joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1012c180
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x1012c1f3
mov edx, dword [esp + 0x10]
test edx, edx
je 0x1012c1f3
push ebx
mov ebx, dword [esp + 0xc]
push edi
mov edi, dword [ebx + 0x14]
cmp edx, edi
cmovb edi, edx
test edi, edi
je 0x1012c1c0
push esi
mov esi, ebp
lea ecx, [ebx + 0x1c]
nop dword [eax]
mov al, byte [esi]
lea esi, [esi + 1]
xor byte [ecx], al
lea ecx, [ecx + 1]
sub edi, 1
jne 0x1012c1b0
pop esi
mov eax, dword [ebx + 0x14]
cmp edx, eax
jbe 0x1012c1f1
sub edx, eax
cmp edx, 0x10
jbe 0x1012c1d5
mov edx, 0x10
jmp 0x1012c1d9
test edx, edx
je 0x1012c1f1
xor ecx, ecx
nop dword [eax + eax]
mov eax, dword [ebx + 0x14]
add eax, ecx
mov al, byte [eax + ebp]
xor byte [ebx + ecx + 0x3c], al
inc ecx
cmp ecx, edx
jb 0x1012c1e0
pop edi
pop ebx
pop ebp
ret
Function at 0x1012c470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x74
call fcn.101fe2f0
mov eax, dword [0x102c5980]
xor eax, esp
mov dword [esp + 0x70], eax
mov ecx, dword [esp + 0x78]
mov edx, 0x10
mov eax, dword [esp + 0x84]
push ebx
push ebp
mov ebp, dword [esp + 0x84]
push esi
mov esi, dword [ecx + 0x88]
mov dword [esp + 0x10], 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x98]
movups xmm0, xmmword [esi + 0x3c]
mov dword [esp + 0x18], ecx
mov ecx, 1
push edi
mov dword [esp + 0x18], eax
movups xmmword [esp + 0x20], xmm0
nop
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x1012c4d0
movups xmm0, xmmword [esi + 0x3c]
movups xmmword [esp + 0x30], xmm0
cmp dword [esi + 0x14], 0x10
jne 0x1012c4f7
lea edi, [edx + 0x20]
jmp 0x1012c522
mov edx, 0x10
mov ecx, 1
movzx eax, byte [edx + esi + 0x3b]
dec edx
add ecx, eax
mov byte [edx + esi + 0x3c], cl
shr ecx, 8
test edx, edx
jne 0x1012c501
movups xmm0, xmmword [esi + 0x3c]
mov edi, 0x30
movups xmmword [esp + 0x40], xmm0
push edi
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x5c]
push eax
push dword [esi]
call fcn.1009fa40
add esp, 0x14
test eax, eax
je 0x1012c639
cmp dword [esp + 0x14], edi
jne 0x1012c639
push dword [esi + 0x14]
lea eax, [esp + 0x54]
push eax
lea ebx, [esi + 0x1c]
push ebx
call fcn.101ff960
mov eax, dword [esi + 0x14]
add esp, 0xc
cmp dword [esi + 0x18], 0
movups xmm0, xmmword [esp + eax + 0x50]
movups xmmword [esi + 0x3c], xmm0
je 0x1012c5cf
mov edi, dword [esp + 0x90]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
test ebp, ebp
jne 0x1012c58f
test ecx, ecx
jne 0x1012c58f
test eax, eax
je 0x1012c5b2
push dword [esp + 0x98]
push eax
push dword [esp + 0xa8]
push ecx
push edi
push ebp
push esi
call fcn.1012c200
add esp, 0x1c
test eax, eax
je 0x1012c639
test edi, edi
je 0x1012c5f2
mov eax, dword [esp + 0x1c]
push dword [eax + 0x80]
lea eax, [esi + 0x60]
push eax
push esi
call fcn.1012c180
add esp, 0xc
jmp 0x1012c5f2
push dword [esp + 0x90]
push ebp
push esi
call fcn.1012c180
push dword [esp + 0xa4]
mov eax, dword [esp + 0x20]
push eax
push esi
call fcn.1012c180
add esp, 0x18
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi]
call fcn.1009fa10
add esp, 0x18
test eax, eax
je 0x1012c639
push 0xffffffffffffffff
push 0
push ebx
push 0
push 0
push dword [esi + 4]
call fcn.1009fa10
add esp, 0x18
test eax, eax
je 0x1012c639
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.101fdd0b
add esp, 0x74
ret
mov ecx, dword [esp + 0x80]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101fdd0b
add esp, 0x74
ret
Function at 0x1012fdd0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x1012fddd
