joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1010e870
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.101aa6d0
push esi
mov esi, dword [esp + 0xc]
push esi
call sym.libcrypto_1_1.dll_EVP_MD_type
add esp, 4
cmp eax, 0x72
jne 0x1010e98a
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
push ebp
push edi
mov edi, dword [esp + 0x2c]
push edi
push esi
push dword [esp + 0x2c]
mov ebp, eax
push dword [esp + 0x2c]
and eax, 1
shr ebp, 1
add eax, ebp
push eax
push dword [esp + 0x2c]
mov dword [esp + 0x24], eax
call sym.libcrypto_1_1.dll_EVP_md5
push eax
call fcn.1010e570
add esp, 0x1c
test eax, eax
jne 0x1010e8d2
pop edi
pop ebp
pop esi
pop ecx
ret
push ebx
push 0x104
push str...cryptokdf_tls1_prf.c
push edi
call sym.libcrypto_1_1.dll_CRYPTO_malloc
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x1010e90c
push 0x105
push str...cryptokdf_tls1_prf.c
push 0x41
push 0x6f
push 0x34
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop ebx
pop edi
pop ebp
pop esi
pop ecx
ret
mov eax, dword [esp + 0x1c]
push edi
push ebx
push dword [esp + 0x30]
add eax, ebp
push dword [esp + 0x30]
push dword [esp + 0x20]
push eax
call sym.libcrypto_1_1.dll_EVP_sha1
push eax
call fcn.1010e570
add esp, 0x1c
test eax, eax
jne 0x1010e94f
push 0x10a
push str...cryptokdf_tls1_prf.c
push edi
push ebx
call sym.libcrypto_1_1.dll_CRYPTO_clear_free
add esp, 0x10
xor eax, eax
pop ebx
pop edi
pop ebp
pop esi
pop ecx
ret
test edi, edi
je 0x1010e96b
mov edx, ebx
sub edx, esi
mov ecx, edi
lea esp, [esp]
mov al, byte [edx + esi]
xor byte [esi], al
lea esi, [esi + 1]
dec ecx
jne 0x1010e960
push 0x10f
push str...cryptokdf_tls1_prf.c
push edi
push ebx
call sym.libcrypto_1_1.dll_CRYPTO_clear_free
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop ebp
pop esi
pop ecx
ret
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push dword [esp + 0x24]
push esi
call fcn.1010e570
add esp, 0x1c
neg eax
sbb eax, eax
neg eax
pop esi
pop ecx
ret
Function at 0x10111020
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.101aa6d0
mov eax, dword [0x102745f0]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
mov ebx, dword [esp + 0xa8]
push edi
mov edi, dword [esp + 0xb4]
test edi, edi
je 0x101111c2
push ebp
dec edi
lea ebp, [ebx + 0xc]
add ebx, 0x14
shr edi, 3
push esi
mov esi, dword [esp + 0xb8]
mov dword [esp + 0x18], ebx
inc edi
jmp 0x10111070
movzx eax, byte [esi + 1]
movzx ecx, byte [esi]
shl eax, 8
or ecx, eax
movzx eax, byte [esi + 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi + 3]
shl eax, 0x18
or ecx, eax
movzx eax, byte [esi + 5]
shl eax, 8
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], ecx
movzx ecx, byte [esi + 4]
or ecx, eax
movzx eax, byte [esi + 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi + 7]
shl eax, 0x18
or ecx, eax
movzx eax, byte [ebp]
and al, 0xdf
or al, 0x40
mov byte [ebp], al
movzx eax, byte [ebx]
and al, 0xbf
or al, 0x20
push ebp
mov dword [esp + 0x18], ecx
lea esi, [esi + 8]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x24], ecx
mov byte [ebx], al
call sym.libcrypto_1_1.dll_DES_set_odd_parity
lea eax, [esp + 0x30]
push eax
push ebp
call sym.libcrypto_1_1.dll_DES_set_key_unchecked
push 1
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x30]
push eax
call sym.libcrypto_1_1.dll_DES_encrypt1
push ebx
call sym.libcrypto_1_1.dll_DES_set_odd_parity
lea eax, [esp + 0x48]
push eax
push ebx
call sym.libcrypto_1_1.dll_DES_set_key_unchecked
push 1
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x50]
