joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100e4090
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
push ebx
call fcn.10121840
push 0x62
push esi
mov edi, eax
mov ebp, 1
call fcn.101b5310
add esp, 0x10
test eax, eax
jne 0x100e40bc
lea ebp, [eax + 0x11]
test edi, edi
jne 0x100e4145
push 0x45
push str.crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.100dc5a0
push 0x101f947c
push esi
push 0x10207220
push ebx
push str.fopen_
push 5
call fcn.100dcb20
add esp, 0x2c
call fcn.101b707f
cmp dword [eax], 2
je 0x100e4126
call fcn.101b707f
cmp dword [eax], 6
je 0x100e4126
push 0x4e
push str.crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.100dc5a0
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x4c
push str.crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.100dc5a0
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x102071c4
call fcn.100d0930
mov esi, eax
add esp, 4
test esi, esi
jne 0x100e4168
push edi
call fcn.101b65ea
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.100d0b10
push edi
push ebp
push 0x6a
push esi
call fcn.100d10c0
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
Function at 0x100e6a20
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x5c
push 0
push esi
call fcn.101b5c80
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov eax, 1
pop esi
ret
Function at 0x100e7ca0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
xor ebx, ebx
test ebp, ebp
je 0x100e7d19
mov al, byte [ebp]
test al, al
je 0x100e7d19
push esi
mov dword [esp + 0x10], 0x100
push edi
lea ecx, [ecx]
movsx eax, al
push eax
call fcn.1010baf0
mov esi, eax
or esi, dword [esp + 0x18]
mov ecx, 0x20
mov edi, esi
shr edi, 2
xor edi, esi
and edi, 0xf
add esp, 4
sub ecx, edi
mov eax, ebx
xor edx, edx
call fcn.101baec0
add dword [esp + 0x14], 0x100
mov ecx, edi
shl ebx, cl
mov ecx, esi
imul ecx, esi
or eax, ebx
xor eax, ecx
add ebp, 1
mov ebx, eax
mov al, byte [ebp]
test al, al
jne 0x100e7cc0
pop edi
mov eax, ebx
pop esi
shr eax, 0x10
pop ebp
xor eax, ebx
pop ebx
ret
pop ebp
xor eax, eax
pop ebx
ret

Function at 0x100e98a0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
ret

Function at 0x100ea0d0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov edx, dword [edi + 0x20]
push 0
push eax
push ecx
push edx
call dword [sym.imp.WS2_32.dll_send]
push 0xf
push edi
mov esi, eax
call fcn.100d0b10
add esp, 8
test esi, esi
jg 0x100ea12e
je 0x100ea10c
cmp esi, 0xffffffff
jne 0x100ea12e
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 4
je 0x100ea123
cmp eax, 0xb
je 0x100ea123
cmp eax, 0x2733
jne 0x100ea12e
push 0xa
push edi
call fcn.100d0b30
add esp, 8
pop edi
mov eax, esi
pop esi
ret
Function at 0x100f3020
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov edi, dword [eax + 0x60]
mov eax, dword [edi + 0x70]
test eax, eax
je 0x100f308f
test ebp, ebp
je 0x100f306b
lea esp, [esp]
cmp eax, 0x40
jae 0x100f306b
mov dl, byte [eax + edi + 0x30]
mov ecx, dword [esp + 0x18]
xor dl, byte [ecx]
mov esi, dword [esp + 0x14]
mov byte [esi], dl
add esi, 1
add ecx, 1
add eax, 1
sub ebp, 1
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], ecx
jne 0x100f3040
test ebp, ebp
mov dword [edi + 0x70], eax
je 0x100f3137
cmp eax, 0x40
jne 0x100f308f
mov eax, 1
add dword [edi + 0x20], eax
mov dword [edi + 0x70], 0
jne 0x100f308f
add dword [edi + 0x24], eax
mov eax, ebp
and eax, 0x3f
sub ebp, eax
cmp ebp, 0x40
push ebx
mov ebx, dword [edi + 0x20]
mov dword [esp + 0x14], eax
jb 0x100f30eb
mov esi, ebp
shr esi, 6
add ebx, esi
cmp ebx, esi
jae 0x100f30b2
sub esi, ebx
xor ebx, ebx
mov ecx, dword [esp + 0x18]
lea eax, [edi + 0x20]
push eax
mov eax, dword [esp + 0x20]
push edi
shl esi, 6
push esi
push eax
push ecx
call fcn.10131570
add dword [esp + 0x30], esi
add dword [esp + 0x2c], esi
add esp, 0x14
sub ebp, esi
test ebx, ebx
mov dword [edi + 0x20], ebx
jne 0x100f30e2
add dword [edi + 0x24], 1
cmp ebp, 0x40
jae 0x100f30a3
mov eax, dword [esp + 0x14]
test eax, eax
je 0x100f3136
push 0x40
lea esi, [edi + 0x30]
push 0
push esi
call fcn.101b5c80
lea eax, [edi + 0x20]
push eax
push edi
push 0x40
push esi
push esi
call fcn.10131570
mov ebp, dword [esp + 0x34]
add esp, 0x20
xor eax, eax
test ebp, ebp
jbe 0x100f3133
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub edx, ecx
mov bl, byte [edx + ecx]
xor bl, byte [esi + eax]
add eax, 1
mov byte [ecx], bl
add ecx, 1
cmp eax, ebp
jb 0x100f3121
mov dword [edi + 0x70], ebp
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
ret
Function at 0x10100890
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x208
call fcn.101b79b0
mov eax, dword [0x1027e110]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x10100905
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x10100905
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x204]
push 0x200
push edx
call fcn.101bb8e1
add esp, 0x10
test eax, eax
jge 0x101008e8
mov eax, 0x200
push 0
lea ecx, [ebp - 0x208]
push ecx
push eax
lea edx, [ebp - 0x204]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x10100a57
mov ebx, dword [ebp + 8]
mov eax, ebx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x10100910
sub eax, edx
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.101bb6b0
mov esi, esp
test esi, esi
jne 0x10100936
mov esi, str.no_stack_
jmp 0x101009c8
push edi
push esi
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x10100963
test edi, edi
jbe 0x10100963
lea esp, [esp]
mov ecx, dword [ebp + 8]
movsx dx, byte [eax + ecx]
mov word [esi + eax*2], dx
add eax, 1
cmp eax, edi
jb 0x10100950
xor eax, eax
test edi, edi
jbe 0x101009c8
lea ebx, [eax + 0x63]
lea esp, [esp]
cmp word [esi + eax*2], 0x25
jne case.0x10100992.43
lea ecx, [esi + eax*2 + 2]
jmp 0x10100980
movzx edx, word [ecx]
add edx, 0xffffffd6
cmp edx, 0x49
ja case.0x10100992.43
movzx edx, byte [edx + 0x10100a88]
jmp dword [edx*4 + 0x10100a70]
add eax, 1
add ecx, 2
jmp 0x10100980
mov word [esi + eax*2 + 2], 0x53
jmp case.0x10100992.43
mov word [esi + eax*2 + 2], 0x73
jmp case.0x10100992.43
mov word [esi + eax*2 + 2], 0x43
jmp case.0x10100992.43
mov word [esi + eax*2 + 2], bx
add eax, 1
cmp eax, edi
jb 0x10100970
lea eax, [ebp + 0xc]
push eax
push esi
lea ecx, [ebp - 0x204]
push 0xff
push ecx
call fcn.101bb811
add esp, 0x10
mov word [ebp - 6], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x10100a41
call fcn.10100750
test eax, eax
jle 0x10100a41
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x10100a57
push 0
lea eax, [ebp - 0x208]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [ebp - 0x204]
push esi
mov dword [ebp - 0x208], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x10100a57
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [ebp - 0x204]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101b40e2
mov esp, ebp
pop ebp
ret
Function at 0x10100b10
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x10100b3a
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
sub esi, eax
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
or cl, dl
add eax, 1
sub edi, 1
jne 0x10100b27
pop esi
pop ebx
movzx eax, cl
pop edi
ret
Function at 0x10101390
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x134
call fcn.101b79b0
mov eax, dword [0x1027e110]
xor eax, esp
mov dword [esp + 0x130], eax
mov eax, dword [esp + 0x148]
push ebx
mov ebx, dword [esp + 0x140]
push ebp
mov ebp, dword [esp + 0x148]
push esi
mov esi, dword [esp + 0x150]
mov dword [esp + 0x14], eax
xor eax, eax
cmp esi, eax
push edi
mov edi, dword [esp + 0x148]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
je 0x101013f5
cmp esi, dword [edi]
je 0x101013f1
cmp ebx, eax
je 0x1010146e
cmp ebp, eax
jl 0x1010146e
mov dword [edi], esi
jmp 0x101013fb
mov esi, dword [edi]
cmp esi, eax
je 0x1010146e
push esi
call fcn.100d5030
add esp, 4
test al, 2
jne 0x1010146e
test ebx, ebx
je 0x10101579
push esi
mov dword [esp + 0x14], 1
call fcn.100eb3b0
add esp, 4
cmp eax, 0x90
jg 0x1010146e
cmp eax, ebp
jge 0x10101489
mov ecx, dword [esp + 0x18]
mov edx, dword [edi + 4]
push ecx
push esi
push edx
call fcn.100e32f0
add esp, 0xc
test eax, eax
je 0x1010146e
mov eax, dword [edi + 4]
push ebp
push ebx
push eax
call fcn.100e3480
add esp, 0xc
test eax, eax
je 0x1010146e
mov eax, dword [edi + 4]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
call fcn.100e34a0
add esp, 0xc
test eax, eax
jne 0x101014a8
xor eax, eax
mov ecx, dword [esp + 0x140]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101b40e2
add esp, 0x134
ret
cmp ebp, 0x90
ja 0x1010146e
push ebp
lea ecx, [esp + 0x24]
push ebx
push ecx
call fcn.101b4f90
mov eax, ebp
add esp, 0xc
mov dword [esp + 0x1c], eax
jmp 0x101014ac
mov eax, dword [esp + 0x1c]
cmp eax, 0x90
je 0x101014ca
mov edx, 0x90
sub edx, eax
push edx
lea eax, [esp + eax + 0x24]
push 0
push eax
call fcn.101b5c80
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x20]
xor cl, 0x36
mov byte [esp + eax + 0xb0], cl
add eax, 1
cmp eax, 0x90
jl 0x101014d0
mov ebx, dword [esp + 0x18]
mov edx, dword [edi + 8]
push ebx
push esi
push edx
call fcn.100e32f0
add esp, 0xc
test eax, eax
je 0x1010159c
push esi
call fcn.100eb3b0
mov ecx, dword [edi + 8]
push eax
lea eax, [esp + 0xb8]
push eax
push ecx
call fcn.100e3480
add esp, 0x10
test eax, eax
je 0x1010159c
xor eax, eax
jmp 0x10101530
mov dl, byte [esp + eax + 0x20]
xor dl, 0x5c
mov byte [esp + eax + 0xb0], dl
add eax, 1
cmp eax, 0x90
jl 0x10101530
mov eax, dword [edi + 0xc]
push ebx
push esi
push eax
call fcn.100e32f0
add esp, 0xc
test eax, eax
je 0x1010159c
push esi
call fcn.100eb3b0
mov edx, dword [edi + 0xc]
push eax
lea ecx, [esp + 0xb8]
push ecx
push edx
call fcn.100e3480
add esp, 0x10
test eax, eax
je 0x1010159c
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
call fcn.100e35b0
add esp, 8
test eax, eax
je 0x10101595
mov dword [esp + 0x14], 1
cmp dword [esp + 0x10], 0
je 0x101015c0
lea edx, [esp + 0x20]
push 0x90
push edx
call fcn.100f9f20
lea eax, [esp + 0xb8]
push 0x90
push eax
call fcn.100f9f20
add esp, 0x10
mov eax, dword [esp + 0x14]
jmp 0x10101470
Function at 0x10107610
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0xcbbb9d5d
mov dword [eax + 8], 0x367cd507
mov dword [eax + 0xc], 0x629a292a
mov dword [eax + 0x10], 0x3070dd17
mov dword [eax + 0x14], 0x9159015a
mov dword [eax + 0x18], 0xf70e5939
mov dword [eax + 0x1c], 0x152fecd8
mov dword [eax + 0x20], 0xffc00b31
mov dword [eax + 0x24], 0x67332667
mov dword [eax + 0x28], 0x68581511
mov dword [eax + 0x2c], 0x8eb44a87
mov dword [eax + 0x30], 0x64f98fa7
mov dword [eax + 0x34], 0xdb0c2e0d
mov dword [eax + 0x38], 0xbefa4fa4
mov dword [eax + 0x3c], 0x47b5481d
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x30
lea eax, [ecx + 1]
ret

Function at 0x101076b0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x10108830
Capabilities:
Hash data using sha224

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.101b5c80
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
mov eax, 1
pop esi
ret

Function at 0x10108890
Capabilities:
Hash data using sha256

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call fcn.101b5c80
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
mov eax, 1
pop esi
ret
Function at 0x10109e80
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call fcn.101b5c80
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
mov eax, 1
pop esi
ret

Function at 0x1010ecc0
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x84], 0xffffffff
jne 0x1010ecd2
xor eax, eax
pop edi
ret
mov eax, dword [edi]
push ebx
push esi
push eax
call fcn.100e90e0
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add esp, 4
test ebx, ebx
mov esi, eax
mov dword [ecx], esi
je 0x1010ed85
mov eax, dword [edi + 0x84]
cmp eax, esi
push ebp
jne 0x1010ed24
test esi, esi
jle 0x1010ed62
mov ecx, ebx
lea eax, [edi + 4]
mov ebp, esi
lea esp, [esp]
mov dl, byte [eax + 0x60]
xor dl, byte [eax]
add eax, 1
mov byte [ecx], dl
add ecx, 1
sub ebp, 1
jne 0x1010ed10
jmp 0x1010ed62
mov ecx, esi
sub ecx, eax
cmp ecx, 1
mov byte [eax + edi + 0x64], 0x80
jle 0x1010ed45
add ecx, 0xffffffff
push ecx
lea eax, [eax + edi + 0x65]
push 0
push eax
call fcn.101b5c80
add esp, 0xc
test esi, esi
jle 0x1010ed62
mov ecx, ebx
lea eax, [edi + 0x24]
mov ebp, esi
mov dl, byte [eax + 0x40]
xor dl, byte [eax]
add eax, 1
mov byte [ecx], dl
add ecx, 1
sub ebp, 1
jne 0x1010ed50
mov eax, dword [edi]
push esi
push ebx
push ebx
push eax
call fcn.100e90f0
add esp, 0x10
test eax, eax
pop ebp
jne 0x1010ed85
push esi
push ebx
call fcn.100f9f20
add esp, 8
pop esi
pop ebx
xor eax, eax
pop edi
ret
pop esi
pop ebx
mov eax, 1
pop edi
ret

Function at 0x10112760
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
movzx edi, byte [esp + 0x10]
mov eax, edi
and eax, 1
add esi, ecx
add edx, ecx
test ecx, ecx
je 0x1011279b
push ebx
lea esp, [esp]
movzx ebx, byte [edx - 1]
sub edx, 1
xor ebx, edi
add eax, ebx
sub esi, 1
sub ecx, 1
mov byte [esi], al
shr eax, 8
test ecx, ecx
jne 0x10112780
pop ebx
pop edi
pop esi
ret
Function at 0x1011a310
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.101b79b0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
xor edi, edi
call fcn.100d9bf0
mov ebx, eax
push ebx
push esi
call fcn.100d9d50
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x1011a39c
push 0xf0000040
push 1
push edi
push edi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1011a376
mov ecx, dword [esp + 0x10]
push ebp
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1011a369
mov edi, ebx
mov edx, dword [esp + 0x10]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.100d9dc0
push esi
call fcn.100d9ab0
mov edi, eax
add esp, 0x10
test edi, edi
jbe 0x1011a39c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 1
push esi
call fcn.100d9bf0
mov ebx, eax
push ebx
push esi
call fcn.100d9d50
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x1011a40e
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
push edi
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1011a3f4
mov edx, dword [esp + 0x10]
push ebp
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1011a3e7
mov edi, ebx
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea ecx, [edi*8]
push ecx
push edi
push esi
call fcn.100d9dc0
push esi
call fcn.100d9ab0
add esp, 0x10
mov edi, eax
test edi, edi
ja 0x1011a394
push esi
call fcn.100d9ab0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x1011b1c0
Capabilities:
Allocate thread local storage

Disassembly:
push 0
push 0
push 0
call fcn.100f1fc0
add esp, 0xc
test eax, eax
jne 0x1011b1d5
xor eax, eax
ret
push 0
push 0x10285c10
call fcn.100e9880
add esp, 8
test eax, eax
je 0x1011b1d2
push ebx
push 0
push 0x10285c14
call fcn.100e9880
add esp, 8
test eax, eax
je 0x1011b265
mov eax, dword [0x10285c20]
mov ecx, dword [0x1027c740]
push esi
push eax
push ecx
xor ecx, ecx
lea ebx, [ecx + 1]
call fcn.1011b000
mov esi, eax
add esp, 8
test esi, esi
je 0x1011b24d
push esi
call fcn.1011ae90
add esp, 4
test eax, eax
jne 0x1011b237
push esi
call fcn.1011a5d0
add esp, 4
xor esi, esi
jmp 0x1011b24d
push 0x1c
push str.OpenSSL_NIST_SP_800_90A_DRBG
mov dword [esi + 0x58], ebx
push esi
mov dword [esi + 0x5c], ebx
call fcn.1011a650
add esp, 0xc
mov dword [0x10285c18], esi
test esi, esi
pop esi
jne 0x1011b276
push 0x10285c14
call fcn.100e98f0
add esp, 4
push 0x10285c10
call fcn.100e98f0
add esp, 4
xor eax, eax
pop ebx
ret
mov eax, ebx
pop ebx
ret
Function at 0x10129b20
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
xor eax, eax
test edx, edx
push edi
mov edi, dword [esp + 0x10]
je 0x10129b3c
test byte [edx + 0x5c], 2
mov esi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x10129b41
mov esi, 0x10228fc0
test ebp, ebp
jle 0x10129c12
push ebx
lea ebx, [ebx]
cmp ebp, 3
jl 0x10129ba6
movzx ebx, byte [edi + 2]
xor edx, edx
mov dh, byte [edi]
add ecx, 1
add ecx, 1
add ecx, 1
mov dl, byte [edi + 1]
shl edx, 8
or edx, ebx
mov ebx, edx
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx - 3], bl
mov ebx, edx
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx - 2], bl
mov ebx, edx
shr ebx, 6
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx - 1], bl
and edx, 0x3f
movzx edx, byte [edx + esi]
mov byte [ecx], dl
jmp 0x10129bf6
movzx edx, byte [edi]
shl edx, 0x10
cmp ebp, 2
jne 0x10129bb8
xor ebx, ebx
mov bh, byte [edi + 1]
or edx, ebx
mov ebx, edx
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
mov byte [ecx], bl
mov ebx, edx
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebx + esi]
add ecx, 1
mov byte [ecx], bl
add ecx, 1
cmp ebp, 1
jne 0x10129be4
lea edx, [ebp + 0x3c]
jmp 0x10129bee
shr edx, 6
and edx, 0x3f
movzx edx, byte [edx + esi]
mov byte [ecx], dl
add ecx, 1
mov byte [ecx], 0x3d
sub ebp, 3
add ecx, 1
add eax, 4
add edi, 3
test ebp, ebp
jg 0x10129b50
pop ebx
pop edi
pop esi
mov byte [ecx], 0
pop ebp
ret
pop edi
pop esi
mov byte [ecx], al
pop ebp
ret
Function at 0x10131570
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, 0x88
call fcn.101b79b0
mov eax, dword [0x1027e110]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
mov eax, dword [esp + 0xa0]
mov edx, dword [eax]
mov ecx, dword [esp + 0xa4]
mov dword [esp + 0x1c], edx
mov edx, dword [eax + 4]
mov dword [esp + 0x20], edx
mov edx, dword [eax + 8]
mov dword [esp + 0x24], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x28], edx
mov edx, dword [eax + 0x10]
mov dword [esp + 0x2c], edx
mov edx, dword [eax + 0x14]
mov dword [esp + 0x30], edx
mov edx, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
mov dword [esp + 0x34], edx
mov edx, dword [ecx]
mov dword [esp + 0x38], eax
mov eax, dword [ecx + 4]
mov ebx, dword [esp + 0x9c]
test ebx, ebx
mov ebp, dword [esp + 0x94]
mov dword [esp + 0x3c], edx
mov edx, dword [ecx + 8]
mov dword [esp + 0x40], eax
mov eax, dword [ecx + 0xc]
mov dword [esp + 8], ebp
mov dword [esp + 0xc], 0x61707865
mov dword [esp + 0x10], 0x3320646e
mov dword [esp + 0x14], 0x79622d32
mov dword [esp + 0x18], 0x6b206574
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], eax
jbe 0x10131687
push esi
push edi
mov esi, 0x40
cmp ebx, esi
jae 0x1013162d
mov esi, ebx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x58]
push edx
call fcn.101312d0
add esp, 8
xor ecx, ecx
test esi, esi
jbe 0x10131669
mov edi, dword [esp + 0xa0]
lea eax, [esp + 0x54]
mov edx, eax
sub edi, eax
sub ebp, edx
lea eax, [esp + ecx + 0x54]
mov dl, byte [edi + eax]
xor dl, byte [eax]
add ecx, 1
cmp ecx, esi
mov byte [eax + ebp], dl
jb 0x10131656
mov ebp, dword [esp + 0x10]
add dword [esp + 0xa0], esi
add dword [esp + 0x44], 1
add ebp, esi
sub ebx, esi
test ebx, ebx
mov dword [esp + 0x10], ebp
ja 0x10131622
pop edi
pop esi
mov ecx, dword [esp + 0x8c]
pop ebp
pop ebx
xor ecx, esp
call fcn.101b40e2
add esp, 0x88
ret
Function at 0x101323d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.101b79b0
mov eax, dword [esp + 0x1c]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
mov esi, dword [eax]
test esi, esi
push edi
mov edi, dword [esp + 0x28]
je 0x1013241d
test ebx, ebx
je 0x1013241d
mov cl, byte [esi + edi]
mov ebp, dword [esp + 0x18]
xor cl, byte [ebp]
mov eax, dword [esp + 0x1c]
mov byte [eax], cl
add eax, 1
add ebp, 1
add esi, 1
sub ebx, 1
and esi, 0xf
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebp
jne 0x101323f0
cmp ebx, 0x10
jb 0x1013249c
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, edx
sub eax, edi
mov dword [esp + 0x20], eax
mov eax, ebx
shr eax, 4
mov ebp, ecx
mov dword [esp + 0x10], eax
shl eax, 4
add ecx, eax
sub ebp, edi
add edx, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov edi, edi
mov edx, dword [esp + 0x24]
push edx
push edi
push edi
call dword [esp + 0x3c]
add esp, 0xc
cmp esi, 0x10
jae 0x10132488
mov ecx, 0xf
sub ecx, esi
shr ecx, 2
lea eax, [esi + edi]
add ecx, 1
mov edx, dword [esp + 0x20]
mov edx, dword [edx + eax]
xor edx, dword [eax]
add eax, 4
sub ecx, 1
mov dword [eax + ebp - 4], edx
jne 0x10132473
add dword [esp + 0x20], 0x10
sub ebx, 0x10
add ebp, 0x10
xor esi, esi
sub dword [esp + 0x10], 1
jne 0x10132450
test ebx, ebx
je 0x101324de
mov eax, dword [esp + 0x24]
push eax
push edi
push edi
call dword [esp + 0x3c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
add esp, 0xc
lea eax, [esi + edi]
sub ebp, edi
sub ecx, edi
add esi, ebx
nop
mov dl, byte [eax + ebp]
xor dl, byte [eax]
sub ebx, 1
mov byte [eax + ecx], dl
add eax, 1
test ebx, ebx
jne 0x101324c0
mov eax, dword [esp + 0x2c]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov ecx, dword [esp + 0x2c]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
pop ecx
ret