joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100031d4
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
jmp 0x1012ace0
mov eax, 0x6c
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x68], eax
push 0xf0000040
push 1
push 0
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1012ad56
lea eax, [esp + 0x28]
push eax
push 0x40
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1012ad4a
mov eax, 8
call fcn.101704b0
movsd xmm0, qword [0x101bbca8]
lea eax, [esp + 0x30]
movsd qword [esp], xmm0
push 0x40
push eax
call sym.libcrypto_1_1.dll_RAND_add
add esp, 0x10
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1012adba
lea eax, [esp + 0x28]
push eax
push 0x40
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1012adae
mov eax, 8
call fcn.101704b0
movsd xmm0, qword [0x101bbca8]
lea eax, [esp + 0x30]
movsd qword [esp], xmm0
push 0x40
push eax
call sym.libcrypto_1_1.dll_RAND_add
add esp, 0x10
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call fcn.1012aea0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, 8
call fcn.101704b0
movsd xmm0, qword [0x1017dc90]
lea eax, [esp + 0x10]
movsd qword [esp], xmm0
push 0x20
push eax
call sym.libcrypto_1_1.dll_RAND_add
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], eax
mov eax, 8
call fcn.101704b0
movsd xmm0, qword [0x1017dc90]
lea eax, [esp + 0xc]
movsd qword [esp], xmm0
push 4
push eax
call sym.libcrypto_1_1.dll_RAND_add
mov ecx, dword [esp + 0x78]
add esp, 0x10
xor ecx, esp
mov eax, 1
call fcn.101704a0
add esp, 0x6c
ret
Function at 0x100032a1
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
jmp 0x1012bf50
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x18]
push esi
push edi
mov edi, 0x80
mov byte [ebx], 0
cmp eax, edi
cmovg eax, edi
test ebp, ebp
jg 0x1012bf78
mov ebp, 0x400
jmp 0x1012bf82
mov ecx, 0x400
cmp ebp, ecx
cmovg ebp, ecx
test eax, eax
jle 0x1012bfa2
sub dword [esp + 0x1c], ebx
mov edx, ebx
mov ebx, dword [esp + 0x1c]
mov esi, eax
mov cl, byte [ebx + edx]
lea edx, [edx + 1]
mov byte [edx - 1], cl
dec esi
jne 0x1012bf92
mov ebx, dword [esp + 0x14]
movzx edx, byte [ebx + eax - 1]
cmp eax, 0x80
jge 0x1012bfd0
mov esi, ebx
sub esi, eax
movzx ecx, byte [esi + eax]
add ecx, edx
and ecx, 0xff
movzx edx, byte [ecx + 0x101bbd20]
mov byte [eax + ebx], dl
inc eax
cmp eax, 0x80
jl 0x1012bfb2
lea eax, [ebp + 7]
mov edx, 0xff
sar eax, 3
neg ebp
sub edi, eax
mov dword [esp + 0x14], eax
movzx eax, byte [edi + ebx]
lea esi, [edi + ebx]
and ebp, 7
mov ecx, ebp
sar edx, cl
and edx, eax
movzx ecx, byte [edx + 0x101bbd20]
mov byte [esi], cl
test edi, edi
je 0x1012c01a
mov edx, dword [esp + 0x14]
movzx eax, byte [esi + edx - 1]
lea esi, [esi - 1]
xor eax, ecx
movzx ecx, byte [eax + 0x101bbd20]
mov byte [esi], cl
dec edi
jne 0x1012c004
lea esi, [ebx + 0xfc]
mov edi, 0x40
lea edx, [ebx + 0x7e]
jmp 0x1012c030
movzx ecx, byte [edx + 1]
lea esi, [esi - 4]
movzx eax, byte [edx]
lea edx, [edx - 2]
shl ecx, 8
or ecx, eax
and ecx, 0xffff
mov dword [esi + 4], ecx
dec edi
jne 0x1012c030
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100037ce
Capabilities:
Query environment variable

Disassembly:
jmp 0x100e8620
push ebx
mov ebx, dword [esp + 8]
test ebx, ebx
jne 0x100e8645
push 0x11f
push str.cryptoengineeng_list.c
push 0x43
push 0x6a
push 0x26
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop ebx
ret
push 0x10001bc2
push 0x101f2b64
call sym.libcrypto_1_1.dll_CRYPTO_THREAD_run_once
add esp, 8
neg eax
sbb eax, eax
test dword [0x101f2b68], eax
jne 0x100e867f
push 0x123
push str.cryptoengineeng_list.c
push 0x41
push 0x6a
push 0x26
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
xor eax, eax
pop ebx
ret
push esi
push edi
push dword [0x101f533c]
call sym.libcrypto_1_1.dll_CRYPTO_THREAD_write_lock
mov esi, dword [0x101f2b78]
add esp, 4
test esi, esi
je 0x100e86fc
lea esp, [esp]
mov ecx, dword [esi]
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100e86c4
test dl, dl
je 0x100e86c0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100e86c4
add eax, 2
add ecx, 2
test dl, dl
jne 0x100e86a4
xor eax, eax
jmp 0x100e86c9
sbb eax, eax
or eax, 1
test eax, eax
je 0x100e86d6
mov esi, dword [esi + 0x60]
test esi, esi
jne 0x100e86a0
jmp 0x100e86fc
test byte [esi + 0x4c], 4
je 0x100e86f9
call sym.libcrypto_1_1.dll_ENGINE_new
mov edi, eax
test edi, edi
jne 0x100e86eb
xor esi, esi
jmp 0x100e86fc
push esi
push edi
call fcn.100e8b90
add esp, 8
mov esi, edi
jmp 0x100e86fc
inc dword [esi + 0x50]
push dword [0x101f533c]
call sym.libcrypto_1_1.dll_CRYPTO_THREAD_unlock
add esp, 4
test esi, esi
jne 0x100e87e7
mov ecx, str.dynamic
mov eax, ebx
lea esp, [esp]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100e8740
test dl, dl
je 0x100e873c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100e8740
add eax, 2
add ecx, 2
test dl, dl
jne 0x100e8720
xor eax, eax
jmp 0x100e8745
sbb eax, eax
or eax, 1
test eax, eax
je 0x100e87ed
push str.OPENSSL_ENGINES
call dword [sym.imp.MSVCR120.dll_getenv]
test eax, eax
mov edi, str.C:Program_Files__x86_OpenSSLlibengines_1_1
push str.dynamic
cmovne edi, eax
call sym.libcrypto_1_1.dll_ENGINE_by_id
mov esi, eax
add esp, 8
test esi, esi
je 0x100e87ed
push 0
push ebx
push 0x1019e22c
push esi
call sym.libcrypto_1_1.dll_ENGINE_ctrl_cmd_string
add esp, 0x10
test eax, eax
je 0x100e87ed
push 0
push 0x1019e048
push str.DIR_LOAD
push esi
call sym.libcrypto_1_1.dll_ENGINE_ctrl_cmd_string
add esp, 0x10
test eax, eax
je 0x100e87ed
push 0
push edi
push str.DIR_ADD
push esi
call sym.libcrypto_1_1.dll_ENGINE_ctrl_cmd_string
add esp, 0x10
test eax, eax
je 0x100e87ed
push 0
push 0x1019eb7c
push str.LIST_ADD
push esi
call sym.libcrypto_1_1.dll_ENGINE_ctrl_cmd_string
add esp, 0x10
test eax, eax
je 0x100e87ed
push 0
push 0
push str.LOAD
push esi
call sym.libcrypto_1_1.dll_ENGINE_ctrl_cmd_string
add esp, 0x10
test eax, eax
je 0x100e87ed
pop edi
mov eax, esi
pop esi
pop ebx
ret
push esi
call sym.libcrypto_1_1.dll_ENGINE_free
push 0x153
push str.cryptoengineeng_list.c
push 0x74
push 0x6a
push 0x26
call sym.libcrypto_1_1.dll_ERR_put_error
push ebx
push 0x1019eb80
push 2
call sym.libcrypto_1_1.dll_ERR_add_error_data
add esp, 0x24
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x100037fb
Capabilities:
Hash data using sha224

Disassembly:
jmp 0x10139450
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [esi], 0xc1059ed8
mov dword [esi + 4], 0x367cd507
mov eax, 1
mov dword [esi + 8], 0x3070dd17
mov dword [esi + 0xc], 0xf70e5939
mov dword [esi + 0x10], 0xffc00b31
mov dword [esi + 0x14], 0x68581511
mov dword [esi + 0x18], 0x64f98fa7
mov dword [esi + 0x1c], 0xbefa4fa4
mov dword [esi + 0x6c], 0x1c
pop esi
ret
Function at 0x100038be
Capabilities:
Hash data using sha256

Disassembly:
jmp 0x10139960
push esi
mov esi, dword [esp + 8]
push 0x70
push 0
push esi
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov eax, 1
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov dword [esi + 0x6c], 0x20
pop esi
ret

Function at 0x100038f0
Capabilities:
Hash data using sha256

Disassembly:
jmp 0x1013a440
mov eax, dword [esp + 4]
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], 0
mov dword [eax + 0x44], 0
mov dword [eax + 0x48], 0
mov dword [eax + 0x4c], 0
mov dword [eax + 0xd0], 0
mov dword [eax + 0xd4], 0x40
mov eax, 1
ret

Function at 0x100038ff
Capabilities:
Resolve dns

Disassembly:
jmp 0x10081fb0
mov eax, 0x20
call fcn.101704b0
push esi
push edi
mov edi, dword [esp + 0x38]
xor esi, esi
mov eax, edi
sub eax, esi
je 0x10081ff8
sub eax, 2
je 0x10081ff8
sub eax, 0x15
je 0x10081ff8
push 0x289
push str.crypto_bio_b_addr.c
push 0x83
push 0x87
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
pop edi
xor eax, eax
pop esi
add esp, 0x20
ret
call sym.libcrypto_1_1.dll_BIO_sock_init
cmp eax, 1
jne 0x10081ff0
cmp dword [esp + 0x34], 1
xorps xmm0, xmm0
mov eax, dword [esp + 0x3c]
movdqu xmmword [esp + 8], xmm0
mov dword [esp + 0xc], edi
movdqu xmmword [esp + 0x18], xmm0
mov dword [esp + 0x10], eax
jne 0x10082029
or dword [esp + 8], 1
push dword [esp + 0x40]
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x38]
push dword [esp + 0x38]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, eax
test edi, edi
je 0x10082077
push 0x2b5
push str.crypto_bio_b_addr.c
push 2
push 0x87
push 0x20
call sym.libcrypto_1_1.dll_ERR_put_error
push edi
call fcn.100021d5
push eax
push 1
call sym.libcrypto_1_1.dll_ERR_add_error_data
add esp, 0x20
mov eax, esi
pop edi
pop esi
add esp, 0x20
ret
mov esi, 1
pop edi
mov eax, esi
pop esi
add esp, 0x20
ret

Function at 0x10003909
Capabilities:
Hash data using sha1

Disassembly:
jmp 0x1012c710
push esi
mov esi, dword [esp + 8]
push 0x60
push 0
push esi
call sub.MSVCR120.dll_memset
add esp, 0xc
mov dword [esi], 0x67452301
mov dword [esi + 4], 0xefcdab89
mov eax, 1
mov dword [esi + 8], 0x98badcfe
mov dword [esi + 0xc], 0x10325476
mov dword [esi + 0x10], 0xc3d2e1f0
pop esi
ret
Function at 0x1000398b
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1010b840
mov eax, 0x10
call fcn.101704b0
mov ecx, dword [esp + 0x28]
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x3c]
mov edi, dword [edi]
test edi, edi
je 0x1010b87d
test esi, esi
je 0x1010b87d
mov al, byte [edi + ecx]
dec esi
xor al, byte [ebp]
inc edi
mov byte [ebx], al
inc ebp
inc ebx
and edi, 0xf
jne 0x1010b868
mov edx, dword [esp + 0x34]
cmp esi, 0x10
jb 0x1010b913
mov eax, ebp
xor edi, edi
sub eax, ecx
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], eax
mov edi, ebx
mov eax, esi
sub edi, ecx
shr eax, 4
mov dword [esp + 0x2c], eax
shl eax, 4
add ebx, eax
add ebp, eax
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x38]
lea esp, [esp]
push dword [esp + 0x30]
push ebp
push edx
call dword [esp + 0x4c]
mov eax, dword [esp + 0x40]
push eax
call fcn.1010bb90
add esp, 0x10
mov eax, ebp
mov edx, 4
mov edi, edi
mov ecx, dword [ebx + eax]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [edi + eax - 4], ecx
dec edx
jne 0x1010b8e0
mov edx, dword [esp + 0x34]
sub esi, 0x10
add edi, 0x10
add ebx, 0x10
dec dword [esp + 0x2c]
jne 0x1010b8c0
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esp + 0x38]
test esi, esi
je 0x1010b950
push dword [esp + 0x30]
push ecx
push edx
call dword [esp + 0x4c]
mov eax, dword [esp + 0x40]
push eax
call fcn.1010bb90
mov eax, dword [esp + 0x48]
add esp, 0x10
sub ebp, eax
sub ebx, eax
lea ecx, [edi + eax]
add edi, esi
jmp 0x1010b940
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
dec esi
jne 0x1010b940
mov eax, dword [esp + 0x3c]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x10003bd9
Capabilities:
Set socket configuration

Disassembly:
jmp 0x10084f80
push esi
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, eax
test esi, esi
jns 0x10084fb8
push 0xcc
push str.crypto_bio_b_sock.c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push 5
push 2
call sym.libcrypto_1_1.dll_ERR_put_error
add esp, 0x14
mov eax, esi
pop esi
ret
Function at 0x10003be8
Capabilities:
Authenticate hmac

Disassembly:
jmp 0x10103f60
mov eax, 0x8c
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x88], eax
mov edx, dword [esp + 0xa0]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [esp + 0xac]
mov dword [esp + 0x10], edx
test edi, edi
je 0x10103fc6
cmp edi, dword [esi]
je 0x10103fbd
test ebp, ebp
je 0x10104040
test ebx, ebx
js 0x10104040
mov eax, 1
mov dword [esi], edi
jmp 0x10103fcc
mov edi, dword [esi]
test edi, edi
je 0x10104040
test ebp, ebp
je 0x1010415a
push edi
call sym.libcrypto_1_1.dll_EVP_MD_block_size
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x10104000
push 0x28
push str.cryptohmachmac.c
push str.assertion_failed:_j____int_sizeof_ctx__key_
call sym.libcrypto_1_1.dll_OPENSSL_die
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
jge 0x1010405b
push dword [esp + 0x10]
push edi
push dword [esi + 4]
call sym.libcrypto_1_1.dll_EVP_DigestInit_ex
add esp, 0xc
test eax, eax
je 0x10104040
push ebx
push ebp
push dword [esi + 4]
call sym.libcrypto_1_1.dll_EVP_DigestUpdate
add esp, 0xc
test eax, eax
je 0x10104040
lea ebp, [esi + 0x10]
push ebp
lea eax, [esi + 0x14]
push eax
push dword [esi + 4]
call sym.libcrypto_1_1.dll_EVP_DigestFinal_ex
add esp, 0xc
test eax, eax
jne 0x10104077
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101704a0
add esp, 0x8c
ret
cmp ebx, 0x80
ja 0x10104040
push ebx
lea eax, [esi + 0x14]
push ebp
push eax
call sub.MSVCR120.dll_memcpy
lea ebp, [esi + 0x10]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x80
je 0x1010409a
mov eax, 0x80
sub eax, ecx
push eax
lea eax, [esi + 0x14]
add eax, ecx
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x14]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x101040a0
push edx
push edi
push dword [esi + 8]
call sym.libcrypto_1_1.dll_EVP_DigestInit_ex
add esp, 0xc
test eax, eax
je 0x10104040
push edi
call sym.libcrypto_1_1.dll_EVP_MD_block_size
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 8]
call sym.libcrypto_1_1.dll_EVP_DigestUpdate
add esp, 0x10
test eax, eax
je 0x10104040
xor ecx, ecx
lea esp, [esp]
mov al, byte [esi + ecx + 0x14]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x101040f0
push dword [esp + 0x10]
push edi
push dword [esi + 0xc]
call sym.libcrypto_1_1.dll_EVP_DigestInit_ex
add esp, 0xc
test eax, eax
je 0x10104040
push edi
call sym.libcrypto_1_1.dll_EVP_MD_block_size
push eax
lea eax, [esp + 0x20]
push eax
push dword [esi + 0xc]
call sym.libcrypto_1_1.dll_EVP_DigestUpdate
add esp, 0x10
test eax, eax
je 0x10104040
push dword [esi + 8]
push dword [esi + 4]
call sym.libcrypto_1_1.dll_EVP_MD_CTX_copy_ex
add esp, 8
test eax, eax
je 0x10104040
mov eax, 1
jmp 0x10104042
test eax, eax
je 0x1010413a
jmp 0x1010409e
Function at 0x10003d4b
Capabilities:
Encode data using xor

Disassembly:
jmp 0x100ab040
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x84], 0xffffffff
jne 0x100ab052
xor eax, eax
pop edi
ret
push ebp
push esi
push dword [edi]
call sym.libcrypto_1_1.dll_EVP_CIPHER_CTX_block_size
mov ecx, dword [esp + 0x1c]
add esp, 4
mov ebp, dword [esp + 0x14]
mov esi, eax
mov dword [ecx], esi
test ebp, ebp
je 0x100ab104
mov ecx, dword [edi + 0x84]
push ebx
cmp ecx, esi
jne 0x100ab0a4
test esi, esi
jle 0x100ab0e2
mov edx, ebp
lea ecx, [edi + 4]
mov ebx, esi
jmp 0x100ab090
mov al, byte [ecx + 0x60]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
dec ebx
jne 0x100ab090
jmp 0x100ab0e2
sub eax, ecx
mov byte [ecx + edi + 0x64], 0x80
cmp eax, 1
jle 0x100ab0c2
dec eax
push eax
lea eax, [edi + 0x65]
add eax, ecx
push 0
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
test esi, esi
jle 0x100ab0e2
mov edx, ebp
lea ecx, [edi + 0x24]
mov ebx, esi
lea ecx, [ecx]
mov al, byte [ecx + 0x40]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
lea edx, [edx + 1]
mov byte [edx - 1], al
dec ebx
jne 0x100ab0d0
push esi
push ebp
push ebp
push dword [edi]
call sym.libcrypto_1_1.dll_EVP_Cipher
add esp, 0x10
pop ebx
test eax, eax
jne 0x100ab104
push esi
push ebp
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
add esp, 8
xor eax, eax
pop esi
pop ebp
pop edi
ret
pop esi
pop ebp
mov eax, 1
pop edi
ret
Function at 0x10003dd2
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1010f540
mov eax, 0x10
call fcn.101704b0
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
mov ebp, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, dword [esp + 0x2c]
mov esi, dword [esi]
test esi, esi
je 0x1010f57d
mov ecx, dword [esp + 0x34]
test edi, edi
je 0x1010f57d
mov al, byte [esi + ecx]
dec edi
xor al, byte [ebp]
inc esi
mov byte [ebx], al
inc ebp
inc ebx
and esi, 0xf
jne 0x1010f568
mov edx, dword [esp + 0x3c]
cmp edi, 0x10
jb 0x1010f612
mov ecx, dword [esp + 0x34]
mov eax, ebx
sub eax, ecx
mov dword [esp + 0x10], eax
mov eax, ebp
sub eax, ecx
mov dword [esp + 0x14], eax
mov eax, edi
shr eax, 4
mov dword [esp + 0x2c], eax
shl eax, 4
add ebx, eax
add ebp, eax
mov dword [esp + 0x18], ebx
mov ebx, dword [esp + 0x10]
mov dword [esp + 0x1c], ebp
mov ebp, dword [esp + 0x14]
jmp 0x1010f5c4
mov ecx, dword [esp + 0x34]
push dword [esp + 0x30]
push ecx
push ecx
call edx
add esp, 0xc
cmp esi, 0x10
jae 0x1010f5f5
mov eax, dword [esp + 0x34]
mov edx, 0xf
sub edx, esi
add eax, esi
shr edx, 2
inc edx
mov ecx, dword [eax + ebp]
lea eax, [eax + 4]
xor ecx, dword [eax - 4]
mov dword [ebx + eax - 4], ecx
dec edx
jne 0x1010f5e5
mov edx, dword [esp + 0x3c]
sub edi, 0x10
add ebx, 0x10
add ebp, 0x10
xor esi, esi
dec dword [esp + 0x2c]
jne 0x1010f5c0
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
test edi, edi
je 0x1010f642
push dword [esp + 0x30]
mov eax, dword [esp + 0x38]
push eax
push eax
call edx
mov eax, dword [esp + 0x40]
add esp, 0xc
sub ebp, eax
sub ebx, eax
lea ecx, [esi + eax]
add esi, edi
mov al, byte [ecx + ebp]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebx - 1], al
dec edi
jne 0x1010f632
mov eax, dword [esp + 0x38]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x10003e68
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10107e30
push esi
mov esi, dword [esp + 8]
xor edx, edx
test esi, esi
je 0x10107e76
mov al, byte [esi]
test al, al
je 0x10107e76
push edi
mov edi, pe_nt_image_headers32
movsx eax, al
lea esi, [esi + 1]
or eax, edi
add edi, 0x100
mov ecx, eax
shr ecx, 2
xor ecx, eax
imul eax, eax
and ecx, 0xf
rol edx, cl
xor edx, eax
mov al, byte [esi]
test al, al
jne 0x10107e47
mov eax, edx
shr eax, 0x10
pop edi
xor eax, edx
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x100043bd
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x10080ef0
push 0
push 0x101f288c
call sym.libcrypto_1_1.dll_CRYPTO_THREAD_init_local
add esp, 8
test eax, eax
je 0x10080f23
push 0
push 0x101f2890
call sym.libcrypto_1_1.dll_CRYPTO_THREAD_init_local
add esp, 8
test eax, eax
jne 0x10080f26
push 0x101f288c
call sym.libcrypto_1_1.dll_CRYPTO_THREAD_cleanup_local
add esp, 4
xor eax, eax
ret
mov eax, 1
ret
Function at 0x1000448f
Capabilities:
Hash data using sha224

Disassembly:
jmp 0x10139340
mov eax, 0x74
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x80]
test eax, eax
push esi
mov esi, dword [esp + 0x7c]
push edi
mov edi, 0x101f4cd8
push 0x70
cmovne edi, eax
lea eax, [esp + 0xc]
push 0
push eax
call sub.MSVCR120.dll_memset
push dword [esp + 0x90]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0xc1059ed8
push esi
push eax
mov dword [esp + 0x24], 0x367cd507
mov dword [esp + 0x28], 0x3070dd17
mov dword [esp + 0x2c], 0xf70e5939
mov dword [esp + 0x30], 0xffc00b31
mov dword [esp + 0x34], 0x68581511
mov dword [esp + 0x38], 0x64f98fa7
mov dword [esp + 0x3c], 0xbefa4fa4
mov dword [esp + 0x8c], 0x1c
call sym.libcrypto_1_1.dll_SHA256_Update
lea eax, [esp + 0x20]
push eax
push edi
call sym.libcrypto_1_1.dll_SHA256_Final
lea eax, [esp + 0x28]
push 0x70
push eax
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov ecx, dword [esp + 0xa0]
add esp, 0x28
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.101704a0
add esp, 0x74
ret

Function at 0x100044e9
Capabilities:
Hash data using sha256

Disassembly:
jmp 0x101394d0
mov eax, 0x74
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x80]
test eax, eax
push esi
mov esi, dword [esp + 0x7c]
push edi
mov edi, 0x101f4cf4
push 0x70
cmovne edi, eax
lea eax, [esp + 0xc]
push 0
push eax
call sub.MSVCR120.dll_memset
push dword [esp + 0x90]
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x6a09e667
push esi
push eax
mov dword [esp + 0x24], 0xbb67ae85
mov dword [esp + 0x28], 0x3c6ef372
mov dword [esp + 0x2c], 0xa54ff53a
mov dword [esp + 0x30], 0x510e527f
mov dword [esp + 0x34], 0x9b05688c
mov dword [esp + 0x38], 0x1f83d9ab
mov dword [esp + 0x3c], 0x5be0cd19
mov dword [esp + 0x8c], 0x20
call sym.libcrypto_1_1.dll_SHA256_Update
lea eax, [esp + 0x20]
push eax
push edi
call sym.libcrypto_1_1.dll_SHA256_Final
lea eax, [esp + 0x28]
push 0x70
push eax
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov ecx, dword [esp + 0xa0]
add esp, 0x28
mov eax, edi
pop edi
pop esi
xor ecx, esp
call fcn.101704a0
add esp, 0x74
ret
Function at 0x100044f3
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1009bab0
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push edi
mov eax, dword [ebx + 4]
cmp eax, dword [ecx + 4]
jge 0x1009bac7
mov edi, ecx
jmp 0x1009bacb
mov edi, ebx
mov ebx, ecx
push dword [edi + 4]
mov ebp, dword [esp + 0x14]
push ebp
call fcn.1000351c
add esp, 8
test eax, eax
jne 0x1009bae3
pop edi
pop ebp
pop ebx
ret
xor eax, eax
cmp dword [ebx + 4], eax
jle 0x1009bb07
push esi
jmp 0x1009baf0
mov ecx, dword [ebx]
mov edx, dword [edi]
mov esi, dword [ecx + eax*4]
mov ecx, dword [ebp]
xor esi, dword [edx + eax*4]
mov dword [ecx + eax*4], esi
inc eax
cmp eax, dword [ebx + 4]
jl 0x1009baf0
pop esi
cmp eax, dword [edi + 4]
jge 0x1009bb21
lea esp, [esp]
mov ecx, dword [edi]
mov edx, dword [ebp]
mov ecx, dword [ecx + eax*4]
mov dword [edx + eax*4], ecx
inc eax
cmp eax, dword [edi + 4]
jl 0x1009bb10
mov eax, dword [edi + 4]
push ebp
mov dword [ebp + 4], eax
call fcn.100021cb
add esp, 4
mov eax, 1
pop edi
pop ebp
pop ebx
ret