joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001b700
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x860
mov eax, dword [0x100934c0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x860], 0x44
mov dword [ebp - 0x85c], 0
push 0x3c
push 0
lea eax, [ebp - 0x858]
push eax
call fcn.10058400
add esp, 0xc
mov dword [ebp - 0x818], 0
xor ecx, ecx
mov dword [ebp - 0x814], ecx
mov dword [ebp - 0x810], ecx
mov dword [ebp - 0x80c], ecx
xor edx, edx
mov word [ebp - 0x808], dx
push 0x7fe
push 0
lea eax, [ebp - 0x806]
push eax
call fcn.10058400
add esp, 0xc
mov ecx, dword [ebp + 0xc]
call fcn.1000de10
push eax
mov ecx, dword [ebp + 8]
call fcn.1000de10
push eax
push str.__s___s
push 0x3ff
push 0x400
lea ecx, [ebp - 0x808]
push ecx
call fcn.10055955
add esp, 0x18
mov dword [ebp - 0x834], 1
mov dx, word [ebp + 0x14]
mov word [ebp - 0x830], dx
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0x18]
call fcn.100047f0
test eax, eax
jbe 0x1001b7da
mov ecx, dword [ebp + 0x18]
call fcn.1000de10
mov dword [ebp - 4], eax
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0x860]
push ecx
mov edx, dword [ebp - 4]
push edx
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x808]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1001b854
movzx ecx, byte [ebp + 0x10]
test ecx, ecx
je 0x1001b822
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x818], 0
je 0x1001b838
mov ecx, dword [ebp - 0x814]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x814], 0
je 0x1001b84e
mov edx, dword [ebp - 0x818]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1001b86b
push 1
movzx eax, byte [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.1001b670
add esp, 0x10
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10053489
mov esp, ebp
pop ebp
ret
Function at 0x1001dae0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10078996
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x100934c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xc0], ecx
mov eax, dword [ebp - 0xc0]
movzx ecx, byte [eax]
cmp ecx, 1
jne 0x1001db26
xor al, al
jmp 0x1001dd18
push 0x1007cca3
mov edx, dword [ebp + 0xc]
push edx
call fcn.10026980
add esp, 8
movzx eax, al
test eax, eax
je 0x1001db5e
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0xc0]
add ecx, 0x90
call fcn.100048f0
mov ecx, dword [ebp - 0xc0]
call fcn.1001d850
mov edx, dword [ebp - 0xc0]
mov byte [edx], 1
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x150], ecx
mov ecx, dword [ebp - 0xc0]
call fcn.1001e030
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edx, dword [ebp - 0xc0]
mov dword [edx + 0x108], eax
mov dword [ebp - 0xbc], 0
lea eax, [ebp - 0xbc]
push eax
push 0
mov ecx, dword [ebp - 0xc0]
push ecx
push 0x1001d460
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 0xc0]
mov dword [edx + 0x104], eax
mov ecx, dword [ebp - 0xc0]
call fcn.1001d9a0
mov ecx, dword [ebp - 0xc0]
call fcn.1001eb60
movzx eax, al
test eax, eax
je 0x1001dc8e
mov ecx, dword [ebp - 0xc0]
cmp dword [ecx + 0x104], 0
je 0x1001dc8e
mov edx, dword [ebp - 0xc0]
cmp dword [edx + 0x108], 0
je 0x1001dc8e
push 0x1007cca7
lea ecx, [ebp - 0x2c]
call fcn.10005790
mov dword [ebp - 4], 0
push 0x1007ccb2
lea ecx, [ebp - 0x48]
call fcn.10005790
mov byte [ebp - 4], 1
push 0x1007f6ac
lea ecx, [ebp - 0x64]
call fcn.10005790
mov byte [ebp - 4], 2
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x48]
push ecx
lea edx, [ebp - 0x64]
push edx
push 1
mov ecx, dword [ebp - 0xc0]
call fcn.1001ef50
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x64]
call fcn.10004600
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.10004600
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.10004600
jmp 0x1001dd16
push 0x1007ccb3
lea ecx, [ebp - 0x80]
call fcn.10005790
mov dword [ebp - 4], 3
push 0x1007ccc6
lea ecx, [ebp - 0x9c]
call fcn.10005790
mov byte [ebp - 4], 4
push 0x1007f6b4
lea ecx, [ebp - 0xb8]
call fcn.10005790
mov byte [ebp - 4], 5
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x9c]
push ecx
lea edx, [ebp - 0xb8]
push edx
push 1
mov ecx, dword [ebp - 0xc0]
call fcn.1001ef50
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xb8]
call fcn.10004600
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x9c]
call fcn.10004600
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x80]
call fcn.10004600
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10053489
mov esp, ebp
pop ebp
ret 8
Function at 0x1002b7c0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], 0
mov dword [ebp - 4], 0
push 0x1007ecfc
mov ecx, 0x1009e224
call fcn.1000ddf0
cmp dword [ebp - 4], 0x14
jge 0x1002b83a
mov eax, dword [ebp + 8]
push eax
push 0x1002a4d0
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x1007ed00
push 0x1009e224
call fcn.10026f30
add esp, 8
movzx ecx, al
test ecx, ecx
je 0x1002b824
push 0x1009e224
mov ecx, dword [ebp + 0xc]
call fcn.1001bd90
mov byte [ebp - 5], 1
jmp 0x1002b83a
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002b7e3
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret 8

Function at 0x1002b870
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x100934c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x244], ecx
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x238], 0x22c
push 0x228
push 0
lea eax, [ebp - 0x234]
push eax
call fcn.10058400
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0xffffffff
jne 0x1002b8d2
xor eax, eax
jmp 0x1002b94b
lea edx, [ebp - 0x238]
push edx
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1002b926
lea ecx, [ebp - 0x214]
push ecx
push str.qq.exe
call fcn.10053e4d
add esp, 8
test eax, eax
jne 0x1002b90e
mov edx, dword [ebp - 0x230]
mov dword [ebp - 0x240], edx
lea eax, [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1002b8ea
mov edx, dword [ebp - 0x23c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x240], 0
jne 0x1002b945
mov eax, dword [ebp + 8]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10053489
mov esp, ebp
pop ebp
ret 4
Function at 0x1002e530
Capabilities:
Print debug messages
Send http response

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [0x100934c0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x170], ecx
push 0x120
push 0
lea eax, [ebp - 0x140]
push eax
call fcn.10058400
add esp, 0xc
mov cx, word [ebp + 0xc]
mov word [ebp - 0x138], cx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x134], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x174], eax
mov ecx, dword [ebp - 0x174]
add ecx, 1
mov dword [ebp - 0x178], ecx
mov edx, dword [ebp - 0x174]
mov al, byte [edx]
mov byte [ebp - 0x179], al
add dword [ebp - 0x174], 1
cmp byte [ebp - 0x179], 0
jne 0x1002e58b
mov ecx, dword [ebp - 0x174]
sub ecx, dword [ebp - 0x178]
mov dword [ebp - 0x180], ecx
mov dx, word [ebp - 0x180]
mov word [ebp - 0x136], dx
xor eax, eax
jne 0x1002e549
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0xbc], ecx
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0x184], edx
mov eax, dword [ebp - 0x184]
add eax, 1
mov dword [ebp - 0x188], eax
mov ecx, dword [ebp - 0x184]
mov dl, byte [ecx]
mov byte [ebp - 0x189], dl
add dword [ebp - 0x184], 1
cmp byte [ebp - 0x189], 0
jne 0x1002e5f2
mov eax, dword [ebp - 0x184]
sub eax, dword [ebp - 0x188]
mov dword [ebp - 0x190], eax
mov cx, word [ebp - 0x190]
mov word [ebp - 0xc0], cx
xor edx, edx
jne 0x1002e5d1
mov dword [ebp - 0xcc], 0x1007e380
mov eax, 1
mov word [ebp - 0xd0], ax
xor ecx, ecx
jne 0x1002e634
mov edx, 0x1b
mov word [ebp - 0x18], dx
mov dword [ebp - 0x14], str.Access_Control_Allow_Origin
mov eax, 1
mov word [ebp - 0x16], ax
mov dword [ebp - 0x10], 0x1007e3a0
mov ecx, 0x1c
mov word [ebp - 0xc], cx
mov dword [ebp - 8], str.Access_Control_Allow_Methods
mov edx, 0x1f
mov word [ebp - 0xa], dx
mov dword [ebp - 4], str.GET__PUT__POST__DELETE__OPTIONS
mov eax, 2
mov word [ebp - 0x130], ax
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x12c], ecx
cmp dword [ebp + 0x14], 0
je 0x1002e6d7
mov dword [ebp - 0x168], 0
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0x160], edx
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x15c], eax
mov ecx, 1
mov word [ebp - 0x30], cx
lea edx, [ebp - 0x168]
mov dword [ebp - 0x2c], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x144]
push eax
push 0
lea ecx, [ebp - 0x140]
