joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d2a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x905790
push 0x403f74
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
nop
nop
call dword [sym.imp.MSVCRT.dll___set_app_type]
pop ecx
or dword [0x407df0], 0xffffffff
or dword [0x407df4], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x407dd4]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x407dd0]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x407dec], eax
call fcn.00403f73
cmp dword [0x407ce0], ebx
jne 0x403dad
push 0x403f70
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.00403f5e
push 0x407018
push 0x407014
call sub.MSVCRT.dll__initterm
mov eax, dword [0x407dcc]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0x407dc8]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x407010
push section..data
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x403e40
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x403e14
cmp al, 0x22
jne 0x403e06
cmp byte [esi], 0x22
jne 0x403e1d
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x403e27
cmp al, 0x20
jbe 0x403e19
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x403e4b
movzx eax, word [ebp - 0x2c]
jmp 0x403e4e
cmp byte [esi], 0x20
jbe 0x403e1d
inc esi
mov dword [ebp - 0x74], esi
jmp 0x403e40
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
nop
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x407529
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40c918
cmp edx, dword [eax]
je 0x40754b
add eax, 8
inc ecx
cmp eax, 0x40c9a8
jl 0x40753c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40c918]
jne 0x407679
mov eax, dword [0xf0aa40]
cmp eax, 1
je 0x407653
test eax, eax
jne 0x40757c
cmp dword [0x40c244], 1
je 0x407653
cmp edx, 0xfc
je 0x407679
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4075b3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00404360
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00404450
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4075f6
lea eax, [ebp - 0x1a4]
push eax
call fcn.00404450
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b47c
push edi
call fcn.00404f20
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00404360
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00404370
lea eax, [ebp - 0xa0]
push 0x40b45c
push eax
call fcn.00404370
push dword [esi + 0x40c91c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404370
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004096f3
add esp, 0x2c
pop edi
jmp 0x407679
lea eax, [ebp + 8]
lea esi, [esi + 0x40c91c]
push 0
push eax
push dword [esi]
call fcn.00404450
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10006f50
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x8c
call fcn.10061cf0
mov eax, dword [0x100b14c0]
xor eax, esp
mov dword [esp + 0x88], eax
mov edx, dword [esp + 0xa0]
xor eax, eax
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0x9c]
push esi
mov esi, dword [esp + 0x9c]
push edi
mov edi, dword [esp + 0xac]
mov dword [esp + 0x10], edx
test edi, edi
je 0x10006fb6
cmp edi, dword [esi]
je 0x10006fad
test ebp, ebp
je 0x10007030
test ebx, ebx
js 0x10007030
mov eax, 1
mov dword [esi], edi
jmp 0x10006fbc
mov edi, dword [esi]
test edi, edi
je 0x10007030
test ebp, ebp
je 0x1000714b
push edi
call fcn.1000a110
add esp, 4
mov dword [esp + 0x14], eax
cmp eax, 0x80
jle 0x10006ff0
push str.j____int_sizeof_ctx__key_
push 0x74
push str..cryptohmachmac.c
call fcn.10008b60
mov eax, dword [esp + 0x20]
add esp, 0xc
cmp eax, ebx
jge 0x1000704b
push dword [esp + 0x10]
lea eax, [esi + 4]
push edi
push eax
call fcn.10012860
add esp, 0xc
test eax, eax
je 0x10007030
push ebx
push ebp
lea ebx, [esi + 4]
push ebx
call fcn.10012a10
add esp, 0xc
test eax, eax
je 0x10007030
lea ebp, [esi + 0x4c]
push ebp
lea eax, [esi + 0x50]
push eax
push ebx
call fcn.100127e0
add esp, 0xc
test eax, eax
jne 0x10007067
xor eax, eax
mov ecx, dword [esp + 0x98]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10061ce0
add esp, 0x8c
ret
cmp ebx, 0x80
ja 0x10007030
push ebx
lea eax, [esi + 0x50]
push ebp
push eax
call fcn.100629f0
lea ebp, [esi + 0x4c]
add esp, 0xc
mov dword [ebp], ebx
mov ecx, dword [ebp]
cmp ecx, 0x80
je 0x1000708a
mov eax, 0x80
sub eax, ecx
push eax
lea eax, [esi + 0x50]
add eax, ecx
push 0
push eax
call fcn.10062f70
add esp, 0xc
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov al, byte [esi + ecx + 0x50]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x10007090
push edx
lea ebx, [esi + 0x1c]
push edi
push ebx
call fcn.10012860
add esp, 0xc
test eax, eax
je 0x10007030
push edi
call fcn.1000a110
push eax
lea eax, [esp + 0x20]
push eax
push ebx
call fcn.10012a10
add esp, 0x10
test eax, eax
je 0x10007030
xor ecx, ecx
nop dword [eax + eax]
mov al, byte [esi + ecx + 0x50]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x100070e0
push dword [esp + 0x10]
lea ebx, [esi + 0x34]
push edi
push ebx
call fcn.10012860
add esp, 0xc
test eax, eax
je 0x10007030
push edi
call fcn.1000a110
push eax
lea eax, [esp + 0x20]
push eax
push ebx
call fcn.10012a10
add esp, 0x10
test eax, eax
je 0x10007030
lea eax, [esi + 0x1c]
push eax
lea eax, [esi + 4]
push eax
call fcn.10012ae0
add esp, 8
test eax, eax
je 0x10007030
mov eax, 1
jmp 0x10007032
test eax, eax
je 0x10007129
jmp 0x1000708e

Function at 0x10008890
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor dl, dl
test esi, esi
je 0x100088b7
mov eax, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
sub edi, eax
mov cl, byte [edi + eax]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
or dl, cl
sub esi, 1
jne 0x100088a6
pop edi
movzx eax, dl
pop esi
ret
Function at 0x10008a00
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x10c
call fcn.10061cf0
mov eax, dword [0x100b14c0]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
test esi, esi
je 0x10008a9f
push esi
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x10008a9f
lea eax, [esp + 0x118]
push eax
push 0
push dword [esp + 0x11c]
lea eax, [esp + 0x14]
push pe_nt_image_headers32
push eax
call fcn.100014ca
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.10067dea
add esp, 0x1c
or ecx, 0xffffffff
test eax, eax
cmovs eax, ecx
lea ecx, [esp + 4]
push 0
push ecx
test eax, eax
mov ecx, pe_nt_image_headers32
cmovs eax, ecx
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.10061ce0
add esp, 0x10c
ret
lea eax, [esp + 0x118]
push eax
push 0
push dword [esp + 0x11c]
lea eax, [esp + 0x14]
push 0xff
push eax
call fcn.100014ca
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.10067dea
add esp, 0x1c
mov byte [esp + 0x107], 0
call fcn.100088c0
test eax, eax
jle 0x10008b33
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x10008b47
push 0
lea eax, [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.10061ce0
add esp, 0x10c
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x10c]
pop esi
xor ecx, esp
call fcn.10061ce0
add esp, 0x10c
ret
Function at 0x1000a5e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
jmp 0x1000b0d0
push ebp
mov ebp, dword [esp + 0x10]
push ebp
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.1000b2d0
add esp, 0xc
test eax, eax
js 0x1000b2c0
push ebx
push esi
push edi
mov edi, dword [ebp + 0xf0]
xor ebx, ebx
shl edi, 2
test edi, edi
jle 0x1000b150
lea esi, [ebp + 8]
lea esi, [esi + edi*4]
lea eax, [ebp + 8]
nop dword [eax]
mov edx, dword [eax - 8]
lea eax, [eax + 0x10]
mov ecx, dword [esi - 8]
lea esi, [esi - 0x10]
mov dword [eax - 0x18], ecx
add ebx, 4
mov ecx, dword [esi + 0xc]
sub edi, 4
mov dword [esi + 8], edx
mov edx, dword [eax - 0x14]
mov dword [eax - 0x14], ecx
mov ecx, dword [esi + 0x10]
mov dword [esi + 0xc], edx
mov edx, dword [eax - 0x10]
mov dword [eax - 0x10], ecx
mov ecx, dword [esi + 0x14]
mov dword [esi + 0x10], edx
mov edx, dword [eax - 0xc]
mov dword [eax - 0xc], ecx
mov dword [esi + 0x14], edx
cmp ebx, edi
jl 0x1000b110
mov edi, 1
cmp dword [ebp + 0xf0], edi
jle 0x1000b2bb
lea esi, [ebp + 2]
mov edx, dword [esi + 0xe]
lea esi, [esi + 0x10]
mov eax, edx
inc edi
shr eax, 0x18
movzx ecx, byte [eax*4 + 0x10081070]
movzx eax, byte [esi - 1]
mov ecx, dword [ecx*4 + 0x10081c70]
movzx eax, byte [eax*4 + 0x10081070]
xor ecx, dword [eax*4 + 0x10082470]
movzx eax, byte [esi]
movzx eax, byte [eax*4 + 0x10081070]
xor ecx, dword [eax*4 + 0x10082070]
movzx eax, dl
mov edx, dword [esi + 2]
movzx eax, byte [eax*4 + 0x10081070]
xor ecx, dword [eax*4 + 0x10082870]
mov eax, edx
shr eax, 0x18
mov dword [esi - 2], ecx
movzx ecx, byte [eax*4 + 0x10081070]
movzx eax, byte [esi + 3]
mov ecx, dword [ecx*4 + 0x10081c70]
movzx eax, byte [eax*4 + 0x10081070]
xor ecx, dword [eax*4 + 0x10082470]
movzx eax, byte [esi + 4]
movzx eax, byte [eax*4 + 0x10081070]
xor ecx, dword [eax*4 + 0x10082070]
movzx eax, dl
mov edx, dword [esi + 6]
movzx eax, byte [eax*4 + 0x10081070]
xor ecx, dword [eax*4 + 0x10082870]
mov eax, edx
shr eax, 0x18
mov dword [esi + 2], ecx
movzx ecx, byte [eax*4 + 0x10081070]
movzx eax, byte [esi + 7]
mov ecx, dword [ecx*4 + 0x10081c70]
movzx eax, byte [eax*4 + 0x10081070]
xor ecx, dword [eax*4 + 0x10082470]
movzx eax, byte [esi + 8]
movzx eax, byte [eax*4 + 0x10081070]
xor ecx, dword [eax*4 + 0x10082070]
movzx eax, dl
mov edx, dword [esi + 0xa]
movzx eax, byte [eax*4 + 0x10081070]
xor ecx, dword [eax*4 + 0x10082870]
mov eax, edx
shr eax, 0x18
mov dword [esi + 6], ecx
movzx ecx, byte [eax*4 + 0x10081070]
movzx eax, byte [esi + 0xb]
mov ecx, dword [ecx*4 + 0x10081c70]
movzx eax, byte [eax*4 + 0x10081070]
xor ecx, dword [eax*4 + 0x10082470]
movzx eax, byte [esi + 0xc]
movzx eax, byte [eax*4 + 0x10081070]
xor ecx, dword [eax*4 + 0x10082070]
movzx eax, dl
movzx eax, byte [eax*4 + 0x10081070]
xor ecx, dword [eax*4 + 0x10082870]
mov dword [esi + 0xa], ecx
cmp edi, dword [ebp + 0xf0]
jl 0x1000b164
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x1000ba90
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.10061cf0
mov ecx, dword [esp + 0x28]
mov edx, ecx
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x2c]
cmp esi, 0x10
jb 0x1000bb10
mov eax, esi
shr eax, 4
mov dword [esp + 0x10], eax
nop
mov eax, edi
sub edx, ebp
sub eax, ebp
mov ecx, ebp
mov dword [esp + 0x14], eax
mov ebx, 4
mov esi, eax
mov eax, dword [edx + ecx]
lea ecx, [ecx + 4]
xor eax, dword [ecx - 4]
mov dword [esi + ecx - 4], eax
sub ebx, 1
jne 0x1000bad3
push dword [esp + 0x34]
push edi
push edi
call dword [esp + 0x48]
mov esi, dword [esp + 0x3c]
mov edx, edi
sub esi, 0x10
add esp, 0xc
add ebp, 0x10
mov dword [esp + 0x30], esi
add edi, 0x10
sub dword [esp + 0x10], 1
jne 0x1000bac0
mov ecx, dword [esp + 0x38]
test esi, esi
je 0x1000bc1c
mov ebx, edi
mov ecx, edx
sub ebx, ebp
sub ecx, ebp
mov dword [esp + 0x14], ebx
xor eax, eax
mov ebx, 1
mov dword [esp + 0x20], ecx
sub ebx, ebp
mov dword [esp + 0x10], ebx
mov ebx, 2
sub ebx, ebp
mov dword [esp + 0x18], ebx
mov ebx, 3
sub ebx, ebp
mov dword [esp + 0x1c], ebx
nop dword [eax + eax]
cmp eax, esi
jae 0x1000bbc2
mov esi, dword [esp + 0x14]
lea ebx, [eax + ebp]
mov cl, byte [ecx + ebx]
xor cl, byte [ebx]
mov byte [esi + ebx], cl
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x30]
add ecx, ebx
cmp ecx, esi
jae 0x1000bbc1
mov cl, byte [eax + ebp + 1]
xor cl, byte [eax + edx + 1]
mov byte [edi + eax + 1], cl
mov ecx, dword [esp + 0x18]
add ecx, ebx
cmp ecx, esi
jae 0x1000bbbc
mov cl, byte [eax + ebp + 2]
xor cl, byte [eax + edx + 2]
mov byte [edi + eax + 2], cl
mov ecx, dword [esp + 0x1c]
add ecx, ebx
cmp ecx, esi
jae 0x1000bbb7
mov cl, byte [eax + ebp + 3]
xor cl, byte [eax + edx + 3]
mov byte [edi + eax + 3], cl
add eax, 4
mov ecx, dword [esp + 0x20]
cmp eax, 0x10
jb 0x1000bb50
jmp 0x1000bbe1
add eax, 3
jmp 0x1000bbc2
add eax, 2
jmp 0x1000bbc2
inc eax
cmp eax, 0x10
jae 0x1000bbe1
mov ebx, 0x10
lea ecx, [eax + edi]
sub edx, edi
sub ebx, eax
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
mov byte [ecx - 1], al
sub ebx, 1
jne 0x1000bbd3
push dword [esp + 0x34]
push edi
push edi
call dword [esp + 0x48]
add esp, 0xc
mov edx, edi
cmp esi, 0x10
jbe 0x1000bc0a
sub esi, 0x10
add ebp, 0x10
add edi, 0x10
mov dword [esp + 0x30], esi
test esi, esi
jne 0x1000bb18
mov eax, dword [esp + 0x38]
movups xmm0, xmmword [edx]
pop edi
pop esi
pop ebp
movups xmmword [eax], xmm0
pop ebx
add esp, 0x14
ret
movups xmm0, xmmword [edx]
pop edi
pop esi
pop ebp
movups xmmword [ecx], xmm0
pop ebx
add esp, 0x14
ret
Function at 0x1000bd50
Capabilities:
Encode data using xor

Disassembly:
mov eax, 8
call fcn.10061cf0
mov ecx, dword [esp + 0xc]
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
push edi
mov edi, dword [esp + 0x34]
mov dword [esp + 0x10], ecx
mov edi, dword [edi]
mov dword [esp + 0x14], edi
test edi, edi
je 0x1000bd9d
mov edx, dword [esp + 0x30]
test esi, esi
je 0x1000bd9d
mov al, byte [edi + edx]
dec esi
xor al, byte [ecx]
inc edi
mov byte [ebp], al
inc ecx
inc ebp
mov dword [esp + 0x10], ecx
and edi, 0xf
mov dword [esp + 0x14], edi
jne 0x1000bd80
mov ebx, dword [esp + 0x2c]
movzx edx, byte [ebx + 0xc]
movzx eax, byte [ebx + 0xd]
shl edx, 8
or edx, eax
movzx eax, byte [ebx + 0xe]
shl edx, 8
or edx, eax
movzx eax, byte [ebx + 0xf]
shl edx, 8
or edx, eax
mov dword [esp + 0x24], edx
cmp esi, 0x10
jb 0x1000be57
mov edi, ebx
nop
mov ebx, esi
shr ebx, 4
add edx, ebx
mov dword [esp + 0x24], edx
cmp edx, ebx
jae 0x1000bde7
sub ebx, edx
xor edx, edx
mov dword [esp + 0x24], edx
push edi
push dword [esp + 0x2c]
push ebx
push ebp
push ecx
call dword [esp + 0x4c]
mov edx, dword [esp + 0x38]
add esp, 0x14
mov eax, edx
mov byte [edi + 0xf], dl
shr eax, 0x18
mov byte [edi + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [edi + 0xd], al
mov eax, edx
shr eax, 8
mov byte [edi + 0xe], al
test edx, edx
jne 0x1000be39
mov edx, 0xc
mov ecx, 1
movzx eax, byte [edx + edi - 1]
dec edx
add ecx, eax
mov byte [edx + edi], cl
shr ecx, 8
test edx, edx
jne 0x1000be23
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
shl ebx, 4
sub esi, ebx
add ecx, ebx
add ebp, ebx
mov dword [esp + 0x10], ecx
cmp esi, 0x10
jae 0x1000bdd0
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x2c]
test esi, esi
je 0x1000bec5
mov eax, dword [esp + 0x30]
xorps xmm0, xmm0
push ebx
push dword [esp + 0x2c]
push 1
push eax
push eax
movups xmmword [eax], xmm0
call dword [esp + 0x4c]
mov ecx, dword [esp + 0x38]
add esp, 0x14
inc ecx
mov eax, ecx
mov byte [ebx + 0xf], cl
shr eax, 0x18
mov byte [ebx + 0xc], al
mov eax, ecx
shr eax, 0x10
mov byte [ebx + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [ebx + 0xe], al
test ecx, ecx
jne 0x1000bea2
push ebx
call fcn.1000bf10
add esp, 4
mov eax, dword [esp + 0x30]
sub ebp, eax
mov edx, dword [esp + 0x10]
sub edx, eax
lea ecx, [edi + eax]
add edi, esi
mov al, byte [edx + ecx]
lea ecx, [ecx + 1]
xor al, byte [ecx - 1]
mov byte [ecx + ebp - 1], al
sub esi, 1
jne 0x1000beb3
mov eax, dword [esp + 0x34]
mov dword [eax], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x1000c520
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx + 0x38]
or eax, dword [ebx + 0x3c]
je 0x1000c534
mov eax, 0xfffffffe
pop ebx
ret
push esi
mov esi, dword [esp + 0x14]
xor ecx, ecx
mov eax, esi
add eax, dword [ebx + 0x30]
adc ecx, dword [ebx + 0x34]
cmp ecx, 0x20000000
ja 0x1000c5e9
jb 0x1000c559
test eax, eax
jne 0x1000c5e9
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [ebx + 0x16c]
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x34], ecx
test edi, edi
je 0x1000c599
nop
test esi, esi
je 0x1000c585
mov al, byte [ebp]
dec esi
xor byte [edi + ebx + 0x40], al
inc ebp
inc edi
and edi, 0xf
jne 0x1000c570
jmp 0x1000c589
test edi, edi
jne 0x1000c5dc
lea eax, [ebx + 0x60]
push eax
lea eax, [ebx + 0x40]
push eax
call fcn.1000d840
add esp, 8
mov eax, esi
and eax, 0xfffffff0
mov dword [esp + 0x14], eax
je 0x1000c5be
push eax
push ebp
lea eax, [ebx + 0x60]
push eax
lea eax, [ebx + 0x40]
push eax
call fcn.1000d600
add ebp, dword [esp + 0x24]
add esp, 0x10
sub esi, dword [esp + 0x14]
test esi, esi
je 0x1000c5dc
xor ecx, ecx
mov edi, esi
test esi, esi
je 0x1000c5dc
nop word [eax + eax]
mov al, byte [ecx + ebp]
xor byte [ebx + ecx + 0x40], al
inc ecx
cmp ecx, esi
jb 0x1000c5d0
mov dword [ebx + 0x16c], edi
xor eax, eax
pop edi
pop ebp
pop esi
pop ebx
ret
pop esi
or eax, 0xffffffff
pop ebx
ret
Function at 0x1000d840
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x14
call fcn.10061cf0
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
movzx ecx, byte [eax + 0xf]
mov esi, dword [esp + 0x28]
mov ebp, ecx
and ecx, 0xf
mov dword [esp + 0x24], 0
add ecx, ecx
and ebp, 0xfffffff0
push edi
mov ebx, dword [esi + ecx*8]
mov edi, dword [esi + ecx*8 + 4]
mov edx, dword [esi + ecx*8 + 8]
mov ecx, dword [esi + ecx*8 + 0xc]
mov esi, edx
shrd edx, ecx, 4
and esi, 0xf
mov dword [esp + 0x14], ebx
or dword [esp + 0x28], edx
shl dword [esp + 0x14], 0x1c
shrd ebx, edi, 4
mov edx, dword [esi*4 + 0x10082d98]
mov esi, dword [esp + 0x2c]
shr ecx, 4
or dword [esp + 0x14], ecx
xor ecx, ecx
shr edi, 4
xor ecx, ebx
xor ecx, dword [esi + ebp]
xor edx, edi
xor edx, dword [esi + ebp + 4]
mov edi, dword [esp + 0x28]
mov ebx, dword [esp + 0x14]
xor edi, dword [esi + ebp + 8]
xor ebx, dword [esi + ebp + 0xc]
mov dword [esp + 0x18], edx
mov edx, 0xe
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], edx
nop dword [eax + eax]
movzx edx, byte [edx + eax]
xor esi, esi
mov ebp, dword [esp + 0x10]
mov ecx, edx
shr ecx, 4
and edx, 0xf
mov dword [esp + 0x20], ecx
add edx, edx
mov ecx, edi
shl ebp, 0x1c
shrd edi, ebx, 4
and ecx, 0xf
mov dword [esp + 0x28], 0
shr ebx, 4
or esi, edi
or ebp, ebx
xor edi, edi
mov ebx, dword [ecx*4 + 0x10082d98]
mov ecx, dword [esp + 0x18]
shrd dword [esp + 0x10], ecx, 4
xor edi, dword [esp + 0x10]
shr ecx, 4
xor ebx, ecx
mov ecx, dword [esp + 0x2c]
xor ebx, dword [ecx + edx*8 + 4]
xor ebp, dword [ecx + edx*8 + 0xc]
xor edi, dword [ecx + edx*8]
xor esi, dword [ecx + edx*8 + 8]
mov edx, edi
shrd edi, ebx, 4
mov ecx, esi
shl edx, 0x1c
shrd esi, ebp, 4
and ecx, 0xf
shr ebx, 4
or dword [esp + 0x28], esi
shr ebp, 4
or edx, ebp
xor ebp, ebp
mov ecx, dword [ecx*4 + 0x10082d98]
xor ebp, edi
xor ecx, ebx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x20]
mov ebx, ebp
add edx, edx
mov dword [esp + 0x10], ebp
mov ebp, dword [esp + 0x2c]
xor ebx, dword [ebp + edx*8]
xor ecx, dword [ebp + edx*8 + 4]
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x28]
xor ebx, dword [ebp + edx*8 + 8]
mov dword [esp + 0x28], ebx
mov ebx, dword [esp + 0x14]
xor ebx, dword [ebp + edx*8 + 0xc]
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x28]
sub edx, 1
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
jns 0x1000d8e0
mov edx, dword [esp + 0x18]
shr ecx, 0x18
mov byte [eax], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 1], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 2], cl
mov byte [eax + 3], dl
mov edx, dword [esp + 0x10]
mov ecx, edx
shr ecx, 0x18
mov byte [eax + 4], cl
mov ecx, edx
shr ecx, 0x10
mov byte [eax + 5], cl
mov ecx, edx
shr ecx, 8
mov byte [eax + 6], cl
mov ecx, ebx
shr ecx, 0x18
mov byte [eax + 8], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [eax + 9], cl
mov ecx, ebx
shr ecx, 8
mov byte [eax + 0xa], cl
mov byte [eax + 7], dl
mov edx, edi
mov ecx, edx
mov byte [eax + 0xb], bl
shr ecx, 0x18
mov byte [eax + 0xc], cl
mov ecx, edx
shr ecx, 0x10
pop edi
mov byte [eax + 0xd], cl
mov ecx, edx
pop esi
shr ecx, 8
pop ebp
mov byte [eax + 0xe], cl
mov byte [eax + 0xf], dl
pop ebx
add esp, 0x14
ret
Function at 0x1000feb0
Capabilities:
Encode data using base64

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x14]
xor ebx, ebx
test esi, esi
jle 0x1000ff9c
mov edx, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
inc edi
nop word [eax + eax]
cmp esi, 3
jl 0x1000ff2d
movzx ecx, byte [edi - 1]
movzx eax, byte [edi]
shl ecx, 8
or ecx, eax
movzx eax, byte [edi + 1]
shl ecx, 8
or ecx, eax
mov eax, ecx
shr eax, 0x12
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
mov eax, ecx
shr eax, 0xc
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], al
mov eax, ecx
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 2], al
add edx, 3
and ecx, 0x3f
movzx eax, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
jmp 0x1000ff81
movzx eax, byte [edi - 1]
shl eax, 0x10
cmp esi, 2
jne 0x1000ff41
movzx ecx, byte [edi]
shl ecx, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], cl
mov ecx, eax
shr ecx, 0xc
and ecx, 0x3f
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], cl
cmp esi, 1
jne 0x1000ff6b
lea eax, [esi + 0x3c]
jmp 0x1000ff78
shr eax, 6
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 2], al
add edx, 3
mov byte [edx], 0x3d
sub esi, 3
add ebx, 4
add edi, 3
inc edx
test esi, esi
jg 0x1000fed0
pop edi
pop esi
mov eax, ebx
mov byte [edx], 0
pop ebx
ret
mov eax, dword [esp + 0xc]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
ret
Function at 0x100186a0
Capabilities:
Check if file exists

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
push dword [esp + 0x10]
call fcn.10018790
mov edi, eax
add esp, 8
test edi, edi
jne 0x10018746
push 0xaf
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.10009a30
push 0x10092e34
push esi
push 0x10092e38
push dword [esp + 0x2c]
push str.fopen_
push 5
call fcn.10009220
add esp, 0x2c
call fcn.1006aadd
cmp dword [eax], 2
je 0x10018726
call fcn.1006aadd
cmp dword [eax], 6
je 0x10018726
push 0xb8
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.10009a30
add esp, 0x14
xor eax, eax
pop edi
pop esi
ret
push 0xb6
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.10009a30
add esp, 0x14
xor eax, eax
pop edi
pop esi
ret
push 0x100b08d8
call fcn.100040e0
mov esi, eax
add esp, 4
test esi, esi
jne 0x10018767
push edi
call fcn.10067fb8
add esp, 4
xor eax, eax
pop edi
pop esi
ret
push 0
push esi
call fcn.10003d20
push edi
push 1
push 0x6a
push esi
call fcn.10003d50
add esp, 0x18
mov eax, esi
pop edi
pop esi
ret