joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1007e490
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x10]
lea edx, [eax - 1]
not eax
shr edx, 0x1f
shr eax, 0x1f
and edx, eax
mov eax, dword [ebx + 4]
mov ecx, dword [ebp + 4]
dec edx
xor eax, ecx
mov dword [esp + 0xc], edx
and eax, edx
xor ecx, eax
mov dword [ebp + 4], ecx
xor dword [ebx + 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
xor eax, ecx
movd xmm0, edx
and eax, edx
pshufd xmm4, xmm0, 0
xor ecx, eax
mov dword [ebp + 0xc], ecx
xor dword [ebx + 0xc], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebx + 0x10]
xor eax, ecx
and eax, edx
mov edx, dword [esp + 0x18]
and eax, 4
xor ecx, eax
mov dword [ebp + 0x10], ecx
xor dword [ebx + 0x10], eax
xor eax, eax
test edx, edx
jle 0x1007e5c7
push esi
push edi
cmp edx, 4
jb 0x1007e59d
mov esi, dword [ebp]
lea ecx, [edx - 1]
mov edi, dword [ebx]
lea ebp, [edx - 1]
lea ebp, [esi + ebp*4]
cmp edi, ebp
lea ecx, [edi + ecx*4]
mov ebp, dword [esp + 0x18]
ja 0x1007e528
cmp ecx, esi
jae 0x1007e59d
cmp edi, ebx
ja 0x1007e530
cmp ecx, ebx
jae 0x1007e59d
cmp edi, ebp
ja 0x1007e538
cmp ecx, ebp
jae 0x1007e59d
lea ecx, [edx - 1]
lea ecx, [esi + ecx*4]
cmp esi, ebx
ja 0x1007e546
cmp ecx, ebx
jae 0x1007e59d
cmp esi, ebp
ja 0x1007e54e
cmp ecx, ebp
jae 0x1007e59d
mov ecx, edx
and ecx, reloc.WS2_32.dll_closesocket
jns 0x1007e55d
dec ecx
or ecx, 0xfffffffc
inc ecx
mov dword [esp + 0x18], edx
sub dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
nop dword [eax]
movups xmm3, xmmword [edi + eax*4]
movups xmm2, xmmword [esi + eax*4]
movaps xmm1, xmm3
pxor xmm1, xmm2
pand xmm1, xmm4
movaps xmm0, xmm1
pxor xmm1, xmm3
pxor xmm0, xmm2
movups xmmword [esi + eax*4], xmm0
movups xmmword [edi + eax*4], xmm1
add eax, 4
cmp eax, ecx
jl 0x1007e570
cmp eax, edx
jge 0x1007e5c5
mov ecx, dword [ebp]
mov edx, dword [ecx + eax*4]
lea esi, [ecx + eax*4]
mov ecx, dword [ebx]
mov edi, dword [ecx + eax*4]
xor edi, edx
and edi, dword [esp + 0x14]
xor edx, edi
mov dword [esi], edx
mov ecx, dword [ebx]
xor dword [ecx + eax*4], edi
inc eax
cmp eax, dword [esp + 0x20]
jl 0x1007e5a1
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x1007eeb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.10228380
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push ebx
push ebp
test byte [eax + 0x10], 4
mov ebx, dword [eax]
mov ebp, dword [ecx]
push esi
je 0x1007ef71
mov edx, dword [ecx + 4]
cmp dword [eax + 4], edx
jne 0x1007ef71
push edi
xor edi, edi
mov dword [esp + 0x1c], edi
test edx, edx
jle 0x1007ef67
sub ebx, ebp
nop dword [eax]
mov edx, dword [ebx + ebp]
lea ebp, [ebp + 4]
mov ecx, dword [ebp - 4]
mov esi, edx
sub esi, ecx
mov eax, edx
xor esi, ecx
xor eax, ecx
or esi, eax
xor esi, edx
shr esi, 0x1f
neg esi
mov dword [esp + 0x14], esi
not esi
mov dword [esp + 0x10], esi
mov eax, dword [esp + 0x10]
and eax, edi
mov edi, dword [esp + 0x14]
mov edx, dword [ebp - 4]
or edi, eax
mov ecx, dword [ebx + ebp - 4]
mov esi, edx
sub esi, ecx
mov eax, edx
xor esi, ecx
xor eax, ecx
or esi, eax
mov eax, dword [esp + 0x20]
xor esi, edx
shr esi, 0x1f
neg esi
mov dword [esp + 0x10], esi
not esi
mov dword [esp + 0x14], esi
mov ecx, dword [esp + 0x14]
and ecx, edi
mov edi, dword [esp + 0x10]
and edi, 1
or edi, ecx
mov ecx, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x1c], ecx
cmp ecx, dword [eax + 4]
jl 0x1007eef0
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [eax + 4]
mov eax, edx
sub eax, dword [ecx + 4]
jne 0x1007efa3
lea ecx, [edx - 1]
test ecx, ecx
js 0x1007efa1
lea eax, [ecx*4]
add eax, ebp
sub ebx, ebp
nop dword [eax]
mov edx, dword [eax + ebx]
mov esi, dword [eax]
cmp esi, edx
jne 0x1007efaa
sub eax, 4
sub ecx, 1
jns 0x1007ef90
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 8
ret
sbb eax, eax
pop esi
and eax, 2
pop ebp
dec eax
pop ebx
add esp, 8
ret
Function at 0x1007f270
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x24
call fcn.10228380
push ebx
push esi
push edi
mov edi, dword [esp + 0x34]
xor ecx, ecx
push edi
mov dword [esp + 0x14], 0
xor ebx, ebx
mov dword [esp + 0x10], ecx
call sym.libcrypto_3.dll_BN_num_bits
mov esi, eax
add esp, 4
lea eax, [esi + 7]
cdq
and edx, 7
lea ecx, [edx + eax]
sar ecx, 3
cmp dword [esp + 0x44], ebx
jne 0x1007f2e1
mov ebx, dword [edi + 0xc]
mov eax, ebx
neg eax
sbb eax, eax
and eax, 0xff
mov dword [esp + 0x10], eax
lea eax, [ecx*8]
cmp eax, esi
jne 0x1007f2d9
xor eax, eax
test ebx, ebx
sete al
mov dword [esp + 0xc], eax
jmp 0x1007f2e3
mov eax, ebx
mov dword [esp + 0xc], eax
jmp 0x1007f2e3
xor eax, eax
mov esi, dword [esp + 0x3c]
add eax, ecx
cmp esi, 0xffffffff
jne 0x1007f321
mov esi, eax
mov dword [esp + 0x3c], esi
mov ecx, dword [edi + 8]
shl ecx, 2
test ecx, ecx
jne 0x1007f3a0
test esi, esi
je 0x1007f434
push esi
push ecx
push dword [esp + 0x40]
call fcn.1022a0e0
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x24
ret
cmp esi, eax
jge 0x1007f2f4
movups xmm0, xmmword [edi]
mov eax, dword [edi + 0x10]
mov dword [esp + 0x2c], eax
movups xmmword [esp + 0x1c], xmm0
psrldq xmm0, 4
movd ecx, xmm0
test ecx, ecx
jle 0x1007f362
mov eax, dword [esp + 0x1c]
lea eax, [eax + ecx*4]
nop dword [eax + eax]
cmp dword [eax - 4], 0
lea eax, [eax - 4]
jne 0x1007f35e
dec ecx
test ecx, ecx
jg 0x1007f350
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x28]
xor edx, edx
test ecx, ecx
cmove eax, edx
mov dword [esp + 0x28], eax
lea eax, [esp + 0x1c]
push eax
call sym.libcrypto_3.dll_BN_num_bits
add eax, 7
add esp, 4
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, dword [esp + 0xc]
cmp esi, eax
jge 0x1007f2f4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0x24
ret
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
cmp edx, 1
je 0x1007f3b0
dec eax
add eax, esi
mov edi, dword [edi + 4]
mov dword [esp + 0x44], eax
xor eax, eax
cmp edx, 1
push ebp
sete al
shl edi, 2
xor ebp, ebp
lea eax, [eax*2 - 1]
mov dword [esp + 0x18], eax
lea eax, [ecx - 1]
mov dword [esp + 0x1c], eax
test esi, esi
je 0x1007f433
mov dword [esp + 0x10], esi
neg edi
mov esi, dword [esp + 0x38]
mov eax, dword [esi]
mov edx, ebp
shr edx, 2
mov ecx, ebp
and ecx, 3
shl ecx, 3
mov edx, dword [eax + edx*4]
mov eax, edi
shr edx, cl
mov ecx, ebp
shr eax, 0x1f
neg al
and dl, al
mov eax, dword [esp + 0x48]
xor dl, byte [esp + 0x14]
add bl, dl
cmp bl, dl
mov byte [eax], bl
sbb ebx, ebx
sub ecx, dword [esp + 0x1c]
add eax, dword [esp + 0x18]
neg ebx
shr ecx, 0x1f
inc edi
add ebp, ecx
mov dword [esp + 0x48], eax
sub dword [esp + 0x10], 1
jne 0x1007f3e5
mov esi, dword [esp + 0x40]
pop ebp
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x24
ret
Function at 0x10089d80
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
cmp dword [edi + 0x84], 0xffffffff
je 0x10089e54
push dword [edi]
call sym.libcrypto_3.dll_EVP_CIPHER_CTX_get_block_size
mov esi, eax
add esp, 4
test esi, esi
je 0x10089e54
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10089db1
mov dword [eax], esi
push ebp
mov ebp, dword [esp + 0x14]
test ebp, ebp
je 0x10089e4b
mov ecx, dword [edi + 0x84]
push ebx
cmp ecx, esi
jne 0x10089dea
test esi, esi
jle 0x10089e29
mov edx, ebp
lea ecx, [edi + 4]
mov ebx, esi
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x10089dd4
jmp 0x10089e29
mov eax, esi
mov byte [ecx + edi + 0x64], 0x80
sub eax, ecx
cmp eax, 1
jle 0x10089e0a
dec eax
push eax
lea eax, [edi + 0x65]
add eax, ecx
push 0
push eax
call fcn.1022a0e0
add esp, 0xc
test esi, esi
jle 0x10089e29
mov edx, ebp
lea ecx, [edi + 0x24]
mov ebx, esi
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
sub ebx, 1
jne 0x10089e15
push esi
push ebp
push ebp
push dword [edi]
call sym.libcrypto_3.dll_EVP_Cipher
add esp, 0x10
pop ebx
test eax, eax
jg 0x10089e4b
push esi
push ebp
call sym.libcrypto_3.dll_OPENSSL_cleanse
add esp, 8
xor eax, eax
pop ebp
pop edi
pop esi
ret
pop ebp
pop edi
mov eax, 1
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x100bb200
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 8]
test eax, eax
je 0x100bb214
mov dword [esp + 4], eax
jmp sym.libcrypto_3.dll_BN_num_bits
or eax, 0xffffffff
ret
Function at 0x1012a910
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.10228380
mov eax, dword [0x1033b254]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xa4]
push ebx
mov ebx, dword [esp + 0xcc]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xb0]
push ebp
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xbc]
push esi
mov esi, dword [esp + 0xc4]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xcc]
push edi
mov edi, dword [esp + 0xc0]
push ecx
mov ebp, dword [eax]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], ebx
call fcn.10078bd0
push ebp
push 0
push ebx
mov dword [esp + 0x2c], eax
call sym.libcrypto_3.dll_BN_GENCB_call
add esp, 0x10
test eax, eax
je 0x1012ab11
mov ebx, dword [esp + 0xcc]
inc ebp
test ebx, ebx
mov ebx, dword [esp + 0x10]
je 0x1012a9c4
push 0
push esi
push ebx
push dword [esp + 0x28]
call sym.libcrypto_3.dll_RAND_bytes_ex
add esp, 0x10
test eax, eax
jle 0x1012ab12
push esi
push ebx
push edi
call fcn.10229b60
push esi
lea eax, [esp + 0x7c]
push ebx
push eax
call fcn.10229b60
lea eax, [esi - 1]
add esp, 0x18
test eax, eax
js 0x1012a9ed
add byte [edi + eax], 1
jne 0x1012a9ed
sub eax, 1
jns 0x1012a9e2
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x34]
push 0
push eax
push esi
push ebx
call sym.libcrypto_3.dll_EVP_Digest
add esp, 0x18
test eax, eax
je 0x1012ab12
push 0
push dword [esp + 0x18]
lea eax, [esp + 0x74]
push 0
push eax
push esi
push edi
call sym.libcrypto_3.dll_EVP_Digest
add esp, 0x18
test eax, eax
je 0x1012ab12
xor eax, eax
test esi, esi
jle 0x1012aabd
cmp esi, 0x40
jb 0x1012aaa9
mov ecx, esi
and ecx, 0x8000003f
jns 0x1012aa49
dec ecx
or ecx, 0xffffffc0
inc ecx
mov edx, esi
sub edx, ecx
nop dword [eax]
movups xmm0, xmmword [esp + eax + 0x2c]
movups xmm1, xmmword [esp + eax + 0x6c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x2c], xmm1
movups xmm0, xmmword [esp + eax + 0x3c]
movups xmm1, xmmword [esp + eax + 0x7c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x3c], xmm1
movups xmm0, xmmword [esp + eax + 0x4c]
movups xmm1, xmmword [esp + eax + 0x8c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x4c], xmm1
movups xmm0, xmmword [esp + eax + 0x5c]
movups xmm1, xmmword [esp + eax + 0x9c]
pxor xmm1, xmm0
movups xmmword [esp + eax + 0x5c], xmm1
add eax, 0x40
cmp eax, edx
jl 0x1012aa50
cmp eax, esi
jge 0x1012aabd
nop dword [eax]
mov cl, byte [esp + eax + 0x6c]
xor byte [esp + eax + 0x2c], cl
inc eax
cmp eax, esi
jl 0x1012aab0
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0x2c]
or byte [esp + 0x2c], 0x80
or byte [esp + esi + 0x2b], 1
push ebx
push esi
push eax
call sym.libcrypto_3.dll_BN_bin2bn
add esp, 0xc
test eax, eax
je 0x1012ab12
push dword [esp + 0x18]
push dword [esp + 0x28]
push ebx
call sym.libcrypto_3.dll_BN_check_prime
add esp, 0xc
test eax, eax
jg 0x1012ab33
jne 0x1012ab12
push ebp
push 0
push dword [esp + 0x20]
mov ebx, 1
call sym.libcrypto_3.dll_BN_GENCB_call
add esp, 0xc
test eax, eax
jne 0x1012a9a3
inc ebp
xor eax, eax
mov ecx, dword [esp + 0x28]
pop edi
pop esi
mov dword [ecx], ebp
mov ecx, dword [esp + 0xa4]
pop ebp
pop ebx
xor ecx, esp
call fcn.1022836f
add esp, 0xa0
ret
mov eax, 1
jmp 0x1012ab14
Function at 0x1012f720
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.10228380
push ebp
mov ebp, dword [esp + 0x10]
push edi
test ebp, ebp
je 0x1012f85c
mov edi, dword [esp + 0x1c]
cmp edi, 8
jb 0x1012f85c
cmp edi, dword [ebp + 0x44]
jne 0x1012f85c
push ebx
mov ebx, dword [ebp + 0x28]
push esi
mov esi, dword [ebp + 0x2c]
push edi
push 0
push dword [esp + 0x28]
call fcn.1022a0e0
mov edx, dword [esp + 0x2c]
add esp, 0xc
xor eax, eax
mov byte [edx + edi - 1], bl
shrd ebx, esi, 8
shr esi, 8
mov byte [edx + edi - 2], bl
shrd ebx, esi, 8
shr esi, 8
mov byte [edx + edi - 3], bl
shrd ebx, esi, 8
shr esi, 8
mov byte [edx + edi - 4], bl
shrd ebx, esi, 8
shr esi, 8
mov byte [edx + edi - 5], bl
shrd ebx, esi, 8
shr esi, 8
mov byte [edx + edi - 6], bl
shrd ebx, esi, 8
shr esi, 8
mov byte [edx + edi - 7], bl
shrd ebx, esi, 8
mov byte [edx + edi - 8], bl
test edi, edi
je 0x1012f852
cmp edi, 0x40
jb 0x1012f840
mov esi, dword [ebp + 0x40]
lea ebx, [ebp + 0x40]
lea ecx, [edi - 1]
add ecx, esi
cmp edx, ecx
lea ecx, [edx - 1]
ja 0x1012f7e0
add ecx, edi
cmp ecx, esi
jae 0x1012f840
jmp 0x1012f7e2
add ecx, edi
cmp edx, ebx
ja 0x1012f7ea
cmp ecx, ebx
jae 0x1012f840
mov ecx, edi
and ecx, 0xffffffc0
nop
movups xmm0, xmmword [edx + eax]
movups xmm1, xmmword [esi + eax]
pxor xmm1, xmm0
movups xmmword [edx + eax], xmm1
movups xmm0, xmmword [edx + eax + 0x10]
movups xmm1, xmmword [esi + eax + 0x10]
pxor xmm1, xmm0
movups xmmword [edx + eax + 0x10], xmm1
movups xmm0, xmmword [edx + eax + 0x20]
movups xmm1, xmmword [esi + eax + 0x20]
pxor xmm1, xmm0
movups xmmword [edx + eax + 0x20], xmm1
movups xmm0, xmmword [edx + eax + 0x30]
movups xmm1, xmmword [esi + eax + 0x30]
pxor xmm1, xmm0
movups xmmword [edx + eax + 0x30], xmm1
add eax, 0x40
cmp eax, ecx
jb 0x1012f7f0
cmp eax, edi
jae 0x1012f852
mov ecx, dword [ebp + 0x40]
mov cl, byte [eax + ecx]
xor byte [eax + edx], cl
inc eax
cmp eax, edi
jb 0x1012f844
pop esi
pop ebx
mov eax, edi
pop edi
pop ebp
add esp, 8
ret
pop edi
xor eax, eax
pop ebp
add esp, 8
ret
Function at 0x10134fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.10228380
mov eax, dword [0x1033b254]
xor eax, esp
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
push esi
mov esi, dword [ecx]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test esi, esi
jns 0x10134ff1
mov dword [ecx], 0xffffffff
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1022836f
add esp, 0x28
ret
push ebx
movzx ebx, byte [eax]
push ebp
lea ebp, [eax + 1]
shl ebx, 0x18
mov edx, ebp
mov dword [esp + 0x1c], ebp
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
movzx eax, byte [edx + 2]
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x10], ebx
movzx eax, byte [edx + 6]
mov dword [esp + 0x28], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x28]
shl ecx, 8
or ecx, eax
mov byte [esp + 0x2b], bl
mov eax, ebx
or edx, ecx
shr eax, 0x18
mov byte [esp + 0x28], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x29], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2a], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, dword [esp + 0x40]
mov dword [esp + 0x14], edx
mov byte [esp + 0x2f], dl
test eax, eax
je 0x10135160
mov ecx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x10135108
push dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
call sym.libcrypto_3.dll_IDEA_encrypt
mov ebx, dword [esp + 0x1c]
add esp, 8
mov edx, dword [esp + 0x18]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x101350a3
test ebp, ebp
mov ebp, dword [esp + 0x20]
pop edi
je 0x10135160
mov ecx, dword [esp + 0x20]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
pop ebp
pop ebx
mov dword [eax], esi
pop esi
xor ecx, esp
call fcn.1022836f
add esp, 0x28
ret
Function at 0x10135d30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.10228380
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x10135db0
mov cl, byte [edi]
test cl, cl
je 0x10135db0
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x10135d60
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret

Function at 0x10136030
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.10228380
push edi
mov edi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x101360b3
mov cl, byte [edi]
test cl, cl
je 0x101360b3
push ebx
push esi
mov ebx, 0x100
nop word [eax + eax]
movd xmm1, dword [esp + 0xc]
lea edi, [edi + 1]
movsx esi, cl
mov edx, 0x20
and esi, 0xffffffdf
or esi, ebx
add ebx, 0x100
mov ecx, esi
shr ecx, 2
xor ecx, esi
imul esi, esi
and ecx, 0xf
sub edx, ecx
shl eax, cl
mov cl, byte [edi]
movd xmm0, edx
psrlq xmm1, xmm0
movd edx, xmm1
or eax, edx
xor eax, esi
mov dword [esp + 0xc], eax
test cl, cl
jne 0x10136060
mov ecx, eax
pop esi
shr ecx, 0x10
pop ebx
xor eax, ecx
pop edi
pop ecx
ret
xor eax, eax
pop edi
pop ecx
ret
Function at 0x1014f3d0
Capabilities:
Allocate thread local storage

Disassembly:
cmp dword [0x1033c6d8], 2
push esi
push edi
mov edi, 1
je 0x1014f427
mov edx, 0x1033c6d8
mov ecx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x1014f401
cmp eax, 1
je 0x1014f3e5
cmp dword [0x1033c6d8], 2
jne 0x1014f441
jmp 0x1014f427
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push 0x1014f1e0
push 0
push 0
mov dword [0x1033c6d4], eax
call fcn.1013c470
add esp, 0xc
mov dword [0x1033c6d8], 2
push 0x97
push str.crypto_threads_win.c
push 0x34
call sym.libcrypto_3.dll_CRYPTO_zalloc
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x1014f446
pop edi
xor eax, eax
pop esi
ret
push ebx
push ebp
lea ebx, [esi + 0x20]
call fcn.1019c5d0
mov dword [ebx], eax
lea ebp, [esi + 0x28]
call fcn.1019c2d0
mov dword [ebp], eax
call fcn.1019c2d0
mov dword [esi + 0x30], eax
call fcn.1019c5d0
mov dword [esi + 0x24], eax
call fcn.1019c5d0
cmp dword [esp + 0x14], edi
push 0x85
cmovge edi, dword [esp + 0x18]
inc edi
mov dword [esi + 0x2c], eax
push str.crypto_threads_win.c
lea eax, [edi*8]
push eax
call sym.libcrypto_3.dll_CRYPTO_zalloc
add esp, 0xc
mov dword [esi + 0xc], edi
mov dword [esi + 8], eax
test eax, eax
je 0x1014f4c0
cmp dword [ebp], 0
je 0x1014f4c0
cmp dword [esi + 0x30], 0
je 0x1014f4c0
cmp dword [ebx], 0
je 0x1014f4c0
cmp dword [esi + 0x24], 0
je 0x1014f4c0
cmp dword [esi + 0x2c], 0
jne 0x1014f50c
push 0xa8
push str.crypto_threads_win.c
push eax
call sym.libcrypto_3.dll_CRYPTO_free
push ebp
call fcn.1019c270
lea eax, [esi + 0x30]
push eax
call fcn.1019c270
lea eax, [esi + 0x24]
push eax
call fcn.1019c590
lea eax, [esi + 0x2c]
push eax
call fcn.1019c590
push ebx
call fcn.1019c590
push 0xae
push str.crypto_threads_win.c
push esi
call sym.libcrypto_3.dll_CRYPTO_free
add esp, 0x2c
xor esi, esi
pop ebp
pop ebx
pop edi
mov eax, esi
pop esi
ret
Function at 0x1014f520
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, 0x14
call fcn.10228380
push ebx
push esi
or ebx, 0xffffffff
push edi
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x1033c6d4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, eax
push esi
mov dword [esp + 0x18], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test edi, edi
jne 0x1014f59b
push 0xdd
push str.crypto_threads_win.c
push 0x78
call sym.libcrypto_3.dll_CRYPTO_zalloc
mov edi, eax
add esp, 0xc
mov dword [esp + 0x14], edi
test edi, edi
jne 0x1014f58e
push 0xde
push str.crypto_threads_win.c
push str.assertion_failed:_data___NULL
call sym.libcrypto_3.dll_OPENSSL_die
add esp, 0xc
push edi
push dword [0x1033c6d4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov edx, dword [esp + 0x24]
xor ecx, ecx
mov eax, edi
cmp dword [eax], 0
jne 0x1014f5b2
cmp ebx, 0xffffffff
cmove ebx, ecx
mov dword [esp + 0x10], ebx
cmp dword [eax + 8], edx
je 0x1014f67d
inc ecx
add eax, 0xc
cmp ecx, 0xa
jl 0x1014f5a3
lea ebx, [edx + 0x14]
mov dword [esp + 0xc], ebx
push ebp
nop dword [eax]
xor esi, esi
mov eax, dword [ebx]
mov ecx, eax
or ecx, esi
lock cmpxchg dword [ebx], ecx
jne 0x1014f5d4
mov ebp, dword [edx + 8]
mov dword [esp + 0x20], eax
shl eax, 3
mov dword [esp + 0x1c], eax
add ebp, eax
nop
mov esi, dword [ebp]
mov ebx, esi
mov edi, dword [ebp + 4]
add ebx, 1
mov ecx, edi
mov eax, esi
adc ecx, 0
mov edx, edi
lock cmpxchg8b qword [ebp]
cmp eax, esi
jne 0x1014f5f0
cmp edx, edi
jne 0x1014f5f0
mov edx, dword [esp + 0x10]
xor esi, esi
mov eax, dword [edx]
mov ecx, eax
or ecx, esi
lock cmpxchg dword [edx], ecx
jne 0x1014f619
mov ecx, dword [esp + 0x28]
mov ebp, dword [ecx + 8]
add ebp, dword [esp + 0x1c]
cmp dword [esp + 0x20], eax
je 0x1014f662
mov edi, dword [ebp]
mov ebx, edi
mov esi, dword [ebp + 4]
sub ebx, 1
mov ecx, esi
mov eax, edi
sbb ecx, 0
mov edx, esi
lock cmpxchg8b qword [ebp]
cmp eax, edi
jne 0x1014f634
cmp edx, esi
jne 0x1014f634
mov edx, dword [esp + 0x28]
mov ebx, dword [esp + 0x10]
jmp 0x1014f5d0
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
lea eax, [eax + eax*2]
mov dword [edx + eax*4], ebp
mov dword [edx + eax*4 + 4], 1
mov dword [edx + eax*4 + 8], ecx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x1014f690
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0xc
call fcn.10228380
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x1033c6d4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, dword [esp + 0x18]
lea edx, [edi + 8]
xor ecx, ecx
cmp dword [edx], esi
je 0x1014f6d5
inc ecx
add edx, 0xc
cmp ecx, 0xa
jl 0x1014f6c2
pop edi
pop esi
add esp, 0xc
ret
lea eax, [ecx + ecx*2]
add dword [edi + eax*4 + 4], 0xffffffff
push ebp
lea ebp, [edi + eax*4]
mov dword [esp + 0x10], ebp
jne 0x1014f757
mov eax, dword [ebp]
mov ebp, eax
mov dword [esp + 0xc], eax
push ebx
mov esi, dword [ebp]
mov ecx, esi
mov edi, dword [ebp + 4]
sub ecx, 1
mov eax, edi
mov dword [esp + 0x18], ecx
sbb eax, 0
mov edx, edi
mov dword [esp + 0x10], eax
mov eax, esi
mov ebx, ecx
mov ecx, dword [esp + 0x10]
lock cmpxchg8b qword [ebp]
cmp eax, esi
jne 0x1014f6f1
cmp edx, edi
jne 0x1014f6f1
mov ebp, dword [esp + 0x14]
pop ebx
test ecx, ecx
jg 0x1014f749
jl 0x1014f732
cmp dword [esp + 0x14], 0
jae 0x1014f749
push 0x10b
push str.crypto_threads_win.c
push str.assertion_failed:_ret___0
call sym.libcrypto_3.dll_OPENSSL_die
add esp, 0xc
mov dword [ebp], 0
mov dword [ebp + 8], 0
pop ebp
pop edi
pop esi
add esp, 0xc
ret