joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10146620
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 4], edx
mov edx, dword [ebp + 8]
mov ebx, edx
mov esi, edx
mov dword [ebp - 8], ecx
shr esi, 5
inc esi
push edi
mov edi, edx
cmp edx, esi
jb 0x10146668
mov eax, dword [ebp - 4]
dec edx
lea edx, [eax + edx*2]
mov ecx, ebx
mov eax, ebx
shr eax, 2
sub edi, esi
shl ecx, 5
add ecx, eax
movzx eax, word [edx]
add ecx, eax
lea eax, [esi + esi]
xor ebx, ecx
sub edx, eax
cmp edi, esi
jae 0x10146647
mov edx, dword [ebp + 8]
mov esi, dword [ebp - 8]
mov eax, dword [esi + 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [eax + 8]
mov eax, dword [eax]
dec ecx
and ecx, ebx
mov edi, dword [eax + ecx*4]
test edi, edi
je 0x10146719
cmp byte [edi + 4], 9
jne 0x101466e3
cmp dword [edi + 0xc], edx
jne 0x101466e3
lea esi, [edx + edx]
mov edx, dword [ebp - 4]
lea eax, [edi + 0x10]
sub esi, 4
jb 0x101466b1
nop dword [eax]
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x101466b6
add edx, 4
add eax, 4
sub esi, 4
jae 0x101466a0
cmp esi, 0xfffffffc
je 0x101466ee
mov cl, byte [edx]
cmp cl, byte [eax]
jne 0x101466e3
cmp esi, 0xfffffffd
je 0x101466ee
mov cl, byte [edx + 1]
cmp cl, byte [eax + 1]
jne 0x101466e3
cmp esi, 0xfffffffe
je 0x101466ee
mov cl, byte [edx + 2]
cmp cl, byte [eax + 2]
jne 0x101466e3
cmp esi, 0xffffffff
je 0x101466ee
mov cl, byte [edx + 3]
cmp cl, byte [eax + 3]
je 0x101466ee
mov edi, dword [edi]
test edi, edi
je 0x10146716
mov edx, dword [ebp + 8]
jmp 0x10146684
mov ecx, dword [ebp - 0xc]
mov al, byte [edi + 5]
movzx edx, byte [ecx + 0x14]
not edx
movzx ecx, al
and edx, ecx
test dl, 3
je 0x101467ba
xor al, 3
mov byte [edi + 5], al
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
lea eax, [edi + 1]
cmp eax, 0x7ffffff6
jbe 0x1014672d
mov ecx, esi
call fcn.10147190
lea eax, [edi*2 + 0x12]
xor edx, edx
push eax
push 0
mov ecx, esi
call fcn.101471b0
mov dword [ebp - 0xc], eax
mov dword [eax + 0xc], edi
mov dword [eax + 8], ebx
mov ecx, dword [esi + 0x10]
lea esi, [edi + edi]
push esi
push dword [ebp - 4]
mov cl, byte [ecx + 0x14]
and cl, 3
mov byte [eax + 4], 9
mov byte [eax + 5], cl
mov byte [eax + 6], 0
add eax, 0x10
push eax
call fcn.10187960
mov eax, dword [ebp - 0xc]
add esp, 0x14
mov byte [eax + edi*2 + 0x10], 0
mov edi, eax
mov byte [esi + edi + 0x11], 0
mov esi, dword [ebp - 8]
mov edx, dword [esi + 0x10]
mov eax, dword [edx + 8]
dec eax
and eax, ebx
lea ecx, [eax*4]
mov eax, dword [edx]
mov eax, dword [ecx + eax]
mov dword [edi], eax
mov eax, dword [edx]
mov dword [ecx + eax], edi
inc dword [edx + 4]
mov eax, dword [edx + 8]
cmp dword [edx + 4], eax
jbe 0x101467ba
cmp eax, 0x3ffffffe
jg 0x101467ba
lea edx, [eax + eax]
mov ecx, esi
call fcn.10146350
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1015c2b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x1022c068]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
mov eax, ecx
mov dword [esp + 0xc], 0
push esi
mov dword [esp + 8], eax
mov ebx, edx
mov dword [esp + 0x14], eax
mov esi, 0x200
lea eax, [esp + 0x18]
mov dword [esp + 0x218], 0
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0x10], eax
nop dword [eax]
lea ecx, [esp + 0x10]
call fcn.10131bf0
test eax, eax
je 0x1015c316
lea ecx, [esp + 0x10]
call fcn.10131cb0
cmp esi, edi
mov eax, edi
push ebx
cmovbe eax, esi
mov esi, eax
lea eax, [esp + 0x20]
push esi
push 1
push eax
call fcn.1018f461
add dword [esp + 0x20], eax
add esp, 0x10
sub edi, eax
je 0x1015c33c
cmp eax, esi
je 0x1015c300
lea ecx, [esp + 0x10]
call fcn.10131bf0
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
call fcn.101305d0
mov dword [esp + 0x14], 1
test edi, edi
je 0x1015c3c8
mov edi, dword [esp + 0xc]
or edx, 0xffffffff
mov ecx, edi
call fcn.1012f5c0
mov esi, eax
mov ecx, dword [esi + 8]
add ecx, 0xfffffffd
cmp ecx, 6
ja case.0x1015c379.6
jmp dword [ecx*4 + 0x1015c3e4]
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
jmp 0x1015c3ad
mov eax, dword [esi]
mov eax, dword [eax + 0x10]
jmp 0x1015c3ad
mov ecx, dword [esi]
call fcn.10143770
jmp 0x1015c3ad
mov edx, esi
mov ecx, edi
call fcn.1013eb40
test eax, eax
je 0x1015c3ab
mov eax, dword [esi]
mov eax, dword [eax + 0xc]
jmp 0x1015c3ad
xor eax, eax
test eax, eax
jne 0x1015c3c8
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.10186332
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x224]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.10186332
mov esp, ebp
pop ebp
ret
Function at 0x1015c970
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], edx
push edi
mov edi, 1
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
sar eax, 4
sub eax, edi
je 0x1015ca11
mov ebx, dword [ebp + 8]
dec eax
mov edx, ebx
mov ecx, esi
mov dword [esp + 0x2c], eax
call fcn.1012f5c0
cmp eax, 0x101f0cf8
je 0x1015ca40
cmp dword [eax + 8], 3
jne 0x1015ca40
test edi, edi
je 0x1015ca06
mov edx, ebx
mov ecx, esi
call fcn.1012f5c0
cmp dword [eax + 8], 3
je 0x1015c9e1
lea edx, [esp + 0x30]
mov ecx, eax
call fcn.1013ea80
test eax, eax
jne 0x1015c9e1
xorps xmm0, xmm0
jmp 0x1015c9e5
movsd xmm0, qword [eax]
sub esp, 8
movsd qword [esp], xmm0
push str._.14g
push dword [esp + 0x30]
call fcn.1000fa08
add esp, 0x10
test eax, eax
jg 0x1015cb0b
xor edi, edi
mov eax, dword [esp + 0x2c]
inc ebx
test eax, eax
jne 0x1015c997
call fcn.1018efb7
mov ebx, dword [eax]
mov eax, dword [esi + 8]
test edi, edi
je 0x1015cb15
mov dword [eax], 1
mov dword [eax + 8], 1
mov eax, 1
add dword [esi + 8], 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, ebx
mov ecx, esi
call fcn.1012f5c0
cmp dword [eax + 8], 4
je 0x1015ca83
mov edx, eax
mov ecx, esi
call fcn.1013eb40
test eax, eax
jne 0x1015ca68
xor ecx, ecx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
jmp 0x1015ca95
mov ecx, dword [esi + 0x10]
mov eax, dword [ecx + 0x44]
cmp eax, dword [ecx + 0x40]
jb 0x1015ca7a
mov ecx, esi
call fcn.10142a90
mov edx, ebx
mov ecx, esi
call fcn.1012f5c0
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
add eax, 0x10
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], eax
jne 0x1015cae9
mov eax, dword [str.string]
mov edx, ebx
mov ecx, esi
mov dword [esp + 0x28], eax
call fcn.1012f5c0
cmp eax, 0x101f0cf8
je 0x1015cabf
mov eax, dword [eax + 8]
cmp eax, 0xffffffff
je 0x1015cabf
mov eax, dword [eax*4 + 0x101f083c]
jmp 0x1015cac4
mov eax, str.no_value
push eax
push dword [esp + 0x2c]
push str._s_expected__got__s
push esi
call fcn.1012fd70
push eax
mov edx, ebx
mov ecx, esi
call fcn.10130c50
mov ecx, dword [esp + 0x30]
add esp, 0x14
mov eax, dword [esp + 0x20]
test edi, edi
je 0x1015ca06
push dword [esp + 0x24]
push ecx
push 1
push eax
call fcn.101b0f89
add esp, 0x10
cmp eax, dword [esp + 0x1c]
jne 0x1015ca06
mov edi, 1
jmp 0x1015ca08
mov dword [eax + 8], 0
add dword [esi + 8], 0x10
push ebx
call fcn.101b2a33
add esp, 4
push eax
push 0x101fc08c
push esi
call fcn.1012fd70
mov eax, dword [esi + 8]
add esp, 0xc
movd xmm0, ebx
cvtdq2pd xmm0, xmm0
mov dword [eax + 8], 3
pop edi
movsd qword [eax], xmm0
mov eax, 3
add dword [esi + 8], 0x10
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1015f7b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1022c068]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x110], 0
mov esi, edx
mov dword [ebp - 0x114], 0
push eax
lea edx, [ebp - 0x110]
mov dword [ebp - 0x10c], 0
call fcn.1015f250
add esp, 8
test eax, eax
je 0x1015f872
push 0
lea eax, [ebp - 0x10c]
push eax
push 0
push 0x202
push 0
push 0
push 0
lea eax, [ebp - 0x107]
push eax
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1015f872
push dword [ebp + 0xc]
push edi
push esi
push eax
push dword [ebp - 0x114]
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x10c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10186332
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.10186332
mov esp, ebp
pop ebp
ret

Function at 0x1015fb00
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
mov eax, edx
xor ebx, ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
test ecx, ecx
je 0x1015fc2d
test eax, eax
je 0x1015fc2d
push 0x101e857c
push ecx
call fcn.1018f123
mov esi, eax
add esp, 8
test esi, esi
je 0x1015fc2d
push 2
push ebx
push esi
call fcn.1018b8c7
add esp, 0xc
test eax, eax
jne 0x1015fbfe
push esi
call fcn.1018b48f
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x1015fbfe
push ebx
push ebx
push esi
call fcn.1018b8c7
add esp, 0xc
test eax, eax
jne 0x1015fbfe
push dword [ebp - 4]
call fcn.10198880
mov edi, eax
add esp, 4
test edi, edi
je 0x1015fbfe
push esi
push 1
push dword [ebp - 4]
push edi
call fcn.1018f461
add esp, 0x10
cmp eax, 1
jne 0x1015fbfe
push esi
call fcn.1018b580
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xc]
add esp, 4
mov ecx, esi
push dword [ebp + 0xc]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push edi
call dword [0x101d3368]
call esi
add esp, 0x14
test eax, eax
je 0x1015fc07
push 0x101f2168
push dword [ebp - 0x10]
call fcn.1018f123
mov esi, eax
add esp, 8
test esi, esi
je 0x1015fc07
push esi
push 1
push dword [ebp - 0xc]
push dword [ebp - 8]
call fcn.101b0f89
mov ecx, 1
add esp, 0x10
cmp eax, ecx
cmove ebx, ecx
push esi
call fcn.1018b580
add esp, 4
test edi, edi
je 0x1015fc14
push edi
call fcn.1018f160
add esp, 4
mov eax, dword [ebp - 8]
test eax, eax
je 0x1015fc24
push eax
call fcn.1018f160
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1015fe00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push 0x101e857c
push ecx
mov dword [ebp - 8], edx
call fcn.1018f123
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x1015fe25
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push 2
push 0
push ebx
call fcn.1018b8c7
add esp, 0xc
test eax, eax
jne 0x1015ffaa
push ebx
call fcn.1018b48f
mov edi, eax
add esp, 4
mov dword [ebp - 4], edi
cmp edi, 0xffffffff
je 0x1015ffaa
test edi, edi
je 0x1015ffaa
push 0
push 4
push ebx
call fcn.1018b8c7
add esp, 0xc
test eax, eax
jne 0x1015ffaa
push esi
push 0x10232730
push edi
call fcn.101b0a6b
add esp, 8
mov esi, eax
push ebx
test esi, esi
jne 0x1015fe94
call fcn.1018b580
add esp, 4
xor bl, bl
jmp 0x1015ff94
push 1
lea eax, [edi - 8]
push eax
push esi
call fcn.1018f461
push ebx
mov edi, eax
call fcn.1018b580
add esp, 0x14
cmp edi, 1
je 0x1015feb7
xor bl, bl
jmp 0x1015ff94
mov ebx, dword [ebp - 4]
xor eax, eax
add ebx, 0xfffffff8
xor edi, edi
test ebx, ebx
jle 0x1015ff8d
nop dword [eax]
mov dl, byte [edi + esi]
xor ecx, ecx
test dl, 1
je 0x1015fede
bts ecx, 7
shr dl, 1
test dl, 1
je 0x1015fee9
bts ecx, 6
shr dl, 1
test dl, 1
je 0x1015fef4
bts ecx, 5
shr dl, 1
test dl, 1
je 0x1015feff
bts ecx, 4
shr dl, 1
test dl, 1
je 0x1015ff0a
bts ecx, 3
shr dl, 1
test dl, 1
je 0x1015ff15
bts ecx, 2
shr dl, 1
test dl, 1
je 0x1015ff20
bts ecx, 1
cmp dl, 2
jb 0x1015ff29
bts ecx, 0
shl ecx, 0x18
xor eax, ecx
jge 0x1015ff35
xor eax, 0xf6dc4190
add eax, eax
test eax, eax
jns 0x1015ff40
xor eax, 0xf6dc4190
add eax, eax
test eax, eax
jns 0x1015ff4b
xor eax, 0xf6dc4190
add eax, eax
test eax, eax
jns 0x1015ff56
xor eax, 0xf6dc4190
add eax, eax
test eax, eax
jns 0x1015ff61
xor eax, 0xf6dc4190
add eax, eax
test eax, eax
jns 0x1015ff6c
xor eax, 0xf6dc4190
add eax, eax
test eax, eax
jns 0x1015ff77
xor eax, 0xf6dc4190
add eax, eax
test eax, eax
jns 0x1015ff82
xor eax, 0xf6dc4190
inc edi
add eax, eax
cmp edi, ebx
jl 0x1015fed0
mov ecx, dword [ebp - 8]
mov bl, 1
mov dword [ecx], eax
test esi, esi
je 0x1015ffa1
push esi
call fcn.10186693
add esp, 4
pop esi
pop edi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call fcn.1018b580
add esp, 4
xor al, al
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1015ffc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d0760
mov eax, dword fs:[0]
push eax
sub esp, 0x218
mov eax, dword [0x1022c068]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, edx
mov esi, ecx
mov dword [ebp - 0x224], ebx
test esi, esi
je case.default.0x10160025
push 0x20c
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.10188460
lea eax, [esi - 1]
add esp, 0xc
cmp eax, 7
ja case.default.0x10160025
jmp dword [eax*4 + 0x1016014c]
mov eax, 0x1a
jmp 0x1016005b
mov eax, 0x1c
jmp 0x1016005b
mov eax, 0x23
jmp 0x1016005b
mov eax, 0x2e
jmp 0x1016005b
mov eax, 5
jmp 0x1016005b
mov eax, 0x28
jmp 0x1016005b
mov eax, 0x2a
lea ecx, [ebp - 0x220]
push ecx
push 0
push 0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne case.default.0x10160025
lea edi, [ebp - 0x220]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10160080
mov eax, dword [0x101e8618]
lea edx, [ebp - 0x220]
mov dword [edi], eax
lea esi, [edx + 2]
mov dword [ebp - 4], 2
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x101600a3
sub edx, esi
lea eax, [ebp - 0x220]
sar edx, 1
mov ecx, ebx
push edx
push eax
call fcn.10005040
mov al, 1
jmp 0x1016012d
lea eax, [ebp - 0x220]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp eax, 0x104
ja case.default.0x10160025
test eax, eax
je case.default.0x10160025
lea ecx, [ebp - 0x220]
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10160103
sub ecx, edx
lea eax, [ebp - 0x220]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.10005040
mov al, 1
jmp 0x1016012d
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10186332
mov esp, ebp
pop ebp
ret
Function at 0x10160170
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d07b1
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2070
call fcn.10187310
mov eax, dword [0x1022c068]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x207c], ecx
mov esi, dword [ebp + 8]
mov ecx, edx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], 0
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x101601c0
sub ecx, edi
push 0
push ecx
lea ecx, [ebp - 0x2060]
call fcn.1000a040
add esp, 8
mov ecx, esi
mov byte [ebp - 4], 1
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x101601e3
sub ecx, edx
mov edx, esi
push 0
push ecx
lea ecx, [ebp - 0x2048]
call fcn.1000a040
add esp, 8
push 0x2000
lea eax, [ebp - 0x2018]
mov byte [ebp - 4], 2
push 0
push eax
call fcn.10188460
add esp, 0xc
lea edx, [ebp - 0x2018]
cmp dword [ebp - 0x2034], 8
lea ecx, [ebp - 0x2048]
lea eax, [ebp - 0x2060]
cmovae ecx, dword [ebp - 0x2048]
push dword [ebp - 0x207c]
cmp dword [ebp - 0x204c], 8
push 0x1000
cmovae eax, dword [ebp - 0x2060]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x10160335
xor eax, eax
mov dword [ebp - 0x2020], 0
lea ecx, [ebp - 0x2018]
mov dword [ebp - 0x201c], 7
mov word [ebp - 0x2030], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10160290
sub ecx, edx
lea eax, [ebp - 0x2018]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x2030]
call fcn.10005040
push 0
lea edx, [ebp - 0x2030]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2078]
call fcn.10009dc0
add esp, 4
lea eax, [ebp - 0x2078]
mov ecx, ebx
push eax
call fcn.100087f0
mov edx, dword [ebp - 0x2064]
cmp edx, 0x10
jb 0x10160310
mov ecx, dword [ebp - 0x2078]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10160306
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1016036f
push edx
push ecx
call fcn.101866c8
add esp, 8
lea ecx, [ebp - 0x2030]
call fcn.10004e60
lea ecx, [ebp - 0x2048]
call fcn.10004e60
lea ecx, [ebp - 0x2060]
call fcn.10004e60
mov al, 1
jmp 0x1016034d
lea ecx, [ebp - 0x2048]
call fcn.10004e60
lea ecx, [ebp - 0x2060]
call fcn.10004e60
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10186332
mov esp, ebp
pop ebp
ret
call fcn.1018f750
int3
Function at 0x10164c00
Capabilities:
Hash data via bcrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d1108
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x1022c068]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
push 8
push 0
push str.SHA256
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
call dword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
jne 0x10164d4d
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 4], eax
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], ebx
push esi
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 1
push eax
push 4
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push eax
push str.ObjectLength
push edi
mov dword [ebp - 0x20], esi
call dword [sym.imp.bcrypt.dll_BCryptGetProperty]
test eax, eax
jne 0x10164d68
mov byte [ebp - 0xd], al
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10164caf
push ecx
push eax
lea ecx, [ebp - 0x38]
lfence
call fcn.1004ae70
mov esi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x38]
push 0
push 0x20
push dword [ebp + 0xc]
sub esi, ebx
mov dword [ebp - 0x18], 0
push esi
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.bcrypt.dll_BCryptCreateHash]
test eax, eax
je 0x10164cdc
push str.BCryptCreateHash_failed
jmp 0x10164d6d
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x20], esi
push 0
push dword [ebp - 0x24]
mov byte [ebp - 4], 2
push dword [ebp - 0x28]
push esi
call dword [sym.imp.bcrypt.dll_BCryptHashData]
test eax, eax
je 0x10164d00
push str.BCryptHashData_failed
jmp 0x10164d6d
push 0
push 0x20
push dword [ebp + 8]
push dword [ebp - 0x18]
call dword [sym.imp.bcrypt.dll_BCryptFinishHash]
test eax, eax
je 0x10164d1b
push str.BCryptFinishHash_failed
jmp 0x10164d6d
test esi, esi
je 0x10164d26
push esi
call dword [sym.imp.bcrypt.dll_BCryptDestroyHash]
lea ecx, [ebp - 0x38]
call fcn.10004e00
test edi, edi
je 0x10164d3b
push 0
push edi
call dword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.BCryptOpenAlgorithmProvider_failed
lea ecx, [ebp - 0x38]
call fcn.10001480
push 0x10229d38
lea eax, [ebp - 0x38]
push eax
call fcn.101878e5
push str.BCryptGetProperty_failed
lea ecx, [ebp - 0x44]
call fcn.10001480
push 0x10229d38
lea eax, [ebp - 0x44]
push eax
call fcn.101878e5
int3
Function at 0x10164d90
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101d1148
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x1022c068]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x14]
push 0
push 0
mov dword [ebp - 0x5c], eax
mov dword [eax], 0
lea eax, [ebp - 0x28]
push 0x1020a098
push eax
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x28], 0
call dword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
jne 0x10164f14
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 4], eax
xor edi, edi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
push edi
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 1
push eax
push 4
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], edi
push eax
push str.ObjectLength
push esi
mov dword [ebp - 0x38], edi
call dword [sym.imp.bcrypt.dll_BCryptGetProperty]
test eax, eax
jne 0x10164f2f
mov byte [ebp - 0x21], al
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x10164e5a
push ecx
push eax
lea ecx, [ebp - 0x48]
lfence
call fcn.1004ae70
mov edi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x48]
sub edi, eax
push 0
push 0x10
push dword [ebp - 0x3c]
mov dword [ebp - 0x30], 0
push edi
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.bcrypt.dll_BCryptGenerateSymmetricKey]
test eax, eax
je 0x10164e8a
push str.BCryptGenerateSymmetricKey_failed
jmp 0x10164f34
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x3c], edi
mov eax, dword [ebp - 0x4c]
push 1
mov byte [ebp - 4], 2
mov dword [ebp - 0x34], 0
movups xmm0, xmmword [eax]
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20]
push dword [ebp - 0x50]
movups xmmword [ebp - 0x20], xmm0
push 0x10
push eax
push 0
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push edi
call dword [sym.imp.bcrypt.dll_BCryptDecrypt]
test eax, eax
je 0x10164ed1
push str.BCryptDecrypt_failed
jmp 0x10164f34
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x34]
mov dword [ecx], eax
test edi, edi
je 0x10164ee4
push edi
call dword [sym.imp.bcrypt.dll_BCryptDestroyKey]
lea ecx, [ebp - 0x48]
call fcn.10004e00
test esi, esi
je 0x10164ef9
push 0
push esi
call dword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10186332
mov esp, ebp
pop ebp
ret
push str.BCryptOpenAlgorithmProvider_failed
lea ecx, [ebp - 0x48]
call fcn.10001480
push 0x10229d38
lea eax, [ebp - 0x48]
push eax
call fcn.101878e5
push str.BCryptGetProperty_failed
lea ecx, [ebp - 0x68]
call fcn.10001480
push 0x10229d38
lea eax, [ebp - 0x68]
push eax
call fcn.101878e5
int3