joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a130
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.00437980
mov eax, dword [esp + 0x20]
mov eax, dword [eax]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x45a17c
test ebp, ebp
je 0x45a17c
mov ecx, dword [esp + 0x2c]
mov dl, byte [eax + ecx]
mov esi, dword [esp + 0x18]
xor dl, byte [esi]
mov ecx, dword [esp + 0x1c]
mov byte [ecx], dl
inc ecx
inc esi
inc eax
dec ebp
and eax, 0xf
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], eax
jne 0x45a150
mov esi, dword [esp + 0x28]
movzx ebx, byte [esi + 0xc]
movzx ecx, byte [esi + 0xd]
movzx edx, byte [esi + 0xe]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 0xf]
shl ebx, 8
or ebx, edx
shl ebx, 8
or ebx, ecx
cmp ebp, 0x10
jb 0x45a216
mov edi, ebp
shr edi, 4
add ebx, edi
cmp ebx, edi
jae 0x45a1b3
sub edi, ebx
xor ebx, ebx
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
push esi
push edx
push edi
push eax
push ecx
call dword [esp + 0x48]
mov edx, ebx
mov eax, ebx
mov ecx, ebx
shr edx, 0x18
shr eax, 0x10
shr ecx, 8
add esp, 0x14
mov byte [esi + 0xc], dl
mov byte [esi + 0xd], al
mov byte [esi + 0xe], cl
mov byte [esi + 0xf], bl
test ebx, ebx
jne 0x45a200
mov ecx, 0xc
nop
mov al, byte [ecx + esi - 1]
dec ecx
add al, 1
mov byte [ecx + esi], al
jne 0x45a200
test ecx, ecx
jne 0x45a1f0
shl edi, 4
add dword [esp + 0x1c], edi
add dword [esp + 0x18], edi
sub ebp, edi
cmp ebp, 0x10
jae 0x45a1a4
mov eax, dword [esp + 0x10]
test ebp, ebp
je 0x45a2aa
mov edi, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
push esi
push edx
xor eax, eax
mov dword [edi], eax
push 1
mov dword [edi + 4], eax
push edi
mov dword [edi + 8], eax
push edi
mov dword [edi + 0xc], eax
call dword [esp + 0x48]
inc ebx
mov eax, ebx
mov ecx, ebx
mov edx, ebx
shr eax, 0x18
shr ecx, 0x10
shr edx, 8
add esp, 0x14
mov byte [esi + 0xc], al
mov byte [esi + 0xd], cl
mov byte [esi + 0xe], dl
mov byte [esi + 0xf], bl
test ebx, ebx
jne 0x45a275
mov ecx, 0xc
mov al, byte [ecx + esi - 1]
dec ecx
add al, 1
mov byte [ecx + esi], al
jne 0x45a275
test ecx, ecx
jne 0x45a265
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
lea eax, [edx + edi]
sub ecx, edi
sub esi, edi
add edx, ebp
lea ebx, [ebx]
mov bl, byte [ecx + eax]
xor bl, byte [eax]
dec ebp
mov byte [esi + eax], bl
inc eax
test ebp, ebp
jne 0x45a290
mov eax, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov dword [eax], edx
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
mov dword [ecx], eax
pop ebx
pop ecx
ret
Function at 0x45aa40
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.00437980
xor eax, eax
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x16c], eax
mov dword [esi + 0x168], eax
cmp ebx, 0xc
jne 0x45aaac
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov dword [esi], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov byte [esi + 0xf], 1
mov ebx, 1
jmp 0x45abdf
mov ecx, ebx
push edi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
cmp ebx, 0x10
jb 0x45ab2b
mov edi, dword [esp + 0x1c]
mov eax, ebx
sub edi, esi
shr eax, 4
mov dword [esp + 0x18], eax
push ebp
lea esp, [esp]
mov ecx, dword [esp + 0x20]
add ecx, 2
mov eax, esi
mov ebp, 4
mov edi, edi
movzx edx, byte [edi + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
sub ebp, 1
jne 0x45aae0
lea eax, [esi + 0x60]
push eax
push esi
call fcn.0045a600
add dword [esp + 0x28], 0x10
add esp, 8
add edi, 0x10
sub ebx, 0x10
sub dword [esp + 0x1c], 1
jne 0x45aad0
mov ecx, dword [esp + 0x10]
xor eax, eax
pop ebp
cmp ebx, eax
je 0x45ab5c
jbe 0x45ab4b
mov ecx, dword [esp + 0x1c]
mov eax, esi
sub ecx, esi
mov edi, ebx
jmp 0x45ab40
mov dl, byte [eax + ecx]
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x45ab40
lea eax, [esi + 0x60]
push eax
push esi
call fcn.0045a600
mov ecx, dword [esp + 0x14]
add esp, 8
mov eax, dword [esp + 0x10]
shld eax, ecx, 3
mov edx, eax
shr edx, 0x18
xor byte [esi + 8], dl
mov edx, eax
shr edx, 0x10
xor byte [esi + 9], dl
mov edx, eax
shr edx, 8
xor byte [esi + 0xa], dl
add ecx, ecx
mov edx, eax
xor byte [esi + 0xb], dl
add ecx, ecx
add ecx, ecx
xor byte [esi + 0xf], cl
mov edi, eax
mov edx, ecx
shrd edx, edi, 0x18
xor byte [esi + 0xc], dl
shr edi, 0x18
mov edi, eax
mov edx, ecx
shrd edx, edi, 0x10
xor byte [esi + 0xd], dl
mov edx, ecx
shrd edx, eax, 8
xor byte [esi + 0xe], dl
shr eax, 8
lea eax, [esi + 0x60]
push eax
push esi
shr edi, 0x10
call fcn.0045a600
movzx ebx, byte [esi + 0xc]
movzx ecx, byte [esi + 0xd]
movzx edx, byte [esi + 0xe]
movzx eax, byte [esi + 0xf]
shl ebx, 8
or ebx, ecx
shl ebx, 8
or ebx, edx
add esp, 8
shl ebx, 8
or ebx, eax
pop edi
mov ecx, dword [esi + 0x174]
mov eax, dword [esi + 0x170]
push ecx
lea edx, [esi + 0x20]
push edx
push esi
call eax
inc ebx
mov ecx, ebx
mov edx, ebx
add esp, 0xc
mov eax, ebx
shr ecx, 0x18
shr edx, 0x10
shr eax, 8
mov byte [esi + 0xf], bl
mov byte [esi + 0xc], cl
mov byte [esi + 0xd], dl
mov byte [esi + 0xe], al
pop esi
pop ebx
add esp, 8
ret
Function at 0x45ac20
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x38]
or eax, dword [esi + 0x3c]
je 0x45ac34
mov eax, 0xfffffffe
pop esi
ret
push ebx
mov ebx, dword [esp + 0x14]
xor eax, eax
mov ecx, ebx
add ecx, dword [esi + 0x30]
adc eax, dword [esi + 0x34]
cmp eax, 0x20000000
ja 0x45ace9
jb 0x45ac58
test ecx, ecx
ja 0x45ace9
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esi + 0x16c]
mov dword [esi + 0x30], ecx
mov dword [esi + 0x34], eax
test edi, edi
je 0x45ac99
mov edi, edi
test ebx, ebx
je 0x45ac85
mov cl, byte [ebp]
xor byte [edi + esi + 0x40], cl
inc edi
inc ebp
dec ebx
and edi, 0xf
jne 0x45ac70
jmp 0x45ac89
test edi, edi
jne 0x45acdc
lea edx, [esi + 0x60]
push edx
lea eax, [esi + 0x40]
push eax
call fcn.0045a600
add esp, 8
mov eax, ebx
and eax, 0xfffffff0
mov dword [esp + 0x14], eax
je 0x45acbf
push eax
lea ecx, [esi + 0x60]
push ecx
lea edx, [esi + 0x40]
push edx
mov ecx, ebp
call fcn.0045a780
mov eax, dword [esp + 0x20]
add esp, 0xc
add ebp, eax
sub ebx, eax
test ebx, ebx
je 0x45acdc
xor eax, eax
mov edi, ebx
test ebx, ebx
jbe 0x45acdc
jmp 0x45acd0
mov cl, byte [eax + ebp]
xor byte [esi + eax + 0x40], cl
inc eax
cmp eax, ebx
jb 0x45acd0
mov dword [esi + 0x16c], edi
pop edi
pop ebp
pop ebx
xor eax, eax
pop esi
ret
pop ebx
or eax, 0xffffffff
pop esi
ret
Function at 0x45c520
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.00437980
mov eax, dword [0x4ce540]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x44]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
mov bl, byte [esi]
mov dword [esp + 0x18], eax
mov eax, dword [esi + 0x28]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x2c]
mov dword [esp + 0x24], edx
mov byte [esp + 0xf], bl
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
test bl, 0x40
jne 0x45c578
push ecx
lea ecx, [esi + 0x10]
push ecx
push esi
call eax
add esp, 0xc
movzx eax, bl
and eax, 7
mov ebx, 0xf
sub ebx, eax
mov byte [esi], al
mov eax, ebx
xor ecx, ecx
mov dword [esp + 0x20], ebx
cmp eax, 0xf
jae 0x45c5a7
movzx edx, byte [esi + eax]
or ecx, edx
mov byte [esi + eax], 0
inc eax
shl ecx, 8
cmp eax, 0xf
jb 0x45c594
movzx eax, byte [esi + 0xf]
mov ebp, dword [esp + 0x4c]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, ebp
je 0x45c5ce
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.004265ea
add esp, 0x30
ret
push edi
mov edi, ebp
shr edi, 4
test edi, edi
je 0x45c60f
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
lea ecx, [esi + 0x10]
push ecx
mov ecx, dword [esp + 0x20]
push esi
push edx
push edi
push eax
push ecx
call dword [esp + 0x40]
shl edi, 4
mov edx, edi
add dword [esp + 0x34], edx
add dword [esp + 0x30], edx
add esp, 0x18
sub ebp, edx
je 0x45c66a
shr edx, 4
mov ecx, esi
call fcn.0045c2e0
test ebp, ebp
je 0x45c66a
mov edx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
push esi
call dword [esp + 0x2c]
add esp, 0xc
xor eax, eax
test ebp, ebp
jbe 0x45c659
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
lea ecx, [esp + 0x2c]
mov edx, ecx
sub edi, ecx
sub ebx, edx
lea ecx, [ecx]
lea edx, [esp + eax + 0x2c]
mov cl, byte [edi + edx]
xor cl, byte [edx]
inc eax
mov byte [ebx + edx], cl
xor byte [esi + eax + 0xf], cl
cmp eax, ebp
jb 0x45c640
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
lea eax, [esi + 0x10]
push ecx
push eax
push eax
call dword [esp + 0x2c]
add esp, 0xc
pop edi
cmp ebx, 0x10
jae 0x45c686
mov edx, 0x10
sub edx, ebx
push edx
lea eax, [esi + ebx]
push 0
push eax
call fcn.00427b00
add esp, 0xc
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [esp + 0x28]
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
xor dword [esi + 0x14], eax
xor dword [esi + 0x10], edx
mov ecx, dword [esp + 0x3c]
xor dword [esi + 0x18], ecx
mov al, byte [esp + 0x1b]
mov edx, dword [esp + 0x40]
xor dword [esi + 0x1c], edx
mov ecx, dword [esp + 0x44]
add esp, 0xc
mov byte [esi], al
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004265ea
add esp, 0x30
ret
Function at 0x45f560
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x45f5a7
mov al, byte [edx]
test al, al
je 0x45f5a7
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x45f577
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x461af0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24
call fcn.00437980
mov eax, dword [0x4ce540]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, esi
push edi
mov dword [ebp - 0x18], esi
lea ecx, [eax + 1]
jmp 0x461b20
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x461b20
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0
push 0
sub eax, ecx
lea edi, [eax + 1]
push edi
push esi
push 8
push 0xfde9
mov dword [ebp - 0x20], 8
call ebx
mov esi, eax
test esi, esi
jg 0x461b98
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3ec
jne 0x461b7a
mov ecx, dword [ebp - 0x18]
push 0
push 0
push edi
push ecx
push 0
push 0xfde9
mov dword [ebp - 0x20], 0
call ebx
mov esi, eax
test esi, esi
jg 0x461b98
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x459
jne 0x461c2a
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push edx
push eax
jmp 0x461c18
lea eax, [esi + esi]
call fcn.00434de0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x20]
mov eax, esp
push esi
push eax
push edi
push ecx
push edx
push 0xfde9
mov dword [ebp - 0x24], eax
call ebx
test eax, eax
je 0x461c2a
mov esi, dword [ebp - 0x1c]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x461bc3
push 8
sub eax, edx
lea ecx, [ebp - 0x14]
push ecx
inc eax
push eax
push esi
push 0
push 0xfde9
call ebx
test eax, eax
je 0x461c2a
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x14]
push edx
push eax
call fcn.004266bf
mov esi, eax
add esp, 8
test esi, esi
jne 0x461cce
call fcn.0042c117
cmp dword [eax], 2
je 0x461c10
call fcn.0042c117
cmp dword [eax], 9
jne 0x461c22
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x18]
push ecx
push edx
call fcn.00495b04
mov esi, eax
add esp, 8
test esi, esi
jne 0x461cce
push 0xa9
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.00447580
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
push 0x4bb7a8
push eax
push 0x4bb7a4
push ecx
push str.fopen_
push 5
call fcn.004476f0
add esp, 0x2c
call fcn.0042c117
cmp dword [eax], 2
jne 0x461ca0
push 0xac
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.00447580
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265ea
mov esp, ebp
pop ebp
ret
push 0xae
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.00447580
add esp, 0x14
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265ea
mov esp, ebp
pop ebp
ret
push 0x4cf970
call fcn.004615a0
mov edi, eax
add esp, 4
test edi, edi
jne 0x461d00
push esi
call fcn.00426f80
add esp, 4
xor eax, eax
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265ea
mov esp, ebp
pop ebp
ret
push 0
push edi
call fcn.00461030
push esi
push 1
push 0x6a
push edi
call fcn.00461390
add esp, 0x18
mov eax, edi
lea esp, [ebp - 0x30]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004265ea
mov esp, ebp
pop ebp
ret
Function at 0x464c40
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.00437980
mov eax, dword [0x4ce540]
xor eax, esp
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x2c]
dec ebx
push edi
mov edi, dword [esp + 0x38]
mov dword [esp + 8], ecx
lea ecx, [ebx - 0x29]
cmp edi, ecx
mov dword [esp + 0xc], edx
jle 0x464ca3
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.00447580
add esp, 0x14
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004265ea
add esp, 0x20
ret
cmp ebx, 0x29
jge 0x464cd0
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.00447580
add esp, 0x14
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004265ea
add esp, 0x20
ret
push ebp
push esi
push 0
mov byte [eax], 0
lea esi, [eax + 1]
lea ebp, [eax + 0x15]
call fcn.00443d20
mov edx, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x1c]
push 0
push ebp
push edx
push eax
call fcn.004446b0
add esp, 0x18
test eax, eax
je 0x464d69
mov ecx, ebx
sub ecx, edi
sub ecx, 0x29
push ecx
lea edx, [ebp + 0x14]
push 0
push edx
call fcn.00427b00
mov ecx, dword [esp + 0x1c]
mov eax, ebp
sub eax, edi
add eax, ebx
push edi
mov byte [eax - 0x15], 1
push ecx
add eax, 0xffffffec
push eax
call fcn.0042b330
push 0x14
push esi
call fcn.0043ec70
add esp, 0x20
test eax, eax
jle 0x464d69
push 0x49
add ebx, 0xffffffec
push str..crypto_rsa_rsa_oaep.c
push ebx
call fcn.0043ff90
mov edi, eax
add esp, 0xc
mov dword [esp + 0x14], edi
test edi, edi
jne 0x464d7e
push 0x4c
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.00447580
add esp, 0x14
pop esi
pop ebp
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004265ea
add esp, 0x20
ret
push 0x14
push esi
push ebx
push edi
call fcn.00464c10
add esp, 0x10
test eax, eax
jl 0x464d69
