joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b450fd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
sub esp, 0x3c
mov ecx, dword [ecx + 0x1c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], edx
mov dword [esp + 0x1c], ecx
test ecx, ecx
jne 0x6b451000
mov dword [eax + 4], 0
mov eax, 1
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x28]
lea ebp, [ecx + ecx]
mov dword [esp + 4], ebp
mov dword [esp], eax
call sym._bn_wexpand
test eax, eax
je 0x6b451150
mov esi, dword [esp + 0x28]
mov eax, dword [edi + 0x24]
xor dword [esi + 0xc], eax
mov eax, dword [edi + 0x18]
mov dword [esp + 0x20], eax
mov eax, esi
mov esi, dword [esi]
mov edx, dword [eax + 4]
test ebp, ebp
jle 0x6b451057
mov eax, edx
mov ecx, ebp
sub ecx, edx
neg eax
lea edx, [esi + edx*4]
lea esi, [esi]
mov ebx, eax
sar ebx, 0x1f
and dword [edx + eax*4], ebx
add eax, 1
cmp ecx, eax
jne 0x6b451048
mov eax, dword [esp + 0x28]
xor ebx, ebx
mov dword [eax + 4], ebp
mov eax, dword [edi + 0x40]
xor edi, edi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
lea ebp, [eax*4]
test eax, eax
jle 0x6b451160
lea esi, [esi]
mov eax, dword [esp + 0x24]
imul eax, dword [esi]
mov dword [esp], esi
mov ecx, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
call sym._bn_mul_add_words
mov ecx, dword [esi + ebp]
xor edx, edx
add eax, ebx
add eax, ecx
cmp ecx, eax
mov dword [esi + ebp], eax
setne dl
or ebx, edx
xor edx, edx
cmp ecx, eax
setae dl
add edi, 1
add esi, 4
and ebx, edx
cmp dword [esp + 0x1c], edi
jne 0x6b451080
mov eax, dword [esp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sym._bn_wexpand
test eax, eax
je 0x6b451150
mov ecx, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov eax, dword [ecx + 0xc]
mov esi, dword [edi]
mov dword [edi + 4], edx
mov dword [edi + 0xc], eax
mov edi, dword [ecx]
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], edx
add edi, ebp
mov dword [esp], esi
mov dword [esp + 8], eax
add ebp, edi
mov dword [esp + 4], edi
call sym._bn_sub_words
sub ebx, eax
lea esi, [esi]
mov edx, dword [esi]
mov eax, dword [edi]
add edi, 4
add esi, 4
xor eax, edx
and eax, ebx
xor eax, edx
mov dword [esi - 4], eax
mov dword [edi - 4], 0
cmp edi, ebp
jne 0x6b451120
add esp, 0x3c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
add esp, 0x3c
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov edi, dword [esp + 0x2c]
mov dword [esp + 4], eax
mov esi, eax
mov dword [esp], edi
call sym._bn_wexpand
test eax, eax
je 0x6b451150
mov edx, dword [esp + 0x28]
mov dword [edi + 4], esi
mov eax, dword [edx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
add ebp, dword [edx]
mov dword [esp + 4], ebp
mov eax, dword [edi]
mov dword [esp], eax
call sym._bn_sub_words
mov eax, 1
jmp 0x6b450ff8
Function at 0x6b455a10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ss
inc ecx
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.6b4545b3
xor cl, dl
mov eax, 0xd4858d13
clc
invalid
Function at 0x6b45e830
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov eax, dword [esp + 0x5c]
mov edx, dword [esp + 0x68]
mov ebx, dword [esp + 0x50]
mov esi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
mov edi, dword [esp + 0x60]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x1c], eax
mov eax, dword [eax]
test edx, edx
jne 0x6b45e920
lea ecx, [ebx + ebp]
mov dword [esp + 0x14], ecx
test ebp, ebp
je 0x6b45e8ff
test eax, eax
jne 0x6b45e8dd
mov eax, dword [edi]
add ebx, 1
add esi, 1
bswap eax
mov dword [esp + 0x24], eax
mov eax, dword [edi + 4]
bswap eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
lea eax, [esp + 0x24]
mov dword [esp], eax
call sym.libcrypto_1_1.dll_CAST_encrypt
mov eax, dword [esp + 0x24]
mov ecx, eax
shr eax, 0x18
mov edx, eax
mov eax, dword [esp + 0x28]
bswap ecx
mov dword [edi], ecx
bswap eax
mov dword [edi + 4], eax
movzx eax, byte [ebx - 1]
mov byte [edi], al
xor eax, edx
mov byte [esi - 1], al
mov eax, 1
cmp ebx, dword [esp + 0x14]
je 0x6b45e8ff
lea ecx, [edi + eax]
movzx edx, byte [ebx]
add esi, 1
add eax, 1
movzx ebp, byte [ecx]
add ebx, 1
and eax, 7
mov byte [ecx], dl
xor edx, ebp
mov byte [esi - 1], dl
cmp dword [esp + 0x14], ebx
jne 0x6b45e880
mov esi, dword [esp + 0x1c]
mov dword [esi], eax
mov eax, dword [esp + 0x2c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b45e9ac
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
test ebp, ebp
je 0x6b45e8ff
add ebp, ebx
lea esi, [esi]
lea esi, [esi]
test eax, eax
jne 0x6b45e98a
mov eax, dword [edi]
add ebx, 1
add esi, 1
bswap eax
mov dword [esp + 0x24], eax
mov eax, dword [edi + 4]
bswap eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
lea eax, [esp + 0x24]
mov dword [esp], eax
call sym.libcrypto_1_1.dll_CAST_encrypt
mov eax, dword [esp + 0x24]
mov edx, eax
shr eax, 0x18
bswap edx
mov dword [edi], edx
mov edx, dword [esp + 0x28]
bswap edx
mov dword [edi + 4], edx
xor al, byte [ebx - 1]
mov byte [esi - 1], al
mov byte [edi], al
mov eax, 1
cmp ebp, ebx
je 0x6b45e8ff
lea ecx, [edi + eax]
movzx edx, byte [ebx]
add ebx, 1
add esi, 1
xor dl, byte [ecx]
add eax, 1
mov byte [esi - 1], dl
and eax, 7
mov byte [ecx], dl
cmp ebp, ebx
jne 0x6b45e930
jmp 0x6b45e8ff
call sym.___stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x6b45e9c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
sub esp, 0x28
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x1c], eax
xor eax, eax
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov eax, dword [edx]
bswap eax
mov dword [esp + 0x14], eax
mov eax, dword [edx + 4]
mov dword [esp + 4], ecx
bswap eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x3c]
test eax, eax
lea eax, [esp + 0x14]
mov dword [esp], eax
je 0x6b45ea30
call sym.libcrypto_1_1.dll_CAST_encrypt
mov eax, dword [esp + 0x14]
bswap eax
mov dword [ebx], eax
mov eax, dword [esp + 0x18]
bswap eax
mov dword [ebx + 4], eax
mov eax, dword [esp + 0x1c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b45ea37
add esp, 0x28
pop ebx
ret
call sym.libcrypto_1_1.dll_CAST_decrypt
jmp 0x6b45ea04
call sym.___stack_chk_fail
nop
nop
nop
nop
Function at 0x6b45f670
Capabilities:
Encrypt data using salsa20 or chacha
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov edi, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x3c], edi
xor edi, edi
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x70]
mov ebp, dword [esp + 0x68]
mov ebx, dword [esp + 0x60]
mov edi, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x74]
mov esi, dword [esp + 0x64]
bswap edi
bswap edx
mov dword [esp + 0x2c], edi
bswap edi
mov dword [esp + 0x18], eax
mov eax, dword [eax]
mov dword [esp + 0x30], edx
bswap edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edx
test ebp, ebp
je 0x6b45f759
lea edi, [ebx + ebp]
mov dword [esp + 0x1c], ecx
xor ebp, ebp
mov edx, ebp
mov ebp, edi
mov edi, edx
lea esi, [esi]
test eax, eax
jne 0x6b45f724
mov eax, dword [esp + 0x14]
add ebx, 1
add edi, 1
add esi, 1
mov dword [esp + 4], eax
lea eax, [esp + 0x2c]
mov dword [esp], eax
call sym.libcrypto_1_1.dll_CAST_encrypt
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
bswap eax
mov dword [esp + 0x34], eax
xor al, byte [ebx - 1]
bswap edx
mov byte [esi - 1], al
mov dword [esp + 0x38], edx
cmp ebx, ebp
je 0x6b45f778
mov eax, 1
movzx edx, byte [ebx]
add ebx, 1
xor dl, byte [esp + eax + 0x34]
add eax, 1
add esi, 1
and eax, 7
mov byte [esi - 1], dl
cmp ebp, ebx
jne 0x6b45f6e0
mov ecx, dword [esp + 0x1c]
mov ebp, edi
test ebp, ebp
je 0x6b45f759
mov ebx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
bswap ebx
bswap edx
mov dword [ecx], ebx
mov dword [ecx + 4], edx
mov ecx, dword [esp + 0x18]
mov dword [ecx], eax
