joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10184960
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.10177300
push dword [ebp + 8]
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x10], xmm0
call fcn.10280f7c
push dword [ebp + 0xc]
mov edi, eax
call fcn.10280f7c
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExA]
add esp, 0xc
mov esi, eax
push 1
push esi
push edi
call ebx
test eax, eax
jne 0x101849e7
lea eax, [ebp - 0x20]
push eax
call fcn.10177300
movups xmm0, xmmword [ebp - 0x10]
sub esp, 0xc
mov ecx, esp
sub esp, 0x10
movups xmmword [ecx], xmm0
mov ecx, esp
movups xmm0, xmmword [eax]
movups xmmword [ecx], xmm0
call fcn.101773b0
add esp, 0x20
test edx, edx
ja 0x10184a0a
jb 0x101849d5
cmp eax, 0x3e8
ja 0x10184a0a
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push esi
push edi
call ebx
test eax, eax
je 0x101849a0
test edi, edi
je 0x101849f4
push edi
call fcn.10275083
add esp, 4
test esi, esi
je 0x10184a01
push esi
call fcn.10275083
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edi, edi
je 0x10184a17
push edi
call fcn.10275083
add esp, 4
test esi, esi
je 0x10184a24
push esi
call fcn.10275083
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10184b60
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration
Start tcp server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x10373f78]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 0x14]
push 6
push 1
push 2
mov dword [ebp - 0x28], 0x10
mov dword [ebp - 0x2c], 1
call dword [sym.imp.WS2_32.dll_socket]
mov esi, eax
cmp esi, 0xffffffff
je 0x10184d31
xorps xmm0, xmm0
mov eax, 2
push 0x7f000001
movlpd qword [ebp - 0xc], xmm0
mov word [ebp - 0x14], ax
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x10], eax
xor eax, eax
push 4
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x2c]
push eax
push 4
push 0xffff
push esi
mov dword [edi + 4], 0xffffffff
mov dword [edi], 0xffffffff
call dword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x10184d1f
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
je 0x10184d1f
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x10184d1f
cmp dword [ebp - 0x28], 0x10
jl 0x10184d1f
push 1
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x10184d1f
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x10184d1f
push 0x10
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x10184d1f
push 1
push esi
call fcn.1018d980
add esp, 8
test eax, eax
js 0x10184d1f
push 0
push 0x2710
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], esi
push 1
push eax
mov dword [ebp - 0x30], 0x300
call fcn.10181620
add esp, 0x10
push 0
push 0
push esi
call dword [sym.imp.WS2_32.dll_accept]
mov dword [edi + 4], eax
cmp eax, 0xffffffff
je 0x10184d1f
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x10
push eax
lea eax, [ebp - 0x14]
push eax
push dword [edi]
call dword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x10184d1f
cmp dword [ebp - 0x28], 0x10
jl 0x10184d1f
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x10
push eax
lea eax, [ebp - 0x24]
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_getpeername]
cmp eax, 0xffffffff
je 0x10184d1f
cmp dword [ebp - 0x28], 0x10
jl 0x10184d1f
mov ax, word [ebp - 0x14]
cmp ax, word [ebp - 0x24]
jne 0x10184d1f
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
jne 0x10184d1f
mov ax, word [ebp - 0x12]
cmp ax, word [ebp - 0x22]
jne 0x10184d1f
push esi
call dword [sym.imp.WS2_32.dll_closesocket]
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102649e4
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.WS2_32.dll_closesocket]
call esi
push dword [edi]
call esi
push dword [edi + 4]
call esi
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
xor ecx, ebp
pop esi
call fcn.102649e4
mov esp, ebp
pop ebp
ret
Function at 0x10184d80
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [eax], ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getaddrinfo]
mov dword [ebp - 8], eax
test eax, eax
jne 0x10184f17
push esi
mov esi, dword [ebp - 0x14]
test esi, esi
je 0x10184f03
push edi
nop dword [eax]
mov eax, dword [esi + 0x14]
test eax, eax
je 0x10184dde
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10184dd0
sub eax, edx
lea ecx, [eax + 1]
jmp 0x10184de0
xor ecx, ecx
mov eax, dword [esi + 4]
mov dword [ebp - 0xc], ecx
cmp eax, 2
jne 0x10184df2
mov eax, 0x10
jmp 0x10184e00
cmp eax, 0x17
jne 0x10184ea5
mov eax, 0x1c
cmp dword [esi + 0x18], 0
mov dword [ebp - 4], eax
je 0x10184ea5
mov edx, dword [esi + 0x10]
test edx, edx
je 0x10184ea5
cmp edx, eax
jb 0x10184ea5
add ecx, 0x20
add eax, ecx
push eax
call dword [0x10373010]
mov edi, eax
add esp, 4
test edi, edi
je 0x10184ef5
mov ecx, dword [esi]
mov dword [edi], ecx
mov ecx, dword [esi + 4]
mov dword [edi + 4], ecx
mov ecx, dword [esi + 8]
mov dword [edi + 8], ecx
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edi + 0xc], eax
lea eax, [edi + 0x20]
push ecx
mov dword [edi + 0x10], ecx
mov dword [edi + 0x14], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x18], eax
push dword [esi + 0x18]
push eax
call fcn.10266cf0
mov edx, dword [ebp - 0xc]
add esp, 0xc
test edx, edx
je 0x10184e93
mov eax, dword [edi + 0x18]
add eax, dword [ebp - 4]
push edx
mov dword [edi + 0x14], eax
push dword [esi + 0x14]
push eax
call fcn.10266cf0
add esp, 0xc
mov eax, dword [ebp - 0x10]
test ebx, ebx
cmove ebx, edi
test eax, eax
je 0x10184ea2
mov dword [eax + 0x1c], edi
mov dword [ebp - 0x10], edi
mov esi, dword [esi + 0x1c]
test esi, esi
jne 0x10184dc0
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
pop edi
test eax, eax
je 0x10184ec2
push eax
call dword [sym.imp.WS2_32.dll_freeaddrinfo]
test esi, esi
je 0x10184eff
test ebx, ebx
je 0x10184ee6
nop word [eax + eax]
mov esi, dword [ebx + 0x1c]
push ebx
call dword [0x10373014]
add esp, 4
mov ebx, esi
test esi, esi
jne 0x10184ed0
mov esi, dword [ebp - 8]
mov eax, dword [ebp + 0x14]
xor ebx, ebx
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, 8
mov dword [ebp - 8], esi
jmp 0x10184eb3
test ebx, ebx
jne 0x10184f0f
mov esi, 0x2af9
push esi
call dword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10185110
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10373f78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push esi
mov esi, dword [ebp + 8]
push eax
push esi
push 2
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x10185159
push ebx
push esi
lea eax, [ebp - 0x18]
push eax
push 2
call fcn.10184f20
add esp, 0x10
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102649e4
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push esi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1018518a
push ebx
push esi
lea eax, [ebp - 0x14]
push eax
push 0x17
call fcn.10184f20
add esp, 0x10
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102649e4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.102649e4
mov esp, ebp
pop ebp
ret

Function at 0x10185300
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call fcn.102755ac
add esp, 0x18
test eax, eax
je 0x10185322
cmp eax, 0xffffffff
jne 0x10185324
xor eax, eax
pop ebp
ret

Function at 0x10185370
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov ecx, 0x2b
test edi, edi
je 0x10185417
mov esi, dword [ebp + 0xc]
nop dword [eax]
push 4
lea eax, [ebp + 0x10]
mov ebx, 4
push eax
push dword [ebp + 8]
cmp edi, ebx
cmovb ebx, edi
call fcn.1016b630
add esp, 0xc
cmp eax, 4
jne 0x101853d5
cmp byte [0x10385f94], 0
jne 0x101853e0
push 2
push eax
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
mov ecx, eax
test eax, eax
jne 0x10185419
mov eax, dword [ebp + 0x10]
jmp 0x101853fc
imul eax, dword [0x10385f90], 0x41c64e6d
add eax, 0x3039
mov dword [0x10385f90], eax
rol eax, 0x10
xor ecx, ecx
mov dword [ebp + 0x10], eax
test ebx, ebx
je 0x1018540f
mov byte [esi], al
dec edi
inc esi
shr eax, 8
sub ebx, 1
jne 0x10185400
mov dword [ebp + 0x10], eax
test edi, edi
jne 0x10185390
mov eax, ecx
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10185420
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x10373f78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x8c], eax
mov eax, ebx
and eax, 0xfffffffe
mov dword [ebp - 0x90], edx
cmp eax, 0x100
jae 0x1018557f
test bl, 1
je 0x1018557f
push esi
dec ebx
lea esi, [ebp - 0x84]
push edi
mov edi, ebx
mov dword [ebp + 0x10], ebx
shr edi, 1
mov ecx, 0x2b
je 0x10185529
nop dword [eax]
push 4
lea eax, [ebp - 0x88]
mov ebx, 4
push eax
push dword [ebp - 0x8c]
cmp edi, ebx
cmovb ebx, edi
call fcn.1016b630
add esp, 0xc
cmp eax, 4
jne 0x101854d1
cmp byte [0x10385f94], 0
jne 0x101854e3
push 2
push eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], 0
push eax
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
mov ecx, eax
test eax, eax
jne 0x1018556e
mov eax, dword [ebp - 0x88]
jmp 0x10185502
imul eax, dword [0x10385f90], 0x41c64e6d
add eax, 0x3039
mov dword [0x10385f90], eax
rol eax, 0x10
xor ecx, ecx
mov dword [ebp - 0x88], eax
test ebx, ebx
je 0x10185518
mov byte [esi], al
dec edi
inc esi
shr eax, 8
sub ebx, 1
jne 0x10185506
mov dword [ebp - 0x88], eax
test edi, edi
jne 0x10185480
mov edx, dword [ebp - 0x90]
mov ebx, dword [ebp + 0x10]
mov eax, ecx
test eax, eax
jne 0x1018556e
test ebx, ebx
je 0x10185569
lea esi, [ebp - 0x84]
nop dword [eax]
movzx ecx, byte [esi]
lea esi, [esi + 1]
mov eax, ecx
and ecx, 0xf
shr eax, 4
movzx eax, byte [eax + str.0123456789abcdef]
mov byte [edx], al
movzx eax, byte [ecx + str.0123456789abcdef]
mov byte [edx + 1], al
add edx, 2
sub ebx, 2
jne 0x10185540
mov byte [edx], 0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102649e4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x2b
xor ecx, ebp
pop ebx
call fcn.102649e4
mov esp, ebp
pop ebp
ret

Function at 0x101855a0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.10267270
add esp, 0xc
push 2
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
pop ebp
ret
Function at 0x10189910
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
lea esi, [ebx + 1]
push esi
push ebx
call dword [0x10373018]
mov edi, eax
add esp, 8
test edi, edi
je 0x1018996a
nop dword [eax]
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov ebx, esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov esi, eax
test esi, esi
je 0x10189986
cmp esi, ebx
je 0x10189986
cmp esi, 0x8000
ja 0x10189986
cmp esi, ebx
jb 0x1018997d
push esi
push edi
call dword [0x10373018]
mov edi, eax
add esp, 8
test edi, edi
jne 0x10189930
mov ebx, dword [ebp - 4]
push ebx
call dword [0x10373014]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call dword [0x10373014]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1018afc0
Capabilities:
Convert ip address from string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x10373f78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov al, byte [edi]
test al, al
jne 0x1018aff9
pop edi
mov eax, 0xe
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102649e4
mov esp, ebp
pop ebp
ret
push esi
cmp al, 0x5b
jne 0x1018b18b
cmp ebx, 4
jb 0x1018b175
inc edi
sub ebx, 2
cmp byte [ebx + edi], 0x5d
lea esi, [ebx + edi]
jne 0x1018b175
push str.0123456789abcdefABCDEF:.
push edi
call fcn.102803a0
add esp, 8
cmp ebx, eax
je 0x1018b0ed
mov dword [ebp - 0x50], eax
add eax, edi
mov dword [ebp - 0x54], eax
cmp byte [eax], 0x25
jne 0x1018b175
inc eax
xor ebx, ebx
push 2
mov esi, eax
mov dword [ebp - 0x4c], eax
push 0x102c92bc
push esi
call fcn.1027cc10
add esp, 0xc
test eax, eax
jne 0x1018b06f
mov cl, byte [esi + 2]
lea eax, [esi + 2]
test cl, cl
je 0x1018b06f
cmp cl, 0x5d
cmovne esi, eax
mov al, byte [esi]
test al, al
je 0x1018b15f
lea ecx, [ebp - 0x14]
sub ecx, esi
nop
cmp al, 0x5d
je 0x1018b095
cmp ebx, 0xf
jge 0x1018b095
mov byte [ecx + esi], al
inc ebx
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1018b080
test ebx, ebx
je 0x1018b15f
cmp byte [esi], 0x5d
jne 0x1018b15f
cmp ebx, 0x10
jae 0x1018b1b3
lea eax, [ebp - 0x14]
mov byte [ebp + ebx - 0x14], 0
push eax
call dword [0x1037301c]
mov ecx, dword [ebp - 0x48]
add esp, 4
mov dword [ecx + 0x14], eax
test eax, eax
jne 0x1018b0e1
pop esi
pop edi
mov eax, 7
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102649e4
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x4c]
mov ebx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x54]
mov byte [eax], 0
lea eax, [ebp - 0x14]
mov byte [esi], 0
push eax
push edi
push 0x17
call dword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jne 0x1018b175
push 0x2e
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x17
call sub.WS2_32.dll_inet_ntop
test eax, eax
je 0x1018b149
lea edx, [ebp - 0x44]
lea ecx, [edx + 1]
nop dword [eax]
mov al, byte [edx]
inc edx
test al, al
jne 0x1018b120
sub edx, ecx
cmp edx, ebx
jae 0x1018b149
lea ecx, [ebp - 0x44]
mov esi, edi
mov eax, ecx
sub esi, eax
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [esi + ecx - 1], al
test al, al
jne 0x1018b136
lea esi, [edx + edi]
mov byte [esi + 1], al
mov byte [esi], 0x5d
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102649e4
mov esp, ebp
pop ebp
ret
pop esi
pop edi
mov eax, 3
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102649e4
mov esp, ebp
pop ebp
ret
pop esi
pop edi
mov eax, 0x16
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.102649e4
mov esp, ebp
pop ebp
ret
push str.__r_n_t_:____________
push edi
call fcn.10270210
add esp, 8
cmp ebx, eax
je 0x1018b14c
mov ecx, dword [ebp - 4]
mov eax, 0x15
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.102649e4
mov esp, ebp
pop ebp
ret
call fcn.1026553b
int3
Function at 0x10196e80
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push dword [ebp + 0x10]
call fcn.10052a00
mov esi, dword [ebp + 8]
mov ebx, eax
mov dword [ebp - 4], ebx
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0x10373010]
mov edi, eax
add esp, 8
test edi, edi
je 0x10196fe0
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x10196efe
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [ebp + 0xc]
push ebx
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp + 0xc], eax
push eax
mov eax, dword [esi + 8]
call eax
mov eax, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp - 4]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x10196f5b
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], eax
nop dword [eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp - 4], 1
jne 0x10196f20
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x10196f87
mov eax, dword [esi + 4]
push 1
push 0x102cb12d
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x102cb12e
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x10196f60
push dword [ebp + 0x18]
call fcn.10052a00
mov ecx, dword [edi]
push eax
push dword [ebp + 0x14]
push dword [edi + 4]
mov eax, dword [ecx + 4]
call eax
mov esi, dword [ebp + 0x1c]
add esp, 0x10
mov ebx, dword [edi]
test esi, esi
jne 0x10196faf
mov esi, dword [ebx + 0xc]
add esi, dword [edi + 8]
push dword [edi + 4]
mov eax, dword [ebx + 8]
push esi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push esi
push dword [edi + 8]
call eax
push dword [edi + 8]
mov eax, dword [ebx + 8]
push esi
call eax
push edi
call dword [0x10373014]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, 0x1b
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x101970b0
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x101970e5
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x800c
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push dword [ebp + 0x10]
call fcn.10052a00
add esp, 4
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [ebp - 4], 0x20
jne 0x10197133
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 8]
test eax, eax
je 0x10197141
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x10197151
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x101991c0
Capabilities:
Create directory

Disassembly:
sub esp, 0x14
push ebx
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x101991e0
xorps xmm0, xmm0
movq qword [edi], xmm0
mov dword [edi + 8], 0
mov eax, dword [esp + 0x28]
test eax, eax
je 0x10199206
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x101991f2
mov ecx, dword [esi]
cmp dword [eax + 0x14], 8
jb 0x101991fa
mov eax, dword [eax]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExW]
jmp 0x10199219
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10199210
mov eax, dword [esi]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x10199226
mov al, 1
pop edi
pop esi
pop ebx
add esp, 0x14
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x14]
xorps xmm0, xmm0
push eax
lea eax, [esp + 0x10]
movq qword [esp + 0x18], xmm0
push esi
push eax
call fcn.10199e40
add esp, 0xc
cmp dword [esp + 0xc], 3
je 0x10199269
push str.boost::filesystem::create_directory
push edi
push esi
push ebx
call fcn.1019abb0
add esp, 0x10
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x14
ret

Function at 0x10199720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
je 0x10199736
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
mov dword [esp + 8], eax
jmp fcn.10199740
Function at 0x101998d0
Capabilities:
Check if file exists
Delete directory
Delete file
Set file attributes

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov cl, al
push ebx
mov ebx, eax
shr ebx, 4
and bl, 1
and cl, 1
push esi
mov esi, dword [esp + 0x10]
mov byte [esp + 0xb], cl
je 0x1019997d
and eax, 0xfffffffe
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x101998ff
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x1019997d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10199a10
cmp eax, 3
je 0x10199a10
cmp eax, 0x7b
je 0x10199a10
cmp eax, 0xf
je 0x10199a10
cmp eax, 0x15
je 0x10199a10
cmp eax, 0x57
je 0x10199a10
cmp eax, 0xa1
je 0x10199a10
cmp eax, 0x35
je 0x10199a10
cmp eax, 0x43
je 0x10199a10
push str.boost::filesystem::remove
push dword [esp + 0x1c]
push esi
push eax
call fcn.1019abb0
add esp, 0x10
xor al, al
pop esi
pop ebx
pop ecx
ret
mov eax, esi
test bl, bl
jne 0x10199994
cmp dword [esi + 0x14], 8
jb 0x1019998b
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x101999a3
cmp dword [esi + 0x14], 8
jb 0x1019999c
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x10199a16
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 2
je 0x10199a0f
cmp edi, 3
je 0x10199a0f
cmp edi, 0x7b
je 0x10199a0f
cmp edi, 0xf
je 0x10199a0f
cmp edi, 0x15
je 0x10199a0f
cmp edi, 0x57
je 0x10199a0f
cmp edi, 0xa1
je 0x10199a0f
cmp edi, 0x35
je 0x10199a0f
cmp edi, 0x43
je 0x10199a0f
cmp byte [esp + 0xf], 0
je 0x101999fc
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x101999f1
mov eax, dword [esi]
push dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push str.boost::filesystem::remove
push dword [esp + 0x20]
push esi
push edi
call fcn.1019abb0
add esp, 0x10
pop edi
pop esi
xor al, al
pop ebx
pop ecx
ret
pop esi
mov al, 1
pop ebx
pop ecx
ret

Function at 0x10199bf0
Capabilities:
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
push edi
cmp dword [esi + 0x14], 8
jb 0x10199c00
mov eax, dword [esi]
mov edi, dword [esp + 0xc]
mov ecx, edi
cmp dword [edi + 0x14], 8
jb 0x10199c0e
mov ecx, dword [edi]
push 3
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x10199c3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10199c3d
push str.boost::filesystem::rename
push dword [esp + 0x18]
push esi
push edi
push eax
call fcn.1019ab40
add esp, 0x14
pop edi
pop esi
ret
mov eax, dword [esp + 0x14]
test eax, eax
je 0x10199c53
xorps xmm0, xmm0
movq qword [eax], xmm0
mov dword [eax + 8], 0
pop edi
pop esi
ret