joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4560e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x45610b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x45612f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x45614a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x457ae2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x457b04
cmp dword [edi + 0x3c], 0
jne 0x457b04
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.004605a4
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.00457b31
pop edi
pop esi
pop ebx
ret 8

Function at 0x4598d9
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x459911
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00458940
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00458918
jmp 0x45991d
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x459921
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x489a40
mov ecx, edi
call fcn.00458622
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x459974
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x459987
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.00458940
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xffffffffffffffff
mov ecx, edi
call fcn.00458918
jmp 0x459987
mov ecx, esi
call fcn.0045b59d
test eax, eax
je 0x459987
push edi
mov ecx, eax
call fcn.004598d9
mov eax, dword [edi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 8

Function at 0x45aec7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x45af09
call fcn.004605a4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x45af09
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45af00
xor eax, eax
jmp 0x45af11
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045af17
pop edi
pop esi
pop ebx
ret 4
Function at 0x10001000
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x134
call fcn.100ffa80
mov eax, dword [0x10291210]
xor eax, esp
mov dword [esp + 0x130], eax
mov eax, dword [esp + 0x148]
push ebx
mov ebx, dword [esp + 0x140]
push ebp
mov ebp, dword [esp + 0x148]
push esi
mov esi, dword [esp + 0x150]
mov dword [esp + 0x14], eax
xor eax, eax
push edi
mov edi, dword [esp + 0x148]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
cmp esi, eax
je 0x10001065
cmp esi, dword [edi]
je 0x10001061
cmp ebx, eax
je 0x100010de
cmp ebp, eax
jl 0x100010de
mov dword [edi], esi
jmp 0x1000106b
mov esi, dword [edi]
cmp esi, eax
je 0x100010de
push esi
call fcn.10060bf0
add esp, 4
test al, 2
jne 0x100010de
test ebx, ebx
je 0x100011d8
push esi
mov dword [esp + 0x14], 1
call fcn.100021e0
add esp, 4
cmp eax, 0x90
jg 0x100010de
cmp eax, ebp
jge 0x100010f9
mov ecx, dword [esp + 0x18]
mov edx, dword [edi + 4]
push ecx
push esi
push edx
call fcn.10005980
add esp, 0xc
test eax, eax
je 0x100010de
mov eax, dword [edi + 4]
push ebp
push ebx
push eax
call fcn.10005b30
add esp, 0xc
test eax, eax
je 0x100010de
mov eax, dword [edi + 4]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x24]
push edx
push eax
call fcn.10005b50
add esp, 0xc
test eax, eax
jne 0x10001118
xor eax, eax
mov ecx, dword [esp + 0x140]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100fd740
add esp, 0x134
ret
cmp ebp, 0x90
ja 0x100010de
push ebp
lea ecx, [esp + 0x24]
push ebx
push ecx
call fcn.100ffb30
mov eax, ebp
add esp, 0xc
mov dword [esp + 0x1c], eax
jmp 0x1000111c
mov eax, dword [esp + 0x1c]
cmp eax, 0x90
je 0x1000113a
mov edx, 0x90
sub edx, eax
push edx
lea eax, [esp + eax + 0x24]
push 0
push eax
call fcn.100ffab0
add esp, 0xc
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x20]
xor cl, 0x36
mov byte [esp + eax + 0xb0], cl
inc eax
cmp eax, 0x90
jl 0x10001140
mov ebx, dword [esp + 0x18]
mov edx, dword [edi + 8]
push ebx
push esi
push edx
call fcn.10005980
add esp, 0xc
test eax, eax
je 0x100011fb
push esi
call fcn.100021e0
mov ecx, dword [edi + 8]
push eax
lea eax, [esp + 0xb8]
push eax
push ecx
call fcn.10005b30
add esp, 0x10
test eax, eax
je 0x100011fb
xor eax, eax
mov dl, byte [esp + eax + 0x20]
xor dl, 0x5c
mov byte [esp + eax + 0xb0], dl
inc eax
cmp eax, 0x90
jl 0x10001191
mov eax, dword [edi + 0xc]
push ebx
push esi
push eax
call fcn.10005980
add esp, 0xc
test eax, eax
je 0x100011fb
push esi
call fcn.100021e0
mov edx, dword [edi + 0xc]
push eax
lea ecx, [esp + 0xb8]
push ecx
push edx
call fcn.10005b30
add esp, 0x10
test eax, eax
je 0x100011fb
mov eax, dword [edi + 8]
mov ecx, dword [edi + 4]
push eax
push ecx
call fcn.10005c60
add esp, 8
test eax, eax
je 0x100011f4
mov dword [esp + 0x14], 1
cmp dword [esp + 0x10], 0
je 0x1000121f
lea edx, [esp + 0x20]
push 0x90
push edx
call fcn.100055e0
lea eax, [esp + 0xb8]
push 0x90
push eax
call fcn.100055e0
add esp, 0x10
mov eax, dword [esp + 0x14]
jmp 0x100010e0
Function at 0x10006320
Capabilities:
Get thread local storage value

Disassembly:
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
ret

Function at 0x10008725
Capabilities:
Allocate thread local storage

Disassembly:
push 0
push 0
push 0
call fcn.1000ce50
add esp, 0xc
test eax, eax
jne 0x10008725
xor eax, eax
ret
push 0
push 0x10297f70
call fcn.10006300
add esp, 8
test eax, eax
je 0x10008722
push ebx
push 0
push 0x10297f74
call fcn.10006300
add esp, 8
test eax, eax
je 0x100087b2
mov eax, dword [0x10297f80]
mov ecx, dword [0x10290300]
push esi
push eax
push ecx
xor ecx, ecx
lea ebx, [ecx + 1]
call fcn.10008550
mov esi, eax
add esp, 8
test esi, esi
je 0x1000879a
push esi
call fcn.10008420
add esp, 4
test eax, eax
jne 0x10008787
push esi
call fcn.100079d0
add esp, 4
xor esi, esi
jmp 0x1000879a
push 0x1c
push str.OpenSSL_NIST_SP_800_90A_DRBG
push esi
mov dword [esi + 0x58], ebx
call fcn.10007a50
add esp, 0xc
mov dword [0x10297f78], esi
test esi, esi
pop esi
jne 0x100087c3
push 0x10297f74
call fcn.10006370
add esp, 4
push 0x10297f70
call fcn.10006370
add esp, 4
xor eax, eax
pop ebx
ret
mov eax, ebx
pop ebx
ret
Function at 0x10009250
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x208
call fcn.100ffa80
mov eax, dword [0x10291210]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x100092c5
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x100092c5
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
lea edx, [ebp - 0x204]
push 0x200
push edx
call fcn.101002b6
add esp, 0x10
test eax, eax
jns 0x100092a8
mov eax, 0x200
push 0
lea ecx, [ebp - 0x208]
push ecx
push eax
lea edx, [ebp - 0x204]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1000940e
mov ebx, dword [ebp + 8]
mov eax, ebx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100092d0
sub eax, edx
lea edi, [eax + 1]
lea eax, [edi + edi]
call fcn.101000f0
mov esi, esp
test esi, esi
jne 0x100092f4
mov esi, str.no_stack_
jmp 0x1000937f
push edi
push esi
push edi
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x10009321
test edi, edi
je 0x10009321
lea ebx, [ebx]
mov ecx, dword [ebp + 8]
movsx dx, byte [eax + ecx]
mov word [esi + eax*2], dx
inc eax
cmp eax, edi
jb 0x10009310
xor eax, eax
test edi, edi
je 0x1000937f
cmp word [esi + eax*2], 0x25
jne case.0x10009344.43
lea ecx, [esi + eax*2 + 2]
movzx edx, word [ecx]
add edx, 0xffffffd6
cmp edx, 0x49
ja case.0x10009344.43
movzx edx, byte [edx + 0x10009440]
jmp dword [edx*4 + 0x10009428]
inc eax
add ecx, 2
jmp 0x10009332
mov ecx, 0x53
mov word [esi + eax*2 + 2], cx
jmp case.0x10009344.43
mov edx, 0x73
jmp 0x10009375
mov ecx, 0x43
mov word [esi + eax*2 + 2], cx
jmp case.0x10009344.43
mov edx, 0x63
mov word [esi + eax*2 + 2], dx
inc eax
cmp eax, edi
jb 0x10009327
lea eax, [ebp + 0xc]
push eax
push esi
lea ecx, [ebp - 0x204]
push 0xff
push ecx
call fcn.101001ed
xor edx, edx
add esp, 0x10
mov word [ebp - 6], dx
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x100093f8
call fcn.10009110
test eax, eax
jle 0x100093f8
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov esi, eax
test esi, esi
je 0x1000940e
push 0
lea ecx, [ebp - 0x208]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
lea eax, [ebp - 0x204]
push esi
mov dword [ebp - 0x208], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x1000940e
push 0x10
push str.OpenSSL:_FATAL
lea edx, [ebp - 0x204]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea esp, [ebp - 0x214]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100fd740
mov esp, ebp
pop ebp
ret

Function at 0x1000a870
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
movzx edi, byte [esp + 0x10]
mov eax, edi
and eax, 1
add esi, ecx
add edx, ecx
test ecx, ecx
je 0x1000a8a3
push ebx
lea esp, [esp]
movzx ebx, byte [edx - 1]
dec edx
xor ebx, edi
add eax, ebx
dec esi
mov byte [esi], al
shr eax, 8
dec ecx
jne 0x1000a890
pop ebx
pop edi
pop esi
ret
Function at 0x1000baf0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xf3bcc908
mov dword [eax + 4], 0x6a09e667
mov dword [eax + 8], 0x84caa73b
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0xfe94f82b
mov dword [eax + 0x14], 0x3c6ef372
mov dword [eax + 0x18], 0x5f1d36f1
mov dword [eax + 0x1c], 0xa54ff53a
mov dword [eax + 0x20], 0xade682d1
mov dword [eax + 0x24], 0x510e527f
mov dword [eax + 0x28], 0x2b3e6c1f
mov dword [eax + 0x2c], 0x9b05688c
mov dword [eax + 0x30], 0xfb41bd6b
mov dword [eax + 0x34], 0x1f83d9ab
mov dword [eax + 0x38], 0x137e2179
mov dword [eax + 0x3c], 0x5be0cd19
mov dword [eax + 0x40], ecx
mov dword [eax + 0x44], ecx
mov dword [eax + 0x48], ecx
mov dword [eax + 0x4c], ecx
mov dword [eax + 0xd0], ecx
mov dword [eax + 0xd4], 0x40
lea eax, [ecx + 1]
ret
Function at 0x100105e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
cmp edi, eax
je 0x1001066b
mov edx, dword [esp + 8]
lea ecx, [edx - 1]
not edx
shr edx, 0x1f
push esi
mov esi, dword [edi + 4]
shr ecx, 0x1f
and ecx, edx
mov edx, dword [eax + 4]
xor edx, esi
dec ecx
and edx, ecx
xor esi, edx
mov dword [edi + 4], esi
xor dword [eax + 4], edx
mov esi, dword [edi + 0xc]
mov edx, dword [eax + 0xc]
xor edx, esi
and edx, ecx
xor esi, edx
mov dword [edi + 0xc], esi
xor dword [eax + 0xc], edx
mov esi, dword [edi + 0x10]
mov edx, dword [eax + 0x10]
xor edx, esi
and edx, ecx
and edx, 4
xor esi, edx
mov dword [edi + 0x10], esi
xor dword [eax + 0x10], edx
xor esi, esi
cmp dword [esp + 0x18], esi
jle 0x1001066a
push ebx
push ebp
mov edx, dword [edi]
mov ebx, dword [edx + esi*4]
lea ebp, [edx + esi*4]
mov edx, dword [eax]
mov edx, dword [edx + esi*4]
xor edx, ebx
and edx, ecx
xor ebx, edx
mov dword [ebp], ebx
mov ebx, dword [eax]
xor dword [ebx + esi*4], edx
lea ebx, [ebx + esi*4]
inc esi
cmp esi, dword [esp + 0x20]
jl 0x10010643
pop ebp
pop ebx
pop esi
pop edi
ret

Function at 0x100108f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
test byte [eax + 0x10], 4
mov ecx, dword [eax + 4]
push esi
lea esi, [ecx - 1]
je 0x1001090b
pop esi
mov dword [esp + 4], eax
jmp fcn.10010040
test ecx, ecx
jne 0x10010913
xor eax, eax
pop esi
ret
mov eax, dword [eax]
mov ecx, dword [eax + esi*4]
push ecx
call fcn.1000ffb0
shl esi, 5
add esp, 4
add eax, esi
pop esi
ret

Function at 0x10012c4f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 4
call fcn.100ffa80
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, ecx
push edi
lea ecx, [esi + 2]
mov dword [esp + 0xc], 0x10
mov eax, ebp
sub esi, ebp
mov edi, 4
jmp 0x10012c70
movzx edx, byte [esi + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
dec edi
jne 0x10012c70
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 4]
push 0x10
push ebp
lea eax, [esp + 0x14]
push eax
push ebp
push edx
call fcn.10004030
add esp, 0x14
pop edi
pop esi
pop ebp
test eax, eax
je 0x10012cc0
cmp dword [esp], 0x10
jne 0x10012cc0
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x100163c9
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, dword [esp + 8]
push ebp
mov ebp, dword [esp + 0x14]
push esi
mov esi, ecx
cmp ebp, 2
je 0x1001643f
test eax, eax
je 0x1001640b
push eax
push 0
lea eax, [esp + 0x20]
push eax
push 0
call fcn.1001e5f0
add esp, 0x10
cmp dword [esp + 0x18], 0xffffffff
je 0x1001640b
push 0x3b
push str.cryptoececx_meth.c
push 0x66
push 0x10a
push 0x10
call fcn.10006fe0
add esp, 0x14
pop esi
xor eax, eax
pop ebp
ret
cmp dword [esp + 0x14], 0
je 0x1001643b
cmp edi, 0x40a
je 0x10016432
cmp edi, 0x43f
je 0x10016432
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x10016437
mov eax, 0x20
cmp esi, eax
je 0x1001643f
push 0x41
jmp 0x100163f0
push ebx
push 0x46
push str.cryptoececx_meth.c
push 0x40
call fcn.10005f40
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x10016475
push 0x48
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.10006fe0
add esp, 0x14
pop ebx
pop esi
xor eax, eax
pop ebp
ret
test ebp, ebp
jne 0x1001648d
mov ecx, dword [esp + 0x18]
push esi
push ecx
push ebx
call fcn.100ffb30
add esp, 0xc
jmp case.0x100165be.1036
cmp edi, 0x40a
je 0x100164ad
cmp edi, 0x43f
je 0x100164ad
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x100164b2
mov eax, 0x20
push 0x50
push str.cryptoececx_meth.c
push eax
call fcn.100061a0
mov esi, eax
add esp, 0xc
mov dword [ebx + 0x3c], esi
test esi, esi
jne 0x100164e5
push 0x52
push str.cryptoececx_meth.c
push 0x41
push 0x10a
push 0x10
call fcn.10006fe0
add esp, 0x14
jmp 0x10016538
cmp ebp, 2
jne 0x10016578
cmp edi, 0x40a
je 0x1001650e
cmp edi, 0x43f
je 0x1001650e
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x10016513
mov eax, 0x20
push eax
push esi
call fcn.10002090
add esp, 8
test eax, eax
jg 0x1001654e
push 0x57
push str.cryptoececx_meth.c
push esi
call fcn.100061c0
add esp, 0xc
mov dword [ebx + 0x3c], 0
push 0x79
push str.cryptoececx_meth.c
push ebx
call fcn.10005fb0
add esp, 0xc
pop ebx
pop esi
xor eax, eax
pop ebp
ret
cmp edi, 0x40a
jne 0x10016567
mov dl, byte [esi + 0x1f]
and byte [esi], 0xf8
and dl, 0x3f
or dl, 0x40
mov byte [esi + 0x1f], dl
jmp 0x100165ac
cmp edi, 0x40b
jne 0x100165ac
and byte [esi], 0xfc
or byte [esi + 0x37], 0x80
jmp 0x100165ac
cmp edi, 0x40a
je 0x10016598
cmp edi, 0x43f
je 0x10016598
xor eax, eax
cmp edi, 0x40b
setne al
add eax, 0x38
jmp 0x1001659d
mov eax, 0x20
push eax
mov eax, dword [esp + 0x1c]
push eax
push esi
call fcn.100ffb30
add esp, 0xc
lea eax, [edi - 0x40a]
cmp eax, 0x36
ja case.0x100165be.1036
movzx ecx, byte [eax + 0x10016618]
jmp dword [ecx*4 + 0x10016604]
push esi
push ebx
call fcn.1004bfd0
jmp 0x100165e7
push esi
push ebx
call fcn.1004beb0
jmp 0x100165e7
push esi
push ebx
call fcn.1003e940
jmp 0x100165e7
push esi
push ebx
call fcn.1003c9f0
add esp, 8
mov edx, dword [esp + 0x10]
push ebx
push edi
push edx
call fcn.1001d840
add esp, 0xc
pop ebx
pop esi
mov eax, 1
pop ebp
ret
Function at 0x10032020
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push esi
push ebx
call fcn.10065180
push 0x62
push esi
mov edi, eax
mov ebp, 1
call fcn.10101220
add esp, 0x10
test eax, eax
jne 0x1003204c
lea ebp, [eax + 0x11]
test edi, edi
jne 0x100320d5
push 0x45
push str.crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.10006fe0
push 0x1022f150
push esi
push 0x1022f14c
push ebx
push str.fopen_
push 5
call fcn.10007560
add esp, 0x2c
call fcn.100febfe
cmp dword [eax], 2
je 0x100320b6
call fcn.100febfe
cmp dword [eax], 6
je 0x100320b6
push 0x4e
push str.crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.10006fe0
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x4c
push str.crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.10006fe0
add esp, 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0x1022f0f0
call fcn.10011dc0
mov esi, eax
add esp, 4
test esi, esi
jne 0x100320f8
push edi
call fcn.1010134b
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.10011f70
push edi
push ebp
push 0x6a
push esi
call fcn.100126c0
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x1003cbb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, ecx
push ebp
lea ecx, [ebx + 0xc]
push esi
lea eax, [edx + 4]
sub ebx, edx
mov ebp, 4
mov esi, dword [eax - 4]
mov edx, dword [ecx - 0xc]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax - 4], esi
xor dword [ecx - 0xc], edx
mov esi, dword [eax]
mov edx, dword [ebx + eax]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax], esi
xor dword [ebx + eax], edx
mov esi, dword [eax + 4]
mov edx, dword [ecx - 4]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax + 4], esi
xor dword [ecx - 4], edx
mov esi, dword [eax + 8]
mov edx, dword [ecx]
xor edx, esi
and edx, edi
xor esi, edx
mov dword [eax + 8], esi
xor dword [ecx], edx
add eax, 0x10
add ecx, 0x10
dec ebp
jne 0x1003cbc2
pop esi
pop ebp
pop ebx
ret
Function at 0x1004beb0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov eax, 0x15c
call fcn.100ffa80
mov eax, dword [0x10291210]
xor eax, esp
mov dword [esp + 0x158], eax
mov eax, dword [esp + 0x164]
push esi
mov esi, dword [esp + 0x164]
lea ecx, [esp + 0x11c]
push ecx
push 0x20
push eax
call fcn.1000c3f0
mov dl, byte [esp + 0x147]
and byte [esp + 0x128], 0xf8
and dl, 0x3f
lea eax, [esp + 0x88]
or dl, 0x40
push eax
lea ecx, [esp + 0x12c]
mov byte [esp + 0x14b], dl
call fcn.10043d90
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0xe0]
call fcn.10041370
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x98]
call fcn.1003f0b0
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x74]
push edx
lea ecx, [esp + 0xc8]
call fcn.1003f0b0
push esi
lea ecx, [esp + 0x7c]
call fcn.1003ee10
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x58]
call fcn.1003ee10
mov cl, byte [esp + 0x30]
lea edx, [esp + 0x148]
shl cl, 7
xor byte [esi + 0x1f], cl
push 0x40
push edx
call fcn.100055e0
mov ecx, dword [esp + 0x190]
add esp, 0x34
pop esi
xor ecx, esp
call fcn.100fd740
add esp, 0x15c
ret