joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005af70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.10033890
mov eax, dword [0x1012f5f0]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
push ebx
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x4c]
movzx edx, byte [edi + 1]
mov dword [esp + 0x18], ecx
movzx ecx, byte [edi]
lea eax, [edi + 1]
mov dword [esp + 0x28], eax
add eax, 1
shl edx, 0x10
add eax, 1
shl ecx, 0x18
or ecx, edx
xor edx, edx
mov dh, byte [eax - 1]
add eax, 1
movzx ebx, byte [eax + 1]
add eax, 1
add eax, 1
or ecx, edx
movzx edx, byte [eax - 3]
or ecx, edx
movzx edx, byte [eax - 2]
shl ebx, 0x10
shl edx, 0x18
or edx, ebx
xor ebx, ebx
mov bh, byte [eax]
mov ebp, dword [esp + 0x40]
mov dword [esp + 0x10], 0
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x2f], cl
mov bl, byte [eax + 1]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x2d], al
or edx, ebx
mov eax, ecx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
cmp dword [esp + 0x44], 0
mov dword [esp + 0x20], edx
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
je 0x1005b155
mov ebx, dword [esp + 0x3c]
sub dword [esp + 0x18], 1
test esi, esi
jne 0x1005b0b9
mov ecx, dword [esp + 0x24]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.1005a1a0
mov ecx, dword [esp + 0x24]
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x34], al
mov edx, ecx
shr edx, 0x10
mov eax, ecx
shr eax, 8
mov byte [esp + 0x36], al
mov byte [esp + 0x35], dl
mov edx, dword [esp + 0x28]
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x38], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x39], al
mov eax, edx
shr eax, 8
add esp, 8
add dword [esp + 0x10], 1
mov byte [esp + 0x2f], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
xor al, byte [ebx]
add esi, 1
mov byte [ebp], al
add ebp, 1
add ebx, 1
and esi, 7
cmp dword [esp + 0x18], 0
jne 0x1005b053
cmp dword [esp + 0x10], 0
je 0x1005b13c
mov eax, ecx
shr eax, 0x18
mov byte [edi], al
mov eax, dword [esp + 0x28]
mov ebx, ecx
shr ebx, 0x10
mov byte [eax], bl
mov ebx, ecx
add eax, 1
shr ebx, 8
mov byte [eax], bl
mov byte [eax + 1], cl
add eax, 1
add eax, 1
mov ecx, edx
shr ecx, 0x18
mov byte [eax], cl
mov ecx, edx
add eax, 1
shr ecx, 0x10
mov byte [eax], cl
add eax, 1
mov ecx, edx
shr ecx, 8
mov byte [eax], cl
mov byte [eax + 1], dl
mov edx, dword [esp + 0x14]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x28
ret
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x28
ret
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ecx], esi
mov ecx, dword [esp + 0x30]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001d3e9
add esp, 0x28
ret
Function at 0x1005e410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.10033890
mov eax, dword [0x1012f5f0]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push ebx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], eax
xor edx, edx
push ebp
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x4c]
mov dh, byte [edi + 1]
lea eax, [edi + 1]
mov dword [esp + 0x28], eax
add eax, 1
mov dword [esp + 0x18], ecx
movzx ecx, byte [edi]
or ecx, edx
movzx edx, byte [eax]
add eax, 1
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax]
add eax, 1
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax]
add eax, 1
xor ebx, ebx
mov bh, byte [eax]
add eax, 1
mov ebp, dword [esp + 0x40]
mov byte [esp + 0x2c], cl
mov dword [esp + 0x10], 0
or edx, ebx
xor ebx, ebx
mov bh, byte [eax + 1]
mov bl, byte [eax]
mov eax, ecx
shr eax, 8
mov byte [esp + 0x2d], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x2e], al
shl ebx, 0x10
or edx, ebx
mov ebx, ecx
shr ecx, 0x18
mov byte [esp + 0x2f], cl
mov ecx, edx
mov eax, edx
mov dword [esp + 0x20], edx
mov byte [esp + 0x30], dl
shr ecx, 8
shr eax, 0x10
shr edx, 0x18
cmp dword [esp + 0x44], 0
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x31], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
je 0x1005e5f1
sub dword [esp + 0x18], 1
test esi, esi
jne 0x1005e54d
mov ecx, dword [esp + 0x24]
push 1
push ecx
lea edx, [esp + 0x24]
push edx
call fcn.1005bd50
mov ebx, dword [esp + 0x28]
mov eax, ebx
shr eax, 8
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
shr edx, 0x18
mov byte [esp + 0x39], al
mov eax, dword [esp + 0x2c]
mov byte [esp + 0x3a], cl
mov byte [esp + 0x3b], dl
mov ecx, eax
mov edx, eax
mov byte [esp + 0x3c], al
shr ecx, 8
shr edx, 0x10
shr eax, 0x18
add esp, 0xc
add dword [esp + 0x10], 1
mov byte [esp + 0x2c], bl
mov byte [esp + 0x31], cl
mov byte [esp + 0x32], dl
mov byte [esp + 0x33], al
mov cl, byte [esp + esi + 0x2c]
mov eax, dword [esp + 0x3c]
xor cl, byte [eax]
add esi, 1
mov byte [ebp], cl
add eax, 1
add ebp, 1
and esi, 7
cmp dword [esp + 0x18], 0
mov dword [esp + 0x3c], eax
jne 0x1005e4e7
cmp dword [esp + 0x10], 0
je 0x1005e5d8
mov eax, dword [esp + 0x28]
mov byte [edi], bl
mov edx, ebx
shr edx, 8
mov byte [eax], dl
add eax, 1
mov ecx, ebx
shr ecx, 0x10
mov byte [eax], cl
mov ecx, dword [esp + 0x20]
add eax, 1
shr ebx, 0x18
mov byte [eax], bl
mov byte [eax + 1], cl
add eax, 1
add eax, 1
mov edx, ecx
shr edx, 8
mov byte [eax], dl
add eax, 1
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
shr ecx, 0x18
mov byte [eax + 1], cl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x28
ret
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x28
ret
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x34]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001d3e9
add esp, 0x28
ret
Function at 0x10072eb0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.10033890
mov eax, dword [0x1012f5f0]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x9c]
push ebx
mov ebx, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x94]
mov dword [esp + 8], eax
xor eax, eax
test ebx, ebx
push edi
mov edi, dword [esp + 0x9c]
je 0x10072f25
cmp ebx, dword [esi]
je 0x10072f1c
test edi, edi
je 0x10072f02
cmp dword [esp + 0xa0], eax
jge 0x10072f1c
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x88
ret
mov eax, 1
mov dword [esi], ebx
jmp 0x10072f2b
mov ebx, dword [esi]
test ebx, ebx
je 0x10072f02
test edi, edi
push ebp
je 0x10072ffd
push ebx
call fcn.1006f050
mov ebp, eax
add esp, 4
cmp ebp, 0x80
jle 0x10072f5b
push str.j____int_sizeof_ctx__key_
push 0x74
push str..cryptohmachmac.c
call fcn.10038d90
add esp, 0xc
mov eax, dword [esp + 0xa4]
cmp ebp, eax
jge 0x10072fb5
mov ecx, dword [esp + 0x10]
push ecx
lea ebp, [esi + 4]
push ebx
push ebp
call fcn.10073900
add esp, 0xc
test eax, eax
je 0x100730b8
mov edx, dword [esp + 0xa4]
push edx
push edi
push ebp
call fcn.10073ab0
add esp, 0xc
test eax, eax
je 0x100730b8
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebp
call fcn.10073ac0
add esp, 0xc
test eax, eax
je 0x100730b8
jmp 0x10072fda
cmp eax, 0x80
ja 0x100730b8
push eax
lea ecx, [esi + 0x50]
push edi
push ecx
call fcn.10024b20
mov edx, dword [esp + 0xb0]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], edx
mov edi, dword [edi]
cmp edi, 0x80
je 0x10073005
mov eax, 0x80
sub eax, edi
push eax
lea ecx, [edi + esi + 0x50]
push 0
push ecx
call fcn.10027680
add esp, 0xc
jmp 0x10073005
test eax, eax
je 0x100730a4
xor eax, eax
jmp 0x10073010
mov dl, byte [esi + eax + 0x50]
xor dl, 0x36
mov byte [esp + eax + 0x14], dl
add eax, 1
cmp eax, 0x80
jl 0x10073010
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x1c]
push ebx
push ebp
call fcn.10073900
add esp, 0xc
test eax, eax
je 0x100730b8
push ebx
call fcn.1006f050
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.10073ab0
add esp, 0x10
test eax, eax
je 0x100730b8
xor eax, eax
jmp 0x10073060
mov dl, byte [esi + eax + 0x50]
xor dl, 0x5c
mov byte [esp + eax + 0x14], dl
add eax, 1
cmp eax, 0x80
jl 0x10073060
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x34]
push ebx
push ebp
call fcn.10073900
add esp, 0xc
test eax, eax
je 0x100730b8
push ebx
call fcn.1006f050
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.10073ab0
add esp, 0x10
test eax, eax
je 0x100730b8
lea edx, [esi + 0x1c]
push edx
add esi, 4
push esi
call fcn.10073c50
add esp, 8
test eax, eax
jne 0x100730bc
xor eax, eax
jmp 0x100730c1
mov eax, 1
mov ecx, dword [esp + 0x94]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001d3e9
add esp, 0x88
ret
Function at 0x10087240
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x10c], 0xffffffff