mov eax, dword [esp + 0x3c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b45f785
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [esp + 0x1c]
mov ebp, edi
mov eax, 1
jmp 0x6b45f744
call sym.___stack_chk_fail
nop
nop
nop
nop
nop
nop
Function at 0x6b465d10
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8c
mov esi, dword [esp + 0xa4]
mov edi, dword [esp + 0xa0]
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x7c], eax
xor eax, eax
mov eax, dword [esi + 8]
mov eax, dword [eax]
mov dword [esp], eax
call sym.libcrypto_1_1.dll_OBJ_obj2nid
mov dword [esp], eax
call sym.libcrypto_1_1.dll_OBJ_nid2sn
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_get_digestbyname
test eax, eax
je 0x6b465dd0
mov ebp, dword [esi + 0xc]
mov ebx, eax
lea esi, [esp + 0x3c]
call sym._CMS_Attributes_Verify_it
lea edx, [esp + 0x38]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edx
mov dword [esp + 8], ebp
mov dword [esp + 4], ebx
mov dword [esp], eax
call sym.libcrypto_1_1.dll_ASN1_item_digest
test eax, eax
je 0x6b465dd0
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], esi
mov dword [esp + 8], 4
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0xd8
mov dword [esp], edi
call sym.libcrypto_1_1.dll_CMS_signed_add1_attr_by_NID
test eax, eax
je 0x6b465e00
mov eax, 1
mov ecx, dword [esp + 0x7c]
xor ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b465e39
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x10], 0x9e
mov dword [esp + 0xc], str.crypto_cms_cms_ess.c
mov dword [esp + 8], 0xac
mov dword [esp + 4], 0xa2
mov dword [esp], 0x2e
call sym.libcrypto_1_1.dll_ERR_put_error
xor eax, eax
jmp 0x6b465daf
mov dword [esp + 0x10], 0xa3
mov dword [esp + 0xc], str.crypto_cms_cms_ess.c
mov dword [esp + 8], 0x41
mov dword [esp + 4], 0xa2
mov dword [esp], 0x2e
mov dword [esp + 0x2c], eax
call sym.libcrypto_1_1.dll_ERR_put_error
mov eax, dword [esp + 0x2c]
jmp 0x6b465daf
call sym.___stack_chk_fail
nop
Function at 0x6b46d550
Capabilities:
Check for software breakpoints

Disassembly:
push esi
push ebx
sub esp, 0x24
mov eax, dword [esp + 0x40]
mov esi, dword [esp + 0x30]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov ebx, dword [esp + 0x34]
and eax, 0xffffffbe
mov dword [esp], esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 4], eax
call sym.libcrypto_1_1.dll_CMS_verify
test eax, eax
jle 0x6b46d5b0
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], esi
add esp, 0x24
pop ebx
pop esi
jmp sym._cms_Receipt_verify
add esp, 0x24
pop ebx
pop esi
ret
Function at 0x6b477410
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x2c], edi
xor edi, edi
mov eax, dword [esp + 0x54]
mov esi, dword [esp + 0x58]
mov ebx, dword [esp + 0x50]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x60]
mov ebp, dword [eax]
mov eax, dword [eax + 4]
test esi, esi
jle 0x6b4774aa
mov edi, ebp
jmp 0x6b47748f
mov ecx, dword [ebx + 4]
mov edx, dword [ebx]
add ebx, 8
xor eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x14]
xor edx, edi
sub esi, 8
mov dword [esp + 8], 1
mov dword [esp + 4], eax
lea eax, [esp + 0x24]
mov dword [esp], eax
mov dword [esp + 0x24], edx
call sym.libcrypto_1_1.dll_DES_encrypt1
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
test esi, esi
jle 0x6b4774a8
cmp esi, 7
ja case.default.0x6b47749e
lea ecx, [ebx + esi]
movzx edx, byte [ecx - 1]
lea ebx, [ecx - 1]
jmp dword [esi*4 + str.ZtGkZtGkPuGk_uGk8uGk0uGk]
mov ebp, edi
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x6b4774b7
mov dword [edi], ebp
mov dword [edi + 4], eax
mov edi, dword [esp + 0x2c]
xor edi, dword [sym.imp.libssp_0.dll___stack_chk_guard]
bswap eax
jne 0x6b47757a
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
xor ebp, ebp
shl edx, 8
or ebp, edx
movzx edx, byte [ecx - 2]
mov ecx, ebx
sub ebx, 1
or ebp, edx
movzx edx, byte [ecx - 2]
xor eax, ebp
lea ecx, [ebx - 1]
shl edx, 0x18
