joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57d0f5
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00417f1c
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x57d131
call fcn.0057d87c
mov dword [esi + 0xc], 1
jmp 0x57d136
call fcn.0057d87c
cmp dword [esi], 0
je 0x57d17f
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x57d159
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0041203c
jmp 0x57d16a
push 0xff
mov ecx, esi
call fcn.00409c10
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00414d6c
jmp 0x57d1a3
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x57d1a3
push dword [esi]
push dword [ebp - 4]
call fcn.004d000a
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x57d6fc
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.0057d87c
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x57d744
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041203c
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00414d6c
jmp 0x57d74f
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.004d000a
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x598552
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
cmp dword [esi], 0
je 0x598592
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x5985a1
push str.SetFileAttributesTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x5985a1
push dword [esi]
mov ecx, edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.005f3be0
call edi
jmp 0x5985a3
cmp dword [esi + 4], 0
je 0x5985a1
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop esi
pop ebp
ret 8
Function at 0x59da0f
Capabilities:
Delete registry key

Disassembly:
push 8
mov eax, 0x665b01
call fcn.005f3c1d
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0040d740
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x59da71
call fcn.004285d0
cmp eax, 1
jne 0x59da71
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.0048370e
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0041d3ae
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.00409c90
inc esi
push dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
push esi
test ecx, ecx
je 0x59da83
call fcn.004c3b27
jmp 0x59da89
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
lea ecx, [ecx - 0x10]
call fcn.00409c90
mov eax, esi
call fcn.005f3be6
ret 0xc

Function at 0x59dbd4
Capabilities:
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x665b82
call fcn.005f3c1d
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0040d740
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x59dc32
call fcn.004285d0
cmp eax, 1
jne 0x59dc32
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.0048370e
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0041d3ae
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00409c90
inc esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00409c90
mov eax, esi
call fcn.005f3be6
ret 0x10

Function at 0x59dc59
Capabilities:
Set registry value

Disassembly:
push 8
mov eax, 0x665bad
call fcn.005f3c1d
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0040d740
and dword [ebp - 4], 0
mov esi, dword [ebp + 8]
cmp esi, 0x80000000
jne 0x59dcb7
call fcn.004285d0
cmp eax, 1
jne 0x59dcb7
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
call fcn.0048370e
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0041d3ae
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00409c90
inc esi
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp - 0x10]
mov esi, eax
add ecx, 0xfffffff0
call fcn.00409c90
mov eax, esi
call fcn.005f3be6
ret 0x14
Function at 0x5c526c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push edi
mov edi, ecx
jne 0x5c527d
xor eax, eax
jmp 0x5c52fa
cmp dword [ebp + 0xc], 0
je 0x5c5279
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x5c5296
call fcn.00428582
mov eax, dword [eax + 0xc]
test eax, eax
je 0x5c5279
push esi
push dword [ebp + 0xc]
mov dword [edi + 8], eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x5c52be
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x5c52c2
xor eax, eax
jmp 0x5c52f9
push ebx
push esi
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x5c52f8
push dword [ebp - 4]
mov esi, dword [edi]
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esi + 4]
push eax
call fcn.005f3be0
mov ecx, edi
call dword [esi + 4]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x5ecbdd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.005f6b00
mov eax, dword [ebp + 8]
add esp, 0xc
and dword [ebp - 0x34], 0
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x63a98e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0063a58f

Function at 0x63a999
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0063a712

Function at 0x63b3fe
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0063b2cb

Function at 0x63d46d
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0063cc07

Function at 0x63d478
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0063ce4e
Function at 0x401411
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x150
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esp], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 0x130], 0
call esi
push edx
mov dword [ebp - 0x124], eax
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x118], 6
push ecx
push ecx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push edx
push edx
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
mov dword [ebp - 0x11c], eax
call dword [sym.imp.USER32.dll_LoadIconA]
push ecx
push ecx
mov dword [esp], 0
mov dword [ebp - 0x120], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push eax
lea eax, [ebp - 0x134]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassW]
push eax
mov dword [esp], 0
call esi
lea esi, [ebp - 0x10c]
push edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.USER32.dll_LoadAcceleratorsA]
push ecx
push ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x1a
mov dword [esp], 0
call dword [sym.imp.SHELL32.DLL_SHGetFolderPathA]
sub esp, 0x14
mov dword [esp], esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
sub esp, 0x1c
call ebx
mov dword [esp], esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebx - 5]
push esi
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret

Function at 0x40162e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 1
call fcn.00401411
test eax, eax
jne 0x4016c8
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x402132
sub eax, 0x4016d0
mov dword [esp], 0x4016d0
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x4016c8
lea ebx, [ebp - 0x88]
mov dword [esp], 0
jmp loc.00464be6
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ecc
mov ecx, 0xd057b19
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x70696686
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x1000db60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x54
call fcn.1008bd60
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x58]
push ebx
push ebp
mov ebp, dword [esp + 0x64]
push edi
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x10], eax
mov byte [esp + 0x14], 0x41
xor edi, edi
call fcn.1001eae0
lea edx, [esp + 0x18]
push 8
push edx
call fcn.1001f450
lea eax, [esp + 0x30]
push eax
call fcn.1001eae0
add esp, 0x10
xor ebx, ebx
test ebp, ebp
jg 0x1000dbf4
lea eax, [esp + 0x38]
push 0x14
push eax
call fcn.1001e800
lea ecx, [esp + 0x1c]
push ecx
call fcn.1001ece0
lea edx, [esp + 0x30]
push edx
call fcn.1001ece0
add esp, 0x10
pop edi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.1007aa10
add esp, 0x54
ret
mov edi, dword [esp + 0x34]
add edi, 1
cmp edi, 0x10
mov dword [esp + 0x34], edi
ja 0x1000dd2e
test edi, edi
jbe 0x1000dc1b
mov ecx, dword [esp + 0x10]
push edi
push ecx
lea edx, [esp + 0x54]
push edx
call fcn.10081800
add esp, 0xc
add byte [esp + 0x10], 1
push 0
call fcn.10019490
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.1001ebc0
push edi
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x38]
push edx
call fcn.1001ec50
mov eax, dword [esi + 0xbc]
mov ecx, dword [eax + 0x10]
push ecx
add eax, 0x14
push eax
lea edx, [esp + 0x44]
push edx
call fcn.1001ec50
mov eax, dword [esi + 0x58]
push 0x20
add eax, 0x98
push eax
lea ecx, [esp + 0x50]
push ecx
call fcn.1001ec50
mov edx, dword [esi + 0x58]
push 0x20
add edx, 0xb8
push edx
lea eax, [esp + 0x5c]
push eax
call fcn.1001ec50
push 0
lea ecx, [esp + 0x78]
push ecx
lea edx, [esp + 0x68]
push edx
call fcn.1001ec60
add esp, 0x48
push 0
call fcn.100199a0
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.1001ebc0
mov eax, dword [esi + 0xbc]
mov ecx, dword [eax + 0x10]
push ecx
add eax, 0x14
push eax
lea edx, [esp + 0x28]
push edx
call fcn.1001ec50
push 0x14
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0x34]
push ecx
call fcn.1001ec50
add esp, 0x24
lea edi, [ebx + 0x10]
cmp edi, ebp
push 0
jle 0x1000dd08
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.1001ec60
mov eax, dword [esp + 0x18]
mov ecx, ebp
sub ecx, ebx
push ecx
lea edx, [esp + 0x48]
push edx
push eax
call fcn.100865f0
add esp, 0x18
jmp 0x1000dd1a
mov ecx, dword [esp + 0x10]
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.1001ec60
add esp, 0xc
add dword [esp + 0xc], 0x10
mov ebx, edi
cmp ebx, ebp
jl 0x1000dbf0
jmp 0x1000dbb4
push 0x9d
push str.._ssl_s3_enc.c
push 0x44
push 0xee
push 0x14
call fcn.100129f0
mov ecx, dword [esp + 0x70]
add esp, 0x14
pop edi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.1007aa10
add esp, 0x54
ret
Function at 0x1000f330
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, 4
call fcn.1008bd60
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
mov edi, edx
mov eax, ecx
cdq
sub eax, edx
mov esi, eax
and ecx, 1
sar esi, 1
lea eax, [esi + edi]
add esi, ecx
mov ecx, dword [esp + 0x20]
push ebx
push ecx
mov ecx, dword [esp + 0x1c]
push esi
push edi
mov edi, dword [esp + 0x2c]
mov edx, ebp
mov dword [esp + 0x1c], eax
call fcn.1000f0d0
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
push ebx
push edx
push esi
mov esi, dword [esp + 0x44]
push eax
mov edx, esi
call fcn.1000f0d0
add esp, 0x20
test ebx, ebx
jle 0x1000f3ad
mov ecx, esi
mov eax, ebp
sub ecx, ebp
mov esi, ebx
lea esp, [esp]
mov dl, byte [ecx + eax]
xor byte [eax], dl
add eax, 1
sub esi, 1
jne 0x1000f3a0
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x10013480
Capabilities:
Access the windows event log

Disassembly:
mov eax, 0x108
call fcn.1008bd60
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x104], eax
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
test eax, eax
je 0x100134e5
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileType]
test eax, eax
je 0x100134e5
mov ecx, dword [esp + 0x10c]
lea eax, [esp + 0x110]
push eax
push ecx
call fcn.100881a6
add eax, 0x40
push eax
call fcn.10091f2e
add esp, 0xc
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1007aa10
add esp, 0x108
ret
mov eax, dword [esp + 0x10c]
lea edx, [esp + 0x110]
push edx
push eax
lea ecx, [esp + 0xc]
push 0xff
push ecx
call fcn.10091e67
add esp, 0x10
mov byte [esp + 0x103], 0
call dword [sym.imp.KERNEL32.DLL_GetVersion]
cmp eax, 0x80000000
jae 0x10013574
call fcn.100133a0
test eax, eax
je 0x10013574
push esi
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [esp + 0x28]
push esi
mov dword [esp + 0x28], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1007aa10
add esp, 0x108
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.1007aa10
add esp, 0x108
ret

Function at 0x100138e0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push esi
xor esi, esi
test edx, edx
je 0x10013929
mov al, byte [edx]
test al, al
je 0x10013929
push edi
mov edi, 0x100
movsx eax, al
or eax, edi
mov ecx, eax
shr ecx, 2
xor ecx, eax
and ecx, 0xf
add edi, 0x100
rol esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edx + 1]
add edx, 1
xor esi, ecx
test al, al
jne 0x100138f7
mov eax, esi
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x10014720
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
push edi
push 0
call sub.WS2_32.dll_WSASetLastError
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
mov edx, dword [edi + 0x1c]
push 0
push eax
push ecx
push edx
call sub.WS2_32.dll_send
push 0xf
push edi
mov esi, eax
call fcn.10013f60
add esp, 8
test esi, esi
jg 0x1001477b
je 0x1001475a
cmp esi, 0xffffffff
jne 0x1001477b
call sub.WS2_32.dll_WSAGetLastError
cmp eax, 4
je 0x10014770
cmp eax, 0xb
je 0x10014770
cmp eax, 0x2733
jne 0x1001477b
push 0xa
push edi
call fcn.10013f80
add esp, 8
pop edi
mov eax, esi
pop esi
ret

Function at 0x1001e720
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push ebx
call fcn.10092667
mov edi, eax
add esp, 8
test edi, edi
jne 0x1001e7b6
push 0x7e
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push 1
push 2
call fcn.100129f0
push 0x100a1844
push esi
push 0x100ab814
push ebx
push str.fopen_
push 5
call fcn.10012c00
add esp, 0x2c
call fcn.1007df56
cmp dword [eax], 2
jne 0x1001e798
push 0x81
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.100129f0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x83
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.100129f0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x100d72e8
call fcn.10014480
mov esi, eax
add esp, 4
test esi, esi
jne 0x1001e7d8
push edi
call fcn.1008eaea
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.10013f60
push edi
push 1
push 0x6a
push esi
call fcn.10014270
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x1001f8b0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.1008bd60
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa0]
mov ecx, dword [esp + 0x94]
push ebx
mov ebx, dword [esp + 0xa0]
push ebp
push esi
mov esi, dword [esp + 0x9c]
mov dword [esp + 0xc], eax
xor eax, eax
test ebx, ebx
push edi
mov dword [esp + 0x14], ecx
je 0x1001f8ff
mov eax, 1
mov dword [esi], ebx
jmp 0x1001f901
mov ebx, dword [esi]
test ecx, ecx
je 0x1001f9c8
push ebx
call fcn.1001f440
mov edi, eax
add esp, 4
cmp edi, 0x80
jle 0x1001f930
push str.j____int_sizeof_ctx__key_
push 0x54
push str..cryptohmachmac.c
call fcn.100135a0
add esp, 0xc
mov ebp, dword [esp + 0xa8]
cmp edi, ebp
jge 0x1001f969
mov ecx, dword [esp + 0x10]
push ecx
lea edi, [esi + 4]
push ebx
push edi
call fcn.1001ebc0
mov edx, dword [esp + 0x20]
push ebp
push edx
push edi
call fcn.1001ec50
lea ebp, [esi + 0x34]
push ebp
lea eax, [esi + 0x38]
push eax
push edi
call fcn.1001ec60
add esp, 0x24
jmp 0x1001f9a4
cmp ebp, 0x80
jbe 0x1001f985
push str.len_0__len__int_sizeof_ctx__key_
push 0x5e
push str..cryptohmachmac.c
call fcn.100135a0
add esp, 0xc
mov ecx, dword [esp + 0x14]
push ebp
push ecx
lea edx, [esi + 0x38]
push edx
call fcn.100865f0
mov eax, dword [esp + 0xb4]
lea ebp, [esi + 0x34]
add esp, 0xc
mov dword [ebp], eax
mov ebp, dword [ebp]
cmp ebp, 0x80
je 0x1001f9cc
mov ecx, 0x80
sub ecx, ebp
push ecx
lea edx, [esi + ebp + 0x38]
push 0
push edx
call fcn.10081800
add esp, 0xc
jmp 0x1001f9cc
test eax, eax
je 0x1001fa45
xor eax, eax
mov edi, edi
mov cl, byte [esi + eax + 0x38]
xor cl, 0x36
mov byte [esp + eax + 0x18], cl
add eax, 1
cmp eax, 0x80
jl 0x1001f9d0
mov ebp, dword [esp + 0x10]
push ebp
lea edi, [esi + 0x14]
push ebx
push edi
call fcn.1001ebc0
push ebx
call fcn.1001f440
push eax
lea edx, [esp + 0x2c]
push edx
push edi
call fcn.1001ec50
add esp, 0x1c
xor eax, eax
jmp 0x1001fa10
mov cl, byte [esi + eax + 0x38]
xor cl, 0x5c
mov byte [esp + eax + 0x18], cl
add eax, 1
cmp eax, 0x80
jl 0x1001fa10
push ebp
lea edi, [esi + 0x24]
push ebx
push edi
call fcn.1001ebc0
push ebx
call fcn.1001f440
push eax
lea edx, [esp + 0x2c]
push edx
push edi
call fcn.1001ec50
add esp, 0x1c
lea eax, [esi + 0x14]
push eax
add esi, 4
push esi
call fcn.1001ed50
mov ecx, dword [esp + 0xa0]
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1007aa10
add esp, 0x8c
ret
Function at 0x10032e70
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xc8
call fcn.1008bd60
push ebx
push ebp
push esi
lea eax, [ecx + 0x54]
lea esi, [ecx + 0x14]
mov ecx, dword [esi + 0x3c]
push edi
lea ebp, [esp + 0x58]
lea edi, [esp + 0x98]
xor ebx, ebx
sub ebp, eax
sub edi, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
sub esi, eax
mov edx, dword [eax]
mov ecx, dword [esp + 0xdc]
movzx ecx, byte [ebx + ecx]
mov dword [eax + ebp - 0x40], edx
xor edx, ecx
mov dword [eax + ebp], ecx
xor ecx, dword [esp + 0x10]
mov dword [edi + eax], edx
mov edx, dword [ecx*4 + str._.C]
xor dword [esi + eax], edx
mov ecx, dword [esi + eax]
add ebx, 1
add eax, 4
cmp ebx, 0x10
mov dword [esp + 0x10], ecx
jl 0x10032ea2
xor ecx, ecx
xor edx, edx
nop
xor eax, eax
jmp 0x10032ef0
mov ecx, dword [ecx*4 + str._.C]
xor dword [esp + eax*4 + 0x18], ecx
mov ecx, dword [esp + eax*4 + 0x18]
mov ecx, dword [ecx*4 + str._.C]
xor dword [esp + eax*4 + 0x1c], ecx
mov ecx, dword [esp + eax*4 + 0x1c]
mov ecx, dword [ecx*4 + str._.C]
xor dword [esp + eax*4 + 0x20], ecx
mov ecx, dword [esp + eax*4 + 0x20]
mov ecx, dword [ecx*4 + str._.C]
xor dword [esp + eax*4 + 0x24], ecx
mov ecx, dword [esp + eax*4 + 0x24]
mov ecx, dword [ecx*4 + str._.C]
xor dword [esp + eax*4 + 0x28], ecx
mov ecx, dword [esp + eax*4 + 0x28]
mov ecx, dword [ecx*4 + str._.C]
xor dword [esp + eax*4 + 0x2c], ecx
mov ecx, dword [esp + eax*4 + 0x2c]
mov ecx, dword [ecx*4 + str._.C]
xor dword [esp + eax*4 + 0x30], ecx
mov ecx, dword [esp + eax*4 + 0x30]
mov ecx, dword [ecx*4 + str._.C]
xor dword [esp + eax*4 + 0x34], ecx
mov ecx, dword [esp + eax*4 + 0x34]
add eax, 8
cmp eax, 0x30
jl 0x10032ef0
add ecx, edx
add edx, 1
and ecx, 0xff
cmp edx, 0x12
jl 0x10032ee0
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x18]
push 0xc0
mov ecx, 0x10
lea esi, [esp + 0x1c]
push edx
rep movsd dword es:[edi], dword [esi]
call fcn.1001e800
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc8
ret