push ecx
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [edx + 0x10]
push ecx
mov edx, dword [ebp - 0x170]
mov eax, dword [edx]
push eax
call dword [sym.imp.HTTPAPI.dll_HttpSendHttpResponse]
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 0
je 0x1002e725
push str.HttpSendHttpResponse_failed_with_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10053489
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1002eb50
Capabilities:
Register http server url

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 1
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.HTTPAPI.dll_HttpAddUrl]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002eb81
xor al, al
jmp 0x1002eb83
mov al, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x1002ef20
Capabilities:
Check if file exists
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x1002ef4e
push 0x1007e490
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor al, al
jmp 0x1002f011
mov ecx, dword [ebp - 4]
and ecx, 0x10
je 0x1002f004
mov edx, dword [ebp + 8]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
add eax, 2
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
mov dx, word [ecx]
mov word [ebp - 0x1e], dx
add dword [ebp - 0x18], 2
cmp word [ebp - 0x1e], 0
jne 0x1002ef69
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
sar eax, 1
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x14]
cmp dword [edx + 8], 0
je 0x1002efad
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.10054d4f
add esp, 4
mov eax, dword [ebp - 8]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.100546a1
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 8]
push edx
call fcn.10055e42
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax + 8]
xor edx, edx
mov eax, dword [ebp - 8]
mov word [ecx + eax*2], dx
mov al, 1
jmp 0x1002f011
push str.Error_during_path_adding._Wrong_path___directory_needed._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
xor al, al
mov esp, ebp
pop ebp
ret 4
Function at 0x1002f270
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10077276
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x100934c0]
xor eax, ebp
mov dword [ebp - 0xc8], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 0
jne 0x1002f2ae
mov eax, 0x1007cbe1
jmp 0x1002f44d
push 1
lea ecx, [ebp - 0xc4]
call fcn.10030ed0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xe4]
call fcn.1000dd50
mov byte [ebp - 4], 1
push 0x40
push 0x20
lea ecx, [ebp - 0xe4]
push ecx
lea ecx, [ebp - 0xc4]
call fcn.10030f80
lea ecx, [ebp - 0xc4]
call fcn.10031020
movzx edx, al
test edx, edx
je 0x1002f30a
push str.file_is_opened_successfully__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x1002f349
push str.G:web_serverhtmlpage_not_found.html
lea ecx, [ebp - 0xe4]
call fcn.1000ddf0
push 0
push 0
mov eax, dword [ebp - 0xc4]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0xc4]
call fcn.10031f70
push 0x40
push 0x20
lea edx, [ebp - 0xe4]
push edx
lea ecx, [ebp - 0xc4]
call fcn.10030f80
lea ecx, [ebp - 0xc4]
call fcn.1000e9d0
mov dword [ebp - 0x10], eax
push 1
push 2
push 0
push 0
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.1002fc80
mov ecx, eax
call fcn.10024890
mov dword [ebp - 0xe8], eax
push 1
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x108], esp
push 0
push 0
call fcn.10024850
lea ecx, [ebp - 0x124]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.1002fcc0
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x128], edx
mov eax, dword [ebp - 0x128]
push eax
call fcn.10054d4f
add esp, 4
mov ecx, dword [ebp - 0xe8]
add ecx, 2
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
push ecx
call fcn.100546a1
add esp, 4
mov dword [ebp - 0x12c], eax
mov edx, dword [ebp - 0x12c]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xe8]
mov byte [eax], 0xd
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xe8]
mov byte [ecx + 1], 0xa
mov edx, dword [ebp - 0xe8]
xor eax, eax
push eax
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp - 0x10]
call fcn.1002fd10
lea ecx, [ebp - 0xc4]
call fcn.10031040
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x130], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xe4]
call fcn.1000ddd0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.1002f470
mov eax, dword [ebp - 0x130]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0xc8]
xor ecx, ebp
call fcn.10053489
mov esp, ebp
pop ebp
ret
Function at 0x10032c80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10074a98
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x100934c0]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x44], 0
je 0x10032cc0
mov ecx, dword [ebp - 0x58]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x10032ccc
mov al, 1
jmp 0x10032e6f
mov dword [ebp - 0x10], 8
call fcn.1001c280
push eax
mov eax, dword [ebp - 0x58]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x58]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.1001c280
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.1001c230
add esp, 8
movzx eax, al
test eax, eax
je 0x10032d0f
xor al, al
jmp 0x10032e6f
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.1002f730
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x44]
push edx
lea ecx, [ebp - 0x34]
call fcn.100049d0
mov ecx, eax
call fcn.1000c970
mov esi, eax
lea ecx, [ebp - 0x34]
call fcn.100047f0
add esi, eax
push esi
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x34]
call fcn.100049d0
mov ecx, eax
call fcn.1000c970
push eax
mov ecx, dword [ebp - 0x58]
add ecx, 0x4c
push ecx
mov edx, dword [ebp - 0x58]
mov ecx, dword [edx + 0x44]
call fcn.10034fe0
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
je 0x10032d8a
cmp dword [ebp - 0x5c], 1
je 0x10032d91
cmp dword [ebp - 0x5c], 3
je 0x10032e2b
jmp 0x10032e43
mov eax, dword [ebp - 0x58]
mov byte [eax + 0x49], 0
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x34]
call fcn.100049d0
mov ecx, eax
call fcn.1000c970
mov edx, dword [ebp - 0x14]
sub edx, eax
mov dword [ebp - 0x38], edx
je 0x10032df4
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax + 0x54]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x34]
call fcn.100049d0
mov ecx, eax
call fcn.1000c970
push eax
call fcn.100558bd
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x10032df4
mov byte [ebp - 0x51], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10004600
mov al, byte [ebp - 0x51]
jmp 0x10032e6f
mov ecx, dword [ebp - 0x58]
movzx edx, byte [ecx + 0x49]
test edx, edx
jne 0x10032e17
mov byte [ebp - 0x52], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10004600
mov al, byte [ebp - 0x52]
jmp 0x10032e6f
cmp dword [ebp - 0x38], 0
jne 0x10032e29
push 0
push 8
lea ecx, [ebp - 0x34]
call fcn.10026230
jmp 0x10032e5b
mov byte [ebp - 0x53], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10004600
mov al, byte [ebp - 0x53]
jmp 0x10032e6f
mov byte [ebp - 0x54], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10004600
mov al, byte [ebp - 0x54]
jmp 0x10032e6f
jmp 0x10032d22
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.10053489
mov esp, ebp
pop ebp
ret
Function at 0x100385f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x100771b9
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x100934c0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x24]
mov esi, dword [esp + 0x1c]
mov ecx, esi
call fcn.10008200
lea ecx, [esi + 0x18]
mov dword [esp + 0x14], 0
call fcn.100089f0
mov cl, byte [esp + 0x28]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov byte [esp + 0x14], 1
mov byte [esi + 0x28], cl
push edx
lea ecx, [esi + 0x34]
mov dword [esi], vtable.CryptoPP::HashFilter.0
mov dword [esi + 4], vtable.CryptoPP::HashFilter.1.0
mov dword [esi + 0x24], eax
call fcn.10009710
mov eax, dword [esp + 0x30]
push eax
lea ecx, [esi + 0x50]
mov byte [esp + 0x18], 2
call fcn.10009710
mov byte [esp + 0x14], 3
test edi, edi
jns 0x10038685
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
call eax
jmp 0x10038687
mov eax, edi
mov dword [esi + 0x2c], eax
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x10038699
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov dword [esi + 0xc], ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 0x18

Function at 0x1003ae10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10077060
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x100934c0]
xor eax, esp
mov dword [esp + 0x70], eax
push ebx
push edi
mov eax, dword [0x100934c0]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
lea eax, [esp + 0x60]
push eax
mov edi, edx
call fcn.1003ad20
mov ebx, eax
push 0x10086fd0
lea ecx, [esp + 0x30]
push edi
push ecx
mov dword [esp + 0x98], 0
call fcn.10035600
mov edi, eax
lea edx, [esp + 0x1c]
push edx
mov eax, ebx
mov byte [esp + 0x9c], 1
call fcn.1003ac20
push str._is_not_a_valid_key_length
push eax
lea eax, [esp + 0x60]
push eax
mov byte [esp + 0xa8], 2
call fcn.1000c300
add esp, 0x20
push eax
mov ecx, esi
mov byte [esp + 0x8c], 3
call fcn.100067d0
lea ecx, [esp + 0x44]
call fcn.10004600
lea ecx, [esp + 0xc]
call fcn.10004600
lea ecx, [esp + 0x28]
call fcn.10004600
lea ecx, [esp + 0x60]
call fcn.10004600
mov dword [esi], vtable.CryptoPP::InvalidKeyLength.0
mov eax, esi
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [esp + 0x70]
xor ecx, esp
call fcn.10053489
add esp, 0x80
ret
Function at 0x1003af00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x10]
push 0
mov esi, eax
call fcn.1000c6f0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x1003af42
test ecx, ecx
je 0x1003af2d
lea eax, [ecx - 1]
test ecx, eax
jne 0x1003af2d
and eax, edi
jmp 0x1003af35
mov eax, edi
xor edx, edx
div ecx
mov eax, edx
neg eax
sbb eax, eax
inc eax
test eax, eax
je 0x1003aff1
push 0
call fcn.1000c6f0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x1003af77
test ecx, ecx
je 0x1003af62
lea eax, [ecx - 1]
test ecx, eax
jne 0x1003af62
and eax, ebp
jmp 0x1003af6a
mov eax, ebp
xor edx, edx
div ecx
mov eax, edx
neg eax
sbb eax, eax
inc eax
test eax, eax
je 0x1003aff1
push 0
call fcn.1000c6f0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x1003afa8
test ecx, ecx
je 0x1003af97
lea eax, [ecx - 1]
test ecx, eax
jne 0x1003af97
and eax, esi
jmp 0x1003af9f
mov eax, esi
xor edx, edx
div ecx
mov eax, edx
neg eax
sbb eax, eax
inc eax
test eax, eax
je 0x1003aff1
mov edx, dword [esp + 0x18]
mov ecx, edx
push ebx
shr ecx, 2
xor ebx, ebx
test ecx, ecx
je 0x1003afdd
mov edx, ebp
sub edx, esi
mov eax, esi
sub edi, esi
mov ebx, ecx
mov ebp, dword [edx + eax]
xor ebp, dword [eax]
add eax, 4
dec ecx
mov dword [edi + eax - 4], ebp
jne 0x1003afc2
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
lea eax, [ebx*4]
sub edx, eax
pop ebx
je 0x1003b010
add edi, eax
add ebp, eax
add esi, eax
jmp 0x1003aff5
mov edx, dword [esp + 0x18]
test edx, edx
je 0x1003b010
mov ecx, ebp
sub ecx, esi
mov eax, esi
sub edi, esi
mov esi, edx
mov dl, byte [eax + ecx]
xor dl, byte [eax]
inc eax
dec esi
mov byte [eax + edi - 1], dl
jne 0x1003b003
pop edi
pop esi
pop ebp
ret
Function at 0x1003b020
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x1c]
push 0
xor bl, bl
call fcn.1000c6f0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x1003b067
test ecx, ecx
je 0x1003b052
lea eax, [ecx - 1]
test ecx, eax
jne 0x1003b052
and eax, esi
jmp 0x1003b05a
mov eax, esi
xor edx, edx
div ecx
mov eax, edx
neg eax
sbb eax, eax
inc eax
test eax, eax
je 0x1003b0f5
push 0
call fcn.1000c6f0
mov ecx, eax
add esp, 4
cmp ecx, 1
je 0x1003b098
test ecx, ecx
je 0x1003b087
lea eax, [ecx - 1]
test ecx, eax
jne 0x1003b087
and eax, ebp
jmp 0x1003b08f
mov eax, ebp
xor edx, edx
div ecx
mov eax, edx
neg eax
sbb eax, eax
inc eax
test eax, eax
je 0x1003b0f5
mov ecx, edi
shr ecx, 2
xor edx, edx
xor ebx, ebx
test ecx, ecx
je 0x1003b0c5
mov eax, ebp
sub esi, ebp
mov ebx, ecx
jmp 0x1003b0b0
mov edi, dword [esi + eax]
xor edi, dword [eax]
add eax, 4
or edx, edi
dec ecx
jne 0x1003b0b0
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x14]
lea eax, [ebx*4]
sub edi, eax
jne 0x1003b0dc
pop edi
pop esi
xor eax, eax
test edx, edx
pop ebp
sete al
pop ebx
ret
mov ebx, edx
shr ebx, 0x18
mov ecx, edx
shr ecx, 0x10
or bl, cl
mov ecx, edx
shr ecx, 8
or bl, cl
add esi, eax
add ebp, eax
or bl, dl
test edi, edi
je 0x1003b10b
mov eax, ebp
sub esi, ebp
lea ecx, [ecx]
mov dl, byte [eax + esi]
xor dl, byte [eax]
inc eax
or bl, dl
dec edi
jne 0x1003b100
pop edi
pop esi
xor eax, eax
test bl, bl
pop ebp
sete al
pop ebx
ret