test ebx, ebx
jle 0x464dab
mov eax, ebp
sub edi, ebp
mov ecx, ebx
lea esp, [esp]
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
sub ecx, 1
jne 0x464da0
call fcn.00443d20
push eax
push ebx
push ebp
lea eax, [esp + 0x24]
push 0x14
push eax
call fcn.00464a90
add esp, 0x14
test eax, eax
jl 0x464d69
lea ecx, [esp + 0x18]
lea edi, [esp + 0x19]
lea ebp, [esp + 0x1a]
lea edx, [esp + 0x1b]
sub ecx, esi
sub edi, esi
sub ebp, esi
sub edx, esi
lea ebx, [esp + 0x1c]
sub ebx, esi
mov eax, esi
mov dword [esp + 0x10], ebx
mov esi, 4
nop
movzx ebx, byte [ecx + eax]
xor byte [eax], bl
movzx ebx, byte [edi + eax]
xor byte [eax + 1], bl
movzx ebx, byte [eax + ebp]
xor byte [eax + 2], bl
movzx ebx, byte [edx + eax]
xor byte [eax + 3], bl
mov ebx, dword [esp + 0x10]
movzx ebx, byte [ebx + eax]
xor byte [eax + 4], bl
add eax, 5
sub esi, 1
jne 0x464df0
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00440140
mov ecx, dword [esp + 0x30]
add esp, 4
lea eax, [esi + 1]
pop esi
pop ebp
pop edi
pop ebx
xor ecx, esp
call fcn.004265ea
add esp, 0x20
ret
Function at 0x465440
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 0x14]
cmp dword [esp + 0x18], esi
jne 0x46550c
mov ecx, dword [esp + 0x10]
mov al, byte [ecx]
cmp al, 0x6a
je 0x465461
cmp al, 0x6b
jne 0x46550c
lea edx, [ecx + 1]
cmp al, 0x6b
jne 0x4654cd
add esi, 0xfffffffd
xor ecx, ecx
test esi, esi
jle 0x465481
mov al, byte [edx]
inc edx
cmp al, 0xba
je 0x465481
cmp al, 0xbb
jne 0x4654aa
inc ecx
cmp ecx, esi
jl 0x465471
sub esi, ecx
test ecx, ecx
jne 0x4654d0
push 0x8a
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00447580
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.00447580
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
add esi, 0xfffffffe
cmp byte [esi + edx], 0xcc
je 0x4654f9
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.00447580
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
mov eax, dword [esp + 8]
push esi
push edx
push eax
call fcn.0042b330
add esp, 0xc
mov eax, esi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.00447580
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
Function at 0x46b370
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x130
call fcn.00437980
mov eax, dword [0x4ce540]
xor eax, esp
mov dword [esp + 0x12c], eax
mov eax, dword [esp + 0x13c]
push ebx
mov ebx, dword [esp + 0x138]
push esi
mov esi, dword [esp + 0x158]
push edi
mov edi, dword [esp + 0x154]
push edi
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], 1
call fcn.00443e40
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
jge 0x46b3e2
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.004265ea
add esp, 0x130
ret
lea ecx, [esp + 0x28]
push ebp
push ecx
call fcn.00472390
mov ebp, esi
mov esi, dword [esp + 0x160]
add esp, 4
mov eax, esi
mov dword [esp + 0x10], eax
test ebx, ebx
jne 0x46b40c
mov dword [esp + 0x148], ebx
jmp 0x46b432
cmp dword [esp + 0x148], 0xffffffff
jne 0x46b432
mov eax, ebx
lea edx, [eax + 1]
jmp 0x46b420
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46b420
sub eax, edx
mov dword [esp + 0x148], eax
mov eax, esi
test esi, esi
jne 0x46b465
lea ecx, [esp + 0x2c]
push ecx
call fcn.00472430
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x13c]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004265ea
add esp, 0x130
ret
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x20]
cmp eax, esi
jg 0x46b46f
mov esi, eax
mov eax, dword [esp + 0x18]
mov edx, eax
shr edx, 0x18
push 0
mov byte [esp + 0x18], dl
mov ecx, eax
mov edx, eax
mov byte [esp + 0x1b], al
mov eax, dword [esp + 0x14c]
push edi
shr ecx, 0x10
push eax
mov byte [esp + 0x21], cl
lea ecx, [esp + 0x38]
shr edx, 8
push ebx
push ecx
mov byte [esp + 0x2a], dl
call fcn.004720d0
add esp, 0x14
test eax, eax
je 0x46b59b
mov edx, dword [esp + 0x150]
mov eax, dword [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.004722d0
add esp, 0xc
test eax, eax
je 0x46b59b
push 4
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x34]
push eax
call fcn.004722d0
add esp, 0xc
test eax, eax
je 0x46b59b
push 0
lea ecx, [esp + 0x100]
push ecx
lea edx, [esp + 0x34]
push edx
call fcn.004722e0
add esp, 0xc
test eax, eax
je 0x46b59b
push esi
lea eax, [esp + 0x100]
push eax
push ebp
call fcn.0042b330
mov eax, dword [esp + 0x160]
add esp, 0xc
cmp eax, 1
jle 0x46b57e
dec eax
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x100]
push ecx
push edx
mov eax, ecx
mov ecx, dword [esp + 0x154]
push eax
push ecx
push ebx
push edi
call fcn.004724a0
add esp, 0x1c
test esi, esi
jle 0x46b577
lea ecx, [esp + 0xfc]
mov eax, ebp
sub ecx, ebp
mov edi, esi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
sub edi, 1
jne 0x46b568
mov edi, dword [esp + 0x24]
sub dword [esp + 0x1c], 1
jne 0x46b533
mov eax, dword [esp + 0x10]
inc dword [esp + 0x18]
sub eax, esi
add ebp, esi
mov dword [esp + 0x10], eax
test eax, eax
jne 0x46b461
jmp 0x46b436
lea eax, [esp + 0x2c]
push eax
call fcn.00472430
add esp, 4
xor eax, eax
jmp 0x46b448
Function at 0x46f970
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x46f989
mov esi, edi
mov edi, eax
jmp 0x46f98b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x46f99b
mov eax, ebx
jmp 0x46f9a5
push eax
push ebx
call fcn.0043df60
add esp, 8
test eax, eax
jne 0x46f9ad
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x46f9c9
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x46f9b4
cmp eax, dword [esi + 4]
jge 0x46f9e0
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x46f9d0
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x46fa01
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x46f9fe
dec eax
test eax, eax
jg 0x46f9f0
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x470ef0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x10c], 0xffffffff
jne 0x470f02
xor eax, eax
pop edi
ret
push ebx
push esi
push edi
call fcn.00476210
mov ebx, dword [esp + 0x18]
mov esi, eax
mov eax, dword [esp + 0x1c]
add esp, 4
mov dword [eax], esi
test ebx, ebx
je 0x470fb2
mov eax, dword [edi + 0x10c]
push ebp
cmp eax, esi
jne 0x470f50
test esi, esi
jle 0x470f91
mov ecx, ebx
lea eax, [edi + 0x8c]
mov ebp, esi
lea ebx, [ebx]
mov dl, byte [eax + 0x60]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x470f40
jmp 0x470f91
mov ecx, esi
sub ecx, eax
cmp ecx, 1
mov byte [eax + edi + 0xec], 0x80
jle 0x470f75
dec ecx
push ecx
lea eax, [eax + edi + 0xed]
push 0
push eax
call fcn.00427b00
add esp, 0xc
test esi, esi
jle 0x470f91
mov ecx, ebx
lea eax, [edi + 0xac]
mov ebp, esi
mov dl, byte [eax + 0x40]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
sub ebp, 1
jne 0x470f83
push esi
push ebx
push ebx
push edi
call fcn.00443e10
add esp, 0x10
pop ebp
test eax, eax
jne 0x470fb2
push esi
push ebx
call fcn.0044f230
add esp, 8
pop esi
pop ebx
xor eax, eax
pop edi
ret
pop esi
pop ebx
mov eax, 1
pop edi
ret