joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10137ad0
Capabilities:
Enumerate pe sections

Disassembly:
push ebx
push ebp
push esi
push edi
mov eax, dword [esp + 0x14]
movzx ecx, byte [eax]
mov edx, dword [esp + 0x18]
shl ecx, 8
mov dword [edx], ecx
movzx ecx, byte [eax + 1]
or dword [edx], ecx
movzx ecx, byte [eax + 2]
shl ecx, 8
mov dword [edx + 4], ecx
movzx ecx, byte [eax + 3]
or dword [edx + 4], ecx
movzx esi, byte [eax + 4]
shl esi, 8
mov dword [edx + 8], esi
movzx esi, byte [eax + 5]
or dword [edx + 8], esi
movzx esi, byte [eax + 6]
lea ecx, [edx + 8]
shl esi, 8
mov dword [edx + 0xc], esi
movzx esi, byte [eax + 7]
or dword [edx + 0xc], esi
movzx esi, byte [eax + 8]
shl esi, 8
mov dword [edx + 0x10], esi
movzx esi, byte [eax + 9]
or dword [edx + 0x10], esi
movzx esi, byte [eax + 0xa]
shl esi, 8
mov dword [edx + 0x14], esi
movzx esi, byte [eax + 0xb]
or dword [edx + 0x14], esi
movzx esi, byte [eax + 0xc]
shl esi, 8
mov dword [edx + 0x18], esi
movzx esi, byte [eax + 0xd]
or dword [edx + 0x18], esi
movzx esi, byte [eax + 0xe]
shl esi, 8
mov dword [edx + 0x1c], esi
movzx eax, byte [eax + 0xf]
or eax, esi
mov dword [edx + 0x1c], eax
lea eax, [edx + 0x20]
xor ebx, ebx
jmp 0x10137b70
mov esi, dword [ecx]
mov edi, dword [ecx - 4]
mov edx, esi
shr edx, 7
mov ebp, edi
shl ebp, 9
or edx, ebp
and edx, 0xffff
mov dword [eax], edx
mov edx, dword [ecx + 4]
mov ebp, edx
shr ebp, 7
shl esi, 9
or ebp, esi
and ebp, 0xffff
mov dword [eax + 4], ebp
mov esi, dword [ecx + 8]
shl edx, 9
mov ebp, esi
shr ebp, 7
or edx, ebp
and edx, 0xffff
mov dword [eax + 8], edx
mov edx, dword [ecx + 0xc]
mov ebp, edx
shr ebp, 7
shl esi, 9
or ebp, esi
and ebp, 0xffff
mov dword [eax + 0xc], ebp
mov esi, dword [ecx + 0x10]
mov ebp, esi
shr ebp, 7
shl edx, 9
or edx, ebp
and edx, 0xffff
mov dword [eax + 0x10], edx
mov edx, dword [ecx + 0x14]
mov ebp, edx
shr ebp, 7
shl esi, 9
or ebp, esi
and ebp, 0xffff
mov dword [eax + 0x14], ebp
mov esi, dword [ecx - 8]
cmp ebx, 5
jge 0x10137c33
mov ebp, esi
shl edx, 9
shr ebp, 7
shl esi, 9
shr edi, 7
or edx, ebp
or esi, edi
and edx, 0xffff
and esi, 0xffff
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], esi
inc ebx
add eax, 0x20
add ecx, 0x20
cmp ebx, 6
jl 0x10137b70
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x10138170
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 8
call fcn.1017f100
mov eax, dword [esp + 0xc]
movzx edx, byte [eax + 1]
movzx ecx, byte [eax]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 2]
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 3]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax + 4]
mov dword [esp], ecx
movzx ecx, byte [eax + 7]
push esi
movzx esi, byte [eax + 5]
movzx eax, byte [eax + 6]
shl ecx, 8
shl esi, 8
or ecx, eax
or edx, esi
shl ecx, 0x10
or ecx, edx
cmp dword [esp + 0x24], 0
mov dword [esp + 8], ecx
pop esi
je 0x101381e6
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.100f92d0
jmp 0x101381ff
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
lea edx, [esp + 0xc]
push edx
call fcn.100f93f0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov byte [eax], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 2], dl
shr ecx, 0x18
mov byte [eax + 3], cl
mov ecx, dword [esp + 0x14]
mov edx, ecx
shr edx, 8
mov byte [eax + 4], cl
mov byte [eax + 5], dl
mov edx, ecx
shr edx, 0x10
add esp, 0x10
shr ecx, 0x18
mov byte [eax + 6], dl
mov byte [eax + 7], cl
add esp, 8
ret
Function at 0x10138e30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x2c
call fcn.1017f100
mov eax, dword [0x101ec05c]
xor eax, esp
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x3c]
push ebx
mov dword [esp + 4], eax
mov eax, dword [esp + 0x48]
push ebp
mov dword [esp + 0xc], eax
push esi
mov esi, dword [eax]
push edi
mov edi, dword [esp + 0x50]
movzx edx, byte [edi + 1]
movzx ebx, byte [edi + 5]
lea eax, [edi + 1]
mov dword [esp + 0x28], ecx
movzx ecx, byte [edi]
shl edx, 8
or ecx, edx
movzx edx, byte [eax + 1]
shl edx, 0x10
or ecx, edx
movzx edx, byte [eax + 2]
mov ebp, dword [esp + 0x48]
shl edx, 0x18
or ecx, edx
movzx edx, byte [eax + 3]
shl ebx, 8
or edx, ebx
movzx ebx, byte [eax + 6]
mov dword [esp + 0x2c], eax
movzx eax, byte [eax + 5]
shl ebx, 8
or ebx, eax
mov eax, ecx
shr eax, 8
shl ebx, 0x10
or edx, ebx
mov byte [esp + 0x31], al
mov eax, ecx
mov ebx, ecx
mov byte [esp + 0x30], cl
shr eax, 0x10
shr ecx, 0x18
mov byte [esp + 0x32], al
mov byte [esp + 0x33], cl
mov ecx, edx
mov eax, edx
mov dword [esp + 0x24], edx
mov byte [esp + 0x34], dl
shr ecx, 8
shr eax, 0x10
shr edx, 0x18
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], ebx
mov byte [esp + 0x35], cl
mov byte [esp + 0x36], al
mov byte [esp + 0x37], dl
test ebp, ebp
je 0x10139004
mov eax, dword [esp + 0x10]
mov ebp, dword [esp + 0x40]
sub eax, ebp
mov dword [esp + 0x10], eax
dec dword [esp + 0x18]
test esi, esi
jne 0x10138f7d
mov ecx, dword [esp + 0x28]
push 1
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.100f8d30
mov ebx, dword [esp + 0x2c]
mov eax, ebx
shr eax, 8
mov byte [esp + 0x3d], al
mov eax, dword [esp + 0x30]
mov ecx, ebx
shr ecx, 0x10
mov edx, ebx
shr edx, 0x18
mov byte [esp + 0x3e], cl
mov byte [esp + 0x3f], dl
mov ecx, eax
mov edx, eax
mov byte [esp + 0x40], al
shr eax, 0x18
shr ecx, 8
shr edx, 0x10
add esp, 0xc
inc dword [esp + 0x1c]
mov byte [esp + 0x37], al
mov eax, dword [esp + 0x10]
mov byte [esp + 0x30], bl
mov byte [esp + 0x35], cl
mov byte [esp + 0x36], dl
mov cl, byte [esp + esi + 0x30]
xor cl, byte [ebp]
inc esi
mov byte [eax + ebp], cl
inc ebp
and esi, 7
cmp dword [esp + 0x18], 0
jne 0x10138f15
cmp dword [esp + 0x1c], 0
je 0x10138feb
mov eax, dword [esp + 0x2c]
mov byte [edi], bl
mov edx, ebx
shr edx, 8
mov byte [eax], dl
mov ecx, ebx
shr ecx, 0x10
mov byte [eax + 1], cl
mov ecx, dword [esp + 0x24]
shr ebx, 0x18
mov byte [eax + 2], bl
mov byte [eax + 3], cl
mov edx, ecx
shr edx, 8
mov byte [eax + 4], dl
mov edx, ecx
shr edx, 0x10
mov byte [eax + 5], dl
shr ecx, 0x18
mov byte [eax + 6], cl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1017eae7
add esp, 0x2c
ret
mov ecx, dword [esp + 0x14]
pop edi
mov dword [ecx], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.1017eae7
add esp, 0x2c
ret
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x38]
pop edi
mov dword [edx], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1017eae7
add esp, 0x2c
ret
Function at 0x10139fb0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.1017f100
mov eax, dword [0x101ec05c]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x9c]
push ebx
mov ebx, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x94]
mov dword [esp + 8], eax
xor eax, eax
push edi
mov edi, dword [esp + 0x9c]
test ebx, ebx
je 0x1013a025
cmp ebx, dword [esi]
je 0x1013a01c
test edi, edi
je 0x1013a002
cmp dword [esp + 0xa0], eax
jge 0x1013a01c
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.1017eae7
add esp, 0x88
ret
mov eax, 1
mov dword [esi], ebx
jmp 0x1013a02b
mov ebx, dword [esi]
test ebx, ebx
je 0x1013a002
push ebp
test edi, edi
je 0x1013a0fd
push ebx
call fcn.100e3650
mov ebp, eax
add esp, 4
cmp ebp, 0x80
jle 0x1013a05b
push str.j____int_sizeof_ctx__key_
push 0x74
push str..cryptohmachmac.c
call fcn.100e1b60
add esp, 0xc
mov eax, dword [esp + 0xa4]
cmp ebp, eax
jge 0x1013a0b5
mov ecx, dword [esp + 0x10]
push ecx
lea ebp, [esi + 4]
push ebx
push ebp
call fcn.100e1ce0
add esp, 0xc
test eax, eax
je 0x1013a1aa
mov edx, dword [esp + 0xa4]
push edx
push edi
push ebp
call fcn.100e1e90
add esp, 0xc
test eax, eax
je 0x1013a1aa
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebp
call fcn.100e1ea0
add esp, 0xc
test eax, eax
je 0x1013a1aa
jmp 0x1013a0da
cmp eax, 0x80
ja 0x1013a1aa
push eax
lea ecx, [esi + 0x50]
push edi
push ecx
call sub.MSVCR100.dll_memcpy
mov edx, dword [esp + 0xb0]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], edx
mov edi, dword [edi]
cmp edi, 0x80
je 0x1013a105
mov eax, 0x80
sub eax, edi
push eax
lea ecx, [edi + esi + 0x50]
push 0
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
jmp 0x1013a105
test eax, eax
je 0x1013a196
xor eax, eax
jmp 0x1013a110
mov dl, byte [esi + eax + 0x50]
xor dl, 0x36
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x80
jl 0x1013a110
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x1c]
push ebx
push ebp
call fcn.100e1ce0
add esp, 0xc
test eax, eax
je 0x1013a1aa
push ebx
call fcn.100e3650
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.100e1e90
add esp, 0x10
test eax, eax
je 0x1013a1aa
xor eax, eax
mov dl, byte [esi + eax + 0x50]
xor dl, 0x5c
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x80
jl 0x1013a154
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x34]
push ebx
push ebp
call fcn.100e1ce0
add esp, 0xc
test eax, eax
je 0x1013a1aa
push ebx
call fcn.100e3650
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.100e1e90
add esp, 0x10
test eax, eax
je 0x1013a1aa
lea edx, [esi + 0x1c]
push edx
add esi, 4
push esi
call fcn.100e2030
add esp, 8
test eax, eax
jne 0x1013a1ae
xor eax, eax
jmp 0x1013a1b3
mov eax, 1
mov ecx, dword [esp + 0x94]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1017eae7
add esp, 0x88
ret
Function at 0x1014c710
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp ecx, dword [edi + 4]
jge 0x1014c729
mov esi, edi
mov edi, eax
jmp 0x1014c72b
mov esi, eax
mov eax, dword [esi + 4]
mov ebx, dword [esp + 0x10]
cmp eax, dword [ebx + 8]
jg 0x1014c73b
mov eax, ebx
jmp 0x1014c745
push eax
push ebx
call fcn.100d8690
add esp, 8
test eax, eax
jne 0x1014c74d
pop edi
pop esi
pop ebx
ret
xor eax, eax
cmp dword [edi + 4], eax
jle 0x1014c769
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
xor edx, dword [ecx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [edi + 4]
jl 0x1014c754
cmp eax, dword [esi + 4]
jge 0x1014c780
mov edi, edi
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [ebx]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [esi + 4]
jl 0x1014c770
mov eax, dword [esi + 4]
mov dword [ebx + 4], eax
test eax, eax
jle 0x1014c7a1
mov ecx, dword [ebx]
lea ecx, [ecx + eax*4 - 4]
mov edx, dword [ecx]
sub ecx, 4
test edx, edx
jne 0x1014c79e
dec eax
test eax, eax
jg 0x1014c790
mov dword [ebx + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x1016dfe0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.1017f100
push ebp
push esi
mov esi, dword [esp + 0x54]
push edi
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
xor ebp, ebp
push ebp
xor edi, edi
call fcn.1015a880
add esp, 0xc
test eax, eax
je 0x1016e03a
lea esp, [esp]
mov edx, dword [esp + 0xc]
shl edx, 0xa
test dword [esp + 0x1c], edx
je 0x1016e01e
inc edi
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
inc ebp
push ebp
call fcn.1015a880
add esp, 0xc
test eax, eax
jne 0x1016e010
test edi, edi
jne 0x1016e05e
push 0x109
push str.._ssl_t1_enc.c
push 0x44
push 0x11c
push 0x14
call fcn.100d08d0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
mov eax, dword [esp + 0x4c]
cdq
idiv edi
push ebx
mov ebx, eax
cmp edi, 1
jne 0x1016e075
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x4c]
push esi
push 0
push eax
call sub.MSVCR100.dll_memset
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
mov dword [esp + 0x30], 0
call fcn.1015a880
add esp, 0x18
test eax, eax
je 0x1016e154
lea ebx, [ebx]
mov eax, dword [esp + 0x10]
shl eax, 0xa
test dword [esp + 0x20], eax
je 0x1016e130
mov eax, dword [esp + 0x14]
test eax, eax
je 0x1016e161
mov ebp, dword [esp + 0x58]
mov edx, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
push esi
push ebp
push edx
mov edx, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x4c]
push ecx
mov ecx, dword [esp + 0x48]
push edx
mov edx, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x54]
and edx, 1
add edx, ebx
push edx
mov edx, dword [esp + 0x60]
push edi
push eax
call fcn.1016dbd0
add esp, 0x34
test eax, eax
je 0x1016e17f
add edi, ebx
test esi, esi
jle 0x1016e130
mov eax, dword [esp + 0x54]
mov ecx, ebp
sub ecx, eax
mov ebp, esi
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec ebp
jne 0x1016e127
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
inc eax
push edx
push eax
mov dword [esp + 0x24], eax
call fcn.1015a880
add esp, 0xc
test eax, eax
jne 0x1016e0b0
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0xc
ret
push 0x114
push str.._ssl_t1_enc.c
push 0x146
push 0x11c
push 0x14
call fcn.100d08d0
add esp, 0x14
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0xc
ret
Function at 0x101702e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.1017f100
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi + 8]
mov ecx, dword [eax + 0x64]
inc ebp
test byte [ecx + 0x38], 1
je 0x10170328
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esi + 4]
lea edx, [ecx + ebp]
cmp edx, eax
jbe 0x1017031b
pop edi
pop esi
xor eax, eax
pop ebp
pop ecx
ret
add dword [esi + 0xc], ecx
add dword [esi + 0x10], ecx
sub eax, ecx
mov dword [esi + 4], eax
jmp 0x10170333
mov eax, dword [esp + 0x18]
cmp ebp, dword [eax + 4]
ja 0x10170314
mov esi, eax
test dword [edi + 0x100], 0x200
mov ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push ebx
movzx ebx, byte [ecx + edx - 1]
je 0x10170386
cmp dword [edi + 0x88], 0
jne 0x10170386
mov eax, dword [edi + 0x58]
push 8
add eax, 8
push 0x101c494c
push eax
call fcn.100e1b90
add esp, 0xc
test eax, eax
jne 0x10170379
test bl, 1
jne 0x10170379
mov eax, dword [edi + 0x58]
or dword [eax], 8
mov ecx, dword [edi + 0x58]
test byte [ecx], 8
je 0x10170386
test ebx, ebx
je 0x10170386
dec ebx
mov edx, dword [edi + 0x80]
mov eax, dword [edx]
push eax
call fcn.100fdf00
add esp, 4
test eax, 0x200000
je 0x101703b1
or ecx, 0xffffffff
sub ecx, ebx
add dword [esi + 4], ecx
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
pop ecx
ret
mov edi, dword [esi + 4]
lea eax, [ebx + ebp]
mov esi, edi
sub esi, eax
xor esi, eax
mov edx, edi
xor edx, eax
or esi, edx
xor esi, edi
shr esi, 0x1f
mov ecx, 0xff
lea eax, [edi - 1]
dec esi
mov dword [esp + 0x18], ecx
cmp eax, ecx
jae 0x101703df
mov ecx, eax
mov dword [esp + 0x18], eax
xor ebp, ebp
test ecx, ecx
je 0x10170437
mov eax, dword [esp + 0x1c]
mov edx, dword [eax + 0xc]
mov ecx, ebx
shr ecx, 0x1f
lea eax, [edi + edx - 1]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], eax
lea ecx, [ecx]
mov edx, ebx
sub edx, ebp
shr edx, 0x1f
mov eax, ebp
shr eax, 0x1f
xor dl, al
xor cl, al
or dl, cl
mov ecx, dword [esp + 0x10]
xor dl, cl
dec dl
movzx eax, dl
mov edx, dword [esp + 0x24]
movzx edx, byte [edx]
dec dword [esp + 0x24]
xor edx, ebx
and eax, edx
not eax
inc ebp
and esi, eax
cmp ebp, dword [esp + 0x18]
jb 0x10170400
mov edx, dword [esp + 0x1c]
not esi
and esi, 0xff
lea ecx, [esi - 1]
shr ecx, 0x1f
not esi
shr esi, 0x1f
and ecx, esi
neg ecx
lea eax, [ebx + 1]
and eax, ecx
sub edi, eax
shl eax, 8
or dword [edx], eax
pop ebx
mov dword [edx + 4], edi
mov eax, ecx
pop edi
and eax, 1
not ecx
pop esi
or eax, ecx
pop ebp
pop ecx
ret
Function at 0x10170470
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa4
call fcn.1017f100
mov eax, dword [0x101ec05c]
xor eax, esp
mov dword [esp + 0xa0], eax
mov ecx, dword [esp + 0xac]
mov eax, dword [esp + 0xa8]
push ebx
mov ebx, dword [esp + 0xb8]
push ebp
push esi
mov esi, dword [ecx + 4]
push edi
mov edi, dword [esp + 0xc0]
mov dword [esp + 0x1c], esi
sub esi, edi
xor ebp, ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], ebp
cmp ebx, edi
jae 0x101704da
push str.orig_len___md_size
push pe_nt_image_headers32
push str.._ssl_s3_cbc.c
call fcn.100e1b60
add esp, 0xc
cmp edi, 0x40
jbe 0x101704f6
push str.md_size___EVP_MAX_MD_SIZE
push 0xf9
push str.._ssl_s3_cbc.c
call fcn.100e1b60
add esp, 0xc
lea ecx, [esp + 0x30]
neg ecx
and ecx, 0x3f
lea edx, [edi + 0x100]
lea ecx, [esp + ecx + 0x30]
mov dword [esp + 0x20], ecx
cmp ebx, edx
jbe 0x10170520
mov eax, ebx
sub eax, edi
sub eax, 0x100
mov dword [esp + 0x14], eax
mov ebp, eax
mov eax, edi
and eax, 0xfffffffe
shl eax, 0x17
sub eax, ebp
add eax, esi
xor edx, edx
div edi
push edi
push 0
push ecx
mov ebx, edx
mov dword [esp + 0x30], ebx
call sub.MSVCR100.dll_memset
mov ecx, dword [esp + 0x20]
add esp, 0xc
xor esi, esi
cmp ecx, dword [esp + 0xc4]
jae 0x10170600
mov ebx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x1f
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xbc]
mov eax, dword [eax + 0xc]
shr edx, 0x1f
sub ecx, ebx
sub ebx, dword [esp + 0x18]
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
jmp 0x10170598
mov edx, dword [esp + 0x14]
mov ebx, dword [esp + 0x1c]
add ebx, ecx
shr ebx, 0x1f
xor bl, dl
mov eax, ebp
shr eax, 0x1f
xor dl, al
or bl, dl
mov dl, byte [esp + 0x2c]
xor bl, al
dec bl
mov byte [esp + 0x13], bl
mov ebx, ecx
shr ebx, 0x1f
xor bl, dl
xor dl, al
or bl, dl
mov edx, dword [esp + 0x18]
mov dl, byte [edx + ebp]
xor al, bl
dec al
not al
and al, dl
and al, byte [esp + 0x13]
mov edx, dword [esp + 0x20]
or byte [esi + edx], al
inc esi
mov eax, esi
sub eax, edi
xor eax, edi
mov ebx, esi
xor ebx, edi
or eax, ebx
xor eax, esi
shr eax, 0x1f
neg eax
inc ebp
and esi, eax
inc ecx
cmp ebp, dword [esp + 0xc4]
jb 0x10170590
mov ebx, dword [esp + 0x24]
jmp 0x10170604
mov edx, dword [esp + 0x20]
xor esi, esi
test edi, edi
je 0x1017063d
lea ebx, [ebx]
mov ecx, ebx
xor ecx, 0x20
mov al, byte [ecx + edx]
mov cl, byte [ebx + edx]
mov eax, dword [esp + 0x28]
mov byte [eax + esi], cl
inc ebx
mov ecx, ebx
sub ecx, edi
xor ecx, edi
mov eax, ebx
xor eax, edi
or ecx, eax
xor ecx, ebx
shr ecx, 0x1f
neg ecx
inc esi
and ebx, ecx
cmp esi, edi
jb 0x10170610
mov ecx, dword [esp + 0xb0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1017eae7
add esp, 0xa4
ret
Function at 0x1017eae7
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101ec05c]
jne 0x1017eaf1
repz ret
jmp fcn.1017f6bd

Function at 0x10182330
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10182778
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101ec05c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [0x101f0c70]
cmp eax, 0xffffffff
jne 0x10182365
xor esi, esi
jmp 0x1018236e
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x24], 0
test esi, esi
je 0x101823b5
cmp dword [esi + 0x1c], 0
jne 0x101823f7
cmp dword [esi + 0xc], 0
jne 0x10182400
push 0x10181ae0
push 0x101f7314
call fcn.10181dc0
mov eax, dword [0x101f0c70]
add esp, 8
cmp eax, 0xffffffff
je 0x101823b5
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x24], 0xffffffff
test esi, esi
je 0x101823e3
lea edx, [esi + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x101823e3
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
cmp dword [esi + 0xc], 0
je 0x10182440
lea ecx, [ecx]
mov ebx, dword [esi + 0xc]
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x1018242e
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0xc], 0
jne 0x10182400
cmp dword [esi + 0x1c], 0
je 0x1018238a
lea ebx, [ebx]
mov ecx, dword [esi + 0x18]
mov edi, dword [ecx]
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x1018246b
mov eax, dword [edi + 0x18]
test eax, eax
je 0x1018246b
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esi + 0x14]
call fcn.101820b0
cmp dword [esi + 0x1c], 0
jne 0x10182450
jmp 0x10182384
jmp 0x10182330
Function at 0x10182490
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x10182778
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x101ec05c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [0x101f0c70]
cmp eax, 0xffffffff
jne 0x10182365
xor esi, esi
jmp 0x1018236e
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x24], 0
test esi, esi
je 0x101823b5
cmp dword [esi + 0x1c], 0
jne 0x101823f7
cmp dword [esi + 0xc], 0
jne 0x10182400
push 0x10181ae0
push 0x101f7314
call fcn.10181dc0
mov eax, dword [0x101f0c70]
add esp, 8
cmp eax, 0xffffffff
je 0x101823b5
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x24], 0xffffffff
test esi, esi
je 0x101823e3
lea edx, [esi + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x101823e3
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
cmp dword [esi + 0xc], 0
je 0x10182440
lea ecx, [ecx]
mov ebx, dword [esi + 0xc]
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x1018242e
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0xc], 0
jne 0x10182400
cmp dword [esi + 0x1c], 0
je 0x1018238a
lea ebx, [ebx]
mov ecx, dword [esi + 0x18]
mov edi, dword [ecx]
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x1018246b
mov eax, dword [edi + 0x18]
test eax, eax
je 0x1018246b
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esi + 0x14]
call fcn.101820b0
cmp dword [esi + 0x1c], 0
jne 0x10182450
jmp 0x10182384
jmp 0x10182330
Function at 0x409ca0
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
lea ebx, [esp + 0x24]
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp sym.___write_memory.part.0