joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10054940
Capabilities:
Resolve dns

Disassembly:
mov eax, 0x428
call fcn.101cf170
mov eax, dword [0x10263fdc]
xor eax, esp
mov dword [esp + 0x424], eax
push ebp
mov ebp, dword [esp + 0x434]
call fcn.100543c0
cmp eax, 1
je 0x10054982
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.101ce9e2
add esp, 0x428
ret
push 0x400
lea eax, [esp + 0x29]
push 0
push eax
mov byte [esp + 0x30], 0
call sub.MSVCR100.dll_memset
xor eax, eax
add esp, 0xc
mov byte [esp + 4], 0
mov dword [esp + 5], eax
mov dword [esp + 9], eax
mov dword [esp + 0xd], eax
mov dword [esp + 0x11], eax
mov dword [esp + 0x15], eax
mov dword [esp + 0x19], eax
mov dword [esp + 0x1d], eax
mov word [esp + 0x21], ax
mov byte [esp + 0x23], al
cmp dword [esp + 0x430], eax
je 0x100549d5
mov eax, 0xa
cmp word [edi], 2
mov ecx, 0x10
je 0x100549e5
mov ecx, 0x1c
push esi
push eax
push 0x20
lea edx, [esp + 0x10]
push edx
push 0x401
lea eax, [esp + 0x38]
push eax
push ecx
push edi
call dword [sym.imp.WS2_32.dll_getnameinfo]
mov esi, eax
test esi, esi
je 0x10054a68
push 0xdb
push str.crypto_bio_b_addr.c
push 2
push 0x86
push 0x20
call fcn.1003c300
add esp, 0x14
push 0
push 0x400
push 0x10269400
push 0x400
push esi
push 0
push 0x12ff
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
push 0x10269400
push 1
call fcn.1003c880
add esp, 8
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.101ce9e2
add esp, 0x428
ret
cmp byte [esp + 8], 0
jne 0x10054aa9
movzx eax, word [edi]
cmp eax, 2
jne 0x10054a7d
movzx eax, word [edi + 2]
jmp 0x10054a8a
cmp eax, 0x17
jne 0x10054a88
movzx eax, word [edi + 2]
jmp 0x10054a8a
xor eax, eax
push eax
call dword [sym.imp.WS2_32.dll_ntohs]
movzx ecx, ax
push ecx
push 0x1024e190
lea edx, [esp + 0x10]
push 0x20
push edx
call fcn.10049740
add esp, 0x10
test ebp, ebp
je 0x10054ac7
push 0xed
lea eax, [esp + 0x2c]
push str.crypto_bio_b_addr.c
push eax
call fcn.1004b7d0
add esp, 0xc
mov dword [ebp], eax
test ebx, ebx
je 0x10054ae4
push 0xef
lea ecx, [esp + 0xc]
push str.crypto_bio_b_addr.c
push ecx
call fcn.1004b7d0
add esp, 0xc
mov dword [ebx], eax
test ebp, ebp
je 0x10054aee
cmp dword [ebp], 0
je 0x10054af7
test ebx, ebx
je 0x10054b6b
cmp dword [ebx], 0
jne 0x10054b6b
test ebp, ebp
je 0x10054b18
mov edx, dword [ebp]
push 0xfe
push str.crypto_bio_b_addr.c
push edx
call fcn.10032790
add esp, 0xc
mov dword [ebp], 0
test ebx, ebx
je 0x10054b37
mov eax, dword [ebx]
push 0x102
push str.crypto_bio_b_addr.c
push eax
call fcn.10032790
add esp, 0xc
mov dword [ebx], 0
push 0x105
push str.crypto_bio_b_addr.c
push 0x41
push 0x86
push 0x20
call fcn.1003c300
add esp, 0x14
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.101ce9e2
add esp, 0x428
ret
mov ecx, dword [esp + 0x42c]
pop esi
pop ebp
xor ecx, esp
mov eax, 1
call fcn.101ce9e2
add esp, 0x428
ret
Function at 0x10054c10
Capabilities:
Resolve dns

Disassembly:
mov eax, 0x24
call fcn.101cf170
push esi
mov esi, dword [esp + 0x38]
push edi
xor edi, edi
mov eax, esi
sub eax, edi
mov dword [esp + 8], edi
je 0x10054c5c
sub eax, 2
je 0x10054c5c
sub eax, 0x15
je 0x10054c5c
push 0x297
push str.crypto_bio_b_addr.c
push 0x83
push 0x8f
push 0x20
call fcn.1003c300
add esp, 0x14
pop edi
xor eax, eax
pop esi
add esp, 0x24
ret
call fcn.100543c0
cmp eax, 1
jne 0x10054c54
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x3c], edi
mov dword [esp + 0xc], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
cmp esi, edi
jne 0x10054cad
or eax, 0x400
mov dword [esp + 0xc], eax
cmp dword [esp + 0x38], 1
jne 0x10054cbb
or eax, 1
mov dword [esp + 0xc], eax
mov edi, dword [esp + 0x48]
push ebx
mov ebx, dword [esp + 0x38]
push ebp
mov ebp, dword [esp + 0x38]
push edi
lea eax, [esp + 0x18]
push eax
push ebx
push ebp
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
je 0x10054d18
lea ecx, [ecx]
cmp esi, 8
je 0x10054d6e
mov eax, dword [esp + 0x14]
test eax, 0x400
je 0x10054d2c
push edi
lea ecx, [esp + 0x18]
push ecx
and eax, 0xfffffbff
push ebx
or eax, 4
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x54], esi
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov esi, eax
test esi, esi
jne 0x10054ce0
pop ebp
pop ebx
mov dword [esp + 8], 1
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x24
ret
push 0x2da
push str.crypto_bio_b_addr.c
push 2
push 0x8f
push 0x20
call fcn.1003c300
mov eax, dword [esp + 0x58]
add esp, 0x14
test eax, eax
je 0x10054d51
mov esi, eax
push esi
call fcn.10054690
push eax
push 1
call fcn.1003c880
mov eax, dword [esp + 0x1c]
add esp, 0xc
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x24
ret
push 0x2cb
push str.crypto_bio_b_addr.c
push 0x41
push 0x8f
push 0x20
call fcn.1003c300
mov eax, dword [esp + 0x24]
add esp, 0x14
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x24
ret
Function at 0x1005d370
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x84], 0xffffffff
jne 0x1005d382
xor eax, eax
pop edi
ret
mov eax, dword [edi]
push ebx
push esi
push eax
call fcn.10047020
mov ebx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add esp, 4
mov esi, eax
mov dword [ecx], esi
test ebx, ebx
je 0x1005d427
mov eax, dword [edi + 0x84]
push ebp
cmp eax, esi
jne 0x1005d3ce
test esi, esi
jle 0x1005d404
mov ecx, ebx
lea eax, [edi + 4]
mov ebp, esi
lea esp, [esp]
mov dl, byte [eax + 0x60]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
dec ebp
jne 0x1005d3c0
jmp 0x1005d404
mov ecx, esi
sub ecx, eax
mov byte [eax + edi + 0x64], 0x80
cmp ecx, 1
jle 0x1005d3ed
dec ecx
push ecx
lea eax, [eax + edi + 0x65]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
test esi, esi
jle 0x1005d404
mov ecx, ebx
lea eax, [edi + 0x24]
mov ebp, esi
mov dl, byte [eax + 0x40]
xor dl, byte [eax]
inc eax
mov byte [ecx], dl
inc ecx
dec ebp
jne 0x1005d3f8
mov eax, dword [edi]
push esi
push ebx
push ebx
push eax
call fcn.10047030
add esp, 0x10
pop ebp
test eax, eax
jne 0x1005d427
push esi
push ebx
call fcn.10045ee0
add esp, 8
pop esi
pop ebx
xor eax, eax
pop edi
ret
pop esi
pop ebx
mov eax, 1
pop edi
ret

Function at 0x10066de0
Capabilities:
Query environment variable

Disassembly:
mov eax, 8
call fcn.101cf170
cmp dword [0x10267a08], 0
jne 0x10066f2b
push ebx
push esi
push edi
push 0x30
push 0x102679a8
push str.OPENSSL_ia32cap
mov dword [0x10267a08], 1
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x2e
ja 0x10066f05
xor eax, eax
cmp word [0x102679a8], 0x7e
sete al
mov esi, eax
lea ecx, [esi*2 + 0x102679a8]
call fcn.10066d30
mov edi, eax
mov ebx, edx
test esi, esi
je 0x10066e72
push 0x10269c10
mov esi, edi
mov dword [esp + 0x14], ebx
call fcn.10045bc0
not edi
and edi, eax
not ebx
and esi, 0x1000000
xor eax, eax
add esp, 4
and ebx, edx
or esi, eax
je 0x10066e8d
and ebx, 0xedfff7fd
jmp 0x10066e8d
cmp word [0x102679a8], 0x3a
jne 0x10066e8d
push 0x10269c10
call fcn.10045bc0
add esp, 4
mov edi, eax
mov ebx, edx
mov dx, word [0x102679a8]
mov eax, 0x102679a8
movzx ecx, dx
test dx, dx
je 0x10066eb3
cmp cx, 0x3a
je 0x10066ec9
movzx ecx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x10066ea1
mov dword [0x10269c18], 0
mov dword [0x10269c1c], 0
jmp 0x10066f16
test eax, eax
je 0x10066eb3
xor ecx, ecx
cmp word [eax + 2], 0x7e
sete cl
mov esi, ecx
lea ecx, [eax + esi*2 + 2]
call fcn.10066d30
test esi, esi
je 0x10066ef8
not eax
and dword [0x10269c18], eax
not edx
and dword [0x10269c1c], edx
jmp 0x10066f16
mov dword [0x10269c18], eax
mov dword [0x10269c1c], edx
jmp 0x10066f16
push 0x10269c10
call fcn.10045bc0
add esp, 4
mov edi, eax
mov ebx, edx
or edi, 0x400
mov dword [0x10269c10], edi
pop edi
pop esi
mov dword [0x10269c14], ebx
pop ebx
add esp, 8
ret
Function at 0x10067070
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x208
call fcn.101cf170
mov eax, dword [0x10263fdc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x100670e5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x100670e5
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x204]
push 0x200
push edx
call sub.MSVCR100.dll__vsnprintf
add esp, 0x10
test eax, eax
jns 0x100670c8
mov eax, 0x200
push 0
lea ecx, [ebp - 0x208]
push ecx
push eax
lea edx, [ebp - 0x204]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1006722e
mov ebx, dword [ebp + 8]
mov eax, ebx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100670f0
sub eax, edx
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.101cf370
mov esi, esp
test esi, esi
jne 0x10067114
mov esi, str.no_stack_
jmp 0x1006719f
push edi
push esi
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x10067141
test edi, edi
je 0x10067141
lea ebx, [ebx]
mov ecx, dword [ebp + 8]
movsx dx, byte [eax + ecx]
mov word [esi + eax*2], dx
inc eax
cmp eax, edi
jb 0x10067130
xor eax, eax
test edi, edi
je 0x1006719f
cmp word [esi + eax*2], 0x25
jne case.0x10067164.43
lea ecx, [esi + eax*2 + 2]
movzx edx, word [ecx]
add edx, 0xffffffd6
cmp edx, 0x49
ja case.0x10067164.43
movzx edx, byte [edx + 0x10067260]
jmp dword [edx*4 + 0x10067248]
inc eax
add ecx, 2
jmp 0x10067152
mov ecx, 0x53
mov word [esi + eax*2 + 2], cx
jmp case.0x10067164.43
mov edx, 0x73
jmp 0x10067195
mov ecx, 0x43
mov word [esi + eax*2 + 2], cx
jmp case.0x10067164.43
mov edx, 0x63
mov word [esi + eax*2 + 2], dx
inc eax
cmp eax, edi
jb 0x10067147
lea eax, [ebp + 0xc]
push eax
push esi
lea ecx, [ebp - 0x204]
push 0xff
push ecx
call sub.MSVCR100.dll__vsnwprintf
xor edx, edx
add esp, 0x10
mov word [ebp - 6], dx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x10067218
call fcn.10066f30
test eax, eax
jle 0x10067218
push 0x101f47c4
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x1006722e
push 0
lea ecx, [ebp - 0x208]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x204]
push esi
mov dword [ebp - 0x208], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x1006722e
push 0x10
push str.OpenSSL:_FATAL
lea edx, [ebp - 0x204]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101ce9e2
mov esp, ebp
pop ebp
ret
Function at 0x100694d0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
cmp ebp, 2
je 0x1006954f
test eax, eax
je 0x1006951b
push eax
push 0
lea eax, [esp + 0x20]
push eax
push 0
call fcn.10038950
add esp, 0x10
cmp dword [esp + 0x18], 0xffffffff
je 0x1006951b
push 0x3b
push str.cryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call fcn.1003c300
add esp, 0x14
pop esi
xor eax, eax
pop ebp
ret
cmp dword [esp + 0x14], 0
je 0x1006954b
cmp edi, 0x40a
je 0x10069542
cmp edi, 0x43f
je 0x10069542
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x10069547
mov eax, 0x20
cmp esi, eax
je 0x1006954f
push 0x41
jmp 0x10069500
push ebx
push 0x46
push str.cryptoececx_meth.c
push 0x40
call fcn.10032720
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x10069585
push 0x48
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.1003c300
add esp, 0x14
pop ebx
pop esi
xor eax, eax
pop ebp
ret
test ebp, ebp
jne 0x1006959d
mov ecx, dword [esp + 0x18]
push esi
push ecx
push ebx
call sub.MSVCR100.dll_memcpy
add esp, 0xc
jmp case.0x100696ce.1036
cmp edi, 0x40a
je 0x100695bd
cmp edi, 0x43f
je 0x100695bd
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x100695c2
mov eax, 0x20
push 0x50
push str.cryptoececx_meth.c
push eax
call fcn.10060e90
mov esi, eax
add esp, 0xc
mov dword [ebx + 0x3c], esi
test esi, esi
jne 0x100695f5
push 0x52
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.1003c300
add esp, 0x14
jmp 0x10069648
cmp ebp, 2
jne 0x10069688
cmp edi, 0x40a
je 0x1006961e
cmp edi, 0x43f
je 0x1006961e
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x10069623
mov eax, 0x20
push eax
push esi
call fcn.10058860
add esp, 8
test eax, eax
jg 0x1006965e
push 0x57
push str.cryptoececx_meth.c
push esi
call fcn.10060eb0
add esp, 0xc
mov dword [ebx + 0x3c], 0
push 0x79
push str.cryptoececx_meth.c
push ebx
call fcn.10032790
add esp, 0xc
pop ebx
pop esi
xor eax, eax
pop ebp
ret
cmp edi, 0x40a
jne 0x10069677
mov dl, byte [esi + 0x1f]
and byte [esi], 0xf8
and dl, 0x3f
or dl, 0x40
mov byte [esi + 0x1f], dl
jmp 0x100696bc
cmp edi, 0x40b
jne 0x100696bc
and byte [esi], 0xfc
or byte [esi + 0x37], 0x80
jmp 0x100696bc
cmp edi, 0x40a
je 0x100696a8
cmp edi, 0x43f
je 0x100696a8
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x100696ad
mov eax, 0x20
push eax
mov eax, dword [esp + 0x1c]
push eax
push esi
call sub.MSVCR100.dll_memcpy
add esp, 0xc
lea eax, [edi - 0x40a]
cmp eax, 0x36
ja case.0x100696ce.1036
movzx ecx, byte [eax + 0x10069728]
jmp dword [ecx*4 + 0x10069714]
push esi
push ebx
call fcn.100ac480
jmp 0x100696f7
push esi
push ebx
call fcn.100ac360
jmp 0x100696f7
push esi
push ebx
call fcn.1009edf0
jmp 0x100696f7
push esi
push ebx
call fcn.1009cf50
add esp, 8
mov edx, dword [esp + 0x10]
push ebx
push edi
push edx
call fcn.1003aac0
add esp, 0xc
pop ebx
pop esi
mov eax, 1
pop ebp
ret
Function at 0x1006f470
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
push ebx
call fcn.100ae1d0
push 0x62
push esi
mov edi, eax
mov ebp, 1
call sub.MSVCR100.dll_strchr
add esp, 0x10
test eax, eax
jne 0x1006f49c
lea ebp, [eax + 0x11]
test edi, edi
jne 0x1006f525
push 0x45
push str.crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.1003c300
push 0x101f605c
push esi
push 0x101f6058
push ebx
push str.fopen_
push 5
call fcn.1003c880
add esp, 0x2c
call sub.MSVCR100.dll__errno
cmp dword [eax], 2
je 0x1006f506
call sub.MSVCR100.dll__errno
cmp dword [eax], 6
je 0x1006f506
push 0x4e
push str.crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.1003c300
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x4c
push str.crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.1003c300
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x101f5ffc
call fcn.10035450
mov esi, eax
add esp, 4
test esi, esi
jne 0x1006f548
push edi
call sub.MSVCR100.dll_fclose
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.10035650
push edi
push ebp
push 0x6a
push esi
call fcn.10035da0
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x1007fe00
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov ebx, edx
push ebx
mov esi, ecx
call fcn.1003a750
mov ecx, dword [esp + 0x10]
add esp, 4
cmp eax, 0x72
mov eax, dword [esp + 0x14]
jne 0x1007fef6
push ebp
mov ebx, esi
push edi
shr ebx, 1
and esi, 1
push eax
lea ebp, [esi + ebx]
push ebp
push ecx
call fcn.100598d0
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
push eax
call fcn.1007fb90
add esp, 0x14
test eax, eax
je 0x1007fe7a
push 0x104
push str.cryptokdf_tls1_prf.c
push edi
call fcn.100326e0
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x1007fe80
push 0x105
push str.cryptokdf_tls1_prf.c
push 0x41
push 0x6f
push 0x34
call fcn.1003c300
add esp, 0x14
pop ebp
pop esi
xor eax, eax
pop ebx
ret
mov edx, dword [esp + 0x18]
add ebx, dword [esp + 0x10]
push edi
push edx
push ebp
push ebx
call fcn.10034210
mov ecx, dword [esp + 0x24]
push eax
mov edx, esi
call fcn.1007fb90
add esp, 0x14
test eax, eax
jne 0x1007febe
push 0x10a
push str.cryptokdf_tls1_prf.c
push edi
push esi
call fcn.100327b0
add esp, 0x10
pop ebp
pop esi
xor eax, eax
pop ebx
ret
test edi, edi
je 0x1007fed9
mov eax, dword [esp + 0x1c]
mov ecx, esi
sub ecx, eax
mov ebp, edi
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec ebp
jne 0x1007fed0
push 0x10f
push str.cryptokdf_tls1_prf.c
push edi
push esi
call fcn.100327b0
add esp, 0x10
pop ebp
pop esi
mov eax, 1
pop ebx
ret
mov edx, dword [esp + 0x18]
push edi
push eax
push esi
push ecx
mov ecx, dword [esp + 0x20]
push ebx
call fcn.1007fb90
add esp, 0x14
neg eax
sbb eax, eax
pop esi
neg eax
pop ebx
ret
Function at 0x10083eb0
Capabilities:
Generate random numbers via winapi

Disassembly:
mov eax, 4
call fcn.101cf170
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 1
push esi
xor edi, edi
call fcn.100581b0
mov ebx, eax
push ebx
push esi
call fcn.10058310
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x10083f3c
push 0xf0000040
push 1
push edi
push edi
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x10083f16
mov ecx, dword [esp + 0x10]
push ebp
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x10083f09
mov edi, ebx
mov edx, dword [esp + 0x10]
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [edi*8]
push eax
push edi
push esi
call fcn.10058380
push esi
call fcn.10058070
mov edi, eax
add esp, 0x10
test edi, edi
je 0x10083f3c
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 1
push esi
call fcn.100581b0
mov ebx, eax
push ebx
push esi
call fcn.10058310
mov ebp, eax
add esp, 0x10
test ebp, ebp
je 0x10083fae
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
xor edi, edi
push edi
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x10083f94
mov edx, dword [esp + 0x10]
push ebp
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x10083f87
mov edi, ebx
mov eax, dword [esp + 0x10]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea ecx, [edi*8]
push ecx
push edi
push esi
call fcn.10058380
push esi
call fcn.10058070
add esp, 0x10
mov edi, eax
test edi, edi
jne 0x10083f34
push esi
call fcn.10058070
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x10084f10
Capabilities:
Allocate thread local storage

Disassembly:
push 0
push 0
push 0
call fcn.1005e4c0
add esp, 0xc
test eax, eax
jne 0x10084f25
xor eax, eax
ret
push 0
push 0x10267a50
call fcn.1003f410
add esp, 8
test eax, eax
je 0x10084f22
push ebx
push 0
push 0x10267a54
call fcn.1003f410
add esp, 8
test eax, eax
je 0x10084fb5
mov eax, dword [0x10267a60]
mov ecx, dword [0x10260828]
push esi
push eax
push ecx
xor ecx, ecx
lea ebx, [ecx + 1]
call fcn.10084d50
mov esi, eax
add esp, 8
test esi, esi
je 0x10084f9d
push esi
call fcn.10084c20
add esp, 4
test eax, eax
jne 0x10084f87
push esi
call fcn.100841b0
add esp, 4
xor esi, esi
jmp 0x10084f9d
push 0x1c
push str.OpenSSL_NIST_SP_800_90A_DRBG
mov dword [esi + 0x58], ebx
push esi
mov dword [esi + 0x5c], ebx
call fcn.10084230
add esp, 0xc
mov dword [0x10267a58], esi
test esi, esi
pop esi
jne 0x10084fc6
push 0x10267a54
call fcn.1003f480
add esp, 4
push 0x10267a50
call fcn.1003f480
add esp, 4
xor eax, eax
pop ebx
ret
mov eax, ebx
pop ebx
ret
Function at 0x10088f80
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.101cf170
mov eax, dword [esp + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0x38]
push esi
push edi
mov edi, edx
push ebp
mov esi, 1
push eax
mov ebx, ecx
shl esi, cl
mov dword [esp + 0x18], edi
call fcn.1004b4e0
add esp, 8
test eax, eax
jne 0x10088fbb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
cmp ebx, 3
jg 0x1008901d
xor ebx, ebx
test ebp, ebp
jle 0x10089180
lea ebx, [ebx]
xor edx, edx
xor ecx, ecx
test esi, esi
jle 0x10088fff
mov eax, ecx
xor eax, dword [esp + 0x44]
inc ecx
lea ebp, [eax - 1]
shr ebp, 0x1f
not eax
shr eax, 0x1f
and ebp, eax
mov eax, dword [edi + ecx*4 - 4]
neg ebp
and ebp, 1
neg ebp
and ebp, eax
or edx, ebp
cmp ecx, esi
jl 0x10088fd8
mov ecx, dword [esp + 0x3c]
mov eax, dword [ecx]
mov dword [eax + ebx*4], edx
lea eax, [esi*4]
inc ebx
add edi, eax
cmp ebx, dword [esp + 0x40]
jl 0x10088fd0
jmp 0x10089180
mov edx, dword [esp + 0x44]
lea ecx, [ebx - 2]
mov eax, edx
sar eax, cl
mov edi, 1
shl edi, cl
lea ebx, [eax - 1]
shr ebx, 0x1f
lea ecx, [edi - 1]
and edx, ecx
mov dword [esp + 0x44], edx
mov edx, eax
not edx
shr edx, 0x1f
and ebx, edx
mov ecx, eax
xor ecx, 1
lea edx, [ecx - 1]
not ecx
shr ecx, 0x1f
shr edx, 0x1f
and edx, ecx
mov ecx, eax
xor ecx, 2
lea ebp, [ecx - 1]
not ecx
shr ecx, 0x1f
shr ebp, 0x1f
and ebp, ecx
xor eax, 3
lea ecx, [eax - 1]
shr ecx, 0x1f
not eax
shr eax, 0x1f
and ecx, eax
neg ebx
neg edx
neg ebp
neg ecx
and ebx, 1
and edx, 1
and ebp, 1
and ecx, 1
xor eax, eax
neg edx
neg ebp
neg ecx
neg ebx
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x40], eax
jle 0x10089180
lea edx, [esi*4]
mov dword [esp + 0x34], edx
mov edi, edi
xor esi, esi
mov dword [esp + 0x20], esi
cmp edi, esi
jle 0x1008915c
mov eax, dword [esp + 0x10]
lea edx, [eax + edi*4]
mov dword [esp + 0x1c], edx
lea edx, [eax + edi*8]
mov dword [esp + 0x18], edx
lea edx, [edi + edi*2]
lea eax, [eax + edx*4]
mov dword [esp + 0x14], eax
lea ebx, [ebx]
mov edx, dword [esp + 0x14]
mov edx, dword [edx]
and edx, ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [ecx]
and ecx, ebp
or ecx, edx
mov edx, dword [esp + 0x1c]
mov edx, dword [edx]
and edx, dword [esp + 0x30]
mov ebp, dword [esp + 0x24]
or edx, ecx
mov eax, esi
xor eax, dword [esp + 0x44]
inc esi
lea ecx, [eax - 1]
not eax
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov eax, dword [esp + 0x10]
mov eax, dword [eax + esi*4 - 4]
neg ecx
and ecx, 1
and eax, ebx
neg ecx
or eax, edx
and ecx, eax
or dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x28]
mov eax, 4
add dword [esp + 0x14], eax
add dword [esp + 0x18], eax
add dword [esp + 0x1c], eax
cmp esi, edi
jl 0x100890f0
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x3c]
mov edx, dword [edx]
mov esi, dword [esp + 0x20]
mov dword [edx + eax*4], esi
mov edx, dword [esp + 0x34]
add dword [esp + 0x10], edx
inc eax
mov dword [esp + 0x2c], eax
cmp eax, dword [esp + 0x40]
jl 0x100890c0
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebp
mov dword [ecx + 4], eax
mov eax, 1
pop ebx
add esp, 0x28
ret
Function at 0x1009d060
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
push ebp
lea ecx, [ebx + 0xc]
push esi
lea eax, [edx + 4]
sub ebx, edx
mov ebp, 4
mov esi, dword [eax - 4]
mov edx, dword [ecx - 0xc]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax - 4], esi
xor dword [ecx - 0xc], edx
mov esi, dword [eax]
mov edx, dword [ebx + eax]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax], esi
xor dword [ebx + eax], edx
mov esi, dword [eax + 4]
mov edx, dword [ecx - 4]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax + 4], esi
xor dword [ecx - 4], edx
mov esi, dword [eax + 8]
mov edx, dword [ecx]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax + 8], esi
xor dword [ecx], edx
add eax, 0x10
add ecx, 0x10
dec ebp
jne 0x1009d072
pop esi
pop ebp
pop ebx
ret