lea ebp, [ecx - 1]
mov dword [esp + 0x18], edx
movzx edx, byte [ebx - 2]
shl edx, 0x10
or edx, dword [esp + 0x18]
lea ebx, [ebp - 1]
mov dword [esp + 0x18], edx
movzx edx, byte [ecx - 2]
movzx ecx, byte [ebp - 2]
shl edx, 8
or edx, dword [esp + 0x18]
sub ebx, 1
or edx, ecx
jmp case.0x6b47749e.0
mov ebp, edx
jmp 0x6b4774ea
mov ebp, ebx
mov ebx, ecx
mov ecx, ebp
jmp 0x6b4774f3
mov dword [esp + 0x18], 0
mov ebp, ebx
jmp 0x6b477501
mov dword [esp + 0x18], 0
mov ebp, ecx
jmp 0x6b477513
shl edx, 0x10
sub ecx, 2
mov ebp, edx
movzx edx, byte [ecx]
mov dword [esp + 0x18], ecx
mov ecx, ebx
mov ebx, dword [esp + 0x18]
jmp 0x6b4774da
call sym.___stack_chk_fail
nop
Function at 0x6b477940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x3c], ecx
xor ecx, ecx
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x80]
mov ebx, dword [esp + 0x60]
mov esi, dword [esp + 0x64]
mov ebp, dword [esp + 0x68]
mov edi, dword [esp + 0x78]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x2c], eax
mov eax, dword [eax]
test edx, edx
jne 0x6b477a50
lea ecx, [ebx + ebp]
mov dword [esp + 0x1c], ecx
test ebp, ebp
je 0x6b477a2f
lea esi, [esi]
nop
test eax, eax
jne 0x6b477a09
mov eax, dword [edi]
mov edx, dword [edi + 4]
add ebx, 1
add esi, 1
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x38], edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
lea eax, [esp + 0x34]
mov dword [esp], eax
call sym.libcrypto_1_1.dll_DES_encrypt3
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov dword [edi], eax
mov dword [edi + 4], edx
movzx edx, byte [edi]
movzx eax, byte [ebx - 1]
mov byte [edi], al
xor eax, edx
mov byte [esi - 1], al
mov eax, 1
cmp ebx, dword [esp + 0x1c]
je 0x6b477a2f
lea ecx, [edi + eax]
movzx edx, byte [ebx]
add esi, 1
add eax, 1
movzx ebp, byte [ecx]
add ebx, 1
and eax, 7
mov byte [ecx], dl
xor edx, ebp
mov byte [esi - 1], dl
cmp ebx, dword [esp + 0x1c]
jne 0x6b4779a8
mov esi, dword [esp + 0x2c]
mov dword [esi], eax
mov eax, dword [esp + 0x3c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b477ae2
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
test ebp, ebp
je 0x6b477a2f
add ebp, ebx
lea esi, [esi]
lea esi, [esi]
test eax, eax
jne 0x6b477ac0
mov eax, dword [edi]
mov edx, dword [edi + 4]
add ebx, 1
add esi, 1
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x38], edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
lea eax, [esp + 0x34]
mov dword [esp], eax
call sym.libcrypto_1_1.dll_DES_encrypt3
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
mov dword [edi], eax
mov dword [edi + 4], edx
movzx eax, byte [ebx - 1]
xor al, byte [edi]
mov byte [esi - 1], al
mov byte [edi], al
mov eax, 1
cmp ebp, ebx
je 0x6b477a2f
lea ecx, [edi + eax]
movzx edx, byte [ebx]
add ebx, 1
add esi, 1
xor dl, byte [ecx]
add eax, 1
mov byte [esi - 1], dl
and eax, 7
mov byte [ecx], dl
cmp ebp, ebx
jne 0x6b477a60
jmp 0x6b477a2f
call sym.___stack_chk_fail
lea esi, [esi]
nop
Function at 0x6b47a9a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x24]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x38]
push ecx
mov eax, dword [esp + 0x34]
push eax
push ebx
cmp ecx, 0
je 0x6b47aa70
and ebp, 0xfffffff8
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
je 0x6b47aa0e
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call sym.libcrypto_1_1.dll_DES_encrypt1
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b47a9e0
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x6b47ab17
call 0x6b47aa20
pop edx
lea ecx, [edx + 0x120]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
je 0x6b47aac0
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call sym.libcrypto_1_1.dll_DES_encrypt1
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b47aa7d
mov ebp, dword [esp + 0x38]
and ebp, 7
je 0x6b47ab17
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
call sym.libcrypto_1_1.dll_DES_encrypt1
mov eax, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x6b47ab15
jmp 0x6b47ab17
mov ecx, dword [esp + 0x40]
add esp, 0x1c
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6b47ab80
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x2c]
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
push edi
push esi
push edi
push esi
mov ebx, esp
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push eax
push ebx
cmp ecx, 0
je 0x6b47ac59
and ebp, 0xfffffff8
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
je 0x6b47abf7
mov ecx, dword [esi]
mov edx, dword [esi + 4]
xor eax, ecx
xor ebx, edx
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call sym.libcrypto_1_1.dll_DES_encrypt3
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov dword [edi], eax
mov dword [edi + 4], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b47abc9
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x6b47ad00
call 0x6b47ac09
pop edx
lea ecx, [edx + 0x137]
mov ebp, dword [ecx + ebp*4]
add ebp, edx
xor ecx, ecx
xor edx, edx
jmp ebp
and ebp, 0xfffffff8
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
je 0x6b47aca9
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call sym.libcrypto_1_1.dll_DES_decrypt3
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [edi], ecx
mov dword [edi + 4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
add esi, 8
add edi, 8
sub ebp, 8
jne 0x6b47ac66
mov ebp, dword [esp + 0x3c]
and ebp, 7
je 0x6b47ad00
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
call sym.libcrypto_1_1.dll_DES_decrypt3
mov eax, dword [esp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
xor ecx, eax
xor edx, ebx
mov eax, dword [esi]
mov ebx, dword [esi + 4]
ror edx, 0x10
mov byte [edi + 6], dl
shr edx, 0x10
mov byte [edi + 5], dh
mov byte [edi + 4], dl
mov dword [edi], ecx
jmp 0x6b47acfe
jmp 0x6b47ad00
mov ecx, dword [esp + 0x4c]
add esp, 0x20
mov dword [ecx], eax
mov dword [ecx + 4], ebx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x6b47bc60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov edi, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x4c], edi
xor edi, edi
mov ecx, dword [esp + 0x88]
mov eax, dword [esp + 0x7c]
mov ebx, dword [esp + 0x70]
mov esi, dword [esp + 0x74]
mov edx, dword [ecx]
mov ebp, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x80]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x24], ecx
mov ecx, ebp
mov ebp, dword [ebp]
mov ecx, dword [ecx + 4]
mov edi, dword [esp + 0x20]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x3c], ebp
mov ebp, dword [esp + 0x24]
mov dword [esp + 0x28], eax
mov eax, dword [eax]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], ebp
mov edx, dword [esp + 0x78]
test edx, edx
je 0x6b47bd27
mov edi, dword [esp + 0x78]
xor ebp, ebp
add edi, ebx
lea esi, [esi]
test eax, eax
je 0x6b47bd48
movzx edx, byte [ebx]
add ebx, 1
xor dl, byte [esp + eax + 0x44]
add eax, 1
add esi, 1
and eax, 7
mov byte [esi - 1], dl
cmp ebx, edi
jne 0x6b47bcf8
test ebp, ebp
je 0x6b47bd27
mov edi, dword [esp + 0x2c]
mov esi, dword [esp + 0x10]
mov dword [edi + 4], ecx
mov dword [edi], esi
mov edi, dword [esp + 0x28]
mov dword [edi], eax
mov eax, dword [esp + 0x4c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b47bda1
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x1c]
add ebx, 1
add esi, 1
add ebp, 1
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 4], eax
lea eax, [esp + 0x3c]
mov dword [esp], eax
call sym.libcrypto_1_1.dll_DES_encrypt3
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov dword [esp + 0x44], eax
xor al, byte [ebx - 1]
mov byte [esi - 1], al
mov eax, 1
mov dword [esp + 0x48], ecx
cmp ebx, edi
jne 0x6b47bcfc
jmp 0x6b47bd16
call sym.___stack_chk_fail
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop