joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10059690
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x410
push ebx
mov ebx, dword [esp + 0x418]
test ebx, ebx
jne 0x100596ac
xor eax, eax
pop ebx
add esp, 0x410
ret
push ebp
push esi
push edi
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
push 0x207
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.100623e5
mov edi, 0x5c
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.10062de0
lea edx, [esp + 0x24]
mov esi, eax
push edx
call fcn.10062422
add esp, 0x18
cmp eax, 2
jbe 0x10059731
cmp word [esp + 0x10], di
jne 0x10059731
cmp word [esp + 0x12], di
jne 0x10059731
lea eax, [esp + 0x14]
push edi
push eax
call fcn.10062de0
add esp, 8
test eax, eax
je 0x100597b9
add eax, 2
push edi
push eax
call fcn.10062de0
add esp, 8
mov esi, eax
test esi, esi
je 0x100597b9
lea ecx, [esp + 0x10]
mov word [esi], 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x10059779
test bl, 1
je 0x10059768
mov edx, ebx
lea eax, [esp + 0x10]
and edx, 0xfffffffe
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x100597ef
cmp ebx, 0xffffffff
je 0x10059782
test edi, edi
jne 0x10059791
lea edx, [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
test ebp, ebp
je 0x100597ef
mov word [esi], 0x5c
add esi, 2
push 0x5c
push esi
call fcn.10062de0
mov esi, eax
add esp, 8
test esi, esi
jne 0x10059739
test ebp, ebp
je 0x100597ef
mov ebx, dword [esp + 0x424]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100597e4
test al, 0x10
jne 0x100597ef
test al, 1
je 0x100597d7
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x100597ef
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x410
ret
Function at 0x1005ee80
Capabilities:
Get file size

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10122718
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov eax, dword [esi + 0x20]
xor edi, edi
xor ebp, ebp
cmp eax, ebx
je 0x1005eeb2
call fcn.1007d290
mov ebp, eax
mov eax, dword [esi + 0x18]
mov ecx, 0xc0000000
cmp eax, ebx
je 0x1005eec3
mov ecx, closesocket
mov eax, dword [esi + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
cmp dword [eax - 8], ebx
je 0x1005ef18
push ebx
push 0x80
push 3
push ebp
push 3
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x1005eefe
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esp + 0x14], eax
cmp dword [esi + 4], 0xffffffff
je 0x1005f044
cmp dword [esp + 0x18], ebx
jne 0x1005ef18
cmp dword [esp + 0x14], ebx
je 0x1005f044
mov eax, dword [esi + 0x18]
mov edi, 4
cmp eax, ebx
je 0x1005ef29
mov edi, 2
lea ebx, [esi + 0x28]
lea ecx, [esp + 0x10]
push ebx
call fcn.1002c6b0
mov eax, dword [esi + 0x1c]
mov dword [esp + 0x24], 0
test eax, eax
je 0x1005ef6f
mov edx, dword [ebx]
mov eax, dword [edx - 8]
test eax, eax
je 0x1005ef6f
call fcn.10075250
test eax, eax
je 0x1005ef6f
push 0x1014431c
lea ecx, [esp + 0x14]
call fcn.1002d330
push ebx
lea ecx, [esp + 0x14]
call fcn.1002dd60
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx - 8]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [esi + 4]
push eax
mov eax, dword [esi + 0x10]
push eax
push 0
push edi
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
test eax, eax
mov dword [esi + 8], eax
je 0x1005f01e
mov edx, dword [esi + 0x18]
mov ecx, 6
test edx, edx
je 0x1005efab
mov ecx, 4
mov edx, dword [esi + 0x10]
push edx
mov edx, dword [esi + 0x14]
push edx
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 0xc], eax
je 0x1005f01e
mov eax, dword [esi + 0x10]
mov ebp, 1
test eax, eax
jne 0x1005eff9
mov eax, dword [esi + 4]
or ebx, 0xffffffff
cmp eax, ebx
je 0x1005effc
mov ecx, dword [esp + 0x14]
mov edx, dword [esi + 0x14]
mov eax, dword [esp + 0x18]
xor edi, edi
sub ecx, edx
sbb eax, edi
test eax, eax
jle 0x1005eff4
mov dword [esi + 0x10], ebx
jmp 0x1005effc
mov dword [esi + 0x10], ecx
jmp 0x1005effc
or ebx, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], ebx
call fcn.1002d0b0
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.1002d0b0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x100613a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
push ebx
push esi
mov edx, ecx
push edi
xor ebx, ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], bx
add edx, 4
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x21c]
lea ecx, [esp + 0x18]
push eax
push edx
push 0x1013f804
push ecx
call fcn.100624ce
add esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
xor esi, esi
push edx
push eax
push reloc.WS2_32.dll_bind
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1006147a
mov edi, dword [esp + 0x220]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ecx
lea edx, [esp + 0x1c]
push ebx
push edx
push ebx
push edi
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
call ebp
mov eax, dword [esp + 0x14]
cmp eax, 2
jb 0x10061460
add eax, 2
mov dword [esp + 0x14], eax
shr eax, 1
lea ecx, [eax + eax]
push ecx
call fcn.10062117
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x10061460
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push ebx
push edi
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8

Function at 0x10061490
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push esi
mov edx, ecx
push edi
xor esi, esi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x21c]
add edx, 4
push eax
push edx
lea ecx, [esp + 0x20]
push 0x1013f804
push ecx
call fcn.100624ce
add esp, 0x10
lea edx, [esp + 8]
lea eax, [esp + 0x18]
mov dword [esp + 0xc], esi
push edx
push eax
push reloc.WS2_32.dll_bind
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x10061529
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x224]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
push eax
push esi
push ecx
push edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x210
ret 8
Function at 0x10061750
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push esi
push eax
xor esi, esi
push ecx
push reloc.WS2_32.dll_bind
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100617ea
mov ecx, dword [esp + 4]
push ebx
lea edx, [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
push eax
lea eax, [esp + 0x18]
push eax
push esi
push edi
push ecx
call ebx
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x100617d4
add eax, 2
mov dword [esp + 0x18], eax
shr eax, 1
lea edx, [eax + eax]
push edx
call fcn.10062117
mov esi, eax
add esp, 4
test esi, esi
je 0x100617d4
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push 0
push edi
push edx
call ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
pop esi
add esp, 8
ret 8
mov eax, esi
pop esi
add esp, 8
ret 8

Function at 0x100749e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x100749eb
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
push edi
mov edi, dword [esp + 0x18]
cmp edi, 8
mov esi, edi
not eax
jb 0x10074aed
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x10127c18]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10127c18]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10127c18]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10127c18]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10127c18]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x10127c18]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x10127c18]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x10127c18]
xor eax, edx
inc ecx
dec edi
jne 0x10074a06
test esi, esi
je 0x10074b0f
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x10127c18]
xor eax, edx
inc ecx
dec esi
jne 0x10074af1
pop edi
pop esi
not eax
pop ebx
ret
Function at 0x10074b30
Capabilities:
Check os version
Get system information on windows

Disassembly:
mov eax, dword [0x1016fa68]
sub esp, 0x114
test eax, eax
jne 0x10074c7d
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push edi
push 0x1016f800
mov dword [0x1016fa68], 1
mov dword [0x1016f800], 0x114
call esi
mov edx, dword [0x1016f810]
xor eax, eax
cmp edx, 2
sete al
test eax, eax
mov dword [0x1014e598], eax
je 0x10074c58
push ebx
push 0x1016f918
mov dword [0x1016f918], 0x11c
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x10141c6c
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push str.GetNativeSystemInfo
push esi
call edi
push str.GetProductInfo
push esi
mov dword [0x1016fa5c], eax
call edi
mov dword [0x1016fa60], eax
mov eax, dword [0x1016fa5c]
test eax, eax
push 0x1016fa38
je 0x10074bd4
call eax
jmp 0x10074bda
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [0x1016f91c]
cmp eax, 6
jae 0x10074bf2
cmp eax, 5
jne 0x10074c06
cmp dword [0x1016f920], 2
jb 0x10074c06
cmp word [0x1016fa38], 9
jne 0x10074c06
mov dword [0x1016f7f4], 1
push str.Ntdll.dll
call ebx
test eax, eax
pop ebx
je 0x10074c24
push str.RtlGetVersion
push eax
call edi
mov edx, eax
mov dword [0x1016fa64], edx
jmp 0x10074c2a
mov edx, dword [0x1016fa64]
test edx, edx
je 0x10074c58
mov ecx, 0x44
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
mov dword [esp + 8], 0x114
push eax
call edx
test eax, eax
jne 0x10074c58
mov ecx, dword [esp + 0x14]
mov dword [0x1016f80c], ecx
push 0x1016f808
push 0x1016f804
call fcn.10075020
add esp, 8
call fcn.10074c90
pop edi
mov eax, 1
pop esi
add esp, 0x114
ret
mov eax, 1
add esp, 0x114
ret
Function at 0x10075eb0
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10128018
push 0x10063304
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x434
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov eax, dword [0x1016fa6c]
xor ebx, ebx
cmp eax, ebx
jne 0x10076010
mov word [ebp - 0x220], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x21e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1007600b
mov word [ebp - 0x42c], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x42a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.user32.dll
lea ecx, [ebp - 0x220]
push ecx
push 0x1013f804
lea edx, [ebp - 0x42c]
push edx
call fcn.100624ce
add esp, 0x10
mov dword [ebp - 0x434], ebx
lea eax, [ebp - 0x434]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x224], eax
push eax
call fcn.10062117
add esp, 4
mov esi, eax
mov dword [ebp - 0x440], esi
cmp esi, ebx
je 0x1007600b
push esi
mov edx, dword [ebp - 0x224]
push edx
mov eax, dword [ebp - 0x434]
push eax
lea ecx, [ebp - 0x42c]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10076002
mov dword [ebp - 0x438], ebx
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x438]
push eax
push 0x1014f650
push esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10076002
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0x43c], eax
mov ecx, dword [eax]
mov dword [0x1016fa6c], ecx
mov dword [ebp - 4], 0xffffffff
jmp 0x10076002
push esi
call fcn.100620d6
add esp, 4
mov eax, dword [0x1016fa6c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10079fe0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10122ca0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebp
push esi
push edi
lea ecx, [esp + 0x20]
mov dword [esp + 0xc], 0
call fcn.1003a4a0
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0
call fcn.100329d0
mov esi, dword [esp + 0x44]
mov byte [esp + 0x38], 1
cmp esi, 0xffffffff
jne 0x1007a030
mov esi, 0xfffffffe
mov edi, dword [esp + 0x40]
push 0x5c
push edi
call fcn.10062de0
mov ebp, eax
lea eax, [esp + 0x18]
push esi
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.1007ebd0
mov eax, dword [esp + 0x28]
add esp, 0x14
xor esi, esi
test eax, eax
jle 0x1007a0bd
test ebp, ebp
je 0x1007a076
mov edx, dword [esp + 0x10]
push edi
mov eax, dword [edx + esi*4]
push eax
call fcn.1006253d
add esp, 8
test eax, eax
je 0x1007a09c
jmp 0x1007a091
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + esi*4]
push eax
call fcn.1004f230
push eax
push edi
call fcn.1006253d
add esp, 0xc
test eax, eax
je 0x1007a0a5
mov eax, dword [esp + 0x14]
inc esi
cmp esi, eax
jl 0x1007a05b
jmp 0x1007a0bd
mov edx, dword [esp + 0x20]
mov esi, dword [edx + esi*4]
jmp 0x1007a0ac
mov eax, dword [esp + 0x20]
mov esi, dword [eax + esi*4]
test esi, esi
je 0x1007a0bd
push esi
call fcn.10079ee0
add esp, 4
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x38], 0
call fcn.100329e0
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xffffffff
call fcn.1003a4b0
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x30
ret

Function at 0x1007c810
Capabilities:
Get user security identifier

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edi
mov edi, dword [esp + 0x1c]
lea ecx, [esp + 0xc]
xor ebx, ebx
push eax
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push ebp
push ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0x1007c85b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1007c85b
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x10]
push esi
push eax
call fcn.10062117
mov ecx, dword [esp + 0x14]
mov dword [edi], eax
lea edx, [ecx + ecx]
push edx
call fcn.10062117
mov esi, eax
mov eax, dword [edi]
add esp, 8
test eax, eax
je 0x1007c8a0
test esi, esi
je 0x1007c8b1
lea ecx, [esp + 0x20]
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x1c]
push esi
push ecx
push eax
push ebp
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test esi, esi
je 0x1007c8ad
push esi
call fcn.100620d6
add esp, 4
test ebx, ebx
jne 0x1007c8c0
mov edi, dword [edi]
test edi, edi
je 0x1007c8c0
push edi
call fcn.100620d6
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10086a40
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x80
call fcn.100631c0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x9c]
xor eax, eax
push edi
test esi, esi
je 0x10086a6b
mov ebx, dword [esp + 0x94]
mov eax, 1
mov dword [ebx], esi
jmp 0x10086a7d
mov ebx, dword [esp + 0x94]
mov ecx, dword [ebx]
mov dword [esp + 0xa0], ecx
mov esi, ecx
mov ecx, dword [esp + 0x98]
test ecx, ecx
je 0x10086be9
push esi
call fcn.10087e40
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x10086ab3
push str.j____int_sizeof_ctx__key_
push 0x54
push str..cryptohmachmac.c
call fcn.10087a70
add esp, 0xc
mov ebp, dword [esp + 0x9c]
cmp edi, ebp
jge 0x10086af2
mov edx, dword [esp + 0xa4]
lea edi, [ebx + 4]
push edx
push esi
push edi
call fcn.10086f80
mov eax, dword [esp + 0xa4]
push ebp
push eax
push edi
call fcn.100870f0
lea esi, [ebx + 0x34]
lea ecx, [ebx + 0x38]
push esi
push ecx
push edi
call fcn.100871f0
add esp, 0x24
jmp 0x10086b31
test ebp, ebp
jl 0x10086afe
cmp ebp, 0x80
jle 0x10086b12
push str.len_0__len__int_sizeof_ctx__key_
push 0x5e
push str..cryptohmachmac.c
call fcn.10087a70
add esp, 0xc
mov esi, dword [esp + 0x98]
mov ecx, ebp
mov edx, ecx
lea edi, [ebx + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea esi, [ebx + 0x34]
mov dword [esi], ebp
mov esi, dword [esi]
cmp esi, 0x80
je 0x10086b56
mov ecx, 0x80
xor eax, eax
sub ecx, esi
lea edi, [esi + ebx + 0x38]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [esp + 0xa0]
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x10086b5f
mov ebp, dword [esp + 0xa4]
lea edi, [ebx + 0x14]
push ebp
push esi
push edi
call fcn.10086f80
push esi
call fcn.10087e40
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.100870f0
add esp, 0x1c
xor eax, eax
mov cl, byte [ebx + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x10], cl
inc eax
cmp eax, 0x80
jl 0x10086b9b
lea edi, [ebx + 0x24]
push ebp
push esi
push edi
call fcn.10086f80
push esi
call fcn.10087e40
lea edx, [esp + 0x20]
push eax
push edx
push edi
call fcn.100870f0
add esp, 0x1c
lea eax, [ebx + 0x14]
add ebx, 4
push eax
push ebx
call fcn.100872a0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret
test eax, eax
je 0x10086bce
jmp 0x10086b5d
Function at 0x100878f0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.100631c0
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x10087939
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x10087939
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x1014b160
call fcn.101158e4
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.10115894
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x10087a4b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x10087a4b
lea edx, [ebp - 4]
push edx
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x10087a4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x10087a4b
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x10087a4b
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.100631c0
lea eax, [ebp - 4]
mov edi, esp
push eax
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x10087a4b
mov ecx, dword [ebp - 4]
push str.Service_0x
push edi
lea eax, [ecx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call fcn.10062267
add esp, 8
test eax, eax
je 0x10087a4b
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push 0
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea ecx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100885a0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x58], ecx
mov eax, 1
ret
Function at 0x10093420
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x10093481
mov al, byte [edi]
test al, al
je 0x10093481
push ebx
push ebp
mov ebx, pe_nt_image_headers32
movsx eax, al
or eax, ebx
mov ebp, esi
mov edx, eax
mov ecx, eax
shr edx, 2
and edx, 0xf
and ecx, 0xf
xor edx, ecx
mov ecx, 0x20
sub ecx, edx
add ebx, 0x100
shr ebp, cl
mov ecx, edx
mov edx, eax
imul edx, eax
shl esi, cl
mov al, byte [edi + 1]
or ebp, esi
xor ebp, edx
inc edi
test al, al
mov esi, ebp
jne 0x10093439
mov eax, esi
pop ebp
shr eax, 0x10
pop ebx
xor eax, esi
pop edi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x100a6ce0
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 0x5c], ecx
mov eax, 1
ret
Function at 0x100a85f0
Capabilities:
Hash data using sha224

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0xc1059ed8
mov dword [eax + 4], 0x367cd507
mov dword [eax + 8], 0x3070dd17
mov dword [eax + 0xc], 0xf70e5939
mov dword [eax + 0x10], 0xffc00b31
mov dword [eax + 0x14], 0x68581511
mov dword [eax + 0x18], 0x64f98fa7
mov dword [eax + 0x1c], 0xbefa4fa4
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x1c
mov eax, 1
ret

Function at 0x100a8650
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
mov dword [eax + 0x68], ecx
mov dword [eax + 0x6c], 0x20
mov eax, 1
ret