jne 0x10087252
xor eax, eax
pop edi
ret
push ebx
push esi
push edi
call fcn.10052a80
mov ebx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
test ebx, ebx
mov dword [eax], esi
je 0x10087313
mov eax, dword [edi + 0x10c]
cmp eax, esi
push ebp
jne 0x100872a4
test esi, esi
jle 0x100872f2
mov ecx, ebx
lea eax, [edi + 0x8c]
mov ebp, esi
lea ebx, [ebx]
mov dl, byte [eax + 0x60]
xor dl, byte [eax]
add eax, 1
mov byte [ecx], dl
add ecx, 1
sub ebp, 1
jne 0x10087290
jmp 0x100872f2
mov ecx, esi
sub ecx, eax
cmp ecx, 1
mov byte [eax + edi + 0xec], 0x80
jle 0x100872cb
add ecx, 0xffffffff
push ecx
lea eax, [eax + edi + 0xed]
push 0
push eax
call fcn.10027680
add esp, 0xc
test esi, esi
jle 0x100872f2
mov ecx, ebx
lea eax, [edi + 0xac]
mov ebp, esi
lea esp, [esp]
mov dl, byte [eax + 0x40]
xor dl, byte [eax]
add eax, 1
mov byte [ecx], dl
add ecx, 1
sub ebp, 1
jne 0x100872e0
push esi
push ebx
push ebx
push edi
call fcn.10052a90
add esp, 0x10
test eax, eax
pop ebp
jne 0x10087313
push esi
push ebx
call fcn.1004f4c0
add esp, 8
pop esi
pop ebx
xor eax, eax
pop edi
ret
pop esi
pop ebx
mov eax, 1
pop edi
ret
Function at 0x100897b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x1008987d
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x100897d1
cmp al, 0x6b
jne 0x1008987d
cmp al, 0x6b
lea edx, [ecx + 1]
jne 0x1008983e
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x100897f5
mov al, byte [edx]
add edx, 1
cmp al, 0xba
je 0x100897f5
cmp al, 0xbb
jne 0x1008981e
add ecx, 1
cmp ecx, esi
jl 0x100897e1
sub esi, ecx
test ecx, ecx
jne 0x10089841
push 0x83
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.1003ae70
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x7b
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.1003ae70
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x1008986a
push 0x8b
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.1003ae70
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.10024b20
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x70
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.1003ae70
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x10089a60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x5c
call fcn.10033890
mov eax, dword [0x1012f5f0]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x70]
push ebx
mov ebx, dword [esp + 0x64]
push ebp
mov ebp, dword [esp + 0x74]
push esi
mov esi, dword [esp + 0x88]
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x88]
add edi, 0xffffffff
test eax, eax
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], edi
jne 0x10089abf
call fcn.1003c6a0
mov dword [esp + 0x10], eax
test esi, esi
jne 0x10089ac7
mov dword [esp + 0x14], eax
push eax
call fcn.10052ad0
mov esi, eax
lea eax, [esi + esi]
sub edi, eax
lea edx, [edi - 1]
add esp, 4
cmp ebp, edx
jle 0x10089b0b
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0xa0
push 4
call fcn.1003ae70
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x5c
ret
add eax, 1
cmp dword [esp + 0x1c], eax
jge 0x10089b1f
push 0x40
push str..crypto_rsa_rsa_oaep.c
push 0x78
jmp 0x10089ae7
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x84]
push 0
push ecx
lea eax, [ebx + 1]
mov byte [ebx], 0
push 0
lea ebx, [ebx + esi + 1]
push ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x30]
push edx
push eax
call fcn.10073db0
add esp, 0x18
test eax, eax
je 0x10089af6
sub edi, ebp
sub edi, 1
push edi
lea ecx, [ebx + esi]
push 0
push ecx
call fcn.10027680
mov ecx, dword [esp + 0x30]
mov edi, dword [esp + 0x28]
mov edx, ebx
sub edx, ebp
sub edx, esi
push ebp
lea eax, [edx + edi]
push ecx
push eax
mov byte [eax - 1], 1
call fcn.10024b20
mov ebp, dword [esp + 0x30]
push esi
push ebp
call fcn.10050b70
add esp, 0x20
test eax, eax
jle 0x10089af6
push 0x55
sub edi, esi
push str..crypto_rsa_rsa_oaep.c
push edi
call fcn.100407f0
add esp, 0xc
test eax, eax
mov dword [esp + 0x10], eax
jne 0x10089bbc
push 0x57
push str..crypto_rsa_rsa_oaep.c
push 0x41
jmp 0x10089ae7
mov edx, dword [esp + 0x14]
push edx
push esi
push ebp
push edi
push eax
call fcn.100898e0
add esp, 0x14
test eax, eax
jl 0x10089c0a
test edi, edi
jle 0x10089bf1
mov ebp, dword [esp + 0x10]
mov eax, ebx
sub ebp, ebx
mov ecx, edi
nop
mov dl, byte [eax + ebp]
xor byte [eax], dl
add eax, 1
sub ecx, 1
jne 0x10089be0
mov ebp, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push eax
push edi
push ebx
lea ecx, [esp + 0x34]
push esi
push ecx
call fcn.100898e0
add esp, 0x14
test eax, eax
jge 0x10089c2c
mov edx, dword [esp + 0x10]
push edx
call fcn.100409f0
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x5c
ret
test esi, esi
jle 0x10089c45
lea ecx, [esp + 0x28]
mov eax, ebp
sub ecx, ebp
mov dl, byte [ecx + eax]
xor byte [eax], dl
add eax, 1
sub esi, 1
jne 0x10089c38
mov eax, dword [esp + 0x10]
push eax
call fcn.100409f0
mov ecx, dword [esp + 0x6c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.1001d3e9
add esp, 0x5c
ret
Function at 0x10093910
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x10093929
mov esi, ebx
mov ebx, eax
jmp 0x1009392b
mov esi, eax
mov eax, dword [esi + 4]
mov edi, dword [esp + 0x10]
cmp eax, dword [edi + 8]
jg 0x1009393b
mov eax, edi
jmp 0x10093945
push eax
push edi
call fcn.100656c0
add esp, 8
test eax, eax
jne 0x1009394d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x1009396b
mov edx, dword [esi]
mov ecx, dword [ebx]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [edi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [ebx + 4]
jl 0x10093954
cmp eax, dword [esi + 4]
jge 0x10093982
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [edi]
mov dword [ecx + eax*4], edx
add eax, 1
cmp eax, dword [esi + 4]
jl 0x10093970
mov eax, dword [esi + 4]
test eax, eax
mov dword [edi + 4], eax
jle 0x100939a5
mov ecx, dword [edi]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x100939a2
sub eax, 1
test eax, eax
jg 0x10093992
mov dword [edi + 4], eax
cmp dword [edi + 4], 0
jne 0x100939b2
mov dword [edi + 0xc], 0
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x10093c20
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, 4
call fcn.10033890
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
xor ebp, ebp
push ebx
mov dword [esp + 0x10], ebp
call fcn.1006b5a0
push ebx
call fcn.1006b630
mov esi, eax
add esp, 8
test esi, esi
je 0x10093e53
push edi
mov edi, dword [esp + 0x1c]
mov eax, dword [edi + 4]
add eax, eax
cmp eax, dword [esi + 8]
jg 0x10093c63
mov eax, esi
jmp 0x10093c6d
push eax
push esi
call fcn.100656c0
add esp, 8
test eax, eax
je 0x10093e52
mov ecx, dword [edi + 4]
sub ecx, 1
js 0x10093e04
mov eax, dword [edi]
mov eax, dword [eax + ecx*4]
mov edx, eax
shr edx, 1
and edx, 0x8000
mov ebp, eax
and ebp, 0x20000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x40000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x80000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x100000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x200000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x400000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x800000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x1000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x2000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x4000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x8000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x10000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x20000000
or edx, ebp
shr edx, 1
mov ebp, eax
and ebp, 0x40000000
or edx, ebp
shr edx, 1
and eax, 0x80000001
or edx, eax
mov eax, dword [esi]
shr edx, 1
mov dword [eax + ecx*8 + 4], edx
mov edx, dword [edi]
mov eax, dword [edx + ecx*4]
mov edx, eax
and edx, 0x8000
add edx, edx
mov ebp, eax
and ebp, 0x4000
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x2000
or edx, ebp
mov ebp, eax
add edx, edx
and ebp, 0x1000
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x800
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x400
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x200
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x100
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x80
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x40
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x20
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 0x10
