joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b552840
Capabilities:
Generate random numbers via winapi

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov ebx, dword [esp + 0x40]
mov dword [esp + 4], 1
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp], ebx
call sym._rand_pool_bytes_needed
mov dword [esp], ebx
mov dword [esp + 4], eax
mov esi, eax
call sym._rand_pool_add_begin
test eax, eax
je 0x6b5528f0
mov edi, eax
lea eax, [esp + 0x28]
mov dword [esp + 0x10], 0xf0000040
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
sub esp, 0x14
test eax, eax
jne 0x6b552980
xor edi, edi
xor esi, esi
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._rand_pool_add_end
mov dword [esp], ebx
call sym._rand_pool_entropy_available
test eax, eax
je 0x6b5528f0
mov edx, dword [esp + 0x2c]
xor edx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b552a16
add esp, 0x30
pop ebx
pop esi
pop edi
ret
mov dword [esp + 4], 1
mov dword [esp], ebx
call sym._rand_pool_bytes_needed
mov dword [esp], ebx
mov dword [esp + 4], eax
mov esi, eax
call sym._rand_pool_add_begin
mov edi, eax
test eax, eax
je 0x6b552970
lea eax, [esp + 0x28]
mov dword [esp + 0x10], 0xf0000040
mov dword [esp + 0xc], 0x16
mov dword [esp + 8], str.Intel_Hardware_Cryptographic_Service_Provider
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
sub esp, 0x14
test eax, eax
jne 0x6b5529d0
xor edi, edi
xor esi, esi
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._rand_pool_add_end
mov dword [esp], ebx
call sym._rand_pool_entropy_available
test eax, eax
jne 0x6b5528d1
mov dword [esp], ebx
call sym._rand_pool_entropy_available
jmp 0x6b5528d1
mov eax, dword [esp + 0x28]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
sub esp, 0xc
test eax, eax
jne 0x6b5529c0
xor edi, edi
xor esi, esi
mov eax, dword [esp + 0x28]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
sub esp, 8
jmp 0x6b5528b5
lea edi, [esi*8]
jmp 0x6b5529a0
mov eax, dword [esp + 0x28]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
sub esp, 0xc
test eax, eax
je 0x6b552a10
lea edi, [esi*8]
mov eax, dword [esp + 0x28]
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
sub esp, 8
jmp 0x6b552950
xor edi, edi
xor esi, esi
jmp 0x6b5529f3
call sym.___stack_chk_fail
lea esi, [esi]
nop
Function at 0x6b552b90
Capabilities:
Query environment variable
Read file on windows
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x56c
mov eax, dword [esp + 0x580]
mov edx, dword [esp + 0x584]
mov ecx, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x55c], ecx
xor ecx, ecx
mov dword [esp + 0x2c], eax
test edx, edx
jne 0x6b552be8
mov eax, dword [esp + 0x55c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b552e09
mov eax, dword [esp + 0x584]
add esp, 0x56c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x6b6130d8
mov dword [esp], eax
call sym._openssl_fopen
mov edi, eax
test eax, eax
je 0x6b552d8c
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__fileno]
lea edx, [esp + 0x38]
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__fstat]
test eax, eax
js 0x6b552da9
mov eax, dword [esp + 0x584]
test eax, eax
jns 0x6b552c4d
movzx eax, word [esp + 0x3e]
and ax, 0xf000
cmp ax, 0x8000
mov eax, 0x100
cmove eax, dword [esp + 0x4c]
mov dword [esp + 0x584], eax
mov dword [esp + 4], 0
lea ebp, [esp + 0x5c]
mov dword [esp], edi
call sym._setbuf
mov esi, dword [esp + 0x584]
mov dword [esp + 0x584], 0
lea esi, [esi]
nop
mov eax, 0x500
test esi, esi
jle 0x6b552c8f
cmp esi, 0x500
mov eax, 0x400
cmovle eax, esi
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebp
call sym._fread
mov dword [esp], edi
mov ebx, eax
call sym._ferror
test eax, eax
jne 0x6b552d68
test ebx, ebx
je 0x6b552ce6
mov dword [esp + 0x28], ebx
fild dword [esp + 0x28]
mov dword [esp + 4], ebx
mov dword [esp], ebp
fstp qword [esp + 8]
call sym.libcrypto_1_1.dll_RAND_add
add dword [esp + 0x584], ebx
test esi, esi
jle 0x6b552c78
sub esi, ebx
test esi, esi
jg 0x6b552c78
mov dword [esp + 4], 0x500
mov dword [esp], ebp
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov dword [esp], edi
call sym._fclose
call sym.libcrypto_1_1.dll_RAND_status
test eax, eax
jne 0x6b552bbf
mov dword [esp + 0x10], 0xa6
mov dword [esp + 0xc], str.crypto_rand_randfile.c
mov dword [esp + 8], 0x76
mov dword [esp + 4], 0x6f
mov dword [esp], 0x24
call sym.libcrypto_1_1.dll_ERR_put_error
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], str.Filename
mov dword [esp], 2
mov dword [esp + 8], eax
call sym.libcrypto_1_1.dll_ERR_add_error_data
mov dword [esp + 0x584], 0xffffffff
jmp 0x6b552bbf
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 4
jne 0x6b552cb9
mov dword [esp], edi
call sym._clearerr
test ebx, ebx
jne 0x6b552cbd
jmp 0x6b552c78
mov dword [esp + 0x10], 0x62
mov dword [esp + 0xc], str.crypto_rand_randfile.c
mov dword [esp + 8], 0x79
jmp 0x6b552d23
mov dword [esp + 0x10], 0x69
mov dword [esp + 0xc], str.crypto_rand_randfile.c
mov dword [esp + 8], 0x71
mov dword [esp + 4], 0x6f
mov dword [esp], 0x24
call sym.libcrypto_1_1.dll_ERR_put_error
mov eax, dword [esp + 0x2c]
mov dword [esp + 4], str.Filename
mov dword [esp], 2
mov dword [esp + 8], eax
call sym.libcrypto_1_1.dll_ERR_add_error_data
mov dword [esp], edi
call sym._fclose
mov dword [esp + 0x584], 0xffffffff
jmp 0x6b552bbf
call sym.___stack_chk_fail
nop
Function at 0x6b552e10
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x450
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x44c], eax
xor eax, eax
mov esi, dword [esp + 0x460]
lea eax, [esp + 0x28]
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll__stat]
test eax, eax
js 0x6b552e56
movzx eax, word [esp + 0x2e]
and ax, 0xf000
cmp ax, 0x8000
jne 0x6b552ef7
lea edi, [esp + 0x4c]
mov dword [esp + 4], 0x400
mov dword [esp], edi
call sym.libcrypto_1_1.dll_RAND_priv_bytes
cmp eax, 1
jne 0x6b552ef0
mov dword [esp + 4], 0x6b6130fc
mov dword [esp], esi
call sym._openssl_fopen
mov ebx, eax
test eax, eax
je 0x6b552f42
mov dword [esp], esi
mov dword [esp + 4], 0x180
call dword [sym.imp.msvcrt.dll__chmod]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x400
mov dword [esp + 4], 1
mov dword [esp], edi
call sym._fwrite
mov dword [esp], ebx
mov esi, eax
call sym._fclose
mov dword [esp + 4], 0x400
mov dword [esp], edi
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov eax, dword [esp + 0x44c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b552f5c
add esp, 0x450
mov eax, esi
pop ebx
pop esi
pop edi
ret
mov esi, 0xffffffff
jmp 0x6b552ed4
mov dword [esp + 0x10], 0xb7
mov dword [esp + 0xc], str.crypto_rand_randfile.c
mov dword [esp + 8], 0x7a
mov dword [esp + 4], 0x70
mov dword [esp], 0x24
call sym.libcrypto_1_1.dll_ERR_put_error
mov dword [esp + 8], esi
mov esi, 0xffffffff
mov dword [esp + 4], str.Filename
mov dword [esp], 2
call sym.libcrypto_1_1.dll_ERR_add_error_data
jmp 0x6b552ed4
mov dword [esp + 0x10], 0xe9
mov dword [esp + 0xc], str.crypto_rand_randfile.c
mov dword [esp + 8], 0x79
jmp 0x6b552f0f
call sym.___stack_chk_fail
lea esi, [esi]
lea esi, [esi]
nop
Function at 0x6b552f70
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, 1
push esi
push ebx
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [esp + 8], 0
mov dword [ebp - 0x30], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [esp + 4], 0
mov dword [esp], str.RANDFILE
call esi
mov ecx, str.RANDFILE
sub esp, 0xc
mov edx, eax
test eax, eax
je 0x6b553110
lea eax, [edx + edx + 0x1b]
shr eax, 4
shl eax, 4
call fcn.6b5c3520
sub esp, eax
mov dword [ebp - 0x2c], edx
lea ebx, [esp + 0x2f]
mov dword [esp + 8], edx
and ebx, 0xfffffff0
mov dword [esp], ecx
mov dword [esp + 4], ebx
call esi
mov edx, dword [ebp - 0x2c]
sub esp, 0xc
cmp eax, edx
jae 0x6b55318a
mov ecx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
mov dword [ebp - 0x2c], ecx
call ecx
sub esp, 0x20
mov edx, eax
test eax, eax
je 0x6b55318a
lea eax, [eax + 0x1b]
shr eax, 4
shl eax, 4
call fcn.6b5c3520
mov ecx, dword [ebp - 0x2c]
sub esp, eax
lea esi, [esp + 0x2f]
mov dword [esp + 0x1c], 0
and esi, 0xfffffff0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call ecx
sub esp, 0x20
test eax, eax
je 0x6b55318a
cmp byte [esi], 0
je 0x6b55318a
mov ebx, esi
mov edx, dword [ebx]
add ebx, 4
lea eax, [edx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x6b5530ad
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea edx, [ebx + 2]
cmove ebx, edx
mov ecx, eax
add cl, al
sbb ebx, 3
sub ebx, esi
test edi, edi
je 0x6b5531a0
add ebx, 1
cmp ebx, dword [ebp + 0xc]
jae 0x6b55318a
mov edi, dword [ebp - 0x30]
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call sym._memcpy
mov eax, edi
jmp 0x6b55318c
mov dword [esp + 8], 0
xor edi, edi
mov dword [esp + 4], 0
mov dword [esp], str.HOME
call esi
mov ecx, str.HOME
sub esp, 0xc
mov edx, eax
test eax, eax
jne 0x6b552fbf
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.USERPROFILE
call esi
mov ecx, str.USERPROFILE
sub esp, 0xc
mov edx, eax
test eax, eax
jne 0x6b552fbf
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], str.SYSTEMROOT
call esi
sub esp, 0xc
mov edx, eax
test eax, eax
jne 0x6b5531d6
xor eax, eax
mov edi, dword [ebp - 0x1c]
xor edi, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b5531d1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebx + 6]
cmp eax, dword [ebp + 0xc]
jae 0x6b55318a
mov edi, dword [ebp - 0x30]
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call sym._memcpy
lea eax, [edi + ebx + 1]
mov byte [edi + ebx], 0x2f
mov dword [eax], 0x646e722e
mov byte [eax + 4], 0
mov eax, edi
jmp 0x6b55318c
call sym.___stack_chk_fail
mov ecx, str.SYSTEMROOT
jmp 0x6b552fbf
Function at 0x6b553980
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, pe_nt_image_headers32
mov edx, ebx
sub esp, 0x10
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
cmp dword [esp + 0x28], 0x80
mov edi, dword [esp + 0x2c]
mov byte [eax], 0
cmovle edx, dword [esp + 0x28]
test ecx, ecx
jle 0x6b553b22
cmp ecx, 0x400
mov esi, 0x400
cmovg ecx, esi
lea esi, [ecx + 7]
neg ecx
sar esi, 3
and ecx, 7
sub ebx, esi
mov dword [esp], ebx
add ebx, eax
mov dword [esp + 4], ebx
mov ebx, 0xff
sar ebx, cl
mov ecx, 0x7f
sub ecx, esi
mov dword [esp + 8], ebx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x28]
test ecx, ecx
jle 0x6b553b4e
lea ecx, [edi + 4]
cmp eax, ecx
lea ecx, [eax + 4]
setae bl
cmp edi, ecx
setae cl
or ecx, ebx
cmp dword [esp + 0x28], 4
setg bl
test cl, bl
je 0x6b553b58
mov ecx, eax
or ecx, edi
and ecx, 3
jne 0x6b553b58
mov ebp, edx
mov dword [esp + 0x24], eax
mov ecx, eax
mov ebx, edi
and ebp, 0xfffffffc
add ebp, eax
lea esi, [esi]
lea esi, [esi]
mov eax, dword [ebx]
add ecx, 4
add ebx, 4
mov dword [ecx - 4], eax
cmp ebp, ecx
jne 0x6b553a40
mov ecx, edx
mov eax, dword [esp + 0x24]
and ecx, 0xfffffffc
test dl, 3
je 0x6b553a84
movzx ebx, byte [edi + ecx]
mov byte [eax + ecx], bl
lea ebx, [ecx + 1]
cmp edx, ebx
jle 0x6b553a84
movzx ebx, byte [edi + ecx + 1]
mov byte [eax + ecx + 1], bl
lea ebx, [ecx + 2]
cmp edx, ebx
jle 0x6b553a84
movzx ebx, byte [edi + ecx + 2]
mov byte [eax + ecx + 2], bl
cmp dword [esp + 0x28], 0x7f
movzx ecx, byte [eax + edx - 1]
jg 0x6b553ab3
mov edi, eax
sub edi, edx
lea esi, [esi]
add cl, byte [edi + edx]
movzx ecx, cl
movzx ecx, byte [ecx + 0x6b6131a0]
mov byte [eax + edx], cl
add edx, 1
cmp edx, 0x80
jne 0x6b553a98
mov edi, dword [esp + 4]
mov edx, dword [esp]
movzx ebx, byte [edi]
and ebx, dword [esp + 8]
movzx ecx, byte [ebx + 0x6b6131a0]
mov ebx, dword [esp + 0xc]
mov byte [edi], cl
add ebx, eax
mov ebp, ecx
test edx, edx
je 0x6b553afb
lea esi, [esi]
lea esi, [esi]
movzx ecx, byte [ebx + esi]
mov edi, ebx
sub ebx, 1
xor ecx, ebp
movzx ebp, byte [ecx + 0x6b6131a0]
mov edx, ebp
mov byte [ebx + 1], dl
cmp eax, edi
jne 0x6b553ae0
mov edx, 0x7f
movzx ecx, byte [eax + edx]
movzx ebx, byte [eax + edx - 1]
shl ecx, 8
or ecx, ebx
mov dword [eax + edx*2 - 2], ecx
sub edx, 2
cmp edx, 0xffffffff
jne 0x6b553b00
add esp, 0x10
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [esp + 0x28]
mov dword [esp + 4], eax
mov esi, pe_nt_image_headers32
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], 0xff
mov dword [esp], 0
test ecx, ecx
jg 0x6b5539f8
movzx ecx, byte [eax + edx - 1]
jmp 0x6b553a90
xor ecx, ecx
lea esi, [esi]
movzx ebx, byte [edi + ecx]
mov byte [eax + ecx], bl
add ecx, 1
cmp edx, ecx
jg 0x6b553b60
jmp 0x6b553a84
Function at 0x6b555a80
Capabilities:
Hash data using sha1

Disassembly:
push edi
mov edx, dword [esp + 8]
xor eax, eax
lea edi, [edx + 0x18]
lea ecx, [edx + 0x14]
mov dword [edx + 0x14], 0
and edi, 0xfffffffc
mov dword [edx + 0x5c], 0
sub ecx, edi
add ecx, 0x4c
shr ecx, 2
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
pop edi
ret

Function at 0x6b5592a0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x10]
mov dword [esp + 4], eax
jmp sym.libcrypto_1_1.dll_BN_num_bits

Function at 0x6b55a220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov ebx, dword [esp + 0x30]
mov esi, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov edi, dword [esp + 0x3c]
mov edx, dword [ebx + 8]
mov eax, dword [edx + 0x34]
test eax, eax
je 0x6b55a250
add esp, 0x20
pop ebx
pop esi
pop edi
jmp eax
mov eax, dword [edx + 0x38]
test eax, eax
je 0x6b55a280
mov dword [esp + 0x10], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 2
call eax
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov dword [esp + 0x34], edi
mov edx, esi
mov eax, ebx
mov dword [esp + 0x30], ecx
add esp, 0x20
mov ecx, 2
pop ebx
pop esi
pop edi
jmp sym._rsa_builtin_keygen

Function at 0x6b55a2a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [ebx + 8]
mov esi, dword [esp + 0x20]
mov ebp, dword [esp + 0x24]
mov eax, dword [edx + 0x38]
test eax, eax
je 0x6b55a2d0
pop ebx
pop esi
pop edi
pop ebp
jmp eax
mov eax, dword [edx + 0x34]
test eax, eax
je 0x6b55a300
cmp ecx, 2
je 0x6b55a2e8
pop ebx
xor eax, eax
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], esi
pop ebx
pop esi
pop edi
pop ebp
jmp eax
mov dword [esp + 0x18], ebp
mov edx, edi
mov eax, ebx
mov dword [esp + 0x14], esi
pop ebx
pop esi
pop edi
pop ebp
jmp sym._rsa_builtin_keygen
Function at 0x6b55b740
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x8c
mov eax, dword [esp + 0xa0]
mov esi, dword [esp + 0xa4]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x18], eax
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x7c], eax
xor eax, eax
call sym.libcrypto_1_1.dll_EVP_MD_CTX_new
mov ebx, eax
test eax, eax
je 0x6b55b8d0
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call sym.libcrypto_1_1.dll_EVP_MD_size
mov dword [esp + 0x1c], eax
test eax, eax
js 0x6b55b8d0
test esi, esi
jle 0x6b55b8db
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x1c]
xor ebp, ebp
xor edi, edi
mov dword [esp + 0x2c], eax
jmp 0x6b55b7ef
mov eax, dword [esp + 0x2c]
mov dword [esp], ebx
mov dword [esp + 0x24], edx
add eax, edx
mov dword [esp + 4], eax
call sym.libcrypto_1_1.dll_EVP_DigestFinal_ex
mov edx, dword [esp + 0x24]
test eax, eax
je 0x6b55b8d0
add edi, 1
cmp edx, esi
jge 0x6b55b8db
mov ebp, edx
mov eax, edi
mov dword [esp + 8], 0
bswap eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x18]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym.libcrypto_1_1.dll_EVP_DigestInit_ex
test eax, eax
je 0x6b55b8d0
mov eax, dword [esp + 0xac]
mov dword [esp], ebx
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
call sym.libcrypto_1_1.dll_EVP_DigestUpdate
test eax, eax
je 0x6b55b8d0
lea eax, [esp + 0x38]
mov dword [esp + 8], 4
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym.libcrypto_1_1.dll_EVP_DigestUpdate
test eax, eax
je 0x6b55b8d0
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], 0
lea edx, [eax + ebp]
cmp edx, esi
jle 0x6b55b7c0
lea edi, [esp + 0x3c]
mov dword [esp], ebx
mov dword [esp + 4], edi
call sym.libcrypto_1_1.dll_EVP_DigestFinal_ex
test eax, eax
je 0x6b55b8d4
mov eax, dword [esp + 0x28]
sub esi, ebp
mov dword [esp + 4], edi
mov dword [esp + 8], esi
xor esi, esi
add eax, ebp
mov dword [esp], eax
call sym._memcpy
mov dword [esp + 4], 0x40
mov dword [esp], edi
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov dword [esp], ebx
call sym.libcrypto_1_1.dll_EVP_MD_CTX_free
mov eax, dword [esp + 0x7c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b55b8e3
add esp, 0x8c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [esp + 0x3c]
mov esi, 0xffffffff
jmp 0x6b55b89b
xor esi, esi
lea edi, [esp + 0x3c]
jmp 0x6b55b89b
call sym.___stack_chk_fail
lea esi, [esi]
nop
Function at 0x6b563950
Capabilities:
Check for software breakpoints

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x40]
cmp ecx, dword [esp + 0x3c]
jne 0x6b563a39
movzx ebx, byte [edx]
lea eax, [ebx - 0x6a]
cmp al, 1
ja 0x6b563a39
lea eax, [edx + 1]
lea esi, [ecx - 2]
cmp bl, 0x6b
je 0x6b5639b0
cmp byte [eax + esi], 0xcc
jne 0x6b563a6f
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 8], esi
mov dword [esp], eax
call sym._memcpy
add esp, 0x20
mov eax, esi
pop ebx
pop esi
pop edi
ret
lea edi, [ecx - 3]
test edi, edi
jle 0x6b5639df
lea ecx, [edx + esi]
xor ebx, ebx
jmp 0x6b5639cc
cmp dl, 0xbb
jne 0x6b5639f0
add ebx, 1
cmp ecx, eax
je 0x6b563a30
movzx edx, byte [eax]
add eax, 1
cmp dl, 0xba
jne 0x6b5639c0
sub edi, ebx
mov esi, edi
test ebx, ebx
jne 0x6b563981
mov dword [esp + 0x10], 0x50
jmp 0x6b5639f8
mov dword [esp + 0x10], 0x48
mov dword [esp + 0xc], str.crypto_rsa_rsa_x931.c
mov esi, 0xffffffff
mov dword [esp + 8], 0x8a
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 4
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x20
mov eax, esi
pop ebx
pop esi
pop edi
ret
sub edi, ebx
mov esi, edi
jmp 0x6b563981
mov dword [esp + 0x10], 0x3d
mov esi, 0xffffffff
mov dword [esp + 0xc], str.crypto_rsa_rsa_x931.c
mov dword [esp + 8], 0x89
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 4
call sym.libcrypto_1_1.dll_ERR_put_error
jmp 0x6b56399f
mov dword [esp + 0x10], 0x59
mov esi, 0xffffffff
mov dword [esp + 0xc], str.crypto_rsa_rsa_x931.c
mov dword [esp + 8], 0x8b
mov dword [esp + 4], pe_nt_image_headers32
mov dword [esp], 4
call sym.libcrypto_1_1.dll_ERR_put_error
jmp 0x6b56399f
Function at 0x6b5660a0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x18]
test eax, eax
je 0x6b5660b8
mov dword [esp + 0x18], sym.libcrypto_1_1.dll_SEED_encrypt
jmp sym.libcrypto_1_1.dll_CRYPTO_cbc128_encrypt
mov dword [esp + 0x18], sym.libcrypto_1_1.dll_SEED_decrypt
jmp sym.libcrypto_1_1.dll_CRYPTO_cbc128_decrypt

Function at 0x6b566120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 0x10]
test eax, eax
je 0x6b566130
jmp sym.libcrypto_1_1.dll_SEED_encrypt
jmp sym.libcrypto_1_1.dll_SEED_decrypt
Function at 0x6b56a170
Capabilities:
Hash data using sha1

Disassembly:
push edi
mov edx, dword [esp + 8]
xor eax, eax
lea edi, [edx + 0x18]
lea ecx, [edx + 0x14]
mov dword [edx + 0x14], 0
and edi, 0xfffffffc
mov dword [edx + 0x5c], 0
sub ecx, edi
add ecx, 0x4c
shr ecx, 2
rep stosd dword es:[edi], eax
mov dword [edx], 0x67452301
mov eax, 1
mov dword [edx + 4], 0xefcdab89
mov dword [edx + 8], 0x98badcfe
mov dword [edx + 0xc], 0x10325476
mov dword [edx + 0x10], 0xc3d2e1f0
pop edi
ret

Function at 0x6b56f800
Capabilities:
Hash data using sha224

Disassembly:
push edi
mov edx, dword [esp + 8]
lea edi, [edx + 0x24]
mov eax, edx
mov dword [edx + 0x20], 0
and edi, 0xfffffffc
sub eax, edi
lea ecx, [eax + 0x70]
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov dword [edx], 0xc1059ed8
mov eax, 1
mov dword [edx + 4], 0x367cd507
mov dword [edx + 8], 0x3070dd17
mov dword [edx + 0xc], 0xf70e5939
mov dword [edx + 0x10], 0xffc00b31
mov dword [edx + 0x14], 0x68581511
mov dword [edx + 0x18], 0x64f98fa7
mov dword [edx + 0x1c], 0xbefa4fa4
mov dword [edx + 0x6c], 0x1c
pop edi
ret

Function at 0x6b56f870
Capabilities:
Hash data using sha256

Disassembly:
push edi
mov edx, dword [esp + 8]
lea edi, [edx + 0x24]
mov eax, edx
mov dword [edx + 0x20], 0
and edi, 0xfffffffc
sub eax, edi
lea ecx, [eax + 0x70]
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov dword [edx], 0x6a09e667
mov eax, 1
mov dword [edx + 4], 0xbb67ae85
mov dword [edx + 8], 0x3c6ef372
mov dword [edx + 0xc], 0xa54ff53a
mov dword [edx + 0x10], 0x510e527f
mov dword [edx + 0x14], 0x9b05688c
mov dword [edx + 0x18], 0x1f83d9ab
mov dword [edx + 0x1c], 0x5be0cd19
mov dword [edx + 0x6c], 0x20
pop edi
ret

Function at 0x6b56fe20
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ecx, 0x13
push edi
push esi
push ebx
sub esp, 0x9c
mov ebx, dword [esp + 0xb8]
lea edx, [esp + 0x3c]
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], 0xc1059ed8
mov eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
mov dword [esp + 0x8c], eax
xor eax, eax
mov eax, 0x6b62cb40
mov edi, edx
mov dword [esp + 0x88], 0x1c
test ebx, ebx
mov ebp, dword [esp + 0xb0]
cmove ebx, eax
xor eax, eax
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x20], 0x367cd507
mov dword [esp + 0x24], 0x3070dd17
mov dword [esp + 0x28], 0xf70e5939
mov dword [esp + 0x2c], 0xffc00b31
mov dword [esp + 0x30], 0x68581511
mov dword [esp + 0x34], 0x64f98fa7
mov dword [esp + 0x38], 0xbefa4fa4
test eax, eax
je 0x6b56fec9
mov ecx, dword [esp + 0xb4]
mov edx, ebp
mov eax, esi
call sym._SHA256_Update.part.0
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym.libcrypto_1_1.dll_SHA256_Final
mov dword [esp + 4], 0x70
mov dword [esp], esi
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov eax, dword [esp + 0x8c]
xor eax, dword [sym.imp.libssp_0.dll___stack_chk_guard]
jne 0x6b56ff01
add esp, 0x9c
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
call sym.___stack_chk_fail
lea esi, [esi]
lea esi, [esi]