joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4075a0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x4075c0
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x40df8f
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.004653a0
push ebx
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
xor ebx, ebx
cmp eax, ebx
je 0x40dfd1
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileType]
test eax, eax
je 0x40dfd1
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
call fcn.00465772
add eax, 0x40
push eax
call fcn.00465d48
add esp, 0xc
jmp 0x40e04e
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push 0xff
push eax
call fcn.00465cf2
add esp, 0x10
mov byte [ebp - 5], bl
call dword [sym.imp.KERNEL32.DLL_GetVersion]
cmp eax, 0x80000000
jae 0x40e039
call fcn.0040dea1
test eax, eax
jle 0x40e039
push str.OPENSSL
push ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push ebx
mov esi, eax
lea eax, [ebp - 0x104]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push ebx
push 1
push ebx
push ebx
push ebx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x40e04e
push 0x10
push str.OpenSSL:_FATAL
lea eax, [ebp - 0x104]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x10c]
pop esi
pop ebx
leave
ret

Function at 0x412bf7
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.004643f0
add esp, 0xc
xor eax, eax
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
inc eax
pop esi
ret
Function at 0x413fc2
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.004643f0
add esp, 0xc
xor eax, eax
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
inc eax
pop esi
ret
Function at 0x41670a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x14
pop eax
call fcn.004653a0
push edi
mov edi, dword [ebp + 0xc]
dec edi
lea eax, [edi - 0x29]
cmp dword [ebp + 0x14], eax
jle 0x41672d
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
jmp 0x41673b
cmp edi, 0x29
jge 0x41674e
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.0040cdf7
add esp, 0x14
xor eax, eax
jmp 0x416845
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
lea ecx, [eax + 1]
push ebx
mov byte [eax], bl
mov dword [ebp + 0xc], ecx
lea esi, [eax + 0x15]
call fcn.0041fdcf
push eax
push ebx
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call fcn.0041fd03
mov eax, edi
sub eax, dword [ebp + 0x14]
sub eax, 0x29
push eax
lea eax, [esi + 0x14]
push ebx
push eax
call fcn.004643f0
push dword [ebp + 0x14]
mov eax, esi
sub eax, dword [ebp + 0x14]
push dword [ebp + 0x10]
add eax, edi
mov byte [eax - 0x15], 1
add eax, 0xffffffec
push eax
call fcn.00464880
push 0x14
push dword [ebp + 0xc]
call fcn.00406aef
add esp, 0x38
test eax, eax
jle 0x416822
push 0x48
add edi, 0xffffffec
push str..crypto_rsa_rsa_oaep.c
push edi
call fcn.0040c251
add esp, 0xc
cmp eax, ebx
mov dword [ebp + 0x14], eax
jne 0x4167e3
push 0x4b
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.0040cdf7
add esp, 0x14
jmp 0x416822
push 0x14
push dword [ebp + 0xc]
push edi
push eax
call fcn.004166eb
add esp, 0x10
test eax, eax
jl 0x416822
cmp edi, ebx
jle 0x41680c
mov ecx, dword [ebp + 0x14]
mov eax, esi
sub ecx, esi
mov edx, edi
mov bl, byte [ecx + eax]
xor byte [eax], bl
inc eax
dec edx
jne 0x416803
push edi
push esi
push 0x14
pop esi
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.004166eb
add esp, 0x10
test eax, eax
jge 0x416826
xor eax, eax
jmp 0x416843
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
sub ecx, eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x41682e
push dword [ebp + 0x14]
call fcn.0040c3c8
xor eax, eax
pop ecx
inc eax
pop esi
pop ebx
pop edi
leave
ret
Function at 0x416848
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x2c
pop eax
call fcn.004653a0
mov eax, dword [ebp + 0x18]
push ebx
xor ebx, ebx
dec eax
cmp eax, 0x29
push esi
push edi
mov dword [ebp - 4], ebx
jl 0x4169be
mov ecx, eax
sub ecx, dword [ebp + 0x14]
mov dword [ebp + 0x18], ecx
jns 0x41687f
mov dword [ebp - 4], 1
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x14], eax
lea edi, [eax - 0x14]
push 0x7b
mov esi, str..crypto_rsa_rsa_oaep.c
add eax, edi
push esi
push eax
call fcn.0040c251
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x4168b1
push 0x7e
push esi
push 0x41
push 0x7a
push 4
call fcn.0040cdf7
add esp, 0x14
jmp 0x4169e1
push dword [ebp + 0x18]
lea esi, [edi + ebx]
push 0
push esi
call fcn.004643f0
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
push dword [ebp + 0x10]
add eax, esi
push eax
call fcn.00464880
lea eax, [esi + 0x14]
push edi
push eax
mov dword [ebp + 0x18], eax
lea eax, [ebp - 0x18]
push 0x14
push eax
call fcn.004166eb
add esp, 0x28
test eax, eax
jne 0x4169e1
lea eax, [ebp - 0x18]
xor ecx, ecx
sub esi, eax
lea eax, [ebp + ecx - 0x18]
mov dl, byte [esi + eax]
xor byte [eax], dl
inc ecx
cmp ecx, 0x14
jl 0x4168f5
push 0x14
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
call fcn.004166eb
add esp, 0x10
test eax, eax
jne 0x4169e1
test edi, edi
jle 0x416932
mov esi, dword [ebp + 0x18]
mov eax, ebx
sub esi, ebx
mov ecx, edi
mov dl, byte [esi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x416929
push 0
call fcn.0041fdcf
push eax
push 0
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
call fcn.0041fd03
push 0x14
lea eax, [ebp - 0x2c]
push eax
push ebx
call fcn.00464f40
add esp, 0x24
test eax, eax
jne 0x4169be
cmp dword [ebp - 4], eax
jne 0x4169be
push 0x14
pop eax
cmp edi, eax
jle 0x416975
cmp byte [eax + ebx], 0
jne 0x416975
inc eax
cmp eax, edi
jl 0x41696a
cmp eax, edi
je 0x4169be
cmp byte [eax + ebx], 1
jne 0x4169be
inc eax
sub edi, eax
cmp dword [ebp + 0xc], edi
jge 0x4169a4
push 0xa6
push str..crypto_rsa_rsa_oaep.c
push 0x6d
push 0x7a
push 4
call fcn.0040cdf7
add esp, 0x14
or edi, 0xffffffff
jmp 0x4169b3
push edi
add eax, ebx
push eax
push dword [ebp + 8]
call fcn.00464880
add esp, 0xc
push ebx
call fcn.0040c3c8
pop ecx
mov eax, edi
jmp 0x4169e4
push 0xb3
push str..crypto_rsa_rsa_oaep.c
push 0x79
push 0x7a
push 4
call fcn.0040cdf7
add esp, 0x14
test ebx, ebx
je 0x4169e1
push ebx
call fcn.0040c3c8
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x416a60
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 0x10]
cmp dword [esp + 0x14], edx
push esi
jne 0x416af1
mov eax, dword [esp + 0x10]
mov cl, byte [eax]
cmp cl, 0x6a
je 0x416a7f
cmp cl, 0x6b
jne 0x416af1
inc eax
cmp cl, 0x6b
jne 0x416ac5
lea esi, [edx - 3]
xor ecx, ecx
test esi, esi
jle 0x416aa0
mov dl, byte [eax]
inc eax
cmp dl, 0xba
je 0x416aa0
cmp dl, 0xbb
jne 0x416ab4
inc ecx
cmp ecx, esi
jl 0x416a8e
sub esi, ecx
test ecx, ecx
jne 0x416ac8
mov eax, 0x8a
push eax
push str..crypto_rsa_rsa_x931.c
push eax
jmp 0x416afd
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
jmp 0x416afd
lea esi, [edx - 2]
cmp byte [esi + eax], 0xcc
je 0x416adf
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
jmp 0x416afd
push esi
push eax
push dword [esp + 0x10]
call fcn.00464880
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.0040cdf7
add esp, 0x14
or eax, 0xffffffff
pop esi
ret

Function at 0x4177be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
test esi, esi
je 0x41781a
mov al, byte [esi]
test al, al
je 0x41781a
mov dword [ebp + 8], 0x100
push ebx
movsx eax, al
or eax, dword [ebp + 8]
add dword [ebp + 8], 0x100
mov edx, eax
shr edx, 2
xor edx, eax
and edx, 0xf
push 0x20
pop ecx
sub ecx, edx
mov ebx, edi
shr ebx, cl
mov ecx, edx
shl edi, cl
mov ecx, eax
imul ecx, eax
or ebx, edi
xor ebx, ecx
inc esi
mov al, byte [esi]
test al, al
mov edi, ebx
jne 0x4177da
mov eax, edi
shr eax, 0x10
xor eax, edi
pop ebx
jmp 0x41781c
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x421f87
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0x18
pop eax
call fcn.004653a0
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00465000
mov esi, dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
pop ecx
push 0
push 0
mov ebx, eax
inc ebx
push ebx
push dword [ebp + 8]
mov edi, 0xfde9
push 8
push edi
call esi
test eax, eax
mov dword [ebp - 8], eax
jle 0x422023
add eax, eax
add eax, 3
and al, 0xfc
call fcn.004653a0
mov dword [ebp - 4], esp
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
push dword [ebp + 8]
push 8
push edi
call esi
test eax, eax
je 0x422043
push 8
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
call fcn.00465000
pop ecx
inc eax
push eax
push dword [ebp + 0xc]
push 0
push edi
call esi
test eax, eax
je 0x422043
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call fcn.0046732e
mov esi, eax
test esi, esi
pop ecx
pop ecx
jne 0x4220aa
call fcn.0046724d
cmp dword [eax], 2
jne 0x42203f
jmp 0x422030
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x459
jne 0x422043
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00464830
pop ecx
pop ecx
mov esi, eax
test esi, esi
jne 0x4220aa
push 0xa3
mov esi, str..crypto_bio_bss_file.c
push esi
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 1
push 2
call fcn.0040cdf7
push 0x483d7c
push dword [ebp + 0xc]
push 0x483d78
push dword [ebp + 8]
push str.fopen_
push 5
call fcn.0040cb51
add esp, 0x2c
call fcn.0046724d
cmp dword [eax], 2
jne 0x422094
push 0xa6
push esi
push 0x80
jmp 0x42209c
push 0xa8
push esi
push 2
push 0x6d
push 0x20
call fcn.0040cdf7
add esp, 0x14
jmp 0x4220c2
push 0x49f8a8
call fcn.0041d024
mov edi, eax
test edi, edi
pop ecx
jne 0x4220c6
push esi
call fcn.00464725
pop ecx
xor eax, eax
jmp 0x4220de
push 0
push edi
call fcn.0041cba2
push esi
push 1
push 0x6a
push edi
call fcn.0041ce5a
add esp, 0x18
mov eax, edi
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x422119
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x124
call fcn.004653a0
push ebx
push edi
push dword [ebp + 0x1c]
xor ebx, ebx
inc ebx
call fcn.0041080d
xor edi, edi
cmp eax, edi
pop ecx
mov dword [ebp - 0x10], eax
jge 0x422144
xor eax, eax
jmp 0x422268
lea eax, [ebp - 0x124]
push esi
push eax
call fcn.00423632
cmp dword [ebp + 8], edi
mov eax, dword [ebp + 0x24]
mov esi, dword [ebp + 0x20]
pop ecx
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
jne 0x422168
mov dword [ebp + 0xc], edi
jmp 0x42217a
cmp dword [ebp + 0xc], 0xffffffff
jne 0x42217a
push dword [ebp + 8]
call fcn.00465000
pop ecx
mov dword [ebp + 0xc], eax
cmp esi, edi
je 0x422257
mov esi, dword [ebp - 0x10]
cmp dword [ebp - 4], esi
jg 0x42218d
mov esi, dword [ebp - 4]
mov eax, ebx
shr eax, 0x18
mov byte [ebp - 0xc], al
push edi
push dword [ebp + 0x1c]
mov eax, ebx
push dword [ebp + 0xc]
shr eax, 0x10
push dword [ebp + 8]
mov byte [ebp - 0xb], al
mov eax, ebx
shr eax, 8
mov byte [ebp - 0xa], al
lea eax, [ebp - 0x124]
push eax
mov byte [ebp - 9], bl
call fcn.004233e8
push dword [ebp + 0x14]
lea eax, [ebp - 0x124]
push dword [ebp + 0x10]
push eax
call fcn.004235a8
push 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.004235a8
push edi
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x124]
push eax
call fcn.004235c1
push esi
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 8]
call fcn.00464880
mov eax, dword [ebp + 0x18]
add esp, 0x44
cmp eax, 1
jle 0x422247
dec eax
mov dword [ebp - 0x14], eax
push edi
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x1c]
call fcn.00423725
add esp, 0x1c
cmp esi, edi
jle 0x422242
mov eax, dword [ebp - 8]
lea edi, [ebp - 0x54]
sub edi, eax
mov ecx, esi
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x422237
xor edi, edi
dec dword [ebp - 0x14]
jne 0x42220f
sub dword [ebp - 4], esi
add dword [ebp - 8], esi
inc ebx
cmp dword [ebp - 4], edi
jne 0x422182
lea eax, [ebp - 0x124]
push eax
call fcn.004236c3
pop ecx
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
leave
ret
Function at 0x4233e8
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov eax, 0x84
lea ebp, [esp - 0x64]
call fcn.004653a0
mov eax, dword [ebp + 0x78]
and dword [ebp + 0x60], 0
test eax, eax
push ebx
push esi
mov esi, dword [ebp + 0x6c]
push edi
je 0x423413
mov dword [ebp + 0x60], 1
mov dword [esi], eax
jmp 0x423418
mov eax, dword [esi]
mov dword [ebp + 0x78], eax
cmp dword [ebp + 0x70], 0
mov edi, 0x80
je 0x4234f8
push dword [ebp + 0x78]
mov dword [ebp + 0x60], 1
call fcn.00410805
mov ebx, eax
cmp ebx, edi
pop ecx
jle 0x423451
push str.j____int_sizeof_ctx__key_
push 0x52
push str..cryptohmachmac.c
call fcn.0040e058
add esp, 0xc
cmp ebx, dword [ebp + 0x74]
jge 0x4234a5
push dword [ebp + 0x7c]
lea ebx, [esi + 4]
push dword [ebp + 0x78]
push ebx
call fcn.0041f944
add esp, 0xc
test eax, eax
je 0x423599
push dword [ebp + 0x74]
push dword [ebp + 0x70]
push ebx
call fcn.0041fac4
add esp, 0xc
test eax, eax
je 0x423599
lea ebx, [esi + 0x4c]
push ebx
lea eax, [esi + 0x50]
push eax
lea eax, [esi + 4]
push eax
call fcn.0041fad8
add esp, 0xc
test eax, eax
je 0x423599
jmp 0x4234de
cmp dword [ebp + 0x74], 0
jl 0x4234b0
cmp dword [ebp + 0x74], edi
jle 0x4234c4
push str.len_0__len__int_sizeof_ctx__key_
push 0x5f
push str..cryptohmachmac.c
call fcn.0040e058
add esp, 0xc
push dword [ebp + 0x74]
lea eax, [esi + 0x50]
push dword [ebp + 0x70]
push eax
call fcn.00464880
mov eax, dword [ebp + 0x74]
lea ebx, [esi + 0x4c]
add esp, 0xc
mov dword [ebx], eax
mov ebx, dword [ebx]
cmp ebx, edi
je 0x423502
mov eax, edi
sub eax, ebx
push eax
lea eax, [ebx + esi + 0x50]
push 0
push eax
call fcn.004643f0
add esp, 0xc
cmp dword [ebp + 0x60], 0
je 0x423586
xor eax, eax
mov cl, byte [esi + eax + 0x50]
xor cl, 0x36
mov byte [ebp + eax - 0x20], cl
inc eax
cmp eax, edi
jl 0x423504
push dword [ebp + 0x7c]
lea ebx, [esi + 0x1c]
push dword [ebp + 0x78]
push ebx
call fcn.0041f944
add esp, 0xc
test eax, eax
je 0x423599
push dword [ebp + 0x78]
call fcn.00410805
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
call fcn.0041fac4
add esp, 0x10
test eax, eax
je 0x423599
xor eax, eax
mov cl, byte [esi + eax + 0x50]
xor cl, 0x5c
mov byte [ebp + eax - 0x20], cl
inc eax
cmp eax, edi
jl 0x423546
push dword [ebp + 0x7c]
lea edi, [esi + 0x34]
push dword [ebp + 0x78]
push edi
call fcn.0041f944
add esp, 0xc
test eax, eax
je 0x423599
push dword [ebp + 0x78]
call fcn.00410805
push eax
lea eax, [ebp - 0x20]
push eax
push edi
call fcn.0041fac4
add esp, 0x10
test eax, eax
je 0x423599
lea eax, [esi + 0x1c]
push eax
add esi, 4
push esi
call fcn.0041fbf8
test eax, eax
pop ecx
pop ecx
jne 0x42359d
xor eax, eax
jmp 0x4235a0
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x64
leave
ret
Function at 0x42bf11
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x30
pop eax
call fcn.004653a0
push dword [ebp + 0x14]
and dword [ebp - 0x18], 0
and dword [ebp - 8], 0
call fcn.0041080d
test eax, eax
pop ecx
mov dword [ebp - 4], eax
jl 0x42c0fc
push edi
mov edi, dword [ebp + 0x18]
cmp edi, 0xffffffff
jne 0x42bfbb
mov edi, eax
push ebx
push esi
mov esi, dword [ebp + 8]
push dword [esi + 0x10]
call fcn.0040d5a2
mov ebx, eax
dec ebx
and ebx, 7
push esi
mov dword [ebp - 0x14], ebx
call fcn.0040626b
pop ecx
test ebx, ebx
mov ebx, dword [ebp + 0xc]
pop ecx
mov dword [ebp - 0xc], eax
jne 0x42bf73
mov byte [ebx], 0
inc ebx
dec eax
mov dword [ebp - 0xc], eax
cmp edi, 0xfffffffe
jne 0x42bfe2
mov edi, eax
sub edi, dword [ebp - 4]
dec edi
dec edi
test edi, edi
jle 0x42c01b
push 0xda
mov esi, str..crypto_rsa_rsa_pss.c
push esi
push edi
call fcn.0040c251
add esp, 0xc
test eax, eax
mov dword [ebp - 8], eax
jne 0x42c00a
push 0xde
push esi
push 0x41
push 0x7d
push 4
call fcn.0040cdf7
add esp, 0x14
jmp 0x42c0ea
cmp edi, 0xfffffffe
je 0x42bf43
jge 0x42bf43
push 0xc3
push str..crypto_rsa_rsa_pss.c
push 0x88
push 0x7d
push 4
call fcn.0040cdf7
add esp, 0x14
jmp 0x42c0fb
mov ecx, dword [ebp - 4]
lea ecx, [ecx + edi + 2]
cmp eax, ecx
jge 0x42bf7f
push 0xd5
push str..crypto_rsa_rsa_pss.c
push 0x6e
push 0x7d
push 4
call fcn.0040cdf7
add esp, 0x14
jmp 0x42c0f9
push edi
push eax
call fcn.00406aef
test eax, eax
pop ecx
pop ecx
jle 0x42c0ea
mov esi, dword [ebp - 0xc]
sub esi, dword [ebp - 4]
lea eax, [esi + ebx - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x30]
push eax
call fcn.0041f910
push 0
push dword [ebp + 0x14]
lea eax, [ebp - 0x30]
push eax
call fcn.0041f944
push 8
lea eax, [ebp - 0x30]
push 0x48898c
push eax
call fcn.0041fac4
push dword [ebp - 4]
lea eax, [ebp - 0x30]
push dword [ebp + 0x10]
push eax
call fcn.0041fac4
add esp, 0x28
test edi, edi
je 0x42c075
push edi
push dword [ebp - 8]
lea eax, [ebp - 0x30]
push eax
call fcn.0041fac4
add esp, 0xc
push 0
push dword [ebp - 0x10]
lea eax, [ebp - 0x30]
push eax
call fcn.0041fbd4
lea eax, [ebp - 0x30]
push eax
call fcn.0041fb48
push dword [ebp + 0x14]
lea eax, [esi - 1]
push dword [ebp - 4]
push dword [ebp - 0x10]
push eax
push ebx
call fcn.004165fe
add esp, 0x24
test eax, eax
jne 0x42c0ea
sub esi, edi
xor edx, edx
inc edx
lea eax, [esi + ebx - 2]
xor byte [eax], dl
inc eax
test edi, edi
jle 0x42c0ca
xor esi, esi
test edi, edi
jle 0x42c0ca
mov ecx, dword [ebp - 8]
mov cl, byte [esi + ecx]
xor byte [eax], cl
inc eax
inc esi
cmp esi, edi
jl 0x42c0bc
cmp dword [ebp - 0x14], 0
je 0x42c0df
push 8
pop ecx
sub ecx, dword [ebp - 0x14]
mov eax, 0xff
sar eax, cl
and byte [ebx], al
mov eax, dword [ebp - 0xc]
mov byte [eax + ebx - 1], 0xbc
mov dword [ebp - 0x18], edx
cmp dword [ebp - 8], 0
je 0x42c0f9
push dword [ebp - 8]
call fcn.0040c3c8
pop ecx
pop esi
pop ebx
pop edi
mov eax, dword [ebp - 0x18]
leave
ret
Function at 0x43662e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0x14
pop eax
call fcn.004653a0
push ebx
mov ebx, dword [ebp + 0x18]
test bl, 7
jne 0x4366f3
cmp ebx, 8
jb 0x4366f3
push esi
mov esi, dword [ebp + 0x10]
push edi
push ebx
push dword [ebp + 0x14]
lea eax, [esi + 8]
push eax
mov dword [ebp + 0x18], 1
call fcn.00464880
add esp, 0xc
cmp dword [ebp + 0xc], 0
jne 0x436678
mov dword [ebp + 0xc], 0x48d3fc
push 8
push dword [ebp + 0xc]
lea eax, [ebp - 0x14]
push eax
call fcn.00464880
add esp, 0xc
mov dword [ebp - 4], 6
test ebx, ebx
lea edi, [esi + 8]
jbe 0x4366d8
lea esi, [ebx - 1]
shr esi, 3
inc esi
push 8
lea eax, [ebp - 0xc]
push edi
push eax
call fcn.00464880
push dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push eax
call fcn.00408440
mov al, byte [ebp + 0x18]
xor byte [ebp - 0xd], al
push 8
lea eax, [ebp - 0xc]
push eax
push edi
call fcn.00464880
add esp, 0x24
inc dword [ebp + 0x18]
add edi, 8
dec esi
jne 0x43669e
mov esi, dword [ebp + 0x10]
dec dword [ebp - 4]
jne 0x436690
push 8
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.00464880
add esp, 0xc
pop edi
lea eax, [ebx + 8]
pop esi
jmp 0x4366f6
or eax, 0xffffffff
pop ebx
leave
ret

Function at 0x43cc63
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x43cc7c
mov esi, ebx
mov ebx, eax
jmp 0x43cc7e
mov esi, eax
mov eax, dword [esi + 4]
mov edi, dword [esp + 0x10]
cmp eax, dword [edi + 8]
jg 0x43cc8e
mov eax, edi
jmp 0x43cc97
push eax
push edi
call fcn.0040d781
pop ecx
pop ecx
test eax, eax
je 0x43cced
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x43ccc4
mov ecx, dword [esi]
mov edx, dword [ebx]
mov ecx, dword [ecx + eax*4]
xor ecx, dword [edx + eax*4]
mov edx, dword [edi]
mov dword [edx + eax*4], ecx
inc eax
cmp eax, dword [ebx + 4]
jl 0x43cca2
jmp 0x43ccc4
mov ecx, dword [esi]
mov ecx, dword [ecx + eax*4]
mov edx, dword [edi]
mov dword [edx + eax*4], ecx
inc eax
cmp eax, dword [esi + 4]
jl 0x43ccb9
mov esi, dword [esi + 4]
test esi, esi
mov dword [edi + 4], esi
jle 0x43ccea
mov eax, dword [edi]
lea eax, [eax + esi*4 - 4]
mov ecx, dword [eax]
sub eax, 4
test ecx, ecx
jne 0x43cce7
dec esi
test esi, esi
jg 0x43ccd9
mov dword [edi + 4], esi
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret