joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007250
Capabilities:
Print debug messages

Disassembly:
sub esp, 8
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 0x5b0]
add eax, 8
mov dword [eax + 0x5b0], ecx
cmp ecx, eax
jne 0x1000727d
xor ecx, ecx
jmp 0x10007289
mov edx, dword [ecx + 0x5a8]
mov dword [eax + 0x5b0], edx
push esi
mov esi, ecx
test ecx, ecx
je 0x1000733d
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenThread]
mov eax, dword [esi]
cmp dword [esp + 0x10], eax
jne 0x100072b0
mov dword [esp + 0xc], esi
jmp 0x10007310
push eax
push 1
push 0x40
call edi
test eax, eax
jne 0x10007309
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100072fc
mov eax, dword [esi + 0x5ac]
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5a8], ecx
mov edx, dword [esi + 0x5a8]
mov eax, dword [esi + 0x5ac]
mov dword [edx + 0x5ac], eax
call ebp
test eax, eax
je 0x10007310
push esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10007310
push 0x10143600
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x10007310
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebx]
mov esi, dword [eax + 0x5b8]
add eax, 8
cmp esi, eax
je 0x10007333
mov ecx, dword [esi + 0x5a8]
mov dword [eax + 0x5b0], ecx
test esi, esi
jne 0x100072a2
mov eax, dword [esp + 0xc]
pop edi
pop ebp
test eax, eax
jne 0x10007351
mov ecx, dword [ebx]
add ecx, 8
call fcn.100074e0
test eax, eax
je 0x10007351
mov edx, dword [esp + 8]
mov dword [eax], edx
pop esi
add esp, 8
ret

Function at 0x10007360
Capabilities:
Allocate thread local storage

Disassembly:
push 0xffffffffffffffff
push 0x101016fb
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x1014a240]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x1c]
lea esi, [edi + 8]
push 0x5a0
lea eax, [esi + 8]
push 0
mov dword [edi], 0
mov dword [edi + 4], 0xffffffff
push eax
mov dword [esi], 0
call fcn.100e1a10
add esp, 0xc
mov dword [esi + 0x5ac], esi
mov dword [esi + 0x5a8], esi
mov dword [esi + 0x5b0], esi
mov dword [esp + 0x14], 0
mov dword [edi + 0x5bc], 0
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
jne 0x100073f8
push 0x101449e4
lea eax, [esp + 0x24]
push eax
mov dword [esp + 0x28], 2
call fcn.100e70bc
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov dword [esp + 0x14], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 8
Function at 0x10025d53
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x1014a240]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
xor edi, edi
cmp ebx, edi
jne 0x10025d76
or eax, 0xffffffff
jmp 0x10025e1b
push 0x80
push edi
push ebx
call fcn.100e1a10
add esp, 0xc
xor ecx, ecx
push esi
movsx eax, byte [ecx + str.91__]
mov esi, dword [ebp + 0xc]
dec eax
mov edx, eax
sar edx, 3
movsx edx, byte [edx + esi]
and eax, 7
test dword [eax*4 + 0x10146520], edx
setne al
mov byte [ebp + ecx - 0x3c], al
inc ecx
cmp ecx, 0x38
jl 0x10025d88
movsx eax, byte [edi + 0x101462c0]
xor ecx, ecx
xor edx, edx
cmp ecx, 0x1c
setge dl
mov esi, eax
dec edx
and edx, 0xffffffe4
add edx, 0x38
cmp eax, edx
jl 0x10025dd4
lea esi, [eax - 0x1c]
mov dl, byte [ebp + esi - 0x3c]
mov byte [ebp + ecx - 0x74], dl
inc ecx
inc eax
cmp ecx, 0x38
jl 0x10025dbc
xor ecx, ecx
movsx eax, byte [ecx + 0x101462d0]
cmp byte [ebp + eax - 0x75], 0
je 0x10025e0c
mov eax, ecx
cdq
push 6
pop esi
idiv esi
mov edx, dword [edx*4 + 0x10146520]
lea eax, [eax + edi*8]
add eax, ebx
sar edx, 2
or byte [eax], dl
inc ecx
cmp ecx, 0x30
jl 0x10025de5
inc edi
cmp edi, 0x10
jl 0x10025db3
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.100e1a8a
leave
ret

Function at 0x10026014
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1014a240]
xor eax, ebp
mov dword [ebp - 4], eax
xor ecx, ecx
xor eax, eax
movsx edx, byte [eax + 0x10146500]
dec edx
cmp edx, ecx
je 0x1002603c
inc eax
cmp eax, 0x20
jl 0x10026028
jmp 0x10026040
mov byte [ebp + ecx - 0x24], al
inc ecx
cmp ecx, 0x20
jl 0x10026026
and dword [ebp - 0x28], 0
push ebx
lea eax, [ebp - 0x24]
push esi
mov dword [ebp - 0x30], eax
mov eax, dword [0x10152838]
push edi
xor edx, edx
mov dword [ebp - 0x2c], eax
mov eax, edx
sar eax, 1
mov ecx, edx
and ecx, 1
shl ecx, 4
and eax, 0xf
or eax, ecx
mov ecx, edx
and ecx, 0x20
or eax, ecx
mov ecx, dword [ebp - 0x28]
movsx eax, byte [ecx + eax + 0x10146300]
xor edi, edi
xor esi, esi
push 8
pop ebx
mov ecx, esi
sar ebx, cl
test eax, ebx
je 0x100260a2
mov ecx, dword [ebp - 0x30]
movsx ebx, byte [ecx + esi]
push 0x1f
pop ecx
sub ecx, ebx
xor ebx, ebx
inc ebx
shl ebx, cl
or edi, ebx
inc esi
cmp esi, 4
jl 0x10026084
mov eax, dword [ebp - 0x2c]
add dword [ebp - 0x2c], 4
inc edx
cmp edx, 0x40
mov dword [eax], edi
jl 0x1002605d
add dword [ebp - 0x28], 0x40
add dword [ebp - 0x30], 4
cmp dword [ebp - 0x28], 0x200
mov eax, dword [ebp - 0x2c]
jl 0x10026058
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e1a8a
leave
ret
Function at 0x100261a9
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov esi, 0x800
push esi
mov dword [0x10152834], ebx
call fcn.100e3cdd
mov edi, eax
pop ecx
mov dword [0x10152838], edi
test edi, edi
je 0x10026237
call fcn.10026014
cmp ebx, 1
je 0x10026237
push esi
call fcn.100e3cdd
pop ecx
mov dword [0x10152830], eax
test eax, eax
jne 0x100261f4
push edi
call fcn.100e3c00
pop ecx
or eax, 0xffffffff
jmp 0x10026239
push 0x10146208
push eax
call fcn.10025fa0
push esi
call fcn.100e3cdd
add esp, 0xc
mov dword [0x1015282c], eax
test eax, eax
jne 0x1002622a
push dword [0x10152838]
call fcn.100e3c00
push dword [0x10152830]
call fcn.100e3c00
pop ecx
jmp 0x100261ee
push 0x10146248
push eax
call fcn.10025fa0
pop ecx
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x100264bd
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x410
lea ebp, [esp - 4]
mov eax, dword [0x1014a240]
xor eax, ebp
mov dword [ebp + 0x410], eax
push 4
mov eax, 0x101015a8
call fcn.100e7706
xor eax, eax
mov word [ebp], ax
push 0x104
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp]
push eax
lea eax, [ebp + 0x208]
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.dnsapi.dll
lea eax, [ebp + 0x208]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea eax, [ebp + 0x208]
push eax
call ebx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
je 0x10026556
push 0
push eax
push 0x10152c74
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x10026552
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [ebp - 0x10], 0
lea eax, [ebp]
push eax
lea eax, [ebp + 0x208]
push eax
call esi
push str.iphlpapi.dll
lea eax, [ebp + 0x208]
push eax
call edi
lea eax, [ebp + 0x208]
push eax
call ebx
push eax
lea ecx, [ebp - 0x10]
call fcn.100264a1
cmp dword [ebp - 0x10], 0
je 0x100265aa
push 0
push dword [ebp - 0x10]
push 0x10152c78
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x100265a6
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [ebp - 0x10], 0
lea eax, [ebp]
push eax
lea eax, [ebp + 0x208]
push eax
call esi
push str._secur32.dll
lea eax, [ebp + 0x208]
push eax
call edi
lea eax, [ebp + 0x208]
push eax
call ebx
push eax
lea ecx, [ebp - 0x10]
call fcn.100264a1
mov edi, dword [ebp - 0x10]
test edi, edi
jne 0x100265e3
push 2
pop eax
jmp 0x10026636
push str.InitSecurityInterfaceA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x100265fc
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x100265de
call eax
mov ebx, eax
test ebx, ebx
jne 0x10026612
push 2
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
jmp 0x10026636
mov esi, dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
push 0
push edi
push 0x10150744
call esi
test eax, eax
je 0x1002662a
xor esi, esi
jmp 0x10026607
push 0
push ebx
push 0x10150748
call esi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.100e1a8a
add ebp, 0x414
leave
ret

Function at 0x10026659
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x1014a240]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x194]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x100266b6
mov eax, dword [ebp - 0x194]
cmp al, 2
jne 0x100266b0
shr eax, 8
cmp al, 2
jne 0x100266b0
push 0
push 1
push 0x10152c70
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
je 0x100266ac
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x100266b9
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 2
pop eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e1a8a
leave
ret
Function at 0x10026b88
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x1014a240]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call fcn.100e1a10
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 5
jne 0x10026bdf
cmp dword [ebp - 0x90], 2
jne 0x10026bdf
xor eax, eax
inc eax
jmp 0x10026be1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100e1a8a
leave
ret

Function at 0x10026bed
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x20]
or eax, 0x20019
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10026c34
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0x20]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
ret
Function at 0x10026c36
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xafc8]
mov eax, 0xb048
call fcn.100e42e0
mov eax, dword [0x1014a240]
xor eax, ebp
mov dword [ebp + 0xafc4], eax
push ebx
push esi
push edi
mov edi, 0x103
xor ebx, ebx
push edi
lea eax, [ebp + 0xadbd]
push ebx
push eax
mov byte [ebp + 0xadbc], bl
call fcn.100e1a10
add esp, 0xc
lea esi, [edi + 1]
push esi
lea eax, [ebp + 0xadbc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edi
lea eax, [ebp + 0xaec1]
push ebx
push eax
mov byte [ebp + 0xaec0], bl
call fcn.100e1a10
lea eax, [ebp + 0xadbc]
push eax
push str._sRasapi32.dll
lea eax, [ebp + 0xaec0]
push esi
push eax
call fcn.100e36a8
add esp, 0x1c
lea eax, [ebp + 0xaec0]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
mov dword [ebp - 0x80], edi
cmp edi, ebx
je 0x10026daa
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RasEnumConnectionsA
push edi
call esi
push str.RasGetConnectStatusA
push edi
mov dword [ebp - 0x68], eax
call esi
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x68], ebx
je 0x10026da3
cmp eax, ebx
je 0x10026da3
mov esi, 0xad00
push esi
lea eax, [ebp + 0xbc]
push ebx
push eax
mov dword [ebp - 0x74], ebx
call fcn.100e1a10
add esp, 0xc
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0xbc]
mov edi, 0x2b4
push eax
mov dword [ebp - 0x7c], esi
mov dword [ebp + 0xbc], edi
mov dword [ebp - 0x70], ebx
call dword [ebp - 0x68]
test eax, eax
jne 0x10026d95
mov dword [ebp - 0x68], ebx
cmp dword [ebp - 0x70], ebx
jbe 0x10026d95
lea eax, [ebp + 0xc0]
mov dword [ebp - 0x6c], eax
mov esi, 0x120
push esi
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.100e1a10
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebp - 0x6c]
push dword [eax]
mov dword [ebp - 0x64], esi
call dword [ebp - 0x78]
test eax, eax
jne 0x10026d7e
cmp dword [ebp - 0x60], 0x2000
je 0x10026d8e
inc dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
add dword [ebp - 0x6c], edi
cmp eax, dword [ebp - 0x70]
jb 0x10026d54
jmp 0x10026d95
mov dword [ebp - 0x74], 1
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x74]
jmp 0x10026dac
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [ebp + 0xafc4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e1a8a
add ebp, 0xafc8
leave
ret
Function at 0x10026e22
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 0xc]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwarePoliciesMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.WS2_32.dll_bind
mov byte [ebp - 1], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10026e51
mov al, 1
jmp 0x10026e8e
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push str.ProxySettingsPerUser
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 4
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10026e82
cmp dword [ebp - 8], ebx
jne 0x10026e82
mov byte [ebp - 1], bl
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
pop ebx
leave
ret
Function at 0x10026eff
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x4b8]
sub esp, 0x538
mov eax, dword [0x1014a240]
xor eax, ebp
mov dword [ebp + 0x4b4], eax
push ebx
push esi
mov esi, dword [ebp + 0x4c8]
push edi
mov edi, dword [ebp + 0x4c0]
xor ebx, ebx
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x7c], esi
cmp byte [0x10146554], bl
je 0x10027064
cmp byte [0x10152c60], bl
je 0x1002702c
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x1a8]
push eax
mov esi, 0x104
mov dword [ebp - 0x70], ebx
push ebx
mov edi, reloc.WS2_32.dll_closesocket
jmp 0x10027015
inc dword [ebp - 0x70]
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
lea eax, [ebp + 0x1a8]
push eax
push 0x10107fac
lea eax, [ebp - 0x60]
push esi
push eax
call fcn.100e7fbf
push 0x208
lea eax, [ebp + 0x2ac]
push ebx
push eax
call fcn.100e1a10
push dword [ebp + 0x4c4]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x2ac]
push eax
lea eax, [ebp - 0x80]
push eax
push str.ProxyServer
lea eax, [ebp - 0x60]
push eax
push edi
mov dword [ebp - 0x78], 0x206
mov dword [ebp - 0x80], 1
call fcn.10026bed
add esp, 0x3c
test eax, eax
je 0x10027003
lea eax, [ebp + 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x10027003
push dword [ebp - 0x7c]
lea eax, [ebp + 0x2ac]
push esi
push eax
push dword [ebp - 0x74]
call fcn.10026e91
add esp, 0x10
test al, al
jne 0x100270db
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x1a8]
push eax
push dword [ebp - 0x70]
push edi
mov dword [ebp - 0x68], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x10026f6b
jmp 0x100270db
push 0x208
lea eax, [ebp + 0x2ac]
push ebx
push eax
call fcn.100e1a10
push dword [ebp + 0x4c4]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x2ac]
push eax
lea eax, [ebp - 0x64]
push eax
push str.ProxyServer
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push bind
jmp 0x1002709a
push 0x208
lea eax, [ebp + 0x2ac]
push ebx
push eax
call fcn.100e1a10
push dword [ebp + 0x4c4]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x2ac]
push eax
lea eax, [ebp - 0x64]
push eax
push str.ProxyServer
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x6c], 0x206
mov dword [ebp - 0x64], 1
call fcn.10026bed
add esp, 0x28
test eax, eax
jne 0x100270db
lea eax, [ebp + 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x100270db
push esi
push 0x104
lea eax, [ebp + 0x2ac]
push eax
push edi
call fcn.10026e91
add esp, 0x10
mov eax, dword [ebp - 0x74]
push dword [eax + 0x310]
call fcn.10026e06
mov ecx, dword [ebp + 0x4b4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100e1a8a
add ebp, 0x4b8
leave
ret
Function at 0x10029010
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x108
call fcn.100e42e0
mov eax, dword [0x1014a240]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x10029097
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x10029097
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x100
push edx
call fcn.100e7960
add esp, 0x10
test eax, eax
jge 0x1002906d
mov eax, 0x100
push 0
lea ecx, [esp + 8]
push ecx
push eax
lea edx, [esp + 0x14]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.100e1a8a
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
lea eax, [esp + 0x114]
push eax
push ecx
lea edx, [esp + 0x10]
push 0xff
push edx
call fcn.100e7960
add esp, 0x10
mov byte [esp + 0x107], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x10029129
call fcn.10028ed0
test eax, eax
jle 0x10029129
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x1002913d
push 0
lea ecx, [esp + 8]
push ecx
push 0
push 1
push 0
push 0
push 0
push 1
lea eax, [esp + 0x28]
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.100e1a8a
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea edx, [esp + 0x10]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.100e1a8a
add esp, 0x108
ret

Function at 0x10029190
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0x10]
xor cl, cl
test edi, edi
jbe 0x100291b8
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0x14]
sub esi, eax
mov dl, byte [esi + eax]
mov bl, byte [eax]
xor dl, bl
or cl, dl
inc eax
sub edi, 1
jne 0x100291a7
pop esi
pop ebx
movzx eax, cl
pop edi
ret
Function at 0x10085727
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 0xa0
call fcn.100e42e0
mov eax, dword [0x1014a240]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebp
mov ebp, dword [esp + 0xa8]
push esi
mov esi, ecx
test eax, eax
jbe 0x10085894
push ebx
dec eax
push edi
lea edi, [ebp + 0xc]
shr eax, 3
add ebp, 0x14
inc eax
mov dword [esp + 0x18], eax
movzx ebx, byte [esi]
movzx eax, byte [esi + 1]
inc esi
movzx ecx, byte [esi + 1]
inc esi
movzx edx, byte [esi + 1]
shl eax, 8
or ebx, eax
inc esi
movzx eax, byte [esi + 1]
inc esi
shl ecx, 0x10
or ebx, ecx
movzx ecx, byte [esi + 1]
shl edx, 0x18
inc esi
or ebx, edx
movzx edx, byte [esi + 1]
inc esi
shl ecx, 8
or eax, ecx
movzx ecx, byte [esi + 1]
inc esi
shl edx, 0x10
or eax, edx
mov dl, byte [edi]
shl ecx, 0x18
or eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov al, byte [ebp]
and dl, 0xdf
and al, 0xbf
or dl, 0x40
or al, 0x20
push edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
inc esi
mov byte [edi], dl
mov byte [ebp], al
call fcn.1009e580
lea ecx, [esp + 0x30]
push ecx
push edi
call fcn.1009e600
push 1
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x38]
push eax
call fcn.1009cc80
push ebp
call fcn.1009e580
lea ecx, [esp + 0x48]
push ecx
push ebp
call fcn.1009e600
push 1
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x48]
push eax
call fcn.1009cc80
mov eax, dword [esp + 0x50]
xor eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x58]
xor dword [esp + 0x40], edx
xor ecx, ebx
xor ebx, dword [esp + 0x54]
mov dword [esp + 0x44], eax
mov eax, edi
mov byte [eax], bl
mov edx, ebx
inc eax
shr edx, 8
add esp, 0x30
mov byte [eax], dl
inc eax
inc eax
mov edx, ebx
shr edx, 0x10
mov byte [eax - 1], dl
mov edx, dword [esp + 0x14]
inc eax
shr ebx, 0x18
mov byte [eax - 1], bl
mov byte [eax], dl
mov ebx, edx
inc eax
inc eax
shr ebx, 8
mov byte [eax - 1], bl
mov ebx, edx
shr edx, 0x18
shr ebx, 0x10
mov byte [eax], bl
mov byte [eax + 1], dl
mov edx, ecx
shr edx, 8
mov eax, ebp
mov byte [eax], cl
mov byte [eax + 1], dl
inc eax
inc eax
mov edx, ecx
shr edx, 0x10
mov byte [eax], dl
inc eax
shr ecx, 0x18
mov byte [eax], cl
mov ecx, dword [esp + 0x10]
inc eax
mov byte [eax], cl
mov edx, ecx
shr edx, 8
inc eax
mov byte [eax], dl
mov edx, ecx
inc eax
shr edx, 0x10
shr ecx, 0x18
sub dword [esp + 0x18], 1
mov byte [eax], dl
mov byte [eax + 1], cl
jne 0x10085743
pop edi
pop ebx
mov ecx, dword [esp + 0xa4]
pop esi
pop ebp
xor ecx, esp
call fcn.100e1a8a
add esp, 0xa0
ret
Function at 0x1009fcd0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x88
call fcn.100e42e0
mov eax, dword [0x1014a240]
xor eax, esp
mov dword [esp + 0x84], eax
mov eax, dword [esp + 0x9c]
push ebx
mov ebx, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x94]
mov dword [esp + 8], eax
xor eax, eax
push edi
mov edi, dword [esp + 0x9c]
test ebx, ebx
je 0x1009fd45
cmp ebx, dword [esi]
je 0x1009fd3c
test edi, edi
je 0x1009fd22
cmp dword [esp + 0xa0], eax
jge 0x1009fd3c
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x84]
xor ecx, esp
call fcn.100e1a8a
add esp, 0x88
ret
mov eax, 1
mov dword [esi], ebx
jmp 0x1009fd4b
mov ebx, dword [esi]
test ebx, ebx
je 0x1009fd22
push ebp
test edi, edi
je 0x1009fe1d
push ebx
call fcn.10042860
mov ebp, eax
add esp, 4
cmp ebp, 0x80
jle 0x1009fd7b
push str.j____int_sizeof_ctx__key_
push 0x74
push str..cryptohmachmac.c
call fcn.10029160
add esp, 0xc
mov eax, dword [esp + 0xa4]
cmp ebp, eax
jge 0x1009fdd5
mov ecx, dword [esp + 0x10]
push ecx
lea ebp, [esi + 4]
push ebx
push ebp
call fcn.10041a80
add esp, 0xc
test eax, eax
je 0x1009feca
mov edx, dword [esp + 0xa4]
push edx
push edi
push ebp
call fcn.10041c30
add esp, 0xc
test eax, eax
je 0x1009feca
lea edi, [esi + 0x4c]
push edi
lea eax, [esi + 0x50]
push eax
push ebp
call fcn.10041c40
add esp, 0xc
test eax, eax
je 0x1009feca
jmp 0x1009fdfa
cmp eax, 0x80
ja 0x1009feca
push eax
lea ecx, [esi + 0x50]
push edi
push ecx
call fcn.100e1b30
mov edx, dword [esp + 0xb0]
lea edi, [esi + 0x4c]
add esp, 0xc
mov dword [edi], edx
mov edi, dword [edi]
cmp edi, 0x80
je 0x1009fe25
mov eax, 0x80
sub eax, edi
push eax
lea ecx, [edi + esi + 0x50]
push 0
push ecx
call fcn.100e1a10
add esp, 0xc
jmp 0x1009fe25
test eax, eax
je 0x1009feb6
xor eax, eax
jmp 0x1009fe30
mov dl, byte [esi + eax + 0x50]
xor dl, 0x36
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x80
jl 0x1009fe30
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x1c]
push ebx
push ebp
call fcn.10041a80
add esp, 0xc
test eax, eax
je 0x1009feca
push ebx
call fcn.10042860
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.10041c30
add esp, 0x10
test eax, eax
je 0x1009feca
xor eax, eax
mov dl, byte [esi + eax + 0x50]
xor dl, 0x5c
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 0x80
jl 0x1009fe74
mov eax, dword [esp + 0x10]
push eax
lea ebp, [esi + 0x34]
push ebx
push ebp
call fcn.10041a80
add esp, 0xc
test eax, eax
je 0x1009feca
push ebx
call fcn.10042860
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
call fcn.10041c30
add esp, 0x10
test eax, eax
je 0x1009feca
lea edx, [esi + 0x1c]
push edx
add esi, 4
push esi
call fcn.10041dd0
add esp, 8
test eax, eax
jne 0x1009fece
xor eax, eax
jmp 0x1009fed3
mov eax, 1
mov ecx, dword [esp + 0x94]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100e1a8a
add esp, 0x88
ret