joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101093b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x9c], eax
push ebx
mov ebx, dword [esp + 0xa8]
push edi
mov edi, dword [esp + 0xb4]
test edi, edi
je 0x10109553
push ebp
dec edi
lea ebp, [ebx + 0xc]
add ebx, 0x14
shr edi, 3
push esi
mov esi, dword [esp + 0xb8]
inc edi
mov dword [esp + 0x18], ebx
jmp 0x10109400
movzx eax, byte [esi + 1]
lea esi, [esi + 8]
movzx ecx, byte [esi - 8]
shl eax, 8
or ecx, eax
movzx eax, byte [esi - 6]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 5]
shl eax, 0x18
or ecx, eax
movzx eax, byte [esi - 3]
shl eax, 8
mov dword [esp + 0x10], ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], ecx
movzx ecx, byte [esi - 4]
or ecx, eax
movzx eax, byte [esi - 2]
shl eax, 0x10
or ecx, eax
movzx eax, byte [esi - 1]
shl eax, 0x18
or ecx, eax
movzx eax, byte [ebp]
and al, 0xdf
mov dword [esp + 0x14], ecx
or al, 0x40
mov dword [esp + 0x28], ecx
mov byte [ebp], al
movzx eax, byte [ebx]
and al, 0xbf
mov dword [esp + 0x20], ecx
or al, 0x20
push ebp
mov byte [ebx], al
call sym.libcrypto_1_1.dll_DES_set_odd_parity
lea eax, [esp + 0x30]
push eax
push ebp
call sym.libcrypto_1_1.dll_DES_set_key_unchecked
push 1
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x30]
push eax
call sym.libcrypto_1_1.dll_DES_encrypt1
push ebx
call sym.libcrypto_1_1.dll_DES_set_odd_parity
lea eax, [esp + 0x48]
push eax
push ebx
call sym.libcrypto_1_1.dll_DES_set_key_unchecked
push 1
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x50]
push eax
call sym.libcrypto_1_1.dll_DES_encrypt1
mov ecx, dword [esp + 0x44]
add esp, 0x30
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
xor edx, ecx
xor ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
xor ebx, eax
mov dword [esp + 0x14], ecx
xor eax, dword [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x10], eax
mov byte [ecx], al
shr eax, 8
mov byte [ecx + 1], al
mov eax, dword [esp + 0x10]
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, dword [esp + 0x10]
shr eax, 0x18
mov byte [ecx + 3], al
mov byte [ecx + 4], dl
mov eax, edx
shr eax, 8
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
mov byte [ecx + 6], al
mov eax, ebx
shr edx, 0x18
mov byte [ecx + 7], dl
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
shr eax, 8
mov byte [ecx], bl
mov byte [ecx + 1], al
mov eax, ebx
shr eax, 0x10
mov byte [ecx + 2], al
mov eax, edx
shr ebx, 0x18
mov byte [ecx + 3], bl
mov ebx, ecx
shr eax, 8
mov byte [ecx + 4], dl
mov byte [ecx + 5], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ecx + 6], al
mov byte [ecx + 7], dl
dec edi
jne 0x10109400
pop esi
pop ebp
mov ecx, dword [esp + 0xa4]
pop edi
pop ebx
xor ecx, esp
call fcn.101704a0
add esp, 0xa0
ret
Function at 0x1010a3c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1010a3c0
mov eax, 0x30
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x3c]
push ebx
push ebp
mov ebp, dword [esp + 0x40]
push esi
mov esi, dword [esp + 0x40]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0x1c], eax
mov bl, byte [esi]
mov ecx, dword [esi + 0x28]
mov eax, dword [esi + 0x2c]
mov dword [esp + 0x20], esi
mov byte [esp + 0xf], bl
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], eax
test bl, 0x40
jne 0x1010a418
push eax
lea eax, [esi + 0x10]
push eax
push esi
call ecx
add esp, 0xc
movzx eax, bl
mov edx, 0xf
and eax, 7
xor ecx, ecx
sub edx, eax
mov byte [esi], al
mov dword [esp + 0x24], edx
cmp edx, 0xf
jae 0x1010a445
movzx eax, byte [esi + edx]
or ecx, eax
mov byte [esi + edx], 0
inc edx
shl ecx, 8
cmp edx, 0xf
jb 0x1010a432
movzx eax, byte [esi + 0xf]
mov ebx, dword [esp + 0x4c]
or ecx, eax
mov byte [esi + 0xf], 1
cmp ecx, ebx
je 0x1010a46c
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x2c]
xor ecx, esp
call fcn.101704a0
add esp, 0x30
ret
push edi
mov edi, ebx
shr edi, 4
test edi, edi
je 0x1010a4a6
lea eax, [esi + 0x10]
push eax
push esi
push dword [esp + 0x20]
push edi
push dword [esp + 0x24]
push ebp
call dword [esp + 0x38]
shl edi, 4
add esp, 0x18
add dword [esp + 0x14], edi
add ebp, edi
sub ebx, edi
je 0x1010a50d
shr edi, 4
push edi
push esi
call fcn.1010ae70
add esp, 8
test ebx, ebx
je 0x1010a50d
push dword [esp + 0x18]
lea eax, [esp + 0x30]
push eax
push esi
call dword [esp + 0x28]
add esp, 0xc
xor edi, edi
test ebx, ebx
je 0x1010a4f8
lea eax, [esp + 0x2c]
sub ebp, eax
sub dword [esp + 0x14], eax
lea eax, [esi + 0x10]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x2c]
add ecx, edi
movzx edx, byte [ecx + ebp]
movzx eax, byte [ecx]
xor edx, eax
mov eax, dword [esp + 0x20]
mov byte [esi + ecx], dl
xor byte [eax + edi], dl
inc edi
cmp edi, ebx
jb 0x1010a4d6
mov esi, dword [esp + 0x24]
mov ebx, dword [esp + 0x18]
lea eax, [esi + 0x10]
mov ebp, dword [esp + 0x1c]
push ebx
push eax
push eax
call ebp
add esp, 0xc
jmp 0x1010a515
mov ebp, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov edx, dword [esp + 0x28]
cmp edx, 0x10
jae 0x1010a538
mov ecx, 0x10
lea edi, [edx + esi]
sub ecx, edx
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
push ebx
lea eax, [esp + 0x30]
push eax
push esi
call ebp
mov eax, dword [esp + 0x38]
add esp, 0xc
xor dword [esi + 0x10], eax
mov eax, dword [esp + 0x30]
xor dword [esi + 0x14], eax
mov eax, dword [esp + 0x34]
xor dword [esi + 0x18], eax
mov eax, dword [esp + 0x38]
xor dword [esi + 0x1c], eax
mov al, byte [esp + 0x13]
mov ecx, dword [esp + 0x3c]
pop edi
mov byte [esi], al
xor eax, eax
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101704a0
add esp, 0x30
ret
Function at 0x1010aef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1010aef0
mov eax, 0x5c
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x64]
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0x74]
push edi
mov edi, dword [esp + 0x74]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0xc], ecx
cmp dword [esp + 0x70], ecx
jbe 0x1010b080
lea eax, [esp + 0x3c]
sub eax, ebx
push ebp
push esi
mov dword [esp + 0x28], eax
mov esi, ebx
lea eax, [esp + 0x45]
sub esi, eax
lea eax, [ebx + 2]
lea edx, [eax - 1]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], edx
movdqu xmm0, xmmword [ebx]
mov eax, ecx
mov ebp, 7
and eax, 7
mov edx, 1
sub ebp, eax
mov eax, ecx
mov ecx, dword [esp + 0x70]
shr eax, 3
mov dword [esp + 0x24], eax
push edi
push ebx
mov al, byte [eax + ecx]
mov ecx, ebp
shl edx, cl
and al, dl
mov dword [esp + 0x48], ebp
neg al
push ebx
sbb al, al
and al, 0x80
mov byte [esp + 0x1f], al
movdqu xmmword [esp + 0x50], xmm0
call dword [esp + 0x44]
add esp, 0xc
cmp dword [esp + 0x88], 0
je 0x1010afc3
movzx edx, byte [ebx]
movzx eax, byte [esp + 0x13]
xor edx, eax
mov byte [esp + 0x54], dl
jmp 0x1010afcf
mov al, byte [esp + 0x13]
mov dl, byte [ebx]
mov byte [esp + 0x54], al
xor dl, al
mov dword [esp + 0x18], edx
xor ebp, ebp
mov edx, dword [esp + 0x28]
lea esp, [esp]
lea edi, [esp + 0x45]
add edi, ebp
add esi, edi
mov ah, byte [edi]
movzx ecx, byte [esi + edx]
mov al, ah
mov bl, byte [edi + 1]
add cl, cl
shr al, 7
add ah, ah
or cl, al
mov al, bl
shr al, 7
add bl, bl
mov byte [esi], cl
or al, ah
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov byte [ecx + ebp], al
mov cl, byte [edi + 2]
mov al, cl
add cl, cl
shr al, 7
or al, bl
mov ebx, dword [esp + 0x30]
mov byte [ebx + ebp], al
mov al, byte [edi + 3]
shr al, 7
or al, cl
mov byte [ebx + ebp + 1], al
add ebp, 4
cmp ebp, 0x10
jl 0x1010afe0
mov cl, byte [esp + 0x14]
mov al, 1
mov edx, dword [esp + 0x18]
and cl, 7
mov ebx, dword [esp + 0x2c]
and dl, 0x80
mov edi, dword [esp + 0x3c]
shr dl, cl
mov ecx, dword [esp + 0x40]
shl al, cl
mov ecx, dword [esp + 0x24]
not al
and al, byte [ecx + ebx]
or dl, al
mov byte [ecx + ebx], dl
mov ecx, dword [esp + 0x14]
mov ebx, dword [esp + 0x34]
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, dword [esp + 0x78]
jb 0x1010af60
pop esi
pop ebp
mov ecx, dword [esp + 0x60]
pop edi
pop ebx
xor ecx, esp
call fcn.101704a0
add esp, 0x5c
ret
Function at 0x1010f210
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10
call fcn.101704b0
mov edx, dword [esp + 0x1c]
xor ecx, ecx
test edx, edx
je 0x1010f304
push ebx
mov ebx, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x20]
cmp edx, 0x20
jb 0x1010f2e4
push ebp
lea eax, [ebx - 1]
lea ebp, [esi - 1]
add eax, edx
add ebp, edx
cmp esi, eax
ja 0x1010f257
cmp ebp, ebx
jae 0x1010f2e3
lea eax, [edi - 1]
add eax, edx
cmp esi, eax
ja 0x1010f264
cmp ebp, edi
jae 0x1010f2e3
mov eax, edx
mov ebp, edx
mov edx, esi
and eax, 0x1f
sub edx, edi
sub ebp, eax
mov dword [esp + 0x10], edx
mov eax, edi
mov edx, ebx
mov dword [esp + 0x1c], ebp
sub edx, edi
lea ebp, [ebx + 0x10]
mov dword [esp + 0x14], edx
mov edx, esi
mov esi, dword [esp + 0x10]
sub edx, ebx
mov edi, dword [esp + 0x14]
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x18]
mov edi, edi
movdqu xmm0, xmmword [eax]
add ecx, 0x20
lea eax, [eax + 0x20]
lea ebp, [ebp + 0x20]
movdqu xmm1, xmmword [edi + eax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [esi + eax - 0x20], xmm1
movdqu xmm1, xmmword [eax - 0x10]
movdqu xmm0, xmmword [ebp - 0x20]
pxor xmm1, xmm0
movdqu xmmword [ebx + ebp - 0x20], xmm1
cmp ecx, dword [esp + 0x1c]
jb 0x1010f2a0
mov esi, dword [esp + 0x30]
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x28]
pop ebp
cmp ecx, edx
jae 0x1010f301
sub edi, ebx
lea eax, [ecx + ebx]
sub esi, ebx
sub edx, ecx
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [eax + esi - 1], cl
dec edx
jne 0x1010f2f1
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x1012ace0
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
jmp 0x1012ace0
mov eax, 0x6c
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x68], eax
push 0xf0000040
push 1
push 0
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1012ad56
lea eax, [esp + 0x28]
push eax
push 0x40
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1012ad4a
mov eax, 8
call fcn.101704b0
movsd xmm0, qword [0x101bbca8]
lea eax, [esp + 0x30]
movsd qword [esp], xmm0
push 0x40
push eax
call sym.libcrypto_1_1.dll_RAND_add
add esp, 0x10
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0xf0000040
push 0x16
push str.Intel_Hardware_Cryptographic_Service_Provider
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1012adba
lea eax, [esp + 0x28]
push eax
push 0x40
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1012adae
mov eax, 8
call fcn.101704b0
movsd xmm0, qword [0x101bbca8]
lea eax, [esp + 0x30]
movsd qword [esp], xmm0
push 0x40
push eax
call sym.libcrypto_1_1.dll_RAND_add
add esp, 0x10
push 0
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
call fcn.1012aea0
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, 8
call fcn.101704b0
movsd xmm0, qword [0x1017dc90]
lea eax, [esp + 0x10]
movsd qword [esp], xmm0
push 0x20
push eax
call sym.libcrypto_1_1.dll_RAND_add
add esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [esp + 4], eax
mov eax, 8
call fcn.101704b0
movsd xmm0, qword [0x1017dc90]
lea eax, [esp + 0xc]
movsd qword [esp], xmm0
push 4
push eax
call sym.libcrypto_1_1.dll_RAND_add
mov ecx, dword [esp + 0x78]
add esp, 0x10
xor ecx, esp
mov eax, 1
call fcn.101704a0
add esp, 0x6c
ret
Function at 0x1012af50
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], 1
push edi
push edi
push str.RANDFILE
mov dword [ebp - 8], str.RANDFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, dword [ebp + 8]
mov esi, eax
test esi, esi
jne 0x1012afe1
push edi
push edi
push str.HOME
mov dword [ebp - 8], str.HOME
mov dword [ebp - 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
jne 0x1012afe1
push eax
push eax
push str.USERPROFILE
mov dword [ebp - 8], str.USERPROFILE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
jne 0x1012afe1
push eax
push eax
push str.SYSTEMROOT
mov dword [ebp - 8], str.SYSTEMROOT
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x1012b059
lea eax, [esi + esi]
call fcn.10170e20
mov eax, esp
push esi
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, esi
jae 0x1012b047
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0x10]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 8], eax
test eax, eax
je 0x1012b047
call fcn.10170e20
mov esi, esp
push 0
push 0
push dword [ebp - 8]
push esi
push 0xffffffffffffffff
push dword [ebp - 0x10]
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
neg edi
sbb edi, edi
and edi, esi
mov edx, dword [ebp - 0xc]
test edx, edx
jne 0x1012b062
test edi, edi
jne 0x1012b066
mov edi, 0x101bbd14
jmp 0x1012b06b
mov edx, edi
mov edi, 0x101bbd14
jmp 0x1012b06b
test edi, edi
je 0x1012b0d8
cmp byte [edi], 0
je 0x1012b0d8
mov ecx, edi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1012b070
sub ecx, esi
mov esi, dword [ebp + 0xc]
test edx, edx
je 0x1012b0ac
lea eax, [ecx + 1]
cmp eax, esi
jae 0x1012b0ac
push esi
push edi
push ebx
call sym.libcrypto_1_1.dll_OPENSSL_strlcpy
add esp, 0xc
cmp eax, esi
jb 0x1012b0db
xor eax, eax
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101704a0
mov esp, ebp
pop ebp
ret
lea eax, [ecx + 6]
cmp eax, esi
jae 0x1012b0db
push esi
push edi
push ebx
call sym.libcrypto_1_1.dll_OPENSSL_strlcpy
push esi
push 0x10189dc0
push ebx
call sym.libcrypto_1_1.dll_OPENSSL_strlcat
push esi
push str..rnd
push ebx
call sym.libcrypto_1_1.dll_OPENSSL_strlcat
add esp, 0x24
jmp 0x1012b0db
mov byte [ebx], 0
xor eax, eax
cmp byte [ebx], al
cmovne eax, ebx
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101704a0
mov esp, ebp
pop ebp
ret
Function at 0x1012b160
Capabilities:
Read file on windows

Disassembly:
jmp 0x1012b160
mov eax, 0x42c
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x428], eax
mov eax, dword [esp + 0x430]
push edi
xor edi, edi
mov dword [esp + 4], edi
test eax, eax
jne 0x1012b1a0
pop edi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.101704a0
add esp, 0x42c
ret
push esi
mov esi, dword [esp + 0x43c]
test esi, esi
jne 0x1012b1c5
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.101704a0
add esp, 0x42c
ret
push ebp
push 0x10189a04
push eax
call fcn.10004101
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x1012b2cf
lea eax, [esp + 0x10]
mov dword [esp + 0x30], edi
xorps xmm0, xmm0
push eax
push ebp
movdqu xmmword [esp + 0x18], xmm0
movdqu xmmword [esp + 0x28], xmm0
call dword [sym.imp.MSVCR120.dll__fileno]
add esp, 4
push eax
call dword [sym.imp.MSVCR120.dll__fstat32]
add esp, 8
test eax, eax
js 0x1012b2c5
mov eax, 8
call fcn.101704b0
xorps xmm0, xmm0
lea eax, [esp + 0x18]
movsd qword [esp], xmm0
push 0x24
push eax
call sym.libcrypto_1_1.dll_RAND_add
add esp, 0x10
test dword [esp + 0x16], 0x2000
je 0x1012b254
mov eax, 0x800
cmp esi, 0xffffffff
push 0
push ebp
cmove esi, eax
call dword [sym.imp.MSVCR120.dll_setbuf]
add esp, 8
push ebx
mov edi, 0x400
test esi, esi
jle 0x1012b263
cmp esi, edi
cmovl edi, esi
push ebp
push edi
lea eax, [esp + 0x40]
push 1
push eax
call dword [sym.imp.MSVCR120.dll_fread]
mov ebx, eax
add esp, 0x10
test ebx, ebx
jle 0x1012b2ae
movd xmm0, ebx
mov eax, 8
cvtdq2pd xmm0, xmm0
call fcn.101704b0
lea eax, [esp + 0x40]
movsd qword [esp], xmm0
push ebx
push eax
call sym.libcrypto_1_1.dll_RAND_add
add dword [esp + 0x20], ebx
add esp, 0x10
test esi, esi
jle 0x1012b255
sub esi, edi
test esi, esi
jg 0x1012b255
lea eax, [esp + 0x38]
push 0x400
push eax
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
mov edi, dword [esp + 0x18]
add esp, 8
pop ebx
push ebp
call dword [sym.imp.MSVCR120.dll_fclose]
add esp, 4
mov ecx, dword [esp + 0x434]
mov eax, edi
pop ebp
pop esi
pop edi
xor ecx, esp
call fcn.101704a0
add esp, 0x42c
ret
Function at 0x1012b350
Capabilities:
Write file on windows

Disassembly:
jmp 0x1012b350
mov eax, 0x42c
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x428], eax
push ebp
push esi
push edi
mov edi, dword [esp + 0x43c]
lea eax, [esp + 0x10]
push eax
push edi
xor esi, esi
xor ebp, ebp
call dword [sym.imp.MSVCR120.dll__stat32]
add esp, 8
cmp eax, 0xffffffff
je 0x1012b3af
test dword [esp + 0x16], 0x2000
je 0x1012b3af
pop edi
lea eax, [esi + 1]
pop esi
pop ebp
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.101704a0
add esp, 0x42c
ret
push 0x101bbcb4
push edi
call fcn.10004101
add esp, 8
mov dword [esp + 0xc], eax
test eax, eax
je 0x1012b44a
push ebx
push 0x180
push edi
call dword [sym.imp.MSVCR120.dll__chmod]
mov ebx, 0x400
add esp, 8
mov ecx, ebx
cmp ebx, 0x400
lea eax, [esp + 0x38]
mov edi, ebx
cmovg edi, ecx
sub ebx, 0x400
push edi
push eax
call sym.libcrypto_1_1.dll_RAND_bytes
push dword [esp + 0x18]
test eax, eax
mov eax, 1
push edi
push eax
cmovle ebp, eax
lea eax, [esp + 0x4c]
push eax
call dword [sym.imp.MSVCR120.dll_fwrite]
add esp, 0x18
test eax, eax
jle 0x1012b42b
add esi, eax
test ebx, ebx
jle 0x1012b42d
mov ecx, 0x400
jmp 0x1012b3e0
xor esi, esi
push dword [esp + 0x10]
call dword [sym.imp.MSVCR120.dll_fclose]
lea eax, [esp + 0x3c]
push 0x400
push eax
call sym.libcrypto_1_1.dll_OPENSSL_cleanse
add esp, 0xc
pop ebx
mov ecx, dword [esp + 0x434]
or eax, 0xffffffff
test ebp, ebp
pop edi
cmovne esi, eax
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.101704a0
add esp, 0x42c
ret
Function at 0x1012c330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1012c330
mov eax, 0x28
call fcn.101704b0
mov eax, dword [0x101f2700]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], eax
push ebx
push ebp
movzx ebx, byte [eax]
lea ebp, [eax + 1]
mov edx, ebp
mov dword [esp + 0x20], ebp
push esi
push edi
mov edi, dword [esp + 0x50]
movzx eax, byte [edx]
shl eax, 8
or ebx, eax
movzx ecx, byte [edx + 3]
movzx eax, byte [edx + 1]
shl eax, 0x10
or ebx, eax
mov esi, dword [edi]
movzx eax, byte [edx + 2]
shl eax, 0x18
or ebx, eax
mov dword [esp + 0x14], edi
movzx eax, byte [edx + 4]
shl eax, 8
or ecx, eax
mov dword [esp + 0x18], ebx
movzx eax, byte [edx + 5]
mov dword [esp + 0x2c], ecx
movzx ecx, byte [edx + 6]
mov edx, dword [esp + 0x2c]
shl ecx, 8
or ecx, eax
mov byte [esp + 0x2c], bl
mov eax, ebx
shl ecx, 0x10
shr eax, 8
or edx, ecx
mov byte [esp + 0x2d], al
mov eax, ebx
shr eax, 0x10
mov byte [esp + 0x2e], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2f], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x32], al
mov eax, edx
shr eax, 0x18
mov byte [esp + 0x33], al
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], edx
mov byte [esp + 0x30], dl
test eax, eax
je 0x1012c4f1
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0x3c]
sub ecx, edi
mov dword [esp + 0x10], ecx
xor ebp, ebp
lea esp, [esp]
dec eax
mov dword [esp + 0x44], eax
test esi, esi
jne 0x1012c485
push dword [esp + 0x20]
lea eax, [esp + 0x1c]
push eax
call sym.libcrypto_1_1.dll_RC2_encrypt
mov ebx, dword [esp + 0x20]
add esp, 8
mov edx, dword [esp + 0x1c]
mov eax, ebx
shr eax, 8
mov byte [esp + 0x2d], al
mov eax, ebx
mov ecx, dword [esp + 0x10]
shr eax, 0x10
mov byte [esp + 0x2e], al
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x2f], al
mov eax, edx
shr eax, 8
mov byte [esp + 0x31], al
mov eax, edx
shr eax, 0x10
mov byte [esp + 0x32], al
mov eax, edx
shr eax, 0x18
inc ebp
mov byte [esp + 0x2c], bl
mov byte [esp + 0x30], dl
mov byte [esp + 0x33], al
mov al, byte [esp + esi + 0x2c]
inc esi
xor al, byte [edi]
and esi, 7
mov byte [ecx + edi], al
inc edi
mov eax, dword [esp + 0x44]
test eax, eax
jne 0x1012c420
test ebp, ebp
mov ebp, dword [esp + 0x28]
je 0x1012c4d8
mov eax, dword [esp + 0x24]
mov byte [eax], bl
mov eax, ebx
shr eax, 8
mov byte [ebp], al
mov eax, ebx
shr eax, 0x10
mov byte [ebp + 1], al
mov eax, edx
shr ebx, 0x18
mov byte [ebp + 2], bl
shr eax, 8
mov byte [ebp + 3], dl
mov byte [ebp + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [ebp + 5], al
mov byte [ebp + 6], dl
mov eax, dword [esp + 0x14]
pop edi
mov dword [eax], esi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.101704a0
add esp, 0x28
ret
mov ecx, dword [esp + 0x34]
mov dword [edi], esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101704a0
add esp, 0x28
ret
Function at 0x1015f8b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, dword [esp + 4]
push ebx
mov ebx, dword [esp + 0x10]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ebp
push edi
sub ecx, 4
jb 0x1015f8e1
lea esp, [esp]
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x1015f8e8
add edx, 4
add esi, 4
sub ecx, 4
jae 0x1015f8d0
xor edi, edi
cmp ecx, 0xfffffffc
je 0x1015f923
movzx edi, byte [edx]
movzx eax, byte [esi]
sub edi, eax
jne 0x1015f923
cmp ecx, 0xfffffffd
je 0x1015f923
movzx edi, byte [edx + 1]
movzx eax, byte [esi + 1]
sub edi, eax
jne 0x1015f923
cmp ecx, 0xfffffffe
je 0x1015f923
movzx edi, byte [edx + 2]
movzx eax, byte [esi + 2]
sub edi, eax
jne 0x1015f923
cmp ecx, 0xffffffff
je 0x1015f923
movzx edi, byte [edx + 3]
movzx eax, byte [esi + 3]
sub edi, eax
test edi, edi
jle 0x1015f93e
push 0x157
push str.cryptox509v3_v3_addr.c
push str.assertion_failed:_memcmp_min__max__length____0
call sym.libcrypto_1_1.dll_OPENSSL_die
add esp, 0xc
mov edi, dword [esp + 0x14]
xor ecx, ecx
test ebx, ebx
jle 0x1015f95d
mov esi, edi
mov edx, ebp
sub esi, ebp
mov edi, edi
mov al, byte [esi + edx]
cmp al, byte [edx]
jne 0x1015f95d
inc ecx
inc edx
cmp ecx, ebx
jl 0x1015f950
lea edx, [ebx - 1]
test edx, edx
js 0x1015f97f
mov esi, edi
lea eax, [edx + ebp]
sub esi, ebp
jmp 0x1015f970
cmp byte [eax + esi], 0
jne 0x1015f97f
cmp byte [eax], 0xff
jne 0x1015f97f
dec eax
dec edx
jns 0x1015f970
cmp ecx, edx
jl case.0x1015f9ab.2
jle 0x1015f991
pop edi
pop esi
pop ebp
lea eax, [ecx*8]
pop ebx
ret
mov bl, byte [ecx + ebp]
mov dh, byte [ecx + edi]
mov dl, bl
xor dl, dh
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x1015f9ab.2
movzx eax, byte [eax + 0x1015fa1c]
jmp dword [eax*4 + 0x1015f9fc]
mov eax, 7
jmp 0x1015f9e1
mov eax, 6
jmp 0x1015f9e1
mov eax, 5
jmp 0x1015f9e1
mov eax, 4
jmp 0x1015f9e1
mov eax, 3
jmp 0x1015f9e1
mov eax, 2
jmp 0x1015f9e1
mov eax, 1
test dl, dh
jne case.0x1015f9ab.2
and bl, dl
cmp bl, dl
jne case.0x1015f9ab.2
pop edi
pop esi
pop ebp
lea eax, [eax + ecx*8]
pop ebx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret