joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100be330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x100be330
mov eax, 0x30
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
mov dword [esp], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x20], eax
push ebx
push ebp
movzx ebx, byte [eax]
push esi
push edi
lea edi, [eax + 1]
mov ebp, dword [esp + 0x60]
mov edx, edi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x24], edi
mov esi, dword [ebp]
movzx eax, byte [edx]
shl eax, 8
or ebx, eax
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 1]
shl eax, 0x10
or ebx, eax
movzx eax, byte [edx + 2]
shl eax, 0x18
or ebx, eax
movzx eax, byte [edx + 4]
shl eax, 8
or ecx, eax
mov dword [esp + 0x18], ebx
movzx eax, byte [edx + 5]
mov dword [esp + 0x34], ecx
movzx ecx, byte [edx + 6]
mov edx, dword [esp + 0x34]
shl ecx, 8
or ecx, eax
mov byte [esp + 0x34], bl
mov eax, ebx
shl ecx, 0x10
shr eax, 8
or edx, ecx
mov byte [esp + 0x35], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x36], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x37], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x39], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x3a], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x3b], al
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x1c], edx
mov byte [esp + 0x38], dl
test eax, eax
je 0x100be50d
mov ecx, dword [esp + 0x10]
mov ebp, dword [esp + 0x44]
sub ecx, ebp
mov dword [esp + 0x10], ecx
xor edi, edi
lea ebx, [ebx]
dec eax
mov dword [esp + 0x4c], eax
test esi, esi
jne 0x100be49d
push dword [esp + 0x2c]
lea eax, [esp + 0x1c]
push dword [esp + 0x24]
push dword [esp + 0x30]
push eax
call sym.libcrypto_1_1.dll_DES_encrypt3
mov ebx, dword [esp + 0x28]
add esp, 0x10
mov edx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 8
mov byte [esp + 0x35], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x36], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x37], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x39], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x3a], al
mov eax, edx
shr eax, 0x18
inc edi
mov byte [esp + 0x34], bl
mov byte [esp + 0x38], dl
mov byte [esp + 0x3b], al
mov al, byte [esp + esi + 0x34]
inc esi
xor al, byte [ebp]
and esi, 7
mov byte [ecx + ebp], al
inc ebp
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x100be430
test edi, edi
mov edi, dword [esp + 0x24]
je 0x100be4f4
mov eax, dword [esp + 0x30]
mov byte [eax], bl
mov eax, ebx
shr eax, 8
mov byte [edi], al
mov eax, ebx
shr eax, 0x10
mov byte [edi + 1], al
mov eax, edx
shr ebx, 0x18
mov byte [edi + 2], bl
shr eax, 8
mov byte [edi + 3], dl
mov byte [edi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [edi + 5], al
mov byte [edi + 6], dl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.101704a0
add esp, 0x30
ret
mov ecx, dword [esp + 0x3c]
pop edi
mov dword [ebp], esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101704a0
add esp, 0x30
ret
Function at 0x100be5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x100be5a0
mov eax, 0x28
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
push ebx
push ebp
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
mov dword [esp + 0x20], ebp
push esi
push edi
mov edi, dword [esp + 0x50]
movzx eax, byte [edx]
shl eax, 8
or ebx, eax
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 1]
shl eax, 0x10
or ebx, eax
mov esi, dword [edi]
movzx eax, byte [edx + 2]
shl eax, 0x18
or ebx, eax
mov dword [esp + 0x14], edi
movzx eax, byte [edx + 4]
shl eax, 8
or ecx, eax
mov dword [esp + 0x18], ebx
movzx eax, byte [edx + 5]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 6]
mov edx, dword [esp + 0x2c]
shl ecx, 8
or ecx, eax
mov byte [esp + 0x2c], bl
mov eax, ebx
shl ecx, 0x10
shr eax, 8
or edx, ecx
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2e], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2f], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x32], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x33], al
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edx
mov byte [esp + 0x30], dl
test eax, eax
je 0x100be763
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
lea esp, [esp]
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x100be6f7
push 1
push dword [esp + 0x24]
lea eax, [esp + 0x20]
push eax
call sym.libcrypto_1_1.dll_DES_encrypt1
mov ebx, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2d], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2e], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2f], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x32], al
mov eax, edx
shr eax, 0x18
inc ebp
mov byte [esp + 0x2c], bl
mov byte [esp + 0x30], dl
mov byte [esp + 0x33], al
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x100be690
test ebp, ebp
mov ebp, dword [esp + 0x28]
je 0x100be74a
mov eax, dword [esp + 0x24]
mov byte [eax], bl
mov eax, ebx
shr eax, 8
mov byte [ebp], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp + 1], al
mov eax, edx
shr ebx, 0x18
mov byte [ebp + 2], bl
shr eax, 8
mov byte [ebp + 3], dl
mov byte [ebp + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.101704a0
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101704a0
add esp, 0x28
ret
Function at 0x100ca420
Capabilities:
Encrypt data using curve25519

Disassembly:
jmp 0x100ca420
mov eax, 0x120
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0x124]
mov dword [esp], eax
mov eax, dword [esp + 0x128]
push ebx
push ebp
push esi
movdqu xmm0, xmmword [eax]
push edi
movdqu xmm1, xmmword [eax + 0x10]
movd eax, xmm0
movdqu xmmword [esp + 0xec], xmm1
and al, 0xf8
psrldq xmm1, 0xc
movdqu xmmword [esp + 0xdc], xmm0
mov byte [esp + 0xdc], al
movd eax, xmm1
shr eax, 0x18
and al, 0x3f
or al, 0x40
mov byte [esp + 0xfb], al
lea eax, [esp + 0xdc]
push eax
lea eax, [esp + 0x40]
push eax
call fcn.100cf7d0
mov eax, dword [esp + 0x6c]
add eax, dword [esp + 0x94]
mov dword [esp + 0xe4], eax
mov eax, dword [esp + 0x70]
add eax, dword [esp + 0x98]
mov dword [esp + 0xe8], eax
mov eax, dword [esp + 0x74]
add eax, dword [esp + 0x9c]
mov dword [esp + 0xec], eax
mov eax, dword [esp + 0x78]
add eax, dword [esp + 0xa0]
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 0x7c]
add eax, dword [esp + 0xa4]
mov ebx, dword [esp + 0x88]
mov ebp, dword [esp + 0xb0]
mov esi, dword [esp + 0x8c]
mov edi, dword [esp + 0xb4]
mov dword [esp + 0xf4], eax
mov eax, dword [esp + 0x80]
add eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0x90]
mov edx, dword [esp + 0xb8]
mov dword [esp + 0xf8], eax
mov eax, dword [esp + 0x84]
add eax, dword [esp + 0xac]
mov dword [esp + 0xfc], eax
lea eax, [ebx + ebp]
mov dword [esp + 0x100], eax
lea eax, [esi + edi]
mov dword [esp + 0x104], eax
lea eax, [ecx + edx]
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x94]
sub eax, dword [esp + 0x6c]
mov dword [esp + 0x10c], eax
mov eax, dword [esp + 0x98]
sub eax, dword [esp + 0x70]
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x9c]
sub eax, dword [esp + 0x74]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0xa0]
sub eax, dword [esp + 0x78]
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0xa4]
sub eax, dword [esp + 0x7c]
mov dword [esp + 0x11c], eax
mov eax, dword [esp + 0xa8]
sub eax, dword [esp + 0x80]
mov dword [esp + 0x120], eax
mov eax, dword [esp + 0xac]
sub eax, dword [esp + 0x84]
sub ebp, ebx
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], ebp
lea eax, [esp + 0x10c]
sub edx, ecx
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x134], edx
sub edi, esi
push eax
mov dword [esp + 0x134], edi
call fcn.100caf70
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0xf0]
push eax
push eax
call fcn.100cb260
lea eax, [esp + 0xf8]
push eax
push dword [esp + 0x30]
call fcn.100ceb20
mov ecx, dword [esp + 0x150]
add esp, 0x24
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101704a0
add esp, 0x120
ret
Function at 0x100e59b0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
mov ebx, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x14]
cmp ebx, 2
je 0x100e5a0c
mov eax, dword [esp + 0x10]
test eax, eax
je 0x100e59fd
push eax
push 0
lea eax, [esp + 0x24]
push eax
push 0
call sym.libcrypto_1_1.dll_X509_ALGOR_get0
add esp, 0x10
cmp dword [esp + 0x1c], 0xffffffff
je 0x100e59fd
push 0x2f
push str.cryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop edi
pop ebx
ret
test edi, edi
je 0x100e5a08
cmp dword [esp + 0x18], 0x20
je 0x100e5a0c
push 0x35
jmp 0x100e59e2
push esi
push 0x3a
push str.cryptoececx_meth.c
push 0x24
call sym.libcrypto_1_1.dll_CRYPTO_zalloc
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x100e5a42
push 0x3c
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop esi
pop edi
pop ebx
ret
test ebx, ebx
jne 0x100e5a59
push dword [esp + 0x1c]
push edi
push esi
call sub.MSVCR120.dll_memcpy
add esp, 0xc
jmp 0x100e5b09
push 0x43
push str.cryptoececx_meth.c
push 0x20
call sym.libcrypto_1_1.dll_CRYPTO_secure_malloc
add esp, 0xc
mov dword [esi + 0x20], eax
test eax, eax
jne 0x100e5a9c
push 0x45
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call sym.libcrypto_1_1.dll_ERR_put_error
push 0x46
push str.cryptoececx_meth.c
push esi
call sym.libcrypto_1_1.dll_CRYPTO_free
add esp, 0x20
xor eax, eax
pop esi
pop edi
pop ebx
ret
cmp ebx, 2
jne 0x100e5aeb
push 0x20
push eax
call sym.libcrypto_1_1.dll_RAND_bytes
add esp, 8
test eax, eax
jg 0x100e5ad5
push 0x4b
push str.cryptoececx_meth.c
push dword [esi + 0x20]
call sym.libcrypto_1_1.dll_CRYPTO_secure_free
push 0x4c
push str.cryptoececx_meth.c
push esi
call sym.libcrypto_1_1.dll_CRYPTO_free
add esp, 0x18
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov eax, dword [esi + 0x20]
and byte [eax], 0xf8
mov eax, dword [esi + 0x20]
and byte [eax + 0x1f], 0x7f
mov eax, dword [esi + 0x20]
or byte [eax + 0x1f], 0x40
jmp 0x100e5afd
movdqu xmm0, xmmword [edi]
movdqu xmmword [eax], xmm0
movdqu xmm0, xmmword [edi + 0x10]
movdqu xmmword [eax + 0x10], xmm0
push dword [esi + 0x20]
push esi
call fcn.10001ab9
add esp, 8
push esi
push 0x40a
push dword [esp + 0x18]
call sym.libcrypto_1_1.dll_EVP_PKEY_assign
add esp, 0xc
mov eax, 1
pop esi
pop edi
pop ebx
ret
Function at 0x100f5850
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc
call fcn.101704b0
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ecx, dword [eax + 0x60]
mov ebp, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x28]
mov edx, dword [ecx + 0x70]
mov dword [esp + 0x1c], ecx
test edx, edx
je 0x100f58b3
test edi, edi
je 0x100f5894
nop
cmp edx, 0x40
jae 0x100f5894
mov al, byte [edx + ecx + 0x30]
inc edx
xor al, byte [ebx]
inc ebx
mov byte [ebp], al
inc ebp
dec edi
jne 0x100f5880
mov dword [ecx + 0x70], edx
test edi, edi
je 0x100f596c
cmp edx, 0x40
jne 0x100f58b3
mov dword [ecx + 0x70], 0
inc dword [ecx + 0x20]
jne 0x100f58b3
inc dword [ecx + 0x24]
mov eax, edi
lea edx, [ecx + 0x20]
and eax, 0x3f
mov dword [esp + 0x14], edx
sub edi, eax
mov dword [esp + 0xc], eax
mov eax, dword [edx]
push esi
cmp edi, 0x40
jb 0x100f5919
lea ecx, [ecx]
mov esi, edi
shr esi, 6
add eax, esi
mov dword [esp + 0x14], eax
cmp eax, esi
jae 0x100f58e9
sub esi, eax
mov dword [esp + 0x14], 0
push edx
push ecx
shl esi, 6
push esi
push ebx
push ebp
call fcn.1001b6c0
mov edx, dword [esp + 0x2c]
add esp, 0x14
mov eax, dword [esp + 0x14]
sub edi, esi
mov ecx, dword [esp + 0x20]
add ebx, esi
add ebp, esi
mov dword [edx], eax
test eax, eax
jne 0x100f5914
inc dword [ecx + 0x24]
cmp edi, 0x40
jae 0x100f58d0
cmp dword [esp + 0x10], 0
je 0x100f596b
push 0x40
lea edi, [ecx + 0x30]
push 0
push edi
call sub.MSVCR120.dll_memset
push dword [esp + 0x24]
mov esi, dword [esp + 0x30]
push esi
push 0x40
push edi
push edi
call fcn.1001b6c0
mov eax, dword [esp + 0x30]
add esp, 0x20
xor edx, edx
test eax, eax
je 0x100f5968
sub ebx, ebp
mov esi, eax
lea ecx, [edx + ebp]
mov al, byte [ebx + ecx]
xor al, byte [edi + edx]
inc edx
mov byte [ecx], al
cmp edx, esi
jb 0x100f5950
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov dword [esi + 0x70], eax
pop esi
pop edi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x10103f60
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
jmp 0x10103f60
mov eax, 0x8c
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x88], eax
mov edx, dword [esp + 0xa0]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [esp + 0xac]
mov dword [esp + 0x10], edx
test edi, edi
je 0x10103fc6
cmp edi, dword [esi]
je 0x10103fbd
test ebp, ebp
je 0x10104040
test ebx, ebx
js 0x10104040
mov eax, 1
mov dword [esi], edi
jmp 0x10103fcc
mov edi, dword [esi]
test edi, edi
je 0x10104040
test ebp, ebp
je 0x1010415a
push edi
call sym.libcrypto_1_1.dll_EVP_MD_block_size
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x10104000
push 0x28
push str.cryptohmachmac.c
push str.assertion_failed:_j____int_sizeof_ctx__key_
call sym.libcrypto_1_1.dll_OPENSSL_die
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
jge 0x1010405b
push dword [esp + 0x10]
push edi
push dword [esi + 4]
call sym.libcrypto_1_1.dll_EVP_DigestInit_ex
add esp, 0xc
test eax, eax
je 0x10104040
push ebx
push ebp
push dword [esi + 4]
call sym.libcrypto_1_1.dll_EVP_DigestUpdate
add esp, 0xc
test eax, eax
je 0x10104040
lea ebp, [esi + 0x10]
push ebp
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call sym.libcrypto_1_1.dll_EVP_DigestFinal_ex
add esp, 0xc
test eax, eax
jne 0x10104077
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101704a0
add esp, 0x8c
ret
cmp ebx, 0x80
ja 0x10104040
push ebx
lea eax, [esi + 0x14]
push ebp
push eax
call sub.MSVCR120.dll_memcpy
lea ebp, [esi + 0x10]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x80
je 0x1010409a
mov eax, 0x80
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x101040a0
push edx
push edi
push dword [esi + 8]
call sym.libcrypto_1_1.dll_EVP_DigestInit_ex
add esp, 0xc
test eax, eax
je 0x10104040
push edi
call sym.libcrypto_1_1.dll_EVP_MD_block_size
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call sym.libcrypto_1_1.dll_EVP_DigestUpdate
add esp, 0x10
test eax, eax
je 0x10104040
xor ecx, ecx
lea esp, [esp]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x101040f0
push dword [esp + 0x10]
push edi
push dword [esi + 0xc]
call sym.libcrypto_1_1.dll_EVP_DigestInit_ex
add esp, 0xc
test eax, eax
je 0x10104040
push edi
call sym.libcrypto_1_1.dll_EVP_MD_block_size
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call sym.libcrypto_1_1.dll_EVP_DigestUpdate
add esp, 0x10
test eax, eax
je 0x10104040
push dword [esi + 8]
push dword [esi + 4]
call sym.libcrypto_1_1.dll_EVP_MD_CTX_copy_ex
add esp, 8
test eax, eax
je 0x10104040
mov eax, 1
jmp 0x10104042
test eax, eax
je 0x1010413a
jmp 0x1010409e
Function at 0x101055e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x101055e0
mov eax, 0x28
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
push ebx
push ebp
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
shl ebx, 0x18
push esi
push edi
mov edi, dword [esp + 0x50]
movzx eax, byte [edx]
movzx ecx, byte [edx + 3]
shl eax, 0x10
or ebx, eax
shl ecx, 0x18
movzx eax, byte [edx + 1]
shl eax, 8
or ebx, eax
mov esi, dword [edi]
movzx eax, byte [edx + 2]
or ebx, eax
mov dword [esp + 0x14], edi
movzx eax, byte [edx + 4]
shl eax, 0x10
or ecx, eax
mov dword [esp + 0x28], ebp
movzx eax, byte [edx + 6]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 5]
mov edx, dword [esp + 0x2c]
shl ecx, 8
or ecx, eax
mov dword [esp + 0x18], ebx
mov eax, ebx
mov byte [esp + 0x2f], bl
shr eax, 0x18
or edx, ecx
mov byte [esp + 0x2c], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x32], al
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edx
mov byte [esp + 0x33], dl
test eax, eax
je 0x101057a5
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
lea esp, [esp]
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x10105735
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
call sym.libcrypto_1_1.dll_IDEA_encrypt
mov ebx, dword [esp + 0x20]
add esp, 8
mov edx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2c], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2e], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x30], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 8
inc ebp
mov byte [esp + 0x2f], bl
mov byte [esp + 0x32], al
mov byte [esp + 0x33], dl
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x101056d0
test ebp, ebp
mov ebp, dword [esp + 0x28]
je 0x1010578c
mov ecx, dword [esp + 0x24]
mov eax, ebx
shr eax, 0x18
mov byte [ecx], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp], al
mov eax, ebx
shr eax, 8
mov byte [ebp + 1], al
mov eax, edx
shr eax, 0x18
mov byte [ebp + 2], bl
mov byte [ebp + 3], al
mov eax, edx
shr eax, 0x10
mov byte [ebp + 4], al
mov eax, edx
shr eax, 8
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.101704a0
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101704a0
add esp, 0x28
ret
Function at 0x101061c0
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, 4
call fcn.101704b0
push 0x10106530
push 0x101f46b4
call sym.libcrypto_1_1.dll_CRYPTO_THREAD_init_local
push sym.libcrypto_1_1.dll_OPENSSL_cleanup
call fcn.1017101b
add esp, 0xc
call sym.libcrypto_1_1.dll_CRYPTO_THREAD_lock_new
mov dword [0x101f463c], eax
test eax, eax
jne 0x101061f6
pop ecx
ret
call fcn.10002036
lea eax, [esp]
mov dword [0x101f4644], 1
push eax
push 0x101f4644
push 5
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
dec eax
neg eax
sbb eax, eax
inc eax
pop ecx
ret

Function at 0x101075a0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call sym.libcrypto_1_1.dll_EVP_MD_type
add esp, 4
cmp eax, 0x72
jne 0x101076ea
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
push ebp
push edi
push esi
push dword [esp + 0x28]
mov edi, eax
and eax, 1
push dword [esp + 0x28]
shr edi, 1
push dword [esp + 0x28]
lea ebp, [eax + edi]
push ebp
push dword [esp + 0x28]
call sym.libcrypto_1_1.dll_EVP_md5
push eax
call fcn.10107290
add esp, 0x1c
test eax, eax
jne 0x101075f3
pop edi
pop ebp
pop esi
ret
push ebx
push 0xf8
push str.cryptokdf_tls1_prf.c
push esi
call sym.libcrypto_1_1.dll_CRYPTO_malloc
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x10107645
mov eax, dword [esp + 0x18]
push esi
push ebx
push dword [esp + 0x2c]
add eax, edi
push dword [esp + 0x2c]
push ebp
push eax
call sym.libcrypto_1_1.dll_EVP_sha1
push eax
call fcn.10107290
add esp, 0x1c
test eax, eax
jne 0x1010764c
push 0xfd
push str.cryptokdf_tls1_prf.c
push esi
push ebx
call sym.libcrypto_1_1.dll_CRYPTO_clear_free
add esp, 0x10
pop ebx
pop edi
pop ebp
xor eax, eax
pop esi
ret
xor edi, edi
test esi, esi
je 0x101076cc
mov edx, dword [esp + 0x28]
cmp esi, 0x20
jb 0x101076b1
lea eax, [esi - 1]
lea ecx, [edx - 1]
add eax, ebx
add ecx, esi
cmp edx, eax
ja 0x1010766d
cmp ecx, ebx
jae 0x101076b1
mov eax, esi
mov ecx, esi
and eax, 0x1f
mov ebp, ebx
sub ecx, eax
mov eax, edx
sub ebp, edx
lea esp, [esp]
movdqu xmm0, xmmword [eax]
lea eax, [eax + 0x20]
movdqu xmm1, xmmword [eax + ebp - 0x20]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x20], xmm1
movdqu xmm1, xmmword [ebx + edi + 0x10]
add edi, 0x20
movdqu xmm0, xmmword [eax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [eax - 0x10], xmm1
cmp edi, ecx
jb 0x10107680
cmp edi, esi
jae 0x101076cc
mov ebp, ebx
lea ecx, [edi + edx]
sub ebp, edx
mov edx, esi
sub edx, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor byte [ecx - 1], al
dec edx
jne 0x101076c0
push 0x102
push str.cryptokdf_tls1_prf.c
push esi
push ebx
call sym.libcrypto_1_1.dll_CRYPTO_clear_free
add esp, 0x10
mov eax, 1
pop ebx
pop edi
pop ebp
pop esi
ret
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push dword [esp + 0x20]
push esi
call fcn.10107290
add esp, 0x1c
neg eax
sbb eax, eax
neg eax
pop esi
ret