push eax
call sym.libcrypto_1_1.dll_DES_encrypt1
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x58]
mov eax, dword [esp + 0x40]
mov ebx, dword [esp + 0x54]
xor edx, ecx
xor ecx, dword [esp + 0x50]
xor ebx, eax
xor eax, dword [esp + 0x4c]
mov dword [esp + 0x44], ecx
mov ecx, ebp
mov dword [esp + 0x40], eax
mov byte [ecx], al
shr eax, 8
mov byte [ecx + 1], al
mov eax, dword [esp + 0x40]
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [esp + 0x40]
add esp, 0x30
shr eax, 0x18
mov byte [ecx + 3], al
mov byte [ecx + 4], dl
mov eax, edx
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 6], al
shr edx, 0x18
mov byte [ecx + 7], dl
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov byte [ecx], bl
mov eax, ebx
shr eax, 8
mov byte [ecx + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 2], al
shr ebx, 0x18
mov byte [ecx + 3], bl
mov eax, edx
shr eax, 8
mov byte [ecx + 4], dl
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ecx + 6], al
mov byte [ecx + 7], dl
mov ebx, ecx
dec edi
jne 0x10111070
pop esi
pop ebp
mov ecx, dword [esp + 0xa4]
pop edi
pop ebx
xor ecx, esp
call fcn.101aa6fb
add esp, 0xa0
ret
Function at 0x10112040
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10112040
mov eax, 0x30
call fcn.101aa6d0
mov eax, dword [0x102745f0]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x3c]
push ebx
push ebp
mov ebp, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x50]
mov bl, byte [esi]
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x20], esi
mov byte [esp + 0xf], bl
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
test bl, 0x40
jne 0x10112098
push eax
lea eax, [esi + 0x10]
push eax
push esi
call ecx
add esp, 0xc
movzx eax, bl
and eax, 7
mov edx, 0xf
sub edx, eax
xor ecx, ecx
mov byte [esi], al
mov dword [esp + 0x24], edx
cmp edx, 0xf
jae 0x101120c5
movzx eax, byte [esi + edx]
or ecx, eax
mov byte [esi + edx], 0
inc edx
shl ecx, 8
cmp edx, 0xf
jb 0x101120b2
movzx eax, byte [esi + 0xf]
mov ebx, dword [esp + 0x4c]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, ebx
je 0x101120ec
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.101aa6fb
add esp, 0x30
ret
push edi
mov edi, ebx
shr edi, 4
test edi, edi
je 0x10112126
lea eax, [esi + 0x10]
push eax
push esi
push dword [esp + 0x20]
push edi
push dword [esp + 0x24]
push ebp
call dword [esp + 0x38]
shl edi, 4
add dword [esp + 0x2c], edi
add esp, 0x18
add ebp, edi
sub ebx, edi
je 0x1011218e
shr edi, 4
push edi
push esi
call fcn.101128e0
add esp, 8
test ebx, ebx
je 0x1011218e
push dword [esp + 0x18]
lea eax, [esp + 0x30]
push eax
push esi
call dword [esp + 0x28]
add esp, 0xc
xor edi, edi
test ebx, ebx
je 0x10112179
lea eax, [esp + 0x2c]
sub ebp, eax
sub dword [esp + 0x14], eax
lea eax, [esi + 0x10]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x2c]
add ecx, edi
inc edi
movzx edx, byte [ecx + ebp]
movzx eax, byte [ecx]
xor edx, eax
mov eax, dword [esp + 0x20]
mov byte [esi + ecx], dl
xor byte [eax + edi - 1], dl
cmp edi, ebx
jb 0x10112156
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
lea eax, [esi + 0x10]
push ebx
push eax
push eax
call ebp
add esp, 0xc
jmp 0x10112196
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
cmp eax, 0x10
jae 0x101121b9
mov ecx, 0x10
sub ecx, eax
mov edx, ecx
shr ecx, 2
lea edi, [esi + eax]
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x30]
push eax
push esi
call ebp
mov eax, dword [esp + 0x38]
xor dword [esi + 0x10], eax
mov eax, dword [esp + 0x3c]
xor dword [esi + 0x14], eax
mov eax, dword [esp + 0x40]
xor dword [esi + 0x18], eax
mov eax, dword [esp + 0x44]
xor dword [esi + 0x1c], eax
mov al, byte [esp + 0x1f]
mov ecx, dword [esp + 0x48]
add esp, 0xc
mov byte [esi], al
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.101aa6fb
add esp, 0x30
ret
Function at 0x10112960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x10112960
mov eax, 0x5c
call fcn.101aa6d0
mov eax, dword [0x102745f0]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x64]
push ebx
mov ebx, dword [esp + 0x74]
xor ecx, ecx
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0xc], ecx
cmp dword [esp + 0x70], ecx
jbe 0x10112af4
lea eax, [esp + 0x3c]
sub eax, ebx
push ebp
push esi
mov dword [esp + 0x28], eax
lea eax, [esp + 0x45]
mov esi, ebx
sub esi, eax
lea eax, [ebx + 2]
mov dword [esp + 0x1c], esi
lea edx, [eax - 1]
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], edx
movq xmm0, qword [ebx]
mov eax, ecx
and eax, 7
mov ebp, 7
sub ebp, eax
mov eax, ecx
mov ecx, dword [esp + 0x70]
shr eax, 3
mov dword [esp + 0x24], eax
mov al, byte [eax + ecx]
mov ecx, ebp
mov edx, 1
shl edx, cl
push edi
movq qword [esp + 0x48], xmm0
movq xmm0, qword [ebx + 8]
and al, dl
neg al
sbb al, al
and al, 0x80
push ebx
push ebx
mov dword [esp + 0x4c], ebp
mov byte [esp + 0x1f], al
movq qword [esp + 0x58], xmm0
call dword [esp + 0x44]
add esp, 0xc
cmp dword [esp + 0x88], 0
je 0x10112a3e
movzx edx, byte [ebx]
movzx eax, byte [esp + 0x13]
xor edx, eax
mov byte [esp + 0x54], dl
jmp 0x10112a4a
mov al, byte [esp + 0x13]
mov dl, byte [ebx]
mov byte [esp + 0x54], al
xor dl, al
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x28]
xor ebp, ebp
lea edi, [esp + 0x45]
add edi, ebp
add esi, edi
mov ah, byte [edi]
movzx ecx, byte [esi + edx]
mov bl, byte [edi + 1]
add cl, cl
mov al, ah
shr al, 7
or cl, al
mov al, bl
shr al, 7
mov byte [esi], cl
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
add ah, ah
or al, ah
mov byte [ecx + ebp], al
mov cl, byte [edi + 2]
mov al, cl
shr al, 7
add bl, bl
or al, bl
mov ebx, dword [esp + 0x30]
add cl, cl
mov byte [ebx + ebp], al
mov al, byte [edi + 3]
shr al, 7
or al, cl
mov byte [ebx + ebp + 1], al
add ebp, 4
cmp ebp, 0x10
jl 0x10112a54
mov cl, byte [esp + 0x14]
mov edx, dword [esp + 0x18]
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x34]
and cl, 7
and dl, 0x80
shr dl, cl
mov ecx, dword [esp + 0x40]
mov al, 1
shl al, cl
mov ecx, dword [esp + 0x24]
not al
and al, byte [ecx + edi]
or dl, al
mov byte [ecx + edi], dl
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0x3c]
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, dword [esp + 0x78]
jb 0x101129d0
pop esi
pop ebp
mov ecx, dword [esp + 0x60]
pop edi
pop ebx
xor ecx, esp
call fcn.101aa6fb
add esp, 0x5c
ret
Function at 0x10118780
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.101aa6d0
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov ebx, dword [ebp + 0x14]
mov esi, dword [esp + 0x1c]
cmp esi, ebx
jbe 0x10118836
mov ecx, dword [ebp + 0x18]
cmp esi, ecx
jb 0x101187da
mov eax, esi
sub eax, ecx
add eax, 4
and eax, 0xfffffffc
add eax, ecx
push 0x71
mov dword [ebp + 0x18], eax
push str...cryptomodesocb128.c
shl eax, 4
push eax
push dword [ebp + 0x40]
call sym.libcrypto_1_1.dll_CRYPTO_realloc
add esp, 0x10
test eax, eax
jne 0x101187d7
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov dword [ebp + 0x40], eax
cmp ebx, esi
jae 0x10118833
mov eax, ebx
shl eax, 4
mov dword [esp + 0xc], eax
mov eax, esi
mov esi, dword [esp + 0xc]
sub eax, ebx
add ebx, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ebx
push edi
lea ebx, [ebx]
mov eax, dword [ebp + 0x40]
add eax, esi
mov bl, byte [eax]
lea edi, [eax + 0x10]
push edi
shr bl, 7
push 1
neg bl
push eax
and bl, 0x87
call fcn.101184f0
xor byte [edi + 0xf], bl
add esp, 0xc
add esi, 0x10
dec dword [esp + 0x1c]
jne 0x10118800
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x14]
pop edi
mov dword [ebp + 0x14], ebx
shl esi, 4
add esi, dword [ebp + 0x40]
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10136630
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.101aa6d0
push ebx
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
lea edx, [esi + 2]
mov dword [esp + 0xc], 0x10
mov eax, edi
sub esi, edi
mov ebx, 4
lea esp, [esp]
movzx ecx, byte [esi + eax]
xor byte [eax], cl
movzx ecx, byte [edx - 1]
xor byte [eax + 1], cl
movzx ecx, byte [edx]
xor byte [eax + 2], cl
movzx ecx, byte [edx + 1]
xor byte [eax + 3], cl
lea eax, [eax + 4]
lea edx, [edx + 4]
dec ebx
jne 0x10136660
push 0x10
push edi
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push edi
push dword [eax + 4]
call sym.libcrypto_1_1.dll_EVP_CipherUpdate
add esp, 0x14
pop edi
pop esi
pop ebx
test eax, eax
je 0x101366af
cmp dword [esp], 0x10
jne 0x101366af
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x10136990
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x101369f3
mov edx, dword [esp + 0x10]
test edx, edx
je 0x101369f3
push ebx
push edi
mov edi, dword [esp + 0x10]
mov ebx, dword [edi + 0xc]
cmp edx, ebx
cmovb ebx, edx
xor ecx, ecx
test ebx, ebx
je 0x101369c1
mov al, byte [ecx + esi]
xor byte [edi + ecx + 0x10], al
inc ecx
cmp ecx, ebx
jb 0x101369b5
mov eax, dword [edi + 0xc]
cmp edx, eax
jbe 0x101369f1
sub edx, eax
mov eax, 0x10
cmp edx, eax
cmova edx, eax
xor eax, eax
test edx, edx
je 0x101369f1
lea ebx, [ebx]
mov ecx, dword [edi + 0xc]
add ecx, eax
inc eax
mov cl, byte [ecx + esi]
xor byte [edi + eax + 0x2f], cl
cmp eax, edx
jb 0x101369e0
pop edi
pop ebx
pop esi
ret

Function at 0x10138140
Capabilities:
Allocate thread local storage

Disassembly:
push 0
push 0
push 0
call sym.libcrypto_1_1.dll_OPENSSL_init_crypto
add esp, 0xc
test eax, eax
je 0x101381f5
push 0
push 0x1027907c
call sym.libcrypto_1_1.dll_CRYPTO_THREAD_init_local
add esp, 8
test eax, eax
je 0x101381f5
push 0
push 0x10279078
call sym.libcrypto_1_1.dll_CRYPTO_THREAD_init_local
add esp, 8
test eax, eax
je 0x101381e8
push esi
push 0
push dword [0x10279070]
push dword [0x10273b00]
push 1
call fcn.10138430
mov esi, eax
add esp, 0x10
test esi, esi
je 0x101381d0
push esi
call fcn.100057e5
add esp, 4
test eax, eax
jne 0x101381b9
push esi
call sym.libcrypto_1_1.dll_RAND_DRBG_free
add esp, 4
xor esi, esi
jmp 0x101381d0
push 0x1c
push str.OpenSSL_NIST_SP_800_90A_DRBG
push esi
mov dword [esi + 0x58], 1
call sym.libcrypto_1_1.dll_RAND_DRBG_instantiate
add esp, 0xc
mov dword [0x10279074], esi
test esi, esi
pop esi
jne 0x101381f8
push 0x10279078
call sym.libcrypto_1_1.dll_CRYPTO_THREAD_cleanup_local
add esp, 4
push 0x1027907c
call sym.libcrypto_1_1.dll_CRYPTO_THREAD_cleanup_local
add esp, 4
xor eax, eax
ret
mov eax, 1
ret
Function at 0x10139b40
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xc
call fcn.101aa6d0
mov eax, dword [0x102745f0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push 0
push 0
mov ebx, str.RANDFILE
push ebx
mov dword [ebp - 8], 1
call edi
mov esi, eax
test esi, esi
jne 0x10139bb0
push eax
push eax
mov ebx, str.HOME
push ebx
mov dword [ebp - 8], eax
call edi
mov esi, eax
test esi, esi
jne 0x10139bb0
push eax
push eax
mov ebx, str.USERPROFILE
push ebx
call edi
mov esi, eax
test esi, esi
jne 0x10139bb0
push eax
push eax
mov ebx, str.SYSTEMROOT
push ebx
call edi
mov esi, eax
test esi, esi
je 0x10139cd9
lea eax, [esi + esi]
call fcn.101ad870
mov eax, esp
push esi
push eax
push ebx
mov dword [ebp - 0xc], eax
call edi
cmp eax, esi
jae 0x10139cd9
mov ebx, dword [ebp - 0xc]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x10139cd9
call fcn.101ad870
mov esi, esp
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
push ebx
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x10139cd9
test esi, esi
je 0x10139cd9
cmp byte [esi], 0
je 0x10139cd9
mov ecx, esi
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10139c30
sub ecx, edx
cmp dword [ebp - 8], 0
je 0x10139c74
lea eax, [ecx + 1]
cmp eax, dword [ebp + 0xc]
jae 0x10139cd9
mov ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, esi
mov al, byte [esi]
mov byte [ecx + esi], al
lea esi, [esi + 1]
test al, al
jne 0x10139c52
mov eax, ebx
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101aa6fb
mov esp, ebp
pop ebp
ret
lea eax, [ecx + 6]
cmp eax, dword [ebp + 0xc]
jae 0x10139cd9
mov ebx, dword [ebp + 8]
mov ecx, ebx
sub ecx, esi
mov al, byte [esi]
mov byte [ecx + esi], al
lea esi, [esi + 1]
test al, al
jne 0x10139c83
lea edi, [ebx - 1]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x10139c92
mov ax, word [0x101f2674]
mov word [edi], ax
lea edx, [ebx - 1]
mov al, byte [edx + 1]
lea edx, [edx + 1]
test al, al
jne 0x10139ca8
mov ecx, dword [str..rnd]
mov dword [edx], ecx
mov cl, byte [0x10234254]
mov byte [edx + 4], cl
mov eax, ebx
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101aa6fb
mov esp, ebp
pop ebp
ret
xor eax, eax
lea esp, [ebp - 0x18]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101aa6fb
mov esp, ebp
pop ebp
ret
Function at 0x10139d60
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x574
call fcn.101aa6d0
mov eax, dword [0x102745f0]
xor eax, esp
mov dword [esp + 0x570], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [esp + 0x44], edi
mov dword [esp + 0x40], eax
test esi, esi
jne 0x10139daa
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x570]
xor ecx, esp
call fcn.101aa6fb
mov esp, ebp
pop ebp
ret
push 0x101f264c
push edi
call fcn.100038cd
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x10139df8
push 0x62
push str...crypto_rand_randfile.c
push 0x79
push 0x6f
push 0x24
call sym.libcrypto_1_1.dll_ERR_put_error
push edi
push str.Filename
push 2
call sym.libcrypto_1_1.dll_ERR_add_error_data
add esp, 0x20
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x570]
xor ecx, esp
call fcn.101aa6fb
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x48]
push eax
push ebx
call fcn.101acd22
add esp, 4
push eax
call fcn.101b0548
add esp, 8
test eax, eax
jns 0x10139e53
push 0x69
push str...crypto_rand_randfile.c
push 0x71
push 0x6f
push 0x24
call sym.libcrypto_1_1.dll_ERR_put_error
push edi
push str.Filename
push 2
call sym.libcrypto_1_1.dll_ERR_add_error_data
push ebx
call fcn.101ac934
add esp, 0x24
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x570]
xor ecx, esp
call fcn.101aa6fb
mov esp, ebp
pop ebp
ret
test esi, esi
jns 0x10139e69
test dword [esp + 0x4e], 0x8000
mov esi, pe_nt_image_headers32
cmovne esi, dword [esp + 0x5c]
push 0
push ebx
call fcn.101b0520
add esp, 8
test esi, esi
jle 0x10139e88
mov eax, 0x400
cmp esi, 0x500
cmovle eax, esi
jmp 0x10139e8d
mov eax, 0x500
push ebx
push eax
lea eax, [esp + 0x80]
push 1
push eax
call fcn.101acf24
push ebx
mov edi, eax
call fcn.101ac9d1
add esp, 0x14
test eax, eax
je 0x10139ec6
call fcn.101ad4d3
cmp dword [eax], 4
jne 0x10139ec6
push ebx
call fcn.101b0476
add esp, 4
test edi, edi
je 0x10139e74
jmp 0x10139eca
test edi, edi
je 0x10139f04
movd xmm0, edi
mov eax, 8
cvtdq2pd xmm0, xmm0
call fcn.101aa6d0
lea eax, [esp + 0x80]
movsd qword [esp], xmm0
push edi
push eax
call sym.libcrypto_1_1.dll_RAND_add
add dword [esp + 0x50], edi
add esp, 0x10
test esi, esi
jle 0x10139e88
sub esi, edi
test esi, esi
jg 0x10139e78
lea eax, [esp + 0x78]
push 0x500
push eax
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
push ebx
call fcn.101ac934
add esp, 0xc
call sym.libcrypto_1_1.dll_RAND_status
test eax, eax
jne 0x10139f43
push 0xa6
push str...crypto_rand_randfile.c
push 0x76
push 0x6f
push 0x24
call sym.libcrypto_1_1.dll_ERR_put_error
push dword [esp + 0x58]
jmp 0x10139dd1
mov ecx, dword [esp + 0x57c]
mov eax, dword [esp + 0x40]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.101aa6fb
mov esp, ebp
pop ebp
ret
Function at 0x1013afe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1013afe0
mov eax, 0x28
call fcn.101aa6d0
mov eax, dword [0x102745f0]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x24], eax
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
movzx eax, byte [edx]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 1]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
movzx eax, byte [edx + 2]
shl eax, 0x18
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 8
or ecx, eax
movzx eax, byte [edx + 5]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 6]
mov edx, dword [esp + 0x2c]
shl ecx, 8
or ecx, eax
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2e], al
shl ecx, 0x10
or edx, ecx
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2f], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x32], al
mov eax, edx
shr eax, 0x18
mov edi, dword [esp + 0x50]
mov byte [esp + 0x33], al
mov eax, dword [esp + 0x44]
mov esi, dword [edi]
mov dword [esp + 0x14], edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edx
mov byte [esp + 0x2c], bl
mov byte [esp + 0x30], dl
test eax, eax
je 0x1013b1a1
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
lea ebx, [ebx]
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x1013b135
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
call sym.libcrypto_1_1.dll_RC2_encrypt
mov ebx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov eax, ebx
shr eax, 8
mov byte [esp + 0x35], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x36], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x37], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x39], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x3a], al
mov eax, edx
shr eax, 0x18
add esp, 8
mov byte [esp + 0x2c], bl
mov byte [esp + 0x30], dl
mov byte [esp + 0x33], al
inc ebp
mov al, byte [esp + esi + 0x2c]
xor al, byte [edi]
inc esi
mov byte [ecx + edi], al
mov eax, dword [esp + 0x44]
inc edi
and esi, 7
test eax, eax
jne 0x1013b0d0
test ebp, ebp
mov ebp, dword [esp + 0x28]
je 0x1013b188
mov eax, dword [esp + 0x24]
mov byte [eax], bl
mov eax, ebx
shr eax, 8
mov byte [ebp], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp + 1], al
shr ebx, 0x18
mov byte [ebp + 2], bl
mov eax, edx
shr eax, 8
mov byte [ebp + 3], dl
mov byte [ebp + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.101aa6fb
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101aa6fb
add esp, 0x28
ret