joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53a1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 0x18]
mov eax, dword [ebp + 0x1c]
mov ebx, dword [eax]
movzx eax, byte [edi]
shl eax, 0x18
movzx ecx, byte [edi + 1]
shl ecx, 0x10
or ecx, eax
movzx eax, byte [edi + 2]
shl eax, 8
or ecx, eax
movzx eax, byte [edi + 3]
or ecx, eax
movzx esi, byte [edi + 4]
shl esi, 0x18
movzx eax, byte [edi + 5]
shl eax, 0x10
or eax, esi
movzx esi, byte [edi + 6]
shl esi, 8
or eax, esi
movzx esi, byte [edi + 7]
or eax, esi
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], eax
mov esi, ecx
shr esi, 0x18
mov edx, esi
mov byte [ebp - 0x20], dl
mov esi, ecx
shr esi, 0x10
mov edx, esi
mov byte [ebp - 0x1f], dl
mov esi, ecx
shr esi, 8
mov edx, esi
mov byte [ebp - 0x1e], dl
mov byte [ebp - 0x1d], cl
mov ecx, eax
shr ecx, 0x18
mov byte [ebp - 0x1c], cl
mov ecx, eax
shr ecx, 0x10
mov byte [ebp - 0x1b], cl
mov ecx, eax
shr ecx, 8
mov byte [ebp - 0x1a], cl
mov byte [ebp - 0x19], al
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x53a349
xor esi, esi
mov dword [ebp - 0x2c], 0
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x30], edi
mov edi, dword [ebp + 8]
jmp 0x53a2a4
mov al, byte [ebp + ebx - 0x20]
xor al, byte [edi + esi]
mov byte [edx + esi], al
inc ebx
and ebx, 7
inc esi
cmp esi, dword [ebp + 0x10]
je 0x53a304
test ebx, ebx
jne 0x53a290
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov dword [ebp - 0x34], edx
call fcn.0053a51c
mov eax, dword [ebp - 0x28]
mov ecx, eax
shr ecx, 0x18
mov byte [ebp - 0x20], cl
mov ecx, eax
shr ecx, 0x10
mov byte [ebp - 0x1f], cl
mov ecx, eax
shr ecx, 8
mov byte [ebp - 0x1e], cl
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x24]
mov ecx, eax
shr ecx, 0x18
mov byte [ebp - 0x1c], cl
mov ecx, eax
shr ecx, 0x10
mov byte [ebp - 0x1b], cl
mov ecx, eax
shr ecx, 8
mov byte [ebp - 0x1a], cl
mov byte [ebp - 0x19], al
inc dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
jmp 0x53a290
mov edi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x53a349
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov ecx, edx
shr ecx, 0x18
mov byte [edi], cl
mov ecx, edx
shr ecx, 0x10
mov byte [edi + 1], cl
mov ecx, edx
shr ecx, 8
mov byte [edi + 2], cl
mov byte [edi + 3], dl
mov edx, eax
shr edx, 0x18
mov byte [edi + 4], dl
mov edx, eax
shr edx, 0x10
mov byte [edi + 5], dl
mov edx, eax
shr edx, 8
mov byte [edi + 6], dl
mov byte [edi + 7], al
mov edx, dword [ebp + 0x1c]
mov dword [edx], ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
Function at 0x53c534
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov byte [eax], 0
mov edx, dword [ebp + 0xc]
cmp edx, 0x80
jle 0x53c556
mov edx, pe_nt_image_headers32
test ecx, ecx
jle 0x53c64d
cmp ecx, 0x400
jle 0x53c66e
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xff
xor edi, edi
mov ebx, pe_nt_image_headers32
mov dword [ebp - 0x1c], 0xffffffff
test edx, edx
jle 0x53c698
xor ecx, ecx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp + 0x10]
nop
mov bl, byte [esi + ecx]
mov byte [eax + ecx], bl
inc ecx
cmp ecx, edx
jne 0x53c598
mov ebx, dword [ebp - 0x10]
mov cl, byte [eax + edx - 1]
cmp edx, 0x80
je 0x53c5e0
movzx esi, cl
mov ecx, eax
mov dword [ebp - 0x10], ebx
mov eax, esi
mov esi, ecx
nop
add al, byte [ecx]
movzx eax, al
mov bl, byte [eax + 0x69ecc0]
movzx eax, bl
mov byte [esi + edx], bl
inc edx
inc ecx
cmp edx, 0x80
jne 0x53c5c0
mov ebx, dword [ebp - 0x10]
mov eax, esi
mov ecx, dword [ebp - 0x18]
lea ecx, [eax + ecx]
movzx edx, byte [ecx]
and edx, dword [ebp - 0x14]
mov dl, byte [edx + 0x69ecc0]
mov byte [ecx], dl
test edi, edi
je 0x53c61a
movzx esi, dl
mov edx, dword [ebp - 0x1c]
lea edx, [eax + edx]
lea edi, [eax - 1]
movzx ecx, byte [edx + ebx]
xor ecx, esi
mov cl, byte [ecx + 0x69ecc0]
movzx esi, cl
mov byte [edx], cl
dec edx
cmp edx, edi
jne 0x53c604
lea esi, [eax + 0xfc]
mov edx, 0x7f
lea esi, [esi]
movzx ecx, byte [eax + edx]
shl ecx, 8
movzx ebx, byte [eax + edx - 1]
or ecx, ebx
mov dword [esi + edx*2 - 0xfe], ecx
sub edx, 2
cmp edx, 0xffffffff
jne 0x53c628
add esp, 0x10
pop ebx
pop esi
pop edi
leave
ret
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xff
mov dword [ebp - 0x1c], 0xffffffff
xor edi, edi
mov ebx, pe_nt_image_headers32
jmp 0x53c586
lea ebx, [ecx + 7]
sar ebx, 3
mov edi, pe_nt_image_headers32
sub edi, ebx
lea esi, [edi - 1]
mov dword [ebp - 0x1c], esi
neg ecx
and ecx, 7
mov dword [ebp - 0x14], 0xff
sar dword [ebp - 0x14], cl
mov dword [ebp - 0x18], edi
jmp 0x53c586
mov cl, byte [eax + edx - 1]
jmp 0x53c5b2
Function at 0x53c760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x18]
mov eax, dword [ebp + 0x1c]
mov ebx, dword [eax]
movzx ecx, byte [esi]
movzx eax, byte [esi + 1]
shl eax, 8
or eax, ecx
movzx ecx, byte [esi + 2]
shl ecx, 0x10
or eax, ecx
movzx ecx, byte [esi + 3]
shl ecx, 0x18
or eax, ecx
movzx ecx, byte [esi + 4]
movzx edx, byte [esi + 5]
shl edx, 8
or edx, ecx
movzx ecx, byte [esi + 6]
shl ecx, 0x10
or edx, ecx
movzx ecx, byte [esi + 7]
shl ecx, 0x18
or edx, ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov byte [ebp - 0x20], al
mov ecx, eax
shr ecx, 8
mov byte [ebp - 0x1f], cl
mov ecx, eax
shr ecx, 0x10
mov byte [ebp - 0x1e], cl
shr eax, 0x18
mov byte [ebp - 0x1d], al
mov byte [ebp - 0x1c], dl
mov eax, edx
shr eax, 8
mov byte [ebp - 0x1b], al
mov eax, edx
shr eax, 0x10
mov byte [ebp - 0x1a], al
mov eax, edx
shr eax, 0x18
mov byte [ebp - 0x19], al
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x53c8bd
xor eax, eax
mov dword [ebp - 0x2c], 0
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x30], esi
mov esi, eax
jmp 0x53c820
mov al, byte [ebp + ebx - 0x20]
xor al, byte [edi + esi]
mov byte [edx + esi], al
inc ebx
and ebx, 7
inc esi
cmp esi, dword [ebp + 0x10]
je 0x53c87c
test ebx, ebx
jne 0x53c80c
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], eax
lea eax, [ebp - 0x28]
mov dword [esp], eax
mov dword [ebp - 0x34], edx
call fcn.0053bd5c
mov eax, dword [ebp - 0x28]
mov byte [ebp - 0x20], al
mov ecx, eax
shr ecx, 8
mov byte [ebp - 0x1f], cl
mov ecx, eax
shr ecx, 0x10
mov byte [ebp - 0x1e], cl
shr eax, 0x18
mov byte [ebp - 0x1d], al
mov eax, dword [ebp - 0x24]
mov byte [ebp - 0x1c], al
mov ecx, eax
shr ecx, 8
mov byte [ebp - 0x1b], cl
mov ecx, eax
shr ecx, 0x10
mov byte [ebp - 0x1a], cl
shr eax, 0x18
mov byte [ebp - 0x19], al
inc dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
jmp 0x53c80c
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x53c8bd
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov byte [esi], dl
mov ecx, edx
shr ecx, 8
mov byte [esi + 1], cl
mov ecx, edx
shr ecx, 0x10
mov byte [esi + 2], cl
shr edx, 0x18
mov byte [esi + 3], dl
mov byte [esi + 4], al
mov edx, eax
shr edx, 8
mov byte [esi + 5], dl
mov edx, eax
shr edx, 0x10
mov byte [esi + 6], dl
shr eax, 0x18
mov byte [esi + 7], al
mov edx, dword [ebp + 0x1c]
mov dword [edx], ebx
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
Function at 0x53d0e0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x53d100
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x5402ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
cmp dword [ebp + 0x14], 0
jne 0x540310
mov dword [ebp + 0x10], ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], eax
leave
jmp fcn.005419e8
leave
jmp fcn.00540d7c
Function at 0x5426dc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
cmp dword [ebp + 0x1c], 0
jne 0x542714
mov dword [ebp + 0x1c], fcn.005419e8
mov dword [ebp + 0x18], esi
mov dword [ebp + 0x14], ebx
mov dword [ebp + 0x10], ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 8], eax
pop ebx
pop esi
leave
jmp fcn.00564f00
mov dword [ebp + 0x1c], fcn.00540d7c
pop ebx
pop esi
leave
jmp fcn.00564e0c
Function at 0x54711c
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 4
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
jle 0x547239
mov edx, ecx
mov dword [ebp - 0x10], 0
jmp 0x5471a7
movzx ecx, byte [esi]
shl ecx, 0x10
movzx edi, byte [esi + 1]
shl edi, 8
or ecx, edi
movzx edi, byte [esi + 2]
or ecx, edi
mov edi, ecx
shr edi, 0x12
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
mov edi, ecx
shr edi, 0xc
and edi, 0x3f
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], al
mov edi, ecx
shr edi, 6
and edi, 0x3f
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 2], al
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 3], cl
add edx, 4
mov ecx, edx
add dword [ebp - 0x10], 4
sub ebx, 3
test ebx, ebx
jle 0x5471f4
add esi, 3
cmp ebx, 2
jg 0x547144
movzx ecx, byte [esi]
shl ecx, 0x10
cmp ebx, 2
je 0x547200
mov edi, ecx
shr edi, 0x12
mov al, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
shr ecx, 0xc
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], cl
lea ecx, [edx + 2]
mov edi, 0x3d
mov eax, edi
mov byte [ecx], al
mov byte [ecx + 1], 0x3d
add ecx, 2
add edx, 4
add dword [ebp - 0x10], 4
sub ebx, 3
test ebx, ebx
jg 0x5471a4
mov byte [ecx], 0
mov eax, dword [ebp - 0x10]
pop edx
pop ebx
pop esi
pop edi
leave
ret
movzx edi, byte [esi + 1]
shl edi, 8
or edi, ecx
mov ecx, edi
shr ecx, 0x12
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
mov ecx, edi
shr ecx, 0xc
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], cl
lea ecx, [edx + 2]
shr edi, 6
and edi, 0x3f
movzx edi, byte [edi + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x5471db
mov dword [ebp - 0x10], 0
jmp 0x5471f4
Function at 0x5584c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
lea edi, [esi - 1]
lea eax, [esi - 0x29]
cmp eax, dword [ebp + 0x14]
jle 0x558654
cmp edi, 0x28
jle 0x558610
mov byte [ebx], 0
lea eax, [ebx + 1]
mov dword [ebp - 0x44], eax
lea eax, [ebx + 0x15]
mov dword [ebp - 0x40], eax
call fcn.004efb20
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov eax, dword [ebp - 0x40]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x18]
mov dword [esp], eax
call fcn.004fccc8
mov edx, edi
sub edx, dword [ebp + 0x14]
lea ecx, [edx - 0x29]
lea eax, [ebx + 0x29]
mov dword [ebp - 0x3c], eax
xor eax, eax
mov edi, dword [ebp - 0x3c]
rep stosb byte es:[edi], al
mov eax, dword [ebp - 0x40]
mov byte [eax + edx - 0x15], 1
sub esi, 0x15
mov dword [ebp - 0x3c], esi
mov eax, esi
sub eax, dword [ebp + 0x14]
add eax, dword [ebp - 0x40]
mov edi, eax
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 4], 0x14
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call fcn.004f8018
test eax, eax
jle 0x558648
mov dword [esp + 8], 0x48
mov dword [esp + 4], str.crypto_rsa_rsa_oaep.c
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
call fcn.004f28b0
mov edi, eax
test eax, eax
je 0x55868a
mov dword [esp], 0x14
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x3c]
call fcn.00558218
test eax, eax
js 0x558648
xor eax, eax
mov ecx, dword [ebp - 0x3c]
mov dl, byte [edi + eax]
xor byte [ebx + eax + 0x15], dl
inc eax
cmp ecx, eax
jg 0x5585c0
lea esi, [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov dword [esp], eax
mov ecx, dword [ebp - 0x40]
mov edx, 0x14
mov eax, esi
call fcn.00558218
test eax, eax
js 0x558648
xor eax, eax
nop
mov dl, byte [esi + eax]
xor byte [ebx + eax + 1], dl
inc eax
cmp eax, 0x14
jne 0x5585ec
mov dword [esp], edi
call fcn.004f2b90
mov eax, 1
add esp, 0x5c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 0x10], 0x33
mov dword [esp + 0xc], str.crypto_rsa_rsa_oaep.c
mov dword [esp + 8], 0x78
mov dword [esp + 4], 0x79
mov dword [esp], 4
call fcn.004f2144
xor eax, eax
add esp, 0x5c
pop ebx
pop esi
pop edi
leave
ret
xor eax, eax
add esp, 0x5c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 0x10], 0x2d
mov dword [esp + 0xc], str.crypto_rsa_rsa_oaep.c
mov dword [esp + 8], 0x6e
mov dword [esp + 4], 0x79
mov dword [esp], 4
call fcn.004f2144
xor eax, eax
add esp, 0x5c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 0x10], 0x4b
mov dword [esp + 0xc], str.crypto_rsa_rsa_oaep.c
mov dword [esp + 8], 0x41
mov dword [esp + 4], 0x79
mov dword [esp], 4
call fcn.004f2144
xor eax, eax
jmp 0x55863e
Function at 0x558c70
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
cmp eax, dword [ebp + 0x14]
jne 0x558cf8
mov bl, byte [ecx]
lea esi, [ebx - 0x6a]
mov edx, esi
cmp dl, 1
ja 0x558cf8
lea esi, [ecx + 1]
cmp bl, 0x6b
je 0x558cb4
sub eax, 2
cmp byte [esi + eax], 0xcc
jne 0x558d6c
mov edi, dword [ebp + 8]
mov ecx, eax
rep movsb byte es:[edi], byte [esi]
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
sub eax, 3
test eax, eax
jle 0x558da2
mov bl, byte [ecx + 1]
cmp bl, 0xba
je 0x558da2
cmp bl, 0xbb
jne 0x558d34
lea esi, [ecx + 2]
xor ecx, ecx
jmp 0x558ce5
mov bl, byte [esi]
inc esi
cmp bl, 0xba
je 0x558cf2
cmp bl, 0xbb
jne 0x558d34
inc ecx
cmp eax, ecx
jg 0x558cd8
test ecx, ecx
je 0x558da2
sub eax, ecx
jmp 0x558c9b
mov dword [esp + 0x10], 0x72
mov dword [esp + 0xc], str.crypto_rsa_rsa_x931.c
mov dword [esp + 8], 0x89
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 4
call fcn.004f2144
mov eax, 0xffffffff
add esp, 0x2c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp + 0x10], 0x81
mov dword [esp + 0xc], str.crypto_rsa_rsa_x931.c
mov dword [esp + 8], 0x8a
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 4
call fcn.004f2144
mov eax, 0xffffffff
jmp 0x558cac
mov dword [esp + 0x10], 0x93
mov dword [esp + 0xc], str.crypto_rsa_rsa_x931.c
mov dword [esp + 8], 0x8b
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 4
call fcn.004f2144
mov eax, 0xffffffff
jmp 0x558cac
mov dword [esp + 0x10], 0x8a
jmp 0x558d3c
Function at 0x55c4d8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x55c574
test ebx, ebx
je 0x55c580
test esi, esi
je 0x55c58c
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
mov dword [ebp - 0x30], edx
call fcn.004f419c
test eax, eax
mov edx, dword [ebp - 0x30]
je 0x55c534
mov eax, dword [eax + 8]
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
mov edi, 0x6a12e0
mov ecx, 4
repe cmpsb byte [esi], byte es:[edi]
jne 0x55c554
mov dword [esp], edx
mov dword [ebp - 0x30], edx
call sub.msvcrt.dll_getenv
test eax, eax
mov edx, dword [ebp - 0x30]
jne 0x55c52a
mov dword [ebp - 0x24], 0x6a12e4
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x2c]
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call fcn.004f419c
test eax, eax
jne 0x55c527
xor eax, eax
add esp, 0x3c
pop ebx
pop esi
pop edi
leave
ret
mov dword [esp], edx
call sub.msvcrt.dll_getenv
jmp 0x55c52a
lea eax, [ebp - 0x24]
mov dword [ebp - 0x2c], eax
jmp 0x55c554

Function at 0x55ceac
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push ebx
sub esp, 0x10
mov dword [esp], str.OPENSSL_CONF
call sub.msvcrt.dll_getenv
test eax, eax
je 0x55ced8
mov dword [esp], eax
call fcn.004fc788
mov edi, eax
mov eax, edi
add esp, 0x10
pop ebx
pop edi
leave
ret
call fcn.005642ac
mov edi, eax
xor eax, eax
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea ebx, [ecx + 0xc]
mov dword [esp + 8], 0x231
mov dword [esp + 4], str.crypto_conf_conf_mod.c
mov dword [esp], ebx
call fcn.004f28b0
mov edi, eax
test eax, eax
je 0x55cece
call fcn.005642ac
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.004fc6a8
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x6a138b
mov dword [esp], edi
call fcn.004fc7c0
mov dword [esp + 8], ebx
mov dword [esp + 4], str.openssl.cnf
mov dword [esp], edi
call fcn.004fc7c0
jmp 0x55cece
Function at 0x56238c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x16c
mov ebx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x1c]
mov dword [esp], eax
call fcn.00502a80
mov dword [ebp - 0x140], eax
xor eax, eax
cmp dword [ebp - 0x140], 0
js 0x56257c
lea edi, [ebp - 0x12c]
mov dword [esp], edi
call fcn.0050ef38
cmp dword [ebp + 8], 0
je 0x562587
cmp dword [ebp + 0xc], 0xffffffff
je 0x562593
test ebx, ebx
je 0x562569
mov dword [ebp - 0x14c], ebx
mov edx, dword [ebp + 0x24]
mov dword [ebp - 0x148], 1
lea ebx, [ebp - 0x5c]
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x144], eax
mov edi, dword [ebp - 0x140]
cmp eax, edi
jle 0x562417
mov dword [ebp - 0x144], edi
mov eax, dword [ebp - 0x148]
shr eax, 0x18
mov byte [ebp - 0x1c], al
mov eax, dword [ebp - 0x148]
shr eax, 0x10
mov byte [ebp - 0x1b], al
mov eax, dword [ebp - 0x148]
shr eax, 8
mov byte [ebp - 0x1a], al
mov al, byte [ebp - 0x148]
mov byte [ebp - 0x19], al
mov dword [esp + 0x10], 0
mov edi, dword [ebp + 0x1c]
mov dword [esp + 0xc], edi
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov edi, dword [ebp + 8]
mov dword [esp + 4], edi
lea eax, [ebp - 0x12c]
mov dword [esp], eax
mov dword [ebp - 0x154], edx
call fcn.0050ec30
mov edi, dword [ebp + 0x14]
mov dword [esp + 8], edi
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
lea edi, [ebp - 0x12c]
mov dword [esp], edi
call fcn.0050eea0
mov dword [esp + 8], 4
lea eax, [ebp - 0x1c]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.0050eea0
mov dword [esp + 8], 0
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.0050eeb8
mov edx, dword [ebp - 0x154]
mov edi, edx
mov esi, ebx
mov ecx, dword [ebp - 0x144]
rep movsb byte es:[edi], byte [esi]
cmp dword [ebp + 0x18], 1
jle 0x56254e
mov esi, 1
mov dword [ebp - 0x13c], esi
mov esi, dword [ebp - 0x144]
mov dword [ebp - 0x150], edi
mov edi, edx
lea esi, [esi]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], ebx
mov eax, dword [ebp - 0x140]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ebx
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp], eax
call fcn.0050f07c
test esi, esi
jle 0x562537
xor eax, eax
lea esi, [esi]
mov dl, byte [ebx + eax]
xor byte [edi + eax], dl
inc eax
cmp eax, esi
jne 0x56252c
inc dword [ebp - 0x13c]
mov eax, dword [ebp - 0x13c]
cmp dword [ebp + 0x18], eax
jg 0x5624f0
mov edi, dword [ebp - 0x150]
mov eax, dword [ebp - 0x144]
sub dword [ebp - 0x14c], eax
je 0x562569
inc dword [ebp - 0x148]
mov edx, edi
jmp 0x5623fb
lea edi, [ebp - 0x12c]
mov dword [esp], edi
call fcn.0050f03c
mov eax, 1
add esp, 0x16c
pop ebx
pop esi
pop edi
leave
ret
mov dword [ebp + 0xc], 0
jmp 0x5623dd
xor eax, eax
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebp + 0xc], ecx
jmp 0x5623dd