joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10066d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x2c
mov eax, dword [0x1010d170]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
mov ebp, dword [esp + 0x44]
movzx edx, byte [edi + 1]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], ecx
movzx ecx, byte [edi]
mov esi, dword [eax]
lea eax, [edi + 1]
mov dword [esp + 0x24], eax
inc eax
inc eax
shl edx, 0x10
shl ecx, 0x18
or ecx, edx
movzx edx, byte [eax - 1]
inc eax
movzx ebx, byte [eax + 1]
shl edx, 8
inc eax
or ecx, edx
movzx edx, byte [eax - 2]
or ecx, edx
movzx edx, byte [eax - 1]
inc eax
shl ebx, 0x10
shl edx, 0x18
or edx, ebx
movzx ebx, byte [eax]
movzx eax, byte [eax + 1]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x2d], al
or edx, ebx
mov eax, ecx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
mov byte [esp + 0x2f], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
test ebp, ebp
je 0x10066f52
lea ecx, [ecx]
mov ebp, 1
sub dword [esp + 0x10], ebp
test esi, esi
jne 0x10066eb8
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x1c]
push ecx
call fcn.100678c0
mov ecx, dword [esp + 0x20]
mov edx, ecx
shr edx, 0x18
mov byte [esp + 0x30], dl
mov edx, ecx
shr edx, 8
mov eax, ecx
shr eax, 0x10
mov byte [esp + 0x31], al
mov byte [esp + 0x32], dl
mov edx, dword [esp + 0x24]
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x34], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x35], al
mov eax, edx
shr eax, 8
add esp, 4
add dword [esp + 0xc], ebp
mov byte [esp + 0x2f], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov bl, byte [esp + esi + 0x2c]
mov eax, dword [esp + 0x3c]
xor bl, byte [eax]
mov ebp, dword [esp + 0x18]
inc esi
mov byte [ebp], bl
inc ebp
inc eax
and esi, 7
cmp dword [esp + 0x10], 0
mov dword [esp + 0x18], ebp
mov dword [esp + 0x3c], eax
jne 0x10066e50
cmp dword [esp + 0xc], 0
je 0x10066f3a
mov eax, ecx
shr eax, 0x18
mov byte [edi], al
mov eax, dword [esp + 0x24]
mov ebx, ecx
shr ebx, 0x10
mov byte [eax], bl
mov ebx, ecx
inc eax
shr ebx, 8
mov byte [eax], bl
mov byte [eax + 1], cl
inc eax
inc eax
mov ecx, edx
shr ecx, 0x18
mov byte [eax], cl
mov ecx, edx
inc eax
shr ecx, 0x10
mov byte [eax], cl
inc eax
mov ecx, edx
shr ecx, 8
mov byte [eax], cl
mov byte [eax + 1], dl
mov edx, dword [esp + 0x14]
mov dword [edx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100ae60d
add esp, 0x2c
ret
mov eax, dword [esp + 0x14]
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100ae60d
add esp, 0x2c
ret
mov ecx, dword [esp + 0x14]
mov dword [ecx], esi
mov ecx, dword [esp + 0x34]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100ae60d
add esp, 0x2c
ret
Function at 0x10068780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x2c
mov eax, dword [0x1010d170]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
mov ebp, dword [esp + 0x44]
movzx edx, byte [edi + 1]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], ecx
movzx ecx, byte [edi]
shl edx, 8
or ecx, edx
mov esi, dword [eax]
lea eax, [edi + 1]
movzx edx, byte [eax + 1]
mov dword [esp + 0x24], eax
inc eax
inc eax
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax]
inc eax
movzx ebx, byte [eax + 1]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax]
inc eax
inc eax
shl ebx, 8
or edx, ebx
movzx ebx, byte [eax + 1]
movzx eax, byte [eax]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 8
shl ebx, 0x10
or edx, ebx
mov byte [esp + 0x2d], al
mov eax, ecx
mov ebx, ecx
mov byte [esp + 0x2c], cl
shr eax, 0x10
shr ecx, 0x18
mov byte [esp + 0x2e], al
mov byte [esp + 0x2f], cl
mov ecx, edx
mov eax, edx
mov dword [esp + 0x20], edx
mov byte [esp + 0x30], dl
shr ecx, 8
shr eax, 0x10
shr edx, 0x18
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 0
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x31], cl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
test ebp, ebp
je 0x10068952
lea esp, [esp]
mov ebp, 1
sub dword [esp + 0x10], ebp
test esi, esi
jne 0x100688b7
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x1c]
push ebp
push ecx
call fcn.100355d0
mov ebx, dword [esp + 0x24]
mov eax, ebx
shr eax, 0x10
mov edx, ebx
shr edx, 8
mov ecx, ebx
shr ecx, 0x18
mov byte [esp + 0x36], al
mov eax, dword [esp + 0x28]
mov byte [esp + 0x35], dl
mov byte [esp + 0x37], cl
mov edx, eax
mov ecx, eax
mov byte [esp + 0x38], al
shr edx, 8
shr ecx, 0x10
shr eax, 0x18
add esp, 8
add dword [esp + 0xc], ebp
mov byte [esp + 0x2c], bl
mov byte [esp + 0x31], dl
mov byte [esp + 0x32], cl
mov byte [esp + 0x33], al
mov dl, byte [esp + esi + 0x2c]
mov ebp, dword [esp + 0x3c]
xor dl, byte [ebp]
mov eax, dword [esp + 0x18]
inc esi
mov byte [eax], dl
inc eax
inc ebp
and esi, 7
cmp dword [esp + 0x10], 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x3c], ebp
jne 0x10068850
cmp dword [esp + 0xc], 0
je 0x1006893a
mov eax, dword [esp + 0x24]
mov byte [edi], bl
mov ecx, ebx
inc eax
shr ecx, 8
mov byte [eax - 1], cl
mov ecx, dword [esp + 0x20]
mov edx, ebx
shr edx, 0x10
mov byte [eax], dl
inc eax
shr ebx, 0x18
mov byte [eax], bl
mov byte [eax + 1], cl
inc eax
inc eax
mov edx, ecx
shr edx, 8
mov byte [eax], dl
inc eax
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
shr ecx, 0x18
mov byte [eax + 1], cl
mov eax, dword [esp + 0x14]
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100ae60d
add esp, 0x2c
ret
mov ecx, dword [esp + 0x14]
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.100ae60d
add esp, 0x2c
ret
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x34]
mov dword [edx], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100ae60d
add esp, 0x2c
ret
Function at 0x10068b50
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x98
push ebx
push ebp
push esi
push edi
mov ebp, dword [esp + 0xac]
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 3]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 4]
movzx esi, byte [eax + 5]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 6]
movzx ebx, byte [eax + 0xd]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 7]
movzx edi, byte [eax + 9]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 8]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xa]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xb]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xc]
shl edi, 8
or edi, ebx
movzx ebx, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edi, 8
or edi, ebx
shl edi, 8
or edi, eax
xor ecx, 0xa3b1bac6
xor edx, 0x56aa3350
xor esi, 0x677d9197
xor edi, 0xb27022dc
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], edi
xor ecx, ecx
jmp 0x10068c10
mov eax, dword [ecx + 0x100df7a8]
xor eax, dword [esp + ecx + 0x1c]
add ecx, 4
xor eax, dword [esp + ecx + 0x20]
xor eax, dword [esp + ecx + 0x1c]
mov edx, eax
shr edx, 0x18
movzx edx, dl
movzx edx, byte [edx + 0x100df698]
mov ebx, eax
shr ebx, 0x10
mov byte [esp + 0x10], dl
mov byte [esp + 0x15], bl
movzx edx, byte [esp + 0x15]
mov dl, byte [edx + 0x100df698]
mov ebx, eax
movzx eax, al
mov al, byte [eax + 0x100df698]
mov byte [esp + 0x13], al
movzx eax, byte [esp + 0x10]
shr ebx, 8
movzx edx, dl
shl eax, 8
or eax, edx
movzx esi, bl
mov bl, byte [esi + 0x100df698]
shl eax, 8
movzx edx, bl
or eax, edx
movzx edx, byte [esp + 0x13]
shl eax, 8
or eax, edx
mov edx, eax
rol edx, 0xd
mov esi, eax
ror esi, 9
xor edx, esi
xor edx, dword [esp + ecx + 0x14]
xor edx, eax
mov dword [esp + ecx + 0x24], edx
mov dword [ecx + ebp - 4], edx
cmp ecx, 0x80
jb 0x10068c10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x98
ret
Function at 0x10069150
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
mov eax, dword [0x1010d170]
xor eax, esp
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x38], 1
mov eax, dword [esp + 0x34]
push ebx
push ebp
mov ebp, dword [esp + 0x44]
push esi
mov esi, edx
jne 0x10069260
test ecx, ecx
jle 0x10069308
add eax, 4
mov dword [esp + 0x14], eax
mov eax, esi
sub eax, edi
mov dword [esp + 0x10], eax
mov eax, ebp
sub eax, edi
mov dword [esp + 0x18], eax
lea eax, [ecx - 1]
shr eax, 4
inc eax
mov dword [esp + 0xc], eax
lea eax, [ebp + 3]
mov edx, ebp
sub edx, esi
mov dword [esp + 0x1c], eax
lea ecx, [esi + 1]
mov eax, edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], 4
lea esp, [esp]
mov edx, dword [esp + 0x18]
movzx edx, byte [edx + eax]
xor dl, byte [eax]
mov ebx, dword [esp + 0x10]
mov byte [ebx + eax], dl
mov edx, dword [esp + 0x24]
movzx edx, byte [edx + ecx]
xor dl, byte [eax + 1]
add eax, 4
mov byte [ecx], dl
movzx ebx, byte [eax - 2]
mov edx, dword [esp + 0x1c]
xor bl, byte [edx - 1]
add edx, 4
mov byte [ecx + 1], bl
movzx ebx, byte [eax - 1]
xor bl, byte [edx - 4]
add ecx, 4
mov byte [ecx - 2], bl
mov ebx, 1
sub dword [esp + 0x20], ebx
mov dword [esp + 0x1c], edx
jne 0x100691c0
mov ecx, dword [esp + 0x14]
push esi
mov eax, esi
call fcn.10068cc0
mov eax, dword [esi]
mov dword [edi], eax
mov ecx, dword [esi + 4]
mov dword [edi + 4], ecx
mov edx, dword [esi + 8]
mov dword [edi + 8], edx
mov eax, dword [esi + 0xc]
mov dword [edi + 0xc], eax
mov eax, 0x10
add dword [esp + 0x1c], eax
add dword [esp + 0x14], eax
add esp, 4
add ebp, eax
add esi, eax
sub dword [esp + 0xc], ebx
jne 0x100691a0
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.100ae60d
add esp, 0x30
ret
test ecx, ecx
jle 0x10069308
add eax, 4
mov dword [esp + 0x14], eax
lea eax, [ecx - 1]
mov ebx, edi
shr eax, 4
sub ebx, esi
inc eax
mov dword [esp + 0xc], eax
mov edi, edi
mov ecx, dword [ebp]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 4]
mov dword [esp + 0x28], ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x14]
push esi
mov eax, ebp
mov dword [esp + 0x30], edx
call fcn.10068cc0
mov eax, esi
add esp, 4
lea ecx, [edi + 2]
mov esi, 4
movzx edx, byte [eax + ebx]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
sub esi, 1
jne 0x100692b5
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [edi], ecx
mov ecx, dword [esp + 0x30]
mov dword [edi + 4], edx
mov edx, dword [esp + 0x34]
add ebp, 0x10
sub ebx, 0x10
sub dword [esp + 0xc], 1
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov esi, eax
jne 0x10069280
mov ecx, dword [esp + 0x38]
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 0x10
call fcn.100ae60d
add esp, 0x30
ret
Function at 0x1006e1b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1010d170]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
mov dword [ebp - 0x18], eax
mov eax, ebx
push edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1006e1d0
push 0
push 0
sub eax, esi
lea edi, [eax + 1]
push edi
push ebx
push 8
push 0xfde9
mov dword [ebp - 0x1c], 8
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
jg 0x1006e23f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ec
jne 0x1006e229
push 0
push 0
push edi
push ebx
push 0
push 0xfde9
mov dword [ebp - 0x1c], 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test esi, esi
jg 0x1006e23f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x1006e2d4
jmp 0x1006e2bd
lea eax, [esi + esi]
call fcn.100b5c00
mov edx, dword [ebp - 0x1c]
mov eax, esp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
push edi
push ebx
push edx
push 0xfde9
mov dword [ebp - 0x20], eax
call esi
test eax, eax
je 0x1006e2d4
mov edi, dword [ebp - 0x18]
mov eax, edi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1006e270
push 8
sub eax, edx
lea ecx, [ebp - 0x14]
push ecx
inc eax
push eax
push edi
push 0
push 0xfde9
call esi
test eax, eax
je 0x1006e2d4
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.100b290a
mov edi, eax
add esp, 8
test edi, edi
jne 0x1006e356
call fcn.100b2963
cmp dword [eax], 2
je 0x1006e2bd
call fcn.100b2963
cmp dword [eax], 9
jne 0x1006e2cc
mov ecx, dword [ebp - 0x18]
push ecx
push ebx
call fcn.100ae977
mov edi, eax
add esp, 8
test edi, edi
jne 0x1006e356
push 0xa9
push str...crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
mov ecx, 1
call fcn.1002c650
mov edx, dword [ebp - 0x18]
push 0x10100cb8
push edx
push 0x10100cbc
push ebx
push str.fopen_
push 5
call fcn.1002ca20
add esp, 0x24
call fcn.100b2963
cmp dword [eax], 2
mov ecx, 0x6d
jne 0x1006e327
push 0xac
lea eax, [ecx + 0x13]
jmp 0x1006e331
push 0xae
mov eax, 2
push str...crypto_bio_bss_file.c
push 0x20
call fcn.1002c650
add esp, 0xc
xor eax, eax
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ae60d
mov esp, ebp
pop ebp
ret
push 0x1010ec08
call fcn.1002f930
mov esi, eax
add esp, 4
test esi, esi
jne 0x1006e388
push edi
call fcn.100aed1f
add esp, 4
xor eax, eax
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ae60d
mov esp, ebp
pop ebp
ret
and dword [esi + 0x14], 0xffff7fff
push 1
push 0x6a
mov ebx, edi
call fcn.1002fe50
add esp, 8
mov eax, esi
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100ae60d
mov esp, ebp
pop ebp
ret
Function at 0x10078aa0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, eax
cmp dword [esp + 0xc], esi
jne 0x10078b19
mov al, byte [ecx]
cmp al, 0x6a
je 0x10078ab3
cmp al, 0x6b
jne 0x10078b19
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x10078af1
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x10078ad3
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x10078ad3
cmp al, 0xbb
jne 0x10078ae5
inc ecx
cmp ecx, esi
jl 0x10078ac3
sub esi, ecx
test ecx, ecx
jne 0x10078af4
push 0x8a
mov eax, 0x8a
jmp 0x10078b20
push 0x81
mov eax, 0x8a
jmp 0x10078b20
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x10078b06
push 0x93
mov eax, 0x8b
jmp 0x10078b20
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.100b3140
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
mov eax, 0x89
push str...crypto_rsa_rsa_x931.c
push 4
mov ecx, 0x80
call fcn.1002c650
add esp, 0xc
or eax, 0xffffffff
pop esi
ret
Function at 0x10079030
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x20
mov eax, dword [0x1010d170]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
dec edi
mov ebx, ecx
mov esi, edx
lea ecx, [edi - 0x29]
cmp esi, ecx
mov dword [esp + 0xc], eax
jle 0x10079086
push 0x2d
mov eax, 0x6e
push str...crypto_rsa_rsa_oaep.c
push 4
lea ecx, [eax + 0xb]
call fcn.1002c650
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100ae60d
add esp, 0x20
ret
cmp edi, 0x29
jge 0x100790b8
push 0x33
mov eax, 0x78
push str...crypto_rsa_rsa_oaep.c
push 4
lea ecx, [eax + 1]
call fcn.1002c650
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100ae60d
add esp, 0x20
ret
push ebp
push 0x100f6d70
mov byte [ebx], 0
push 0
lea ebp, [ebx + 1]
add ebx, 0x15
push ebx
push 0
push 0
mov dword [esp + 0x28], ebx
call fcn.1002bda0
add esp, 0x14
test eax, eax
je 0x10079147
mov edx, edi
sub edx, esi
sub edx, 0x29
push edx
lea eax, [ebx + 0x14]
push 0
push eax
call fcn.100b34b0
mov ecx, dword [esp + 0x1c]
sub ebx, esi
lea eax, [ebx + edi]
push esi
mov byte [eax - 0x15], 1
push ecx
add eax, 0xffffffec
push eax
call fcn.100b3140
push 0x14
push ebp
call fcn.10036820
add esp, 0x20
test eax, eax
jle 0x10079147
lea esi, [edi - 0x14]
mov edi, 0x49
mov ebx, str...crypto_rsa_rsa_oaep.c
call fcn.1002aa90
mov edi, eax
mov dword [esp + 0x10], edi
test edi, edi
jne 0x1007915c
push 0x4c
push ebx
push 4
lea eax, [edi + 0x41]
lea ecx, [edi + 0x79]
call fcn.1002c650
add esp, 0xc
pop ebp
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.100ae60d
add esp, 0x20
ret
push 0x100f6d70
push 0x14
push esi
push edi
mov ecx, ebp
call fcn.100794f0
add esp, 0x10
test eax, eax
jl 0x10079147
mov ecx, dword [esp + 0x14]
test esi, esi
jle 0x1007918e
mov edx, edi
mov eax, ecx
sub edx, ecx
mov edi, esi
mov bl, byte [edx + eax]
xor byte [eax], bl
inc eax
sub edi, 1
jne 0x10079183
push 0x100f6d70
push esi
lea edx, [esp + 0x20]
push 0x14
push edx
call fcn.100794f0
add esp, 0x10
test eax, eax
jl 0x10079147
lea ecx, [esp + 0x18]
lea esi, [esp + 0x19]
lea edi, [esp + 0x1a]
lea edx, [esp + 0x1b]
sub ecx, ebp
sub esi, ebp
sub edi, ebp
sub edx, ebp
lea ebx, [esp + 0x1c]
sub ebx, ebp
mov eax, ebp
mov dword [esp + 0x14], ebx
mov ebp, 4
movzx ebx, byte [ecx + eax]
xor byte [eax], bl
movzx ebx, byte [esi + eax]
xor byte [eax + 1], bl
movzx ebx, byte [edi + eax]
xor byte [eax + 2], bl
movzx ebx, byte [edx + eax]
xor byte [eax + 3], bl
mov ebx, dword [esp + 0x14]
movzx ebx, byte [ebx + eax]
xor byte [eax + 4], bl
add eax, 5
sub ebp, 1
jne 0x100791d0
mov eax, dword [0x10114e28]
test eax, eax
je 0x10079212
mov ecx, dword [esp + 0x10]
push ebp
push ecx
call eax
add esp, 8
mov edx, dword [esp + 0x10]
push edx
call dword [0x1010f130]
mov eax, dword [0x10114e28]
add esp, 4
test eax, eax
je 0x10079232
push 1
push 0
call eax
add esp, 8
mov ecx, dword [esp + 0x2c]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.100ae60d
add esp, 0x20
ret
Function at 0x100794f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
mov eax, dword [0x1010d170]
xor eax, esp
mov dword [esp + 0x78], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [esp + 0x38], ecx
mov ecx, dword [ebp + 0x14]
mov dword [esp + 0x28], eax
xor eax, eax
xor esi, esi
push edi
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
test ecx, ecx
jne 0x1007955f
push 0x10e
mov eax, 0x9f
push str...cryptoevpevp_lib.c
push 6
lea ecx, [eax + 3]
call fcn.1002c650
add esp, 0xc
jmp 0x1007957f
mov ebx, dword [ecx + 8]
mov dword [esp + 0x38], ebx
test ebx, ebx
jl 0x1007957f
mov edi, dword [ebp + 0xc]
xor eax, eax
mov dword [esp + 0x10], eax
test edi, edi
jg 0x100795ad
mov dword [esp + 0x30], 0
lea edi, [esp + 0x14]
call fcn.1002be80
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0x30]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100ae60d
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
mov edx, eax
sar edx, 0x18
mov byte [esp + 0xc], dl
mov edx, eax
sar edx, 0x10
mov byte [esp + 0xd], dl
mov edx, eax
mov byte [esp + 0xf], al
push ecx
lea eax, [esp + 0x18]
sar edx, 8
push eax
xor eax, eax
mov byte [esp + 0x16], dl
call fcn.1002b980
add esp, 8
test eax, eax
je 0x1007957f
mov ecx, dword [ebp + 0x10]
mov edx, dword [esp + 0x3c]
push ecx
push edx
lea eax, [esp + 0x1c]
push eax
call dword [esp + 0x34]
add esp, 0xc
test eax, eax
je 0x1007957f
push 4
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call dword [esp + 0x34]
add esp, 0xc
test eax, eax
je 0x1007957f
add ebx, esi
cmp ebx, edi
jg 0x1007963b
mov eax, dword [esp + 0x2c]
lea ecx, [eax + esi]
xor edi, edi
lea esi, [esp + 0x14]
call fcn.1002bbf0
test eax, eax
je 0x1007957f
mov edi, dword [ebp + 0xc]
mov esi, ebx
jmp 0x100796ad
mov eax, dword [esp + 0x14]
cmp dword [eax + 8], 0x40
jg 0x100796be
mov eax, dword [eax + 0x18]
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x18]
push edx
call eax
mov ecx, dword [esp + 0x1c]
mov ebx, eax
mov eax, dword [ecx + 0x20]
add esp, 8
test eax, eax
je 0x10079673
lea edx, [esp + 0x14]
push edx
call eax
add esp, 4
or dword [esp + 0x1c], 2
mov eax, dword [esp + 0x14]
mov ecx, dword [eax + 0x44]
mov edx, dword [esp + 0x20]
push ecx
push 0
push edx
call fcn.100b34b0
add esp, 0xc
test ebx, ebx
je 0x1007957f
mov edx, dword [esp + 0x2c]
mov eax, edi
sub eax, esi
push eax
lea ecx, [esp + 0x44]
push ecx
add edx, esi
push edx
call fcn.100b3140
add esp, 0xc
mov esi, edi
inc dword [esp + 0x10]
cmp esi, edi
jl 0x100795a1
jmp 0x10079577
mov eax, str.ctx__digest__md_size___EVP_MAX_MD_SIZE
mov ecx, 0x10e
mov edx, str...cryptoevpdigest.c
call fcn.10031f90
int3
Function at 0x1007ba20
Capabilities:
Encode data using xor

Disassembly:
cmp dword [ebx + 0x10c], 0xffffffff
jne 0x1007ba2c
xor eax, eax
ret
mov eax, dword [ebx]
push ebp
mov ebp, dword [esp + 8]
push edi
mov edi, dword [eax + 4]
mov dword [ecx], edi
test ebp, ebp
jne 0x1007ba43
pop edi
lea eax, [ebp + 1]
pop ebp
ret
mov eax, dword [ebx + 0x10c]
push esi
cmp eax, edi
jne 0x1007ba71
test edi, edi
jle 0x1007bab5
lea eax, [ebx + 0x8c]
mov esi, edi
lea ebx, [ebx]
mov dl, byte [eax + 0x60]
xor dl, byte [eax]
inc eax
mov byte [ebp], dl
inc ebp
sub esi, 1
jne 0x1007ba60
jmp 0x1007bab1
mov ecx, edi
sub ecx, eax
cmp ecx, 1
mov byte [eax + ebx + 0xec], 0x80
jle 0x1007ba96
dec ecx
push ecx
lea eax, [eax + ebx + 0xed]
push 0
push eax
call fcn.100b34b0
add esp, 0xc
test edi, edi
jle 0x1007bab5
lea eax, [ebx + 0xac]
mov esi, edi
mov cl, byte [eax + 0x40]
xor cl, byte [eax]
inc eax
mov byte [ebp], cl
inc ebp
sub esi, 1
jne 0x1007baa2
mov ebp, dword [esp + 0x10]
mov edx, dword [ebx]
mov eax, dword [edx + 0x18]
push edi
push ebp
push ebp
push ebx
call eax
add esp, 0x10
test eax, eax
jne 0x1007bad6
mov edx, edi
mov esi, ebp
call fcn.10036b80
pop esi
pop edi
xor eax, eax
pop ebp
ret
pop esi
pop edi
mov eax, 1
pop ebp
ret

Function at 0x1007c3f0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
mov ecx, dword [ebp + 4]
cmp ecx, dword [eax + 4]
push esi
push edi
jge 0x1007c404
mov edi, eax
jmp 0x1007c408
mov edi, ebp
mov ebp, eax
mov esi, dword [edi + 4]
cmp esi, dword [ebx + 8]
mov dword [esp + 0x14], esi
jle 0x1007c441
push ebx
mov eax, esi
call fcn.100242c0
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
je 0x1007c4a0
mov ecx, dword [ebx]
test ecx, ecx
je 0x1007c43c
mov esi, ecx
call fcn.1002ac20
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov dword [ebx], eax
mov dword [ebx + 8], esi
xor eax, eax
cmp dword [ebp + 4], eax
jle 0x1007c45e
mov edx, dword [edi]
mov ecx, dword [ebp]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebp + 4]
jl 0x1007c448
cmp eax, dword [edi + 4]
jge 0x1007c473
mov edx, dword [edi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x1007c463
mov edi, dword [edi + 4]
mov eax, edi
mov dword [ebx + 4], edi
test eax, eax
jle 0x1007c496
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x1007c493
dec eax
test eax, eax
jg 0x1007c485
mov dword [ebx + 4], eax
mov eax, 1
pop edi
pop esi
pop ebp
pop ecx
ret
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
Function at 0x1007ed90
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x14
cmp dword [0x1010e9fc], 0
je 0x1007edd2
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1007edb2
mov dword [0x1010e9fc], eax
jmp 0x1007edd2
fldz
sub esp, 8
fstp qword [esp]
lea ecx, [esp + 0x10]
push 8
push ecx
call fcn.100367b0
add esp, 0x10
cmp dword [0x1010e9fc], 0
jne 0x1007edf3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
fldz
sub esp, 8
fstp qword [esp]
lea edx, [esp + 0xc]
push 4
push edx
mov dword [esp + 0x14], eax
call fcn.100367b0
add esp, 0x10
add esp, 0x14
ret