joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10143a90
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10241f28
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebp
push esi
mov eax, dword [0x102a8930]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x84]
mov eax, dword [esp + 0x80]
mov esi, ebp
mov dword [ebx + 0x34], str.makeAttribute
call fcn.10180680
test eax, eax
jle 0x10143b20
mov eax, dword [ebp + 0x34]
test eax, eax
je 0x10143ae2
cmp dword [ebp + 0x2c], 0
jne 0x10143ae7
mov eax, 0x1025bd4e
mov ecx, dword [ebx + 0x30]
push eax
mov eax, dword [ebx + 0x34]
push 2
push str.pAttr
push eax
push ecx
push 0x1c7
push ebx
mov ecx, str......._srcDSProcessPSignedData.cpp
call fcn.100e2fd0
mov eax, 2
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x70
ret 8
lea eax, [esp + 0xc]
call fcn.1017c4f0
mov dword [esp + 0xc], vtable.ASN1OctetString.0
mov dword [esp + 0x68], str.ASN1OctetString
mov dword [esp + 0x6c], 0x1025bd4e
mov byte [esp + 0x10], 4
lea esi, [esp + 0x20]
mov dword [esp + 0x78], 1
call fcn.101e5f90
lea ecx, [esp + 0xc]
call fcn.1017c650
lea ecx, [ebp + 0xa8]
call fcn.10186d70
cmp dword [esp + 0x1c], 0
jle 0x10143bcd
lea ecx, [esp + 0x48]
call fcn.101e6430
mov edx, dword [ebx + 0x34]
push eax
mov eax, dword [ebx + 0x30]
push 6
push str.asnOct
push edx
push eax
push 0x1df
push ebx
mov ecx, str......._srcDSProcessPSignedData.cpp
call fcn.100e2fd0
mov dword [esp + 0x78], 0xffffffff
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], vtable.ASN1OctetString.0
call fcn.1017c580
mov eax, 6
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x70
ret 8
mov dword [esp + 0x78], 0xffffffff
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], vtable.ASN1OctetString.0
call fcn.1017c580
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x70
ret 8
Function at 0x10150ce0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x102440a0
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
mov eax, dword [0x102a8930]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [edi + 0x34], str.GenKeyPair
cmp esi, 1
jne 0x10150e02
xor esi, esi
mov ebx, vtable.C3303::ByteString.0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], vtable.DSSign.0
mov dword [esp + 0x40], ebx
mov dword [esp + 0x50], esi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov dword [esp + 0x30], str.DSSign
mov dword [esp + 0x34], 0x1025bd4e
mov dword [esp + 0x3c], esi
mov dword [esp + 0x38], esi
mov ebx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push ebx
push eax
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x70], esi
call fcn.101e4f20
test eax, eax
jle 0x10150dec
mov eax, dword [esp + 0x20]
cmp eax, esi
je 0x10150d9d
cmp dword [esp + 0x18], esi
jne 0x10150da2
mov eax, 0x1025bd4e
mov ecx, dword [edi + 0x34]
mov edx, dword [edi + 0x30]
push eax
push 1
push str.DSSign::GenerateKeyPair
push ecx
push edx
push 0x293
push edi
mov ecx, str......._srcDSProcessPGenKeyPair.cpp
call fcn.100e2fd0
lea ecx, [esp + 0xc]
mov dword [esp + 0x60], 0xffffffff
call fcn.101e4d80
mov eax, 1
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0xc]
mov dword [esp + 0x60], 0xffffffff
call fcn.101e4d80
jmp 0x10150ec8
cmp esi, 2
jne 0x10150ec8
xor esi, esi
mov dword [esp + 0x14], vtable.C3303::ByteString.0
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], vtable.DSKey.0
mov dword [esp + 0x30], str.DSKey
mov dword [esp + 0x34], 0x1025bd4e
push ecx
mov ecx, edx
push eax
lea edx, [esp + 0x14]
mov dword [esp + 0x68], 1
call fcn.101e5340
test eax, eax
jle 0x10150eb7
mov eax, dword [esp + 0x20]
cmp eax, esi
je 0x10150e68
cmp dword [esp + 0x18], esi
jne 0x10150e6d
mov eax, 0x1025bd4e
mov ecx, dword [edi + 0x30]
push eax
mov eax, dword [edi + 0x34]
push 2
push str.DSKey::GenerateKeyPair
push eax
push ecx
push 0x299
push edi
mov ecx, str......._srcDSProcessPGenKeyPair.cpp
call fcn.100e2fd0
lea ecx, [esp + 0xc]
mov dword [esp + 0x60], 0xffffffff
call fcn.101e56a0
mov eax, 2
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
lea ecx, [esp + 0xc]
mov dword [esp + 0x60], 0xffffffff
call fcn.101e56a0
xor eax, eax
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x101541f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1024440b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x102a8930]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x74], 0
mov dword [esi + 0x34], str.setModulus
jne 0x10154291
push 0x480
call fcn.1021b8a4
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x14], 0
test eax, eax
je 0x10154246
push eax
call fcn.1018d4a0
jmp 0x10154248
xor eax, eax
mov dword [esp + 0x14], 0xffffffff
mov dword [esi + 0x74], eax
test eax, eax
jne 0x10154291
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x30]
push str.The_memory_m_pRSAPriKey__allocation_is_failed.
push 1
push str.m_pRSAPriKey
push eax
push ecx
push 0xa2
push esi
mov ecx, str......._srcDSProcessPPrivateKeyUtil.cpp
call fcn.100e2fd0
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
mov eax, dword [edi + 0xc]
mov esi, dword [esi + 0x74]
mov ecx, dword [edi + 4]
test eax, eax
je 0x101542a2
test ecx, ecx
jne 0x101542a7
mov eax, 0x1025bd4e
push ecx
push eax
add esi, 0xac
push esi
call fcn.10184990
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x10154b10
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10243fe8
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push esi
push edi
mov eax, dword [0x102a8930]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
lea eax, [esp + 0xc]
mov dword [edi + 0x34], str.parseECCParam
call fcn.1017c4f0
mov dword [esp + 0xc], vtable.ASN1ObjectIdentifier.0
mov byte [esp + 0x10], 6
mov dword [esp + 0x78], 0
cmp dword [esi + 8], 0
mov eax, dword [esi + 4]
jne 0x10154b6e
mov esi, 0x1025bd4e
jmp 0x10154b71
mov esi, dword [esi + 0xc]
push 0
push eax
push esi
lea ecx, [esp + 0x18]
call fcn.10197630
test eax, eax
jle 0x10154be8
mov eax, dword [esp + 0x54]
test eax, eax
je 0x10154b91
cmp dword [esp + 0x4c], 0
jne 0x10154b96
mov eax, 0x1025bd4e
mov ecx, dword [edi + 0x30]
push eax
mov eax, dword [edi + 0x34]
push 1
push str.eccCurve
push eax
push ecx
push 0x1f6
push edi
mov ecx, str......._srcDSProcessPPrivateKeyUtil.cpp
call fcn.100e2fd0
mov dword [esp + 0x78], 0xffffffff
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], vtable.ASN1ObjectIdentifier.0
call fcn.1017c580
mov eax, 1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x70
ret 4
lea ecx, [esp + 0xc]
call fcn.10197390
mov esi, dword [esp + 0x80]
mov edi, eax
call fcn.101e5f90
mov dword [esp + 0x78], 0xffffffff
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], vtable.ASN1ObjectIdentifier.0
call fcn.1017c580
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x70
ret 4
Function at 0x10154d60
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10243f88
mov eax, dword fs:[0]
push eax
sub esp, 0x64
push ebx
push edi
mov eax, dword [0x102a8930]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0xc]
mov dword [esi + 0x34], str.parseKCDSAPriKey
call fcn.1017c4f0
mov ebx, vtable.ASN1Integer.0
mov dword [esp + 0xc], ebx
mov dword [esp + 0x68], str.ASN1Integer
mov dword [esp + 0x6c], 0x1025bd4e
mov byte [esp + 0x10], 2
mov dword [esp + 0x78], 0
cmp dword [edi + 8], 0
mov eax, dword [edi + 4]
jne 0x10154dcd
mov edi, 0x1025bd4e
jmp 0x10154dd0
mov edi, dword [edi + 0xc]
push 0
push eax
push edi
lea ecx, [esp + 0x18]
call fcn.10184b80
test eax, eax
jle 0x10154e43
mov eax, dword [esp + 0x54]
test eax, eax
je 0x10154df0
cmp dword [esp + 0x4c], 0
jne 0x10154df5
mov eax, 0x1025bd4e
mov ecx, dword [esi + 0x30]
push eax
mov eax, dword [esi + 0x34]
push 1
push str.priKey
push eax
push ecx
push 0x219
push esi
mov ecx, str......._srcDSProcessPPrivateKeyUtil.cpp
call fcn.100e2fd0
mov dword [esp + 0x78], 0xffffffff
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], ebx
call fcn.1017c580
mov eax, 1
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x70
ret 4
mov eax, dword [esp + 0x80]
push 0
lea edx, [esp + 0x10]
push edx
call fcn.10184aa0
test eax, eax
je 0x10154ebc
mov eax, dword [esp + 0x54]
test eax, eax
je 0x10154e69
cmp dword [esp + 0x4c], 0
jne 0x10154e6e
mov eax, 0x1025bd4e
mov ecx, dword [esi + 0x30]
push eax
mov eax, dword [esi + 0x34]
push 2
push str.priKey
push eax
push ecx
push 0x21c
push esi
mov ecx, str......._srcDSProcessPPrivateKeyUtil.cpp
call fcn.100e2fd0
mov dword [esp + 0x78], 0xffffffff
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], ebx
call fcn.1017c580
mov eax, 2
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x70
ret 4
mov dword [esp + 0x78], 0xffffffff
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], ebx
call fcn.1017c580
xor eax, eax
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x70
ret 4
Function at 0x10156470
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10241de8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push esi
push edi
mov eax, dword [0x102a8930]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, edx
xor edi, edi
mov dword [esi + 0x34], str.verifySignatureWithCert
mov dword [esp + 0xc], vtable.C3303::ByteString.0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x30], edi
call fcn.1015a330
test eax, eax
jle 0x1015653d
mov eax, dword [esi + 0x28]
cmp eax, edi
je 0x101564d7
cmp dword [esi + 0x20], edi
jne 0x101564dc
mov eax, 0x1025bd4e
mov ecx, dword [esi + 0x34]
mov edx, dword [esi + 0x30]
push eax
push 1
push str.this
push ecx
push edx
push 0x159
push esi
mov ecx, str......._srcDSProcessPPublicKey.cpp
call fcn.100e2fd0
mov dword [esp + 0x28], 0xffffffff
mov esi, dword [esp + 0x18]
cmp esi, edi
je 0x10156524
mov eax, dword [esp + 0x14]
push eax
push edi
push esi
call fcn.10228aa0
add esp, 0xc
push esi
call fcn.1021b8de
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0x10
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x34]
push edx
push eax
push ecx
push esi
lea ecx, [esp + 0x20]
call fcn.10155f20
test eax, eax
jle 0x101565d1
mov eax, dword [esi + 0x28]
cmp eax, edi
je 0x1015656b
cmp dword [esi + 0x20], edi
jne 0x10156570
mov eax, 0x1025bd4e
mov edx, dword [esi + 0x34]
push eax
mov eax, dword [esi + 0x30]
push 2
push str.this
push edx
push eax
push 0x15c
push esi
mov ecx, str......._srcDSProcessPPublicKey.cpp
call fcn.100e2fd0
mov dword [esp + 0x28], 0xffffffff
mov esi, dword [esp + 0x18]
cmp esi, edi
je 0x101565b8
mov ecx, dword [esp + 0x14]
push ecx
push edi
push esi
call fcn.10228aa0
add esp, 0xc
push esi
call fcn.1021b8de
add esp, 4
mov eax, 2
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0x10
mov dword [esp + 0x28], 0xffffffff
mov esi, dword [esp + 0x18]
cmp esi, edi
je 0x101565f9
mov edx, dword [esp + 0x14]
push edx
push edi
push esi
call fcn.10228aa0
add esp, 0xc
push esi
call fcn.1021b8de
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x20
ret 0x10
Function at 0x1015b650
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x408
mov eax, dword [0x102a8930]
xor eax, esp
mov dword [esp + 0x404], eax
mov eax, dword [esp + 0x410]
cmp dword [eax + 8], 0
push ebp
mov ebp, dword [esp + 0x410]
push esi
push edi
mov edi, 0x1025bd4e
je 0x1015b683
mov edi, dword [eax + 0xc]
mov esi, dword [eax + 4]
test esi, esi
je 0x1015b7e6
push ebx
push 0x200
lea eax, [esp + 0x218]
push 0x30
push eax
call fcn.10228aa0
push 0x200
lea ecx, [esp + 0x24]
push 0x30
push ecx
call fcn.10228aa0
mov bl, 0x43
mov byte [esp + 0x38], bl
mov dl, 0x44
mov cl, 0x45
mov al, 0x46
mov byte [esp + 0x2ec], bl
add esp, 0x18
xor ebx, ebx
mov byte [esp + 0x14], 0x30
mov byte [esp + 0x15], 0x31
mov byte [esp + 0x16], 0x32
mov byte [esp + 0x17], 0x33
mov byte [esp + 0x18], 0x34
mov byte [esp + 0x19], 0x35
mov byte [esp + 0x1a], 0x36
mov byte [esp + 0x1b], 0x37
mov byte [esp + 0x1c], 0x38
mov byte [esp + 0x1d], 0x39
mov byte [esp + 0x1e], 0x41
mov byte [esp + 0x1f], 0x42
mov byte [esp + 0x21], dl
mov byte [esp + 0x22], cl
mov byte [esp + 0x23], al
mov byte [esp + 0x224], 0x31
mov byte [esp + 0x234], 0x32
mov byte [esp + 0x244], 0x33
mov byte [esp + 0x254], 0x34
mov byte [esp + 0x264], 0x35
mov byte [esp + 0x274], 0x36
mov byte [esp + 0x284], 0x37
mov byte [esp + 0x294], 0x38
mov byte [esp + 0x2a4], 0x39
mov byte [esp + 0x2b4], 0x41
mov byte [esp + 0x2c4], 0x42
mov byte [esp + 0x2e4], dl
mov byte [esp + 0x2f4], cl
mov byte [esp + 0x304], al
test esi, esi
jle 0x1015b7e5
xor eax, eax
mov word [esp + 0x10], ax
mov byte [esp + 0x12], al
movzx edx, byte [ebx + edi]
and edx, 0xf0
mov al, byte [esp + edx + 0x214]
mov byte [esp + 0x10], al
movzx ecx, byte [ebx + edi]
and ecx, 0xf
mov dl, byte [esp + ecx + 0x14]
mov byte [esp + 0x11], dl
test ebx, ebx
jne 0x1015b7bf
push 0x1026265c
jmp 0x1015b7c9
test bl, 0x3f
jne 0x1015b7d2
push str._n
push ebp
call fcn.1022704c
add esp, 8
lea eax, [esp + 0x10]
push eax
push ebp
call fcn.1022704c
inc ebx
add esp, 8
cmp ebx, esi
jl 0x1015b785
pop ebx
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.1022649a
add esp, 0x408
ret
Function at 0x10169340
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10241de8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebp
push esi
mov eax, dword [0x102a8930]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov ebp, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
mov dword [eax + 0x34], str.getAlgorithm
mov dword [edi], 0
mov dword [esi], 0
mov ecx, str.1_2_840_113549_1_12_1_3
mov eax, ebp
mov dword [ebx], 0
call fcn.101e62f0
test al, al
je 0x101693c0
mov dword [edi], 0xbc3
mov dword [esi], 0x18
mov dword [ebx], 4
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x20
ret 8
mov ecx, str.1_2_840_113549_1_12_1_4
mov eax, ebp
call fcn.101e62f0
test al, al
je 0x101693f8
mov dword [edi], 0xbc2
mov dword [esi], 0x10
mov dword [ebx], 4
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x20
ret 8
mov ecx, str.1_2_840_113549_1_12_1_1
mov eax, ebp
call fcn.101e62f0
test al, al
je 0x1016942a
mov dword [edi], 0xbf4
mov dword [esi], 0x10
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x20
ret 8
mov ecx, str.1_2_840_113549_1_12_1_2
mov eax, ebp
call fcn.101e62f0
test al, al
je 0x1016945c
mov dword [edi], 0xbf4
mov dword [esi], 5
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x20
ret 8
mov ecx, str.1_2_840_113549_1_12_1_5
mov eax, ebp
call fcn.101e62f0
test al, al
je 0x10169494
mov dword [edi], 0xbec
mov dword [esi], 0x10
mov dword [ebx], 4
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x20
ret 8
mov ecx, str.1_2_840_113549_1_12_1_6
mov eax, ebp
call fcn.101e62f0
test al, al
je 0x101694cc
mov dword [edi], 0xbea
mov dword [esi], 5
mov dword [ebx], 4
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x20
ret 8
xor esi, esi
mov dword [esp + 0xc], vtable.C3303::ByteString.0
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov ecx, ebp
mov dword [esp + 0x28], esi
call fcn.101e6430
push eax
push str.The_bsAlgorithm__s__is_not_supported.
lea eax, [esp + 0x14]
call fcn.101e6de0
mov eax, dword [esp + 0x20]
add esp, 8
cmp eax, esi
je 0x10169511
cmp dword [esp + 0x10], esi
jne 0x10169516
mov eax, 0x1025bd4e
push eax
mov eax, dword [esp + 0x34]
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 0x30]
push 7
push str.bsAlgorithm
push ecx
push edx
push 0x619
push eax
mov ecx, str......._srcDSProcessPPKCS12.cpp
call fcn.100e2fd0
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.101e5b00
mov eax, 7
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
add esp, 0x20
ret 8
Function at 0x1016c7e0
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x1023fe66
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x102a8930]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
call fcn.100e2e80
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [esi], vtable.PPKCS8.0
mov ecx, vtable.C3303::ByteString.0
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x70], ecx
mov dword [esi + 0x80], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
lea eax, [esi + 0x84]
mov dword [eax], ecx
mov dword [eax + 0x10], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [esi + 0x98], ecx
mov dword [esi + 0xa8], ebx
mov dword [esi + 0xa4], ebx
mov dword [esi + 0x9c], ebx
mov dword [esi + 0xa0], ebx
mov dword [esi + 0xb0], ecx
mov dword [esi + 0xc0], ebx
mov dword [esi + 0xbc], ebx
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov dword [esi + 0xc4], ecx
mov dword [esi + 0xd4], ebx
mov dword [esi + 0xd0], ebx
mov dword [esi + 0xc8], ebx
mov dword [esi + 0xcc], ebx
mov byte [esp + 0x14], 6
push eax
mov edx, str.1_2_410_200004_1_4
mov dword [esi + 0x30], str.PPKCS8
mov dword [esi + 0x34], 0x1025bd4e
mov byte [esi + 0x38], bl
mov dword [esi + 0x3c], 0x18
mov dword [esi + 0x44], 0xbcc
call fcn.101e5eb0
mov dword [esi + 0x40], 0x13a6
mov dword [esi + 0x50], 0x14
mov dword [esi + 0x48], 0x20
mov dword [esi + 0x4c], 0x10
mov dword [esi + 0x58], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0xac], 0x400
mov dword [esi + 0xd8], ebx
mov byte [esi + 0xdc], bl
mov byte [esi + 0xdd], bl
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x1016fec0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x102480de
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x102a8930]
xor eax, esp
push eax
lea eax, [esp + 0xa0]
mov dword fs:[0], eax
mov eax, dword [esp + 0xb4]
mov ebp, dword [esp + 0xb0]
mov dword [ebp + 0x34], str.Encrypt
mov ecx, dword [eax + 0xc]
mov edi, dword [eax + 4]
xor ebx, ebx
push ecx
lea esi, [esp + 0x18]
mov dword [esp + 0x18], vtable.C3303::ByteString.0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.101e5d60
mov dword [esp + 0x24], eax
mov dword [esp + 0xa8], ebx
mov dword [esp + 0x28], vtable.C3303::ByteString.0
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
lea eax, [esp + 0x3c]
call fcn.101e34a0
mov byte [esp + 0xa8], 2
mov eax, dword [ebp + 0xc8]
push 2
neg eax
lea edx, [esp + 0x2c]
push edx
sbb eax, eax
and eax, 4
lea esi, [ebp + 0xb0]
push esi
push eax
mov eax, dword [ebp + 0x44]
push eax
lea edx, [esp + 0x50]
lea ecx, [ebp + 0xc4]
push edx
lea eax, [esp + 0x2c]
call fcn.101e3bf0
test eax, eax
mov eax, dword [esi + 0xc]
jle 0x10170047
cmp eax, ebx
je 0x1016ffad
mov ecx, dword [esi + 4]
push ecx
push ebx
push eax
call fcn.10228aa0
add esp, 0xc
mov eax, dword [esp + 0x50]
cmp eax, ebx
je 0x1016ffbb
cmp dword [esp + 0x48], ebx
jne 0x1016ffc0
mov eax, 0x1025bd4e
mov edx, dword [ebp + 0x34]
push eax
mov eax, dword [ebp + 0x30]
push 1
push str.encrypt.EncryptData__
push edx
push eax
push 0x45e
push ebp
mov ecx, str......._srcDSProcessPPKCS8.cpp
call fcn.100e2fd0
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa8], 1
call fcn.101e3520
mov byte [esp + 0xa8], bl
mov esi, dword [esp + 0x34]
cmp esi, ebx
je 0x10170015
mov ecx, dword [esp + 0x30]
push ecx
push ebx
push esi
call fcn.10228aa0
push esi
call fcn.1021b8de
add esp, 0x10
mov dword [esp + 0xa8], 0xffffffff
mov esi, dword [esp + 0x20]
cmp esi, ebx
je 0x1017003d
mov edx, dword [esp + 0x1c]
push edx
push ebx
push esi
call fcn.10228aa0
push esi
call fcn.1021b8de
add esp, 0x10
mov eax, 1
jmp 0x101700c8
cmp eax, ebx
je 0x10170059
mov ecx, dword [esi + 4]
push ecx
push ebx
push eax
call fcn.10228aa0
add esp, 0xc
mov esi, dword [esp + 0xb8]
lea edi, [esp + 0x28]
call fcn.101e5f90
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa8], 1
call fcn.101e3520
mov byte [esp + 0xa8], bl
mov esi, dword [esp + 0x34]
cmp esi, ebx
je 0x1017009e
mov edx, dword [esp + 0x30]
push edx
push ebx
push esi
call fcn.10228aa0
push esi
call fcn.1021b8de
add esp, 0x10
mov dword [esp + 0xa8], 0xffffffff
mov esi, dword [esp + 0x20]
cmp esi, ebx
je 0x101700c6
mov eax, dword [esp + 0x1c]
push eax
push ebx
push esi
call fcn.10228aa0
push esi
call fcn.1021b8de
add esp, 0x10
xor eax, eax
mov ecx, dword [esp + 0xa0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x98
ret 0xc
Function at 0x101732d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1024440b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x102a8930]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
cmp dword [edi + 0x38], 0
mov dword [edi + 0x34], str.setNonce
jne 0x10173371
push 0x3f4
call fcn.1021b8a4
add esp, 4
mov dword [esp + 8], eax
mov dword [esp + 0x14], 0
test eax, eax
je 0x10173324
push eax
call fcn.101d8350
jmp 0x10173326
xor eax, eax
mov dword [esp + 0x14], 0xffffffff
mov dword [edi + 0x38], eax
test eax, eax
jne 0x10173371
mov eax, dword [edi + 0x34]
mov ecx, dword [edi + 0x30]
push str.Memory_allocation_is_failed.
push 1
push str.m_pTimeStampReq
push eax
push ecx
push 0x94
push edi
mov ecx, str......._srcDSProcessPTimeStampRequest.cpp
call fcn.100e2fd0
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
mov eax, dword [esp + 0x1c]
mov esi, dword [edi + 0x38]
call fcn.101d8780
test eax, eax
jle 0x101733d1
mov eax, dword [edi + 0x38]
mov ecx, dword [eax + 0x34]
add eax, 0x28
test ecx, ecx
je 0x10173394
cmp dword [eax + 4], 0
jne 0x10173399
mov ecx, 0x1025bd4e
mov edx, dword [edi + 0x34]
mov eax, dword [edi + 0x30]
push ecx
push 2
push str.m_pTimeStampReq
push edx
push eax
push 0x98
push edi
mov ecx, str......._srcDSProcessPTimeStampRequest.cpp
call fcn.100e2fd0
mov eax, 2
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4
xor eax, eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 4