xor eax, eax
pop ebx
ret
push edi
push dword [ebx + 4]
push 0
push dword [ebx + 8]
push dword [ebx]
call fcn.10100c30
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x1012fe24
call fcn.10050630
push str.ecx_gen
push 0x29d
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.10050730
push edi
push 0x80010
push 0x39
call fcn.10050840
add esp, 0x18
xor eax, eax
pop edi
pop ebx
ret
test byte [ebx + 0xc], 3
je 0x1012fe6f
push esi
push edi
call fcn.10100bc0
mov esi, eax
add esp, 4
test esi, esi
jne 0x1012fe72
call fcn.10050630
push str.ecx_gen
push 0x2a6
push str.providersimplementationskeymgmtecx_kmgmt.c
call fcn.10050730
push esi
push 0x80010
push 0x39
call fcn.10050840
add esp, 0x18
push edi
call fcn.10100be0
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
ret
mov eax, dword [ebx + 0x10]
test eax, eax
je 0x1012fe9f
mov ecx, dword [ebx + 0x14]
test ecx, ecx
je 0x1012fe9f
mov edx, dword [ebx + 8]
cmp edx, 2
je 0x1012fe63
cmp edx, 3
je 0x1012fe63
push ecx
push eax
push esi
push edi
call fcn.1013c210
add esp, 0x10
test eax, eax
je 0x1012fe63
jmp 0x1012feb3
push 0
push dword [edi + 0x4c]
push esi
push dword [ebx]
call fcn.10062ac0
add esp, 0x10
test eax, eax
jle 0x1012fe63
mov eax, dword [ebx + 8]
cmp eax, 3
ja case.default.0x1012febb
jmp dword [eax*4 + 0x1012ff3c]
mov al, byte [esi + 0x1f]
and byte [esi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esi + 0x1f], al
lea eax, [edi + 0xc]
push esi
push eax
call fcn.10148340
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
and byte [esi], 0xfc
lea eax, [edi + 0xc]
or byte [esi + 0x37], 0x80
push esi
push eax
call fcn.101515b0
add esp, 8
mov eax, edi
or dword [edi + 8], 1
pop esi
pop edi
pop ebx
ret
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.10147c30
jmp 0x1012ff24
push dword [ebx + 4]
lea eax, [edi + 0xc]
push esi
push eax
push dword [ebx]
call fcn.1014f9a0
add esp, 0x10
test eax, eax
je 0x1012fe63
or dword [edi + 8], 1
mov eax, edi
pop esi
pop edi
pop ebx
ret
Function at 0x1013c210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x54
call fcn.101fe2f0
mov eax, dword [0x102c5980]
xor eax, esp
mov dword [esp + 0x50], eax
mov ecx, dword [esp + 0x58]
mov edx, str.X25519
mov eax, dword [esp + 0x5c]
push ebx
push ebp
push esi
mov dword [esp + 0x18], eax
xor ebx, ebx
mov eax, dword [esp + 0x6c]
push edi
mov dword [esp + 0x18], eax
xor edi, edi
cmp dword [ecx + 0x50], ebx
mov eax, str.X448
mov dword [esp + 0x14], ecx
cmove eax, edx
push eax
call fcn.1017bb30
mov ebp, dword [esp + 0x78]
mov esi, eax
add esp, 4
cmp ebp, dword [esi + 0x1c]
jae 0x1013c29f
call fcn.10050630
push str.ossl_ecx_dhkem_derive_private
push 0x15d
push str.providersimplementationskemecx_kem.c
call fcn.10050730
push dword [esi + 0x1c]
push ebp
push str.ikm_length_is_:_zu__should_be_at_least__zu
push 0xe6
push 0x39
call fcn.10050840
add esp, 0x20
jmp 0x1013c346
mov eax, dword [esp + 0x14]
push dword [eax + 4]
push dword [eax]
push dword [esi + 0xc]
push str.HKDF
call fcn.1017bf50
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x1013c2d1
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.101fdd0b
add esp, 0x54
ret
movzx eax, byte [esi + 1]
push ebp
push dword [esp + 0x1c]
mov byte [esp + 0x18], al
movzx eax, byte [esi]
push str.dkp_prk
push 2
mov byte [esp + 0x21], al
lea eax, [esp + 0x20]
push eax
push 0x10281718
push 0
push 0
push dword [esi + 0x10]
lea eax, [esp + 0x44]
push eax
push edi
call fcn.1017bd90
add esp, 0x2c
test eax, eax
je 0x1013c346
push 0
push 0
push 0x10281800
push 2
lea eax, [esp + 0x20]
push eax
push 0x10281718
push dword [esi + 0x10]
lea eax, [esp + 0x3c]
push eax
push dword [esi + 0x1c]
push dword [esp + 0x40]
push edi
call fcn.1017bbb0
add esp, 0x2c
mov ecx, 1
test eax, eax
cmovne ebx, ecx
lea eax, [esp + 0x20]
push 0x40
push eax
call fcn.10001320
push edi
call fcn.10155000
mov ecx, dword [esp + 0x6c]
add esp, 0xc
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101fdd0b
add esp, 0x54
ret
Function at 0x10142ee0
Capabilities:
Encrypt data using curve25519

Disassembly:
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, dword [esp + 0x14]
cmp ebp, 2
je 0x10142fb9
mov esi, dword [esp + 0x10]
test esi, esi
je 0x10142f6e
push esi
push 0
lea eax, [esp + 0x28]
push eax
push 0
call fcn.100f2b40
add esp, 0x10
cmp dword [esp + 0x20], 0xffffffff
je 0x10142f42
call fcn.10050630
push str.ossl_ecx_key_op
push 0xa9
push str.cryptoececx_backend.c
call fcn.10050730
push 0
push 0x66
push 0x10
call fcn.10050840
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebp
ret
mov eax, dword [esi]
mov esi, dword [esp + 0x1c]
push eax
call fcn.1006a5f0
add esp, 4
test esi, esi
jne 0x10142f59
mov esi, eax
jmp 0x10142f72
cmp esi, eax
je 0x10142f72
call fcn.10050630
push str.ossl_ecx_key_op
push 0xaf
jmp 0x10142f24
mov esi, dword [esp + 0x1c]
test edi, edi
je 0x10142fa5
test esi, esi
je 0x10142fa5
cmp esi, 0x40a
je 0x10142f9a
cmp esi, 0x43f
je 0x10142f9a
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x10142f9f
mov eax, 0x20
cmp dword [esp + 0x18], eax
je 0x10142fbd
call fcn.10050630
push str.ossl_ecx_key_op
push 0xb5
jmp 0x10142f24
mov esi, dword [esp + 0x1c]
cmp esi, 0x40a
je 0x10142fe1
cmp esi, 0x43f
je 0x10142fe1
xor eax, eax
cmp esi, 0x40b
setne al
lea eax, [eax*2 + 1]
jmp 0x10142ff1
xor ecx, ecx
mov eax, 2
cmp esi, 0x40a
cmove eax, ecx
push ebx
push dword [esp + 0x2c]
push 1
push eax
push dword [esp + 0x34]
call fcn.10100c30
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1014303b
call fcn.10050630
push str.ossl_ecx_key_op
push 0xbc
push str.cryptoececx_backend.c
call fcn.10050730
push ebx
push 0x80010
push 0x10
call fcn.10050840
add esp, 0x18
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
test ebp, ebp
jne 0x10143057
push dword [esp + 0x1c]
lea eax, [ebx + 0xc]
push edi
push eax
call fcn.101ff960
add esp, 0xc
mov eax, ebx
pop ebx
pop edi
pop esi
pop ebp
ret
push ebx
call fcn.10100bc0
mov edi, eax
add esp, 4
test edi, edi
jne 0x1014308a
call fcn.10050630
push str.ossl_ecx_key_op
push 0xc6
push str.cryptoececx_backend.c
call fcn.10050730
push edi
push 0x80010
jmp 0x10143160
cmp ebp, 2
jne 0x101430fc
test esi, esi
je 0x1014312f
cmp esi, 0x40a
je 0x101430b7
cmp esi, 0x43f
je 0x101430b7
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x101430bc
mov eax, 0x20
push 0
push eax
push edi
push dword [esp + 0x34]
call fcn.10062ac0
add esp, 0x10
test eax, eax
jle 0x1014316a
cmp esi, 0x40a
jne 0x101430eb
mov al, byte [edi + 0x1f]
and byte [edi], 0xf8
and al, 0x3f
or al, 0x40
mov byte [edi + 0x1f], al
jmp 0x1014312f
cmp esi, 0x40b
jne 0x1014312f
and byte [edi], 0xfc
or byte [edi + 0x37], 0x80
jmp 0x1014312f
cmp esi, 0x40a
je 0x1014311c
cmp esi, 0x43f
je 0x1014311c
xor eax, eax
cmp esi, 0x40b
setne al
add eax, 0x38
jmp 0x10143121
mov eax, 0x20
push eax
push dword [esp + 0x1c]
push edi
call fcn.101ff960
add esp, 0xc
push ebx
call fcn.10143180
add esp, 4
test eax, eax
jne 0x10143050
call fcn.10050630
push str.ossl_ecx_key_op
push 0xda
push str.cryptoececx_backend.c
call fcn.10050730
push 0
push 0xa6
push 0x10
call fcn.10050840
add esp, 0x18
push ebx
call fcn.10100be0
add esp, 4
xor eax, eax
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x10147c30
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0xe4
call fcn.101fe2f0
mov eax, dword [0x102c5980]
xor eax, esp
mov dword [esp + 0xe0], eax
mov eax, dword [esp + 0xf4]
mov ecx, dword [esp + 0xe8]
push ebx
mov ebx, dword [esp + 0xf0]
push esi
mov esi, dword [esp + 0xf8]
push edi
push eax
push str.SHA512
push ecx
call fcn.10078c20
mov edi, eax
add esp, 0xc
test edi, edi
je 0x10147cb2
push 0
push edi
push 0
lea eax, [esp + 0xb8]
push eax
push 0x20
push esi
call fcn.10077e10
push edi
mov esi, eax
call fcn.10078c50
add esp, 0x1c
test esi, esi
jne 0x10147ccc
lea eax, [esp + 0xac]
push 0x40
push eax
call fcn.10001320
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xe0]
xor ecx, esp
call fcn.101fdd0b
add esp, 0xe4
ret
mov al, byte [esp + 0xcb]
and byte [esp + 0xac], 0xf8
and al, 0x3f
or al, 0x40
mov byte [esp + 0xcb], al
lea eax, [esp + 0xac]
push eax
lea eax, [esp + 0x10]
push eax
call fcn.10147380
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.10147300
lea eax, [esp + 0xbc]
push 0x40
push eax
call fcn.10001320
mov ecx, dword [esp + 0x104]
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.101fdd0b
add esp, 0xe4
ret
Function at 0x1014fe80
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
lea edx, [eax + 0x3c]
movd xmm0, ebx
pshufd xmm4, xmm0, 0
lea ecx, [esi + 0x3c]
cmp eax, ecx
ja 0x1014fecf
cmp edx, esi
jb 0x1014fecf
push edi
sub esi, eax
mov edi, 0x10
nop dword [eax]
mov edx, dword [eax + esi]
lea eax, [eax + 4]
mov ecx, dword [eax - 4]
xor ecx, edx
and ecx, ebx
xor edx, ecx
mov dword [eax + esi - 4], edx
xor dword [eax - 4], ecx
sub edi, 1
jne 0x1014feb0
pop edi
pop esi
pop ebx
ret
sub esi, eax
mov ecx, 4
nop word [eax + eax]
lea eax, [eax + 0x10]
movups xmm1, xmmword [esi + eax - 0x10]
movups xmm3, xmmword [eax - 0x10]
movaps xmm2, xmm1
xorps xmm2, xmm3
andps xmm2, xmm4
movaps xmm0, xmm2
xorps xmm2, xmm3
xorps xmm0, xmm1
movups xmmword [esi + eax - 0x10], xmm0
movups xmmword [eax - 0x10], xmm2
sub ecx, 1
jne 0x1014fee0
pop esi
pop ebx
ret
Function at 0x10153bb0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.101fe2f0
mov ecx, dword [esp + 0x24]
push esi
mov esi, dword [esp + 0x24]
shr ecx, 3
mov dword [esp + 8], ecx
cmp esi, dword [esp + 0x28]
jb 0x10153dc8
push ebx
push ebp
push edi
nop word [eax + eax]
mov dword [esp + 0x10], 0
test ecx, ecx
je 0x10153da2
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x2c]
movzx eax, byte [ecx + 7]
cdq
mov ebp, eax
mov ebx, edx
movzx eax, byte [ecx + 6]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 5]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 4]
shld ebx, ebp, 8
cdq
or ebx, edx
shl ebp, 8
or ebp, eax
movzx eax, byte [ecx + 3]
cdq
mov ecx, ebp
shld ebx, ecx, 8
mov edi, edx
mov dword [esp + 0x20], ebp
shl ecx, 8
or edi, ebx
or eax, ecx
and ebp, 0x55555555
mov ecx, dword [esp + 0x2c]
mov ebx, eax
mov dword [esp + 0x18], eax
shld edi, ebx, 8
movzx eax, byte [ecx + 2]
cdq
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx + 1]
cdq
shld edi, ebx, 8
shl ebx, 8
or edi, edx
or ebx, eax
movzx eax, byte [ecx]
cdq
add ecx, 8
shld edi, ebx, 8
mov dword [esp + 0x2c], ecx
shl ebx, 8
or ebx, eax
mov eax, ebx
and eax, 0x55555555
mov ecx, eax
shr ecx, 1
or ecx, eax
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ecx, eax
shr ecx, 4
or ecx, eax
and ecx, 0xff00ff
mov dword [esp + 0x18], ecx
mov ecx, ebp
shr ecx, 1
or ecx, ebp
and ecx, 0x33333333
mov eax, ecx
shr eax, 2
or eax, ecx
and eax, 0xf0f0f0f
mov ebp, eax
shr ebp, 4
or ebp, eax
and ebx, 0xaaaaaaaa
and ebp, 0xff00ff
lea eax, [ebx + ebx]
or eax, ebx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edi, ecx
shl edi, 4
or edi, ecx
mov ecx, dword [esp + 0x20]
and ecx, 0xaaaaaaaa
and edi, 0xff00ff00
mov ebx, edi
and edi, 0xffff00
shr ebx, 8
or ebx, edi
lea eax, [ecx + ecx]
shr ebx, 8
or eax, ecx
and eax, 0xcccccccc
lea ecx, [eax*4]
or ecx, eax
and ecx, 0xf0f0f0f0
mov edx, ecx
shl edx, 4
or edx, ecx
mov ecx, ebp
and edx, 0xff00ff00
shl ebp, 8
mov eax, edx
and ecx, 0xffffff00
shl eax, 8
or ecx, ebp
or eax, edx
shl ecx, 8
and eax, 0xffff0000
xor edx, edx
or ebx, eax
mov eax, dword [esp + 0x18]
shr eax, 8
or eax, dword [esp + 0x18]
movzx eax, ax
or ecx, eax
mov eax, dword [esp + 0x10]
or edx, ecx
mov ecx, dword [esp + 0x28]
xor dword [ecx + eax*8], edx
xor dword [ecx + eax*8 + 4], ebx
inc eax
mov dword [esp + 0x10], eax
cmp eax, esi
jb 0x10153bf4
mov esi, dword [esp + 0x30]
jmp 0x10153da6
mov ecx, dword [esp + 0x28]
push ecx
call fcn.101532f0
sub esi, dword [esp + 0x38]
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], esi
cmp esi, dword [esp + 0x34]
jae 0x10153be0
pop edi
pop ebp
pop ebx
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x1015e8e0
Capabilities:
Encode data using base64

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
xor ebp, ebp
push esi
test eax, eax
je 0x1015e8f8
test byte [eax + 0x5c], 2
mov ebx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x1015e8fd
mov ebx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov esi, dword [esp + 0x1c]
test esi, esi
jle 0x1015e9d5
mov edx, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
inc edi
movzx eax, byte [edi - 1]
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
cmp esi, 3
jb 0x1015e969
movzx ecx, byte [edi]
shl eax, 8
or eax, ecx
movzx ecx, byte [edi + 1]
shl eax, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
mov ecx, eax
shr ecx, 6
and ecx, 0x3f
and eax, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 2], cl
mov cl, byte [eax + ebx]
lea eax, [edx + 3]
jmp 0x1015e9b5
shl eax, 0x10
cmp esi, 2
jne 0x1015e979
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + ebx]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + ebx]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x1015e99c
mov al, 0x3d
jmp 0x1015e9a5
shr eax, 6
and eax, 0x3f
mov al, byte [eax + ebx]
mov ecx, dword [esp + 0x18]
mov byte [ecx + 2], al
mov cl, 0x3d
mov eax, dword [esp + 0x14]
add eax, 3
sub esi, 3
mov byte [eax], cl
add ebp, 4
lea edx, [eax + 1]
add edi, 3
test esi, esi
jg 0x1015e913
pop edi
pop esi
mov eax, ebp
mov byte [edx], 0
pop ebp
pop ebx
ret
mov eax, dword [esp + 0x14]
pop esi
mov byte [eax], 0
mov eax, ebp
pop ebp
pop ebx
ret
Function at 0x1016d8b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 4
call fcn.101fe2f0
push edi
mov edi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp edi, 0x800
jge 0x1016d8f8
call fcn.10050630
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x59
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.10050730
push 0
push 0x78
push 4
call fcn.10050840
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push dword [esp + 0x18]
call fcn.1017ef60
add esp, 4
test eax, eax
jne 0x1016d934
call fcn.10050630
push str.ossl_rsa_fips186_4_gen_prob_primes
push 0x5e
push str.crypto_rsa_rsa_sp800_56b_gen.c
call fcn.10050730
push 0
push 0xb2
push 4
call fcn.10050840
add esp, 0x18
xor eax, eax
pop edi
pop ecx
ret
push ebx
push ebp
push esi
mov esi, dword [esp + 0x28]
push esi
call fcn.100d7ca0
push esi
call fcn.100d7ab0
push esi
mov dword [esp + 0x2c], eax
call fcn.100d7ab0
push esi
mov ebp, eax
call fcn.100d7ab0
add esp, 0x10
mov ebx, eax
cmp dword [esp + 0x20], 0
je 0x1016da96
test ebp, ebp
je 0x1016da6d
test ebx, ebx
je 0x1016da64
push 4
push ebp
call fcn.1008b440
push 4
push ebx
call fcn.1008b440
mov esi, dword [esp + 0x28]
add esp, 0x10
cmp dword [esi + 0x20], 0
jne 0x1016d99e
call fcn.1008b330
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x1016d9ad
call fcn.1008b330
mov dword [esi + 0x24], eax
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x1016da60
test eax, eax
je 0x1016da60
push 4
push ecx
call fcn.1008b440
push 4
push dword [esi + 0x24]
call fcn.1008b440
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebp
push dword [esi + 0x20]
call fcn.10188630
add esp, 0x3c
test eax, eax
je 0x1016da60
nop dword [eax]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push edi
push 0
push 0
push 0
push 0
push 0
push ebx
push dword [esi + 0x24]
call fcn.10188630
add esp, 0x2c
test eax, eax
je 0x1016da60
push edi
push ebx
push ebp
push dword [esp + 0x2c]
call fcn.1017eef0
add esp, 0x10
test eax, eax
js 0x1016da60
je 0x1016da00
push edi
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esp + 0x2c]
call fcn.1017eef0
add esp, 0x10
test eax, eax
js 0x1016da60
je 0x1016da00
inc dword [esi + 0x78]
mov dword [esp + 0x10], 1
mov esi, dword [esp + 0x28]
push ebp
call fcn.1008abe0
add esp, 4
test ebx, ebx
je 0x1016da7a
push ebx
call fcn.1008abe0
add esp, 4
push dword [esp + 0x20]
call fcn.1008abe0
push esi
call fcn.100d79b0
mov eax, dword [esp + 0x18]
add esp, 8
pop esi
pop ebp
pop ebx
pop edi
pop ecx
ret
mov dword [esp + 0x10], 0
test ebp, ebp
je 0x1016da6d
jmp 0x1016da64
Function at 0x101767e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x30
call fcn.101fe2f0
mov eax, dword [0x102c5980]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push ebx
push ebp
movups xmm0, xmmword [eax]
mov ebp, dword [esp + 0x4c]
xor ebx, ebx
push esi
push edi
mov edi, dword [esp + 0x4c]
xor esi, esi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], edi
movups xmmword [esp + 0x1c], xmm0
test ebp, ebp
je 0x10176899
push 0x10
lea eax, [esp + 0x20]
mov dword [esp + 0x14], 0x10
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x38]
push eax
push dword [ecx]
call fcn.100a04d0
add esp, 0x14
neg eax
sbb eax, eax
inc dword [esp + 0x1c]
inc eax
or esi, eax
mov dword [esp + 0x10], esi
mov esi, ebp
sub esi, ebx
cmp esi, 0x10
jbe 0x10176863
mov esi, 0x10
jmp 0x10176867
test esi, esi
je 0x1017688a
lea edx, [edi + ebx]
mov edi, dword [esp + 0x50]
sub edi, dword [esp + 0x14]
xor eax, eax
mov cl, byte [edi + edx]
lea edx, [edx + 1]
xor cl, byte [esp + eax + 0x2c]
inc eax
mov byte [edx - 1], cl
cmp eax, esi
jb 0x10176874
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
add ebx, 0x10
mov ecx, dword [esp + 0x18]
cmp ebx, ebp
jb 0x10176821
mov ecx, dword [esp + 0x3c]
xor eax, eax
pop edi
test esi, esi
pop esi
pop ebp
sete al
pop ebx
xor ecx, esp
call fcn.101fdd0b
add esp, 0x30
ret