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 8
or edx, ebp
add edx, edx
mov ebp, eax
and ebp, 4
or edx, ebp
mov ebp, eax
add edx, edx
and ebp, 2
or edx, ebp
and eax, 1
add edx, edx
or edx, eax
sub ecx, 1
mov eax, dword [esi]
mov dword [eax + ecx*8 + 8], edx
jns 0x10093c81
mov ebp, dword [esp + 0x10]
mov eax, dword [edi + 4]
add eax, eax
test eax, eax
mov dword [esi + 4], eax
jle 0x10093e29
mov ecx, dword [esi]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x10093e26
sub eax, 1
test eax, eax
jg 0x10093e16
mov dword [esi + 4], eax
cmp dword [esi + 4], 0
jne 0x10093e36
mov dword [esi + 0xc], 0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
push eax
push esi
push ecx
call fcn.100939c0
add esp, 0xc
test eax, eax
je 0x10093e52
mov ebp, 1
pop edi
push ebx
call fcn.1006b5f0
add esp, 4
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret
Function at 0x100b2360
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp + 4]
push ebp
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
test edi, edi
jle 0x100b2450
push esi
mov esi, dword [esp + 0x14]
lea esp, [esp]
cmp edi, 3
jl 0x100b23e2
movzx eax, byte [esi + 2]
xor edx, edx
mov dh, byte [esi]
add ecx, 1
add ecx, 1
add ecx, 1
mov dl, byte [esi + 1]
shl edx, 8
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 3], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 2], al
mov eax, edx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
jmp 0x100b243b
movzx edx, byte [esi]
shl edx, 0x10
cmp edi, 2
jne 0x100b23f4
xor eax, eax
mov ah, byte [esi + 1]
or edx, eax
mov eax, edx
shr eax, 0x12
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov eax, edx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
add ecx, 1
mov byte [ecx], al
add ecx, 1
cmp edi, 1
jne 0x100b2426
lea edx, [edi + 0x3c]
jmp 0x100b2433
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
add ecx, 1
mov byte [ecx], 0x3d
sub edi, 3
add ecx, 1
add ebp, 4
add esi, 3
test edi, edi
jg 0x100b2380
pop esi
pop edi
mov eax, ebp
mov byte [ecx], 0
pop ebp
ret
Function at 0x100d0950
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.10033890
push ebp
push esi
mov esi, dword [esp + 0x54]
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push ebp
xor edi, edi
call fcn.100b9a80
add esp, 0xc
test eax, eax
je 0x100d09b0
lea esp, [esp]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
shl edx, 0xa
test eax, edx
je 0x100d0992
add edi, 1
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
add ebp, 1
push ebp
call fcn.100b9a80
add esp, 0xc
test eax, eax
jne 0x100d0980
test edi, edi
jne 0x100d09d4
push 0x109
push str.._ssl_t1_enc.c
push 0x44
push 0x11c
push 0x14
call fcn.1003ae70
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
mov eax, dword [esp + 0x4c]
cdq
idiv edi
cmp edi, 1
push ebx
mov ebx, eax
jne 0x100d09eb
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x4c]
push esi
push 0
push eax
call fcn.10027680
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
mov dword [esp + 0x30], 0
call fcn.100b9a80
add esp, 0x18
test eax, eax
je 0x100d0ad3
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
shl eax, 0xa
test ecx, eax
je 0x100d0aad
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100d0ae0
mov ebp, dword [esp + 0x58]
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push esi
push ebp
push edx
mov edx, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x5c]
and edx, 1
add edx, ebx
push edx
mov edx, dword [esp + 0x68]
push edi
push eax
call fcn.100d0550
add esp, 0x34
test eax, eax
je 0x100d0afe
add edi, ebx
test esi, esi
jle 0x100d0aad
mov eax, dword [esp + 0x54]
mov ecx, ebp
sub ecx, eax
mov ebp, esi
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
add eax, 1
sub ebp, 1
jne 0x100d0aa0
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
add eax, 1
push edx
push eax
mov dword [esp + 0x24], eax
call fcn.100b9a80
add esp, 0xc
test eax, eax
jne 0x100d0a20
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0xc
ret
push 0x114
push str.._ssl_t1_enc.c
push 0x146
push 0x11c
push 0x14
call fcn.1003ae70
add esp, 0x14
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret