joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1013bff0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x1035b863
mov eax, dword fs:[0]
push eax
sub esp, 0xa0
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0xb4]
mov dword fs:[0], eax
mov edi, ecx
sub esp, 0xc
xor ebx, ebx
mov esi, esp
mov dword [esp + 0x24], ebx
lea ebp, [edi + 0xc]
mov dword [esp + 0x30], esp
push ebp
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.10001120
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
sub esp, 0xc
mov esi, esp
mov ebp, 1
mov dword [esp + 0xd4], ebp
mov dword [esp + 0x34], esp
push edi
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.10001120
mov ecx, dword [edi + 8]
mov dword [esi + 8], ecx
sub esp, 0x4c
mov edx, esp
mov dword [esp + 0x84], esp
add edi, 0x18
push edx
mov byte [esp + 0x124], 2
call fcn.1013c270
lea esi, [esp + 0x8c]
mov byte [esp + 0x120], bl
call fcn.1013c390
mov dword [esp + 0xbc], 3
mov esi, dword [esp + 0xc4]
push esi
mov ecx, eax
call fcn.1013c2e0
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x1c], ebp
mov byte [esp + 0xc0], bl
call fcn.1013bf50
mov eax, esi
mov ecx, dword [esp + 0xb4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xac
ret 4

Function at 0x1013c0f0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x1035b7f3
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0xb0]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xc4]
mov esi, dword [esp + 0xc0]
sub esp, 0xc
xor ebx, ebx
mov edi, esp
mov dword [esp + 0x24], ebx
add esi, 0xc
mov dword [esp + 0x30], esp
push esi
mov ecx, edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.10001120
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
sub esp, 0xc
mov edi, esp
mov dword [esp + 0xd0], 1
mov dword [esp + 0x34], esp
push esi
mov ecx, edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
call fcn.10001120
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov edi, dword [esp + 0xd8]
sub esp, 0x4c
mov edx, esp
mov dword [esp + 0x84], esp
add edi, 0x18
push edx
mov byte [esp + 0x120], 2
call fcn.1013c270
lea esi, [esp + 0x8c]
mov byte [esp + 0x11c], bl
call fcn.1013c390
push ebp
mov ecx, eax
mov dword [esp + 0xbc], 3
call fcn.1013c2e0
mov eax, esi
push eax
mov dword [esp + 0x1c], 1
mov byte [esp + 0xbc], bl
call fcn.1013bf50
mov eax, ebp
mov ecx, dword [esp + 0xb0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa8
ret 8
Function at 0x1013d2b0
Capabilities:
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x1035b1b8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov edi, ecx
sub esp, 0xc
mov esi, esp
mov dword [esp + 0x50], 1
lea eax, [esp + 0x64]
mov dword [esp + 0x20], esp
xor ebx, ebx
push eax
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.10001120
mov ecx, dword [esp + 0x6c]
mov dword [esi + 8], ecx
sub esp, 0xc
mov esi, esp
mov byte [esp + 0x5c], 2
lea edx, [esp + 0x64]
mov dword [esp + 0x30], esp
push edx
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.10001120
mov eax, dword [esp + 0x6c]
mov dword [esi + 8], eax
lea ecx, [esp + 0x48]
push ecx
mov ecx, edi
mov byte [esp + 0x60], 3
call fcn.10016b40
mov ebp, eax
sub esp, 0xc
mov esi, esp
mov byte [esp + 0x68], 4
mov dword [esp + 0x40], esp
push ebp
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.10001120
mov edx, dword [ebp + 8]
mov dword [esi + 8], edx
lea eax, [esp + 0x48]
push eax
mov ecx, edi
mov byte [esp + 0x6c], 5
call fcn.10016b00
mov ebp, eax
sub esp, 0xc
mov esi, esp
mov byte [esp + 0x74], 6
mov dword [esp + 0x50], esp
push ebp
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 4], ebx
call fcn.10001120
mov ecx, dword [ebp + 8]
mov dword [esi + 8], ecx
mov byte [esp + 0x74], 8
call fcn.1001cb50
lea ecx, [esp + 0x24]
mov esi, eax
mov byte [esp + 0x44], 7
call fcn.100011a0
lea ecx, [esp + 0x30]
mov byte [esp + 0x44], 1
call fcn.100011a0
lea ecx, [esp + 0x4c]
mov byte [esp + 0x44], bl
call fcn.100011a0
mov dword [esp + 0x44], 0xffffffff
lea ecx, [esp + 0x58]
call fcn.100011a0
mov eax, esi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 0x18
Function at 0x1013d510
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1035f6d0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x10480b90]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 4]
or ecx, 0xffffffff
add dword [esi + 0xc], ecx
xor edx, edx
mov word [eax], dx
mov eax, dword [esi + 0xc]
cmp dword [esi + 8], eax
ja 0x1013d6ad
mov al, byte [eax]
cmp al, 0x30
jl 0x1013d6ad
cmp al, 0x3a
jge 0x1013d6ad
mov edx, dword [esi + 4]
cbw
sub ax, 0x30
mov word [edx], ax
add dword [esi + 0xc], ecx
lea ecx, [esp + 0x1c]
call fcn.100017d0
mov dword [esp + 0x50], 0
call fcn.1024ae40
mov ecx, eax
lea edx, [esp + 0x1c]
call fcn.10009a10
test al, al
je 0x1013d5bb
call fcn.1013d780
lea ecx, [esp + 0x1c]
mov bl, al
call fcn.10001850
mov al, bl
jmp 0x1013d6af
lea eax, [esp + 0x1c]
push eax
call fcn.10006e20
add esp, 4
lea ecx, [esp + 0x24]
mov edi, eax
push ecx
mov ecx, edi
call fcn.100062c0
mov byte [esp + 0x50], 1
mov eax, dword [esp + 0x3c]
mov ebp, eax
test eax, eax
je 0x1013d6ce
push 0
lea ecx, [esp + 0x28]
call fcn.100037d0
cmp byte [eax], 0
jle 0x1013d6ce
mov edx, dword [edi]
mov eax, dword [edx + 8]
mov ecx, edi
mov byte [esp + 0x1b], 0
call eax
push 0
lea ecx, [esp + 0x28]
mov byte [esp + 0x27], al
call fcn.100037d0
mov bl, byte [eax]
mov ecx, dword [esi + 0xc]
dec bl
cmp ecx, dword [esi + 8]
jb 0x1013d67b
test bl, bl
je 0x1013d639
mov eax, esi
call fcn.1013d6f0
test al, al
je 0x1013d696
dec bl
jmp 0x1013d670
mov eax, dword [esi + 0xc]
mov dl, byte [esp + 0x23]
cmp byte [eax], dl
jne 0x1013d6ce
cmp dword [esi + 8], eax
je 0x1013d696
mov al, byte [esp + 0x1b]
movzx edx, al
lea ecx, [ebp - 1]
cmp edx, ecx
jae 0x1013d661
inc al
mov byte [esp + 0x1b], al
movzx eax, al
push eax
lea ecx, [esp + 0x28]
call fcn.100037d0
mov bl, byte [eax]
dec dword [esi + 0xc]
mov ecx, dword [esi + 0xc]
cmp ecx, dword [esi + 8]
jae 0x1013d626
lea ecx, [esp + 0x24]
mov byte [esp + 0x50], 0
call fcn.10046860
lea ecx, [esp + 0x1c]
call fcn.10001850
mov al, 1
jmp 0x1013d6af
lea ecx, [esp + 0x24]
mov byte [esp + 0x50], 0
call fcn.10046860
lea ecx, [esp + 0x1c]
call fcn.10001850
xor al, al
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.1026af30
add esp, 0x40
ret
call fcn.1013d780
lea ecx, [esp + 0x24]
mov bl, al
mov byte [esp + 0x50], 0
call fcn.10046860
lea ecx, [esp + 0x1c]
call fcn.10001850
mov al, bl
jmp 0x1013d6af
Function at 0x1014d490
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10364a50
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
call fcn.1024ae80
mov dword [esp + 0xc], eax
call fcn.1024adc0
push 0
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.1024b380
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
jae 0x1014d4e1
inc eax
mov dword [esi + 4], eax
lea ecx, [esp + 0x10]
call fcn.1024b3c0
lea edx, [esp + 0xc]
lea ecx, [esp + 0x18]
mov dword [esp + 0x28], 8
call fcn.1014d1c0
push eax
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x30], 9
call fcn.1024cb10
add esp, 8
lea ecx, [esp + 0x14]
call fcn.10001850
lea ecx, [esp + 0x18]
call fcn.10001850
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.10001850
push 2
call fcn.1005ce50
add esp, 4
call fcn.1014d420
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1014ea50
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x10364881
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push edi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0x38]
xor ebx, ebx
mov dword [esp + 0x14], ebx
lea eax, [esi + 0x10]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], eax
mov byte [esp + 0x1c], bl
call fcn.100b4a90
lea ecx, [esi + 4]
mov dword [esp + 0x30], 1
mov eax, dword [ecx]
and eax, 0xfffffffe
mov edx, ecx
je 0x1014eacc
lea esp, [esp]
cmp dword [eax + 0xc], ebp
jge 0x1014eaba
mov eax, dword [eax + 8]
jmp 0x1014eabf
mov edx, eax
mov eax, dword [eax + 4]
cmp eax, ebx
jne 0x1014eab0
cmp edx, ecx
je 0x1014eacc
cmp ebp, dword [edx + 0xc]
jge 0x1014eace
mov edx, ecx
cmp edx, ecx
je 0x1014eb07
push ecx
mov ecx, esp
mov dword [ecx], ebx
lea ecx, [esp + 0x24]
push ecx
lea eax, [esp + 0x44]
push esi
call fcn.100b71a0
mov eax, dword [esp + 0x20]
mov edx, dword [eax + 0x10]
mov dword [edi], edx
mov eax, dword [eax + 0x14]
mov dword [edi + 4], eax
cmp eax, ebx
je 0x1014eb05
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
jmp 0x1014eb0c
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov byte [esp + 0x30], bl
mov dword [esp + 0x14], 1
cmp byte [esp + 0x1c], bl
je 0x1014eb50
mov ecx, dword [esp + 0x18]
mov edx, ecx
mov eax, closesocket
lock xadd dword [edx], eax
test eax, 0x40000000
jne 0x1014eb50
cmp eax, 0x80000000
jle 0x1014eb50
mov eax, ecx
lock bts dword [eax], 0x1e
jb 0x1014eb50
call fcn.1005b950
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x24
ret 8
Function at 0x1017f770
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1035ccf1
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov edi, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], 0
mov eax, dword [eax]
lea esi, [esp + 0x10]
call fcn.10180010
mov esi, eax
mov dword [esp + 0x24], 1
push esi
mov ecx, edi
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.10001120
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 1
mov byte [esp + 0x24], 0
call fcn.100011a0
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret

Function at 0x10183090
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x1035cc08
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov eax, ecx
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ecx
mov byte [eax + 0x20], cl
mov dword [eax + 0x24], ecx
mov dword [eax + 0x28], ecx
mov dword [eax + 0x2c], ecx
mov byte [eax + 0x30], 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x14
ret 4

Function at 0x101832a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1035b638
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
push str.vector_T__too_long
lea ecx, [esp + 0xc]
call fcn.10003660
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x64], 0
call fcn.10009860
push 0x10457924
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], vtable.std::length_error.0
call fcn.102762c0
int3
Function at 0x101837a0
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x1035b5d9
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x10480b90]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov dword [esi], eax
mov dword [esi + 4], ecx
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x20], ecx
mov dword [esi + 0xc], eax
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x10], edx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], edx
mov eax, dword [edx]
mov eax, dword [eax + 0x14]
mov dword [esi + 0x28], eax
lea eax, [esi + 0x44]
mov byte [esi + 0x3f], cl
mov dword [esi + 0x40], eax
lea edi, [esi + 0x40]
mov dword [eax], edi
mov dword [eax + 4], ecx
mov dword [eax + 8], 0xffffffff
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], ecx
mov dword [esi + 0x60], ecx
mov dword [esi + 0x68], ecx
mov dword [esi + 0x6c], ecx
mov dword [esi + 0x70], ecx
mov byte [esp + 0x20], 3
mov dword [esi + 0x84], ecx
mov ecx, dword [esp + 0x38]
push ecx
push edx
mov ecx, esi
call fcn.10314600
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x18
ret 0x18
Function at 0x10189d70
Capabilities:
Hash data using sha224

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0xc1059ed8
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0x367cd507
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x3070dd17
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xf70e5939
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0xffc00b31
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0x68581511
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0x64f98fa7
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1c], 0xbefa4fa4
mov edx, dword [ebp + 8]
mov dword [edx + 0x20], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x68], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x6c], 0x1c
mov eax, 1
pop ebp
ret

Function at 0x10189e00
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x6a09e667
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0xbb67ae85
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0x3c6ef372
mov eax, dword [ebp + 8]
mov dword [eax + 0xc], 0xa54ff53a
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0x510e527f
mov edx, dword [ebp + 8]
mov dword [edx + 0x14], 0x9b05688c
mov eax, dword [ebp + 8]
mov dword [eax + 0x18], 0x1f83d9ab
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x1c], 0x5be0cd19
mov edx, dword [ebp + 8]
mov dword [edx + 0x20], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x68], 0
mov edx, dword [ebp + 8]
mov dword [edx + 0x6c], 0x20
mov eax, 1
pop ebp
ret
Function at 0x1018d390
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, 4
call fcn.102779c0
lea eax, [esp]
push 0x1018d350
push eax
call fcn.101914d0
add esp, 8
test eax, eax
je 0x1018d3f0
call fcn.101913d0
mov dword [0x1049163c], eax
test eax, eax
je 0x1018d3d3
push 0x1018d210
call fcn.1026bb70
add esp, 4
test eax, eax
je 0x1018d3f4
mov eax, dword [0x1049163c]
push eax
call fcn.10191450
lea ecx, [esp + 4]
push ecx
mov dword [0x1049163c], 0
call fcn.10191540
add esp, 8
xor eax, eax
pop ecx
ret
call fcn.101bd9d0
mov edx, dword [esp]
mov eax, 1
mov dword [0x1047f180], edx
mov dword [0x10491644], eax
pop ecx
ret
Function at 0x10190340
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push ebx
push eax
push ecx
call fcn.1018fe10
add esp, 0xc
test eax, eax
jl 0x10190588
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
push edi
test edx, edx
jle 0x101903bd
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea ebx, [ebx]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x10190380
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x10190584
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x103a3bf0]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x103a3bf0]
and esi, 0xff
mov esi, dword [esi*4 + 0x103a47f0]
and edi, 0xff
xor esi, dword [edi*4 + 0x103a4ff0]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x103a3bf0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x103a53f0]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x103a3bf0]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x103a4bf0]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x103a3bf0]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x103a3bf0]
and esi, 0xff
mov esi, dword [esi*4 + 0x103a47f0]
and edi, 0xff
xor esi, dword [edi*4 + 0x103a4ff0]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x103a3bf0]
and edi, 0xff
xor esi, dword [edi*4 + 0x103a4bf0]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x103a3bf0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x103a53f0]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x103a3bf0]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x103a3bf0]
and esi, 0xff
mov esi, dword [esi*4 + 0x103a47f0]
and edi, 0xff
xor esi, dword [edi*4 + 0x103a4ff0]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x103a3bf0]
and edi, 0xff
xor esi, dword [edi*4 + 0x103a4bf0]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x103a3bf0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x103a53f0]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x103a3bf0]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x103a3bf0]
and esi, 0xff
mov esi, dword [esi*4 + 0x103a47f0]
and edi, 0xff
xor esi, dword [edi*4 + 0x103a4ff0]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x103a3bf0]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x103a3bf0]
and edi, 0xff
xor esi, dword [edi*4 + 0x103a4bf0]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x103a53f0]
inc edx
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x101903d1
pop edi
xor eax, eax
pop esi
pop ebx
ret
Function at 0x101914f0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
ret

Function at 0x10196d15
Capabilities:
Allocate thread local storage

Disassembly:
push 0
push 0
push 0
call fcn.1018d570
add esp, 0xc
test eax, eax
jne 0x10196d15
xor eax, eax
ret
push 0
push 0x10492c20
call fcn.101914d0
add esp, 8
test eax, eax
je 0x10196d12
push ebx
push 0
push 0x10492c24
call fcn.101914d0
add esp, 8
test eax, eax
je 0x10196da2
mov eax, dword [0x10492c30]
mov ecx, dword [0x1047f650]
push esi
push eax
push ecx
xor ecx, ecx
lea ebx, [ecx + 1]
call fcn.10196b50
mov esi, eax
add esp, 8
test esi, esi
je 0x10196d8a
push esi
call fcn.101969e0
add esp, 4
test eax, eax
jne 0x10196d77
push esi
call fcn.10196150
add esp, 4
xor esi, esi
jmp 0x10196d8a
push 0x1c
push str.OpenSSL_NIST_SP_800_90A_DRBG
push esi
mov dword [esi + 0x58], ebx
call fcn.101961d0
add esp, 0xc
mov dword [0x10492c28], esi
test esi, esi
pop esi
jne 0x10196db3
push 0x10492c24
call fcn.10191540
add esp, 4
push 0x10492c20
call fcn.10191540
add esp, 4
xor eax, eax
pop ebx
ret
mov eax, ebx
pop ebx
ret
Function at 0x1019a110
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x208
call fcn.102779c0
mov eax, dword [0x10480b90]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x1019a185
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x1019a185
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x204]
push 0x200
push edx
call fcn.10278dd0
add esp, 0x10
test eax, eax
jge 0x1019a168
mov eax, 0x200
push 0
lea ecx, [ebp - 0x208]
push ecx
push eax
lea edx, [ebp - 0x204]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1019a2ce
mov ebx, dword [ebp + 8]
mov eax, ebx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1019a190
sub eax, edx
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.10278620
mov esi, esp
test esi, esi
jne 0x1019a1b4
mov esi, str.no_stack_
jmp 0x1019a23f
push edi
push esi
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x1019a1e1
test edi, edi
jbe 0x1019a1e1
lea ebx, [ebx]
mov ecx, dword [ebp + 8]
movsx dx, byte [eax + ecx]
mov word [esi + eax*2], dx
inc eax
cmp eax, edi
jb 0x1019a1d0
xor eax, eax
test edi, edi
jbe 0x1019a23f
cmp word [esi + eax*2], 0x25
jne case.0x1019a204.43
lea ecx, [esi + eax*2 + 2]
movzx edx, word [ecx]
add edx, 0xffffffd6
cmp edx, 0x49
ja case.0x1019a204.43
movzx edx, byte [edx + 0x1019a300]
jmp dword [edx*4 + 0x1019a2e8]
inc eax
add ecx, 2
jmp 0x1019a1f2
mov ecx, 0x53
mov word [esi + eax*2 + 2], cx
jmp case.0x1019a204.43
mov edx, 0x73
jmp 0x1019a235
mov ecx, 0x43
mov word [esi + eax*2 + 2], cx
jmp case.0x1019a204.43
mov edx, 0x63
mov word [esi + eax*2 + 2], dx
inc eax
cmp eax, edi
jb 0x1019a1e7
lea eax, [ebp + 0xc]
push eax
push esi
lea ecx, [ebp - 0x204]
push 0xff
push ecx
call fcn.10278c00
xor edx, edx
add esp, 0x10
mov word [ebp - 6], dx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1019a2b8
call fcn.10199fd0
test eax, eax
jle 0x1019a2b8
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x1019a2ce
push 0
lea ecx, [ebp - 0x208]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x204]
push esi
mov dword [ebp - 0x208], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x1019a2ce
push 0x10
push str.OpenSSL:_FATAL
lea edx, [ebp - 0x204]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1026af30
mov esp, ebp
pop ebp
ret
Function at 0x1019aa60
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x1019aaa7
mov al, byte [edx]
test al, al
je 0x1019aaa7
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
inc edx
xor esi, ecx
test al, al
jne 0x1019aa77
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x1019aab0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
xor edi, edi
test esi, esi
je 0x1019ab0a
mov al, byte [esi]
test al, al
je 0x1019ab0a
push ebx
mov ebx, 0x100
jmp 0x1019aad0
movsx eax, al
push eax
call fcn.101bab00
or eax, ebx
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add esp, 4
rol edi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [esi + 1]
inc esi
xor edi, ecx
add ebx, 0x100
test al, al
jne 0x1019aad0
mov eax, edi
shr eax, 0x10
pop ebx
xor eax, edi
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret