp + 0x24]
sub ebp, dword [esp + 0x28]
mov dword [esp + 0x44], ebp
mov ebp, dword [esp + 0x1c]
sub ebp, dword [esp + 0x20]
mov dword [esp + 0x48], ebp
mov eax, dword [esp + 8]
sub eax, dword [esp + 0x18]
mov dword [esp + 0x4c], eax
sub ebx, dword [esp + 0x14]
mov dword [esp + 0x50], ebx
sub edi, dword [esp + 0x10]
mov dword [esp + 0x54], edi
sub edx, dword [esp + 0xc]
mov dword [esp + 0x58], edx
sub esi, dword [esp + 4]
mov dword [esp + 0x5c], esi
sub ecx, dword [esp]
mov dword [esp + 0x60], ecx
lea ebx, [esp + 0x14c]
lea edx, [esp + 0x3c]
mov ecx, ebx
call fcn.006cd990
lea ebp, [esp + 0x64]
mov ecx, ebp
mov edx, ebp
push ebx
call fcn.006cdfe0
add esp, 4
mov ecx, dword [esp + 0x188]
mov edx, ebp
call fcn.006cefa0
push 0x20
lea eax, [esp + 0x90]
push eax
call fcn.005e9a90
add esp, 0x17c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x6fc7a0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebp, dword [esp + 0x2c]
mov esi, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
cmp ebp, 2
jne 0x6fc7e1
mov eax, dword [esp + 0x34]
cmp esi, 0x43f
je 0x6fc7d0
cmp esi, 0x40a
jne 0x6fc81f
mov edi, edx
xor ecx, ecx
cmp esi, 0x40a
setne cl
add ecx, ecx
jmp 0x6fc833
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x6fc9d6
lea eax, [esp + 4]
push edi
push 0
push eax
push 0
call fcn.0057a0d0
add esp, 0x10
mov ebx, 0xa9
cmp dword [esp + 4], 0xffffffff
je 0x6fc91a
call fcn.005b7120
push str.ossl_ecx_key_op
push ebx
jmp 0x6fca1e
mov edi, edx
xor ecx, ecx
cmp esi, 0x40b
setne cl
lea ecx, [ecx*2 + 1]
push eax
push 1
push ecx
push dword [esp + 0x3c]
call fcn.006fcb00
add esp, 0x10
test eax, eax
je 0x6fc8db
test ebp, ebp
mov dword [esp], eax
je 0x6fc903
push eax
call fcn.006fcc20
add esp, 4
test eax, eax
je 0x6fc93e
cmp ebp, 2
jne 0x6fc94a
test esi, esi
mov ecx, dword [esp]
je 0x6fc97b
mov ecx, 0x20
cmp esi, 0x40a
je 0x6fc89e
cmp esi, 0x43f
je 0x6fc89e
xor ecx, ecx
cmp esi, 0x40b
sete cl
xor ecx, 0x39
push 0
push ecx
mov ebp, eax
push eax
push dword [esp + 0x3c]
call fcn.006055e0
add esp, 0x10
test eax, eax
jle 0x6fc9bf
cmp esi, 0x40a
mov ecx, dword [esp]
jne 0x6fca43
and byte [ebp], 0xf8
movzx eax, byte [ebp + 0x1f]
and al, 0x3f
or al, 0x40
mov byte [ebp + 0x1f], al
jmp 0x6fc97b
call fcn.005b7120
push str.ossl_ecx_key_op
push 0xbc
push str.crypto_ec_ecx_backend.c
call fcn.005b7220
add esp, 0xc
push 0
push 0x80010
jmp 0x6fca2f
add eax, 0xc
push edi
push ebx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
mov eax, dword [esp + 0xc]
add esp, 0xc
jmp 0x6fca3b
push dword [edi]
call fcn.005f28d0
add esp, 4
test esi, esi
je 0x6fc9cc
mov ebx, 0xaf
cmp eax, esi
jne 0x6fc80f
jmp 0x6fc9ce
mov esi, 0x80010
mov edi, 0xc6
jmp 0x6fc99a
mov ecx, 0x20
cmp esi, 0x40a
je 0x6fc96d
cmp esi, 0x43f
je 0x6fc96d
xor ecx, ecx
cmp esi, 0x40b
sete cl
xor ecx, 0x39
push ecx
push ebx
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov ecx, dword [esp]
push ecx
call fcn.006fc500
add esp, 4
test eax, eax
je 0x6fc990
mov eax, dword [esp]
jmp 0x6fca3b
mov esi, 0xa6
mov edi, 0xda
call fcn.005b7120
push str.ossl_ecx_key_op
push edi
push str.crypto_ec_ecx_backend.c
call fcn.005b7220
add esp, 0xc
push 0
push esi
push 0x10
call fcn.005b7310
add esp, 0xc
push dword [esp]
call fcn.006fcba0
add esp, 4
jmp 0x6fca39
mov esi, eax
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
test ebx, ebx
sete al
test esi, esi
sete cl
or cl, al
jne 0x6fca0f
mov eax, 0x20
cmp esi, 0x40a
je 0x6fca07
cmp esi, 0x43f
je 0x6fca07
xor eax, eax
cmp esi, 0x40b
sete al
xor eax, 0x39
cmp eax, edx
je 0x6fc7bc
call fcn.005b7120
push str.ossl_ecx_key_op
push 0xb5
push str.crypto_ec_ecx_backend.c
call fcn.005b7220
add esp, 0xc
push 0
push 0x66
push 0x10
call fcn.005b7310
add esp, 0xc
xor eax, eax
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
cmp esi, 0x40b
jne 0x6fc97b
and byte [ebp], 0xfc
or byte [ebp + 0x37], 0x80
jmp 0x6fc97b
Function at 0x703230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xa0
mov dword [esp + 0xc], edx
mov ebx, dword [esp + 0xb4]
mov dword [esp + 4], ecx
mov ecx, dword [ecx]
xor eax, eax
cmp ecx, 1
sbb eax, eax
mov dword [esp], eax
mov eax, 1
test ebx, ebx
je 0x7033ae
mov edx, dword [ebx]
test edx, edx
je 0x7033ae
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x3c]
mov dword [esp + 8], eax
or dword [esp], ecx
nop word [eax + eax]
xorps xmm0, xmm0
movsd qword [esp + 0x70], xmm0
xorps xmm1, xmm1
movups xmmword [esp + 0x60], xmm1
movups xmmword [esp + 0x50], xmm1
movups xmmword [esp + 0x40], xmm1
movups xmmword [esp + 0x30], xmm1
movups xmmword [esp + 0x20], xmm1
movups xmmword [esp + 0x10], xmm1
lea eax, [esp + 0x88]
movsd qword [eax + 0x10], xmm0
movups xmmword [eax], xmm1
mov eax, dword [esp + 0xc]
mov dword [esp + 0x78], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 8]
mov dword [esp + 0x80], eax
mov dword [esp + 0x7c], eax
mov eax, dword [esp]
mov dword [esp + 0x84], eax
mov dword [esp + 0x94], edx
lea ecx, [esp + 0x78]
mov edx, 0xa5f600
push 0x56
call fcn.007035d0
add esp, 4
mov esi, eax
mov edi, fcn.007029b0
test eax, eax
je 0x703317
mov eax, dword [esi + 0x10]
mov edi, dword [esi + 0x24]
test edi, edi
mov ecx, fcn.007029b0
cmove edi, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], ebx
lea eax, [esp + 0x10]
push eax
push esi
push 7
call edi
add esp, 0xc
mov ebp, eax
test eax, eax
jle 0x70335f
cmp dword [esp + 0x14], 0
je 0x70335f
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x20]
push dword [esp + 0xc]
push dword [esp + 0x18]
push dword [esp + 0x18]
call fcn.005d2590
add esp, 0x18
mov ebp, eax
test ebp, ebp
jle 0x703378
mov dword [esp + 0x24], ebp
lea eax, [esp + 0x10]
push eax
push esi
push 8
call edi
add esp, 0xc
mov ebp, dword [esp + 0x24]
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x703393
push 0x2c9
push str.crypto_evp_ctrl_params_translate.c
push eax
call fcn.005dcbc0
add esp, 0xc
test ebp, ebp
jle 0x7033ac
mov edx, dword [ebx + 0x14]
add ebx, 0x14
test edx, edx
jne 0x703280
mov eax, 1
jmp 0x7033ae
xor eax, eax
add esp, 0xa0
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x70c440
Capabilities:
Encode data using base64

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
mov esi, dword [edx]
test esi, esi
je 0x70c51f
mov ebx, dword [esp + 0x28]
test byte [edx + 0x5c], 2
mov eax, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov edi, esi
mov esi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
cmove esi, eax
test edi, edi
jle 0x70c526
mov dword [esp + 4], esi
lea ebp, [edx + 9]
mov dword [esp], 4
mov esi, edi
nop dword [eax + eax]
movzx eax, byte [ebp - 1]
mov edi, eax
shl edi, 0x10
cmp esi, 2
mov dword [esp + 8], esi
jbe 0x70c535
movzx ebx, byte [ebp]
shl ebx, 8
movzx ecx, byte [ebp + 1]
mov dword [esp + 0xc], ecx
lea edx, [ebx + ecx]
or ebx, edi
shr eax, 2
mov esi, dword [esp + 4]
movzx eax, byte [esi + eax]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp]
mov byte [edi + ecx - 4], al
shr ebx, 0xc
and ebx, 0x3f
movzx eax, byte [esi + ebx]
mov byte [edi + ecx - 3], al
shr edx, 6
and edx, 0x3f
movzx eax, byte [esi + edx]
mov byte [edi + ecx - 2], al
mov eax, dword [esp + 0xc]
and eax, 0x3f
movzx eax, byte [esi + eax]
mov esi, dword [esp + 8]
mov byte [edi + ecx - 1], al
add ecx, 4
mov dword [esp], ecx
add ebp, 3
add esi, 0xfffffffd
jne 0x70c490
mov ebx, dword [esp + 0x28]
mov esi, dword [esp]
lea eax, [esi + ebx]
add eax, 0xfffffffc
add esi, 0xfffffffc
jmp 0x70c587
xor esi, esi
jmp 0x70c5a7
xor esi, esi
mov eax, ebx
mov byte [eax], 0
test byte [edx + 0x5c], 1
je 0x70c598
jmp 0x70c59d
jne 0x70c540
movzx eax, byte [ebp]
shl eax, 8
or edi, eax
mov eax, edi
shr eax, 0x12
mov edx, dword [esp + 4]
movzx eax, byte [edx + eax]
mov ebx, dword [esp + 0x28]
mov esi, dword [esp]
mov byte [ebx + esi - 4], al
mov eax, edi
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [edx + eax]
mov byte [ebx + esi - 3], al
mov cl, 0x3d
cmp dword [esp + 8], 1
je 0x70c57b
shr edi, 6
and edi, 0x3f
movzx ecx, byte [edx + edi]
lea eax, [ebx + esi]
mov byte [ebx + esi - 2], cl
mov byte [ebx + esi - 1], 0x3d
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
mov byte [eax], 0
test byte [edx + 0x5c], 1
jne 0x70c59d
mov byte [ebx + esi], 0xa
inc esi
mov byte [ebx + esi], 0
mov dword [edx], 0
mov dword [ecx], esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret