joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004a0d0
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0
push 0x1013db6c
push dword [0x101447bc]
lea eax, [ebp - 0x10]
push eax
call sub.CRYPT32.dll_CryptProtectData
test eax, eax
je 0x1004a14c
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
push esi
mov esi, dword [ebp + 8]
add ecx, edx
push dword [ebp - 4]
push ecx
push edx
mov ecx, esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.10049440
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10004b50
push 0x10126738
lea eax, [ebp - 0x1c]
push eax
call fcn.10006a50
int3
Function at 0x1004a170
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e61e9
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
movlpd qword [ebp - 0x1c], xmm0
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x1c]
push eax
push 1
push 0
push 0
push 0x1013db6c
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x24]
push eax
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
je 0x1004a2ad
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
push dword [ebp - 0x10]
mov edi, dword [ebp + 8]
add eax, ecx
push eax
push ecx
mov ecx, edi
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.10049440
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 1
test ecx, ecx
je 0x1004a23e
nop dword [eax + eax]
mov byte [eax], 0
lea eax, [eax + 1]
sub ecx, 1
jne 0x1004a230
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [ebp - 0x10]
test esi, esi
je 0x1004a2ca
mov eax, dword [0x101447bc]
mov ecx, esi
mov dword [ebp - 4], 1
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004a286
test dx, dx
je 0x1004a282
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004a286
add eax, 4
add ecx, 4
test dx, dx
jne 0x1004a260
xor eax, eax
jmp 0x1004a28b
sbb eax, eax
or eax, 1
mov byte [ebp - 4], 0
push esi
test eax, eax
jne 0x1004a2e5
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x30]
call fcn.10004b50
push 0x10126738
lea eax, [ebp - 0x30]
push eax
call fcn.10006a50
push 0xcaa40001
lea ecx, [ebp - 0x3c]
call fcn.100043d0
push 0x1012ad98
lea eax, [ebp - 0x3c]
push eax
call fcn.10006a50
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0xcaa40001
lea ecx, [ebp - 0x48]
call fcn.100043d0
push 0x1012ad98
lea eax, [ebp - 0x48]
push eax
call fcn.10006a50
int3
Function at 0x1004a310
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e6239
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push esi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x14], 0
push 0xf0000000
push dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
mov byte [ebp - 4], 2
push dword [ebp + 0x10]
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1004a37e
call fcn.1003e850
test eax, eax
js 0x1004a47f
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x8004
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1004a3a5
call fcn.1003e850
test eax, eax
js 0x1004a49c
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], 0
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x20], 4
push eax
push 4
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x1004a3d9
call fcn.1003e850
test eax, eax
js 0x1004a4b9
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xd]
push eax
push dword [ebp - 0x18]
mov ecx, esi
call fcn.100495c0
push 0
push dword [0x1013db6c]
mov dword [ebp - 0x24], 1
push dword [0x1013db70]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1004a419
call fcn.1003e850
test eax, eax
js 0x1004a4d6
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
je 0x1004a439
push 0
push eax
push ecx
lea ecx, [ebp - 0x14]
call fcn.10049710
test eax, eax
js 0x1004a4f3
push 0
lea eax, [ebp - 0x18]
push eax
push dword [esi]
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
jne 0x1004a45d
call fcn.1003e850
test eax, eax
js 0x1004a510
lea ecx, [ebp - 0x14]
call fcn.10049650
lea ecx, [ebp - 0x1c]
call fcn.10049620
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x30]
call fcn.10004b50
push 0x10126738
lea eax, [ebp - 0x30]
push eax
call fcn.10006a50
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x30]
call fcn.10004b50
push 0x10126738
lea eax, [ebp - 0x30]
push eax
call fcn.10006a50
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x30]
call fcn.10004b50
push 0x10126738
lea eax, [ebp - 0x30]
push eax
call fcn.10006a50
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x30]
call fcn.10004b50
push 0x10126738
lea eax, [ebp - 0x30]
push eax
call fcn.10006a50
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x30]
call fcn.10004b50
push 0x10126738
lea eax, [ebp - 0x30]
push eax
call fcn.10006a50
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x30]
call fcn.10004b50
push 0x10126738
lea eax, [ebp - 0x30]
push eax
call fcn.10006a50
int3
Function at 0x1004f890
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
cmp dword [edi + 0x1c], 8
lea edx, [edi + 8]
mov ebx, dword [edx + 0x10]
mov dword [ebp - 4], ecx
jb 0x1004f8ab
mov edx, dword [edx]
xor ecx, ecx
mov esi, 0x811c9dc5
add ebx, ebx
je 0x1004f8c7
movzx eax, byte [ecx + edx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, ebx
jb 0x1004f8b6
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x18]
mov ecx, dword [edx + 0xc]
and eax, esi
lea esi, [eax*8]
mov eax, dword [ecx + esi]
add ecx, esi
cmp dword [ecx + 4], edi
jne 0x1004f900
cmp eax, edi
jne 0x1004f8f8
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [esi + ecx + 4], eax
jmp 0x1004f908
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1004f908
cmp eax, edi
jne 0x1004f90b
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
lea ecx, [edx + 4]
mov esi, dword [edi]
push edi
mov dword [eax], esi
mov edx, dword [edi]
mov eax, dword [edi + 4]
mov dword [edx + 4], eax
dec dword [ecx + 4]
call fcn.1004f650
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10053b50
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e7020
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.1003b700
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ebp - 4], 0
mov word [esi + 0xc], 0
mov ecx, dword [ecx]
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
movups xmm0, xmmword [ecx]
movups xmmword [esi + 0x10], xmm0
movq xmm0, qword [ecx + 0x10]
movq qword [esi + 0x20], xmm0
mov dword [ecx + 0x10], 0
mov dword [ecx + 0x14], 0xf
mov byte [ecx], 0
push 0
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 1
mov byte [esi + 0x28], 0
call fcn.100360c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100578e0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e7497
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov dword [ebp - 4], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
lea ecx, [edi + 0x38]
mov dword [edi + 0x30], 0
mov byte [edi + 0x34], 0
mov dword [ebp - 0x14], ecx
mov dword [ecx + 0x24], 0
mov eax, dword [ebp + 0x30]
mov byte [ebp - 4], 4
test eax, eax
je 0x100579a1
mov eax, dword [eax]
push ecx
mov esi, dword [eax]
mov ecx, esi
call dword [0x100f4524]
mov ecx, dword [ebp + 0x30]
call esi
mov dword [edi + 0x5c], eax
mov al, byte [ebp + 0x34]
lea ecx, [edi + 0x70]
mov byte [edi + 0x60], al
push 8
mov byte [ebp - 4], 5
mov byte [edi + 0x68], 8
call fcn.100360c0
mov ecx, dword [edi + 0x1c]
mov edx, dword [edi + 0x10]
mov byte [ebp - 4], 6
mov byte [ebp - 0xd], 1
test ecx, ecx
jns 0x100579e3
mov eax, ecx
neg eax
je 0x100579e3
mov eax, ecx
not eax
shr eax, 5
lea eax, [eax*4 + 4]
sub edx, eax
jmp 0x100579eb
mov eax, ecx
shr eax, 5
lea edx, [edx + eax*4]
lea eax, [ebp - 0xd]
and ecx, 0x1f
push eax
push 1
push ecx
push edx
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x10]
call fcn.10058b40
mov ebx, dword [ebp + 0x30]
test ebx, ebx
je 0x10057a26
mov esi, dword [ebx]
lea eax, [ebp + 0xc]
cmp ebx, eax
setne dl
mov esi, dword [esi + 0x10]
mov ecx, esi
movzx edx, dl
push edx
call dword [0x100f4524]
mov ecx, ebx
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x30
Function at 0x10062ae0
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e8220
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp + 0xc]
mov edi, dword [ebx + 0xc]
mov esi, dword [ebx + 4]
mov dword [ebp - 4], 0
mov ecx, dword [eax]
mov eax, ecx
shr eax, 8
movzx edx, al
movzx eax, cl
xor eax, 0x811c9dc5
mov dword [ebp - 0x14], ecx
imul eax, eax, 0x1000193
xor edx, eax
imul ecx, edx, 0x1000193
mov edx, dword [ebp - 0x14]
mov eax, edx
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
shl ecx, 3
mov dword [ebp - 0x14], ecx
mov eax, dword [edi + ecx]
cmp esi, eax
je 0x10062bc9
mov esi, dword [edi + ecx + 4]
mov esi, dword [esi]
nop dword [eax + eax]
cmp esi, eax
je 0x10062bc9
mov esi, dword [esi + 4]
cmp edx, dword [esi + 8]
jne 0x10062b80
mov edx, dword [ebp + 0x10]
push 0xc
push edx
mov ecx, dword [edx + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov ecx, dword [edx]
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
dec dword [ebx + 8]
call fcn.10005291
mov eax, dword [ebp + 8]
add esp, 8
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x18], edi
mov eax, dword [edi]
cmp esi, eax
je 0x10062bf9
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x14]
mov dword [edi + 4], edx
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx]
cmp eax, dword [ebx + 4]
jne 0x10062c11
mov dword [ecx], edi
mov eax, dword [ebx + 0xc]
mov ecx, dword [ebp - 0x14]
mov dword [eax + ecx + 4], edi
jmp 0x10062c34
cmp eax, esi
jne 0x10062c19
mov dword [ecx], edi
jmp 0x10062c34
mov eax, dword [ecx + 4]
mov eax, dword [eax]
mov dword [ecx + 4], eax
cmp eax, edi
je 0x10062c34
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1006a260
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10062c90
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e8240
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x20], ebx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov ecx, dword [esi]
mov eax, ecx
shr eax, 8
movzx edx, al
movzx eax, cl
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
xor edx, eax
imul ecx, edx, 0x1000193
mov edx, dword [esi]
mov eax, edx
mov esi, dword [ebx + 0xc]
shr eax, 0x10
movzx eax, al
xor ecx, eax
mov eax, edx
imul ecx, ecx, 0x1000193
shr eax, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [ebx + 0x18]
and ecx, eax
shl ecx, 3
add esi, ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebx + 4]
mov eax, dword [esi]
cmp eax, ecx
jne 0x10062d26
mov esi, ecx
jmp 0x10062d30
mov esi, dword [esi + 4]
mov esi, dword [esi]
nop dword [eax + eax]
cmp esi, eax
je 0x10062d59
mov esi, dword [esi + 4]
cmp edx, dword [esi + 8]
jne 0x10062d30
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov byte [eax + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx]
push dword [ebp + 0xc]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], eax
mov ecx, dword [eax + 4]
push ecx
mov dword [ebp - 0x1c], ecx
lea ecx, [ebx + 4]
push eax
call fcn.1002db60
mov edx, eax
mov ecx, 0x15555554
mov eax, dword [ebx + 8]
sub ecx, eax
cmp ecx, 1
jb 0x10062e5c
inc eax
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x18]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x1c]
mov dword [eax], edx
mov ecx, dword [ebx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x1c], edi
mov eax, dword [edi]
cmp esi, eax
je 0x10062dce
mov ecx, dword [edi + 4]
mov dword [ecx], eax
mov ecx, dword [eax + 4]
mov dword [ecx], esi
mov ecx, dword [esi + 4]
mov dword [ecx], edi
mov ecx, dword [eax + 4]
mov edx, dword [esi + 4]
mov dword [esi + 4], ecx
mov ecx, dword [edi + 4]
mov dword [eax + 4], ecx
mov dword [edi + 4], edx
mov ecx, dword [ebx + 4]
mov edx, dword [ebp - 0x14]
add edx, dword [ebx + 0xc]
mov eax, dword [edx]
cmp eax, ecx
jne 0x10062de8
mov ecx, dword [ebp - 0x14]
mov dword [edx], edi
mov eax, dword [ebx + 0xc]
mov dword [ecx + eax + 4], edi
jmp 0x10062e0b
cmp eax, esi
jne 0x10062df0
mov dword [edx], edi
jmp 0x10062e0b
mov eax, dword [edx + 4]
mov eax, dword [eax]
mov dword [edx + 4], eax
cmp eax, edi
je 0x10062e0b
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebx + 0xc]
mov eax, dword [ecx + 4]
mov eax, dword [eax + 4]
mov dword [ecx + 4], eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1006a260
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
push str.list_T__too_long
call fcn.100be607
int3
Function at 0x1006a320
Capabilities:
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov ebx, dword [edi + 8]
movzx eax, bl
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
mov eax, ebx
shr eax, 8
movzx eax, al
xor edx, eax
mov eax, ebx
shr eax, 0x10
imul ecx, edx, 0x1000193
mov edx, dword [ebp - 4]
movzx eax, al
shr ebx, 0x18
xor ecx, eax
imul eax, ecx, 0x1000193
mov ecx, dword [edx + 0x18]
xor eax, ebx
imul eax, eax, 0x1000193
and ecx, eax
lea esi, [ecx*8]
mov ecx, dword [edx + 0xc]
add ecx, esi
mov eax, dword [ecx]
cmp dword [ecx + 4], edi
jne 0x1006a3a1
cmp eax, edi
jne 0x1006a399
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [edx + 0xc]
mov eax, dword [edx + 4]
mov dword [ecx + esi + 4], eax
jmp 0x1006a3a9
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
jmp 0x1006a3a9
cmp eax, edi
jne 0x1006a3ac
mov eax, dword [edi]
mov dword [ecx], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
mov esi, dword [edi]
push 0xc
push edi
mov dword [eax], esi
mov ecx, dword [edi]
mov eax, dword [edi + 4]
mov dword [ecx + 4], eax
dec dword [edx + 8]
call fcn.10005291
mov eax, dword [ebp + 8]
add esp, 8
pop edi
mov dword [eax], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10077cc0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eaca8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
mov edi, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x18], edi
call fcn.10004a50
add esp, 4
mov byte [ebp - 0xd], al
mov dword [ebp - 4], 0
call fcn.10002710
mov ebx, eax
test ebx, ebx
je 0x10077de2
mov eax, dword [ebx]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x100f4524]
mov ecx, ebx
call esi
add eax, 0x10
mov dword [ebp - 0x14], eax
cmp byte [ebp - 0xd], 0
mov dword [ebp - 4], 1
je 0x10077d54
push dword [ebp + 8]
lea eax, [ebp - 0x14]
mov ebx, 0xcaa50002
push edi
push edi
push 0x86
push eax
call fcn.10034160
add esp, 0x14
jmp 0x10077d80
mov edx, dword [ebp + 8]
test edx, edx
jne 0x10077d5f
xor ecx, ecx
jmp 0x10077d73
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10077d64
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x14]
call fcn.10003530
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x20], esi
mov eax, dword [eax + 4]
test eax, eax
je 0x10077daa
push 0
lea ecx, [ebp - 0x20]
push ecx
push 0
push 1
push 0
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10077dce
mov edi, dword [esi]
push esi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f4524]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push 0x80004005
call fcn.10002de0
int3
Function at 0x10079340
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100eafc7
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [edi], vtable.WebRequest.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
lea ecx, [edi + 0x10]
mov dword [ebp - 4], 0
push 0x100f6abe
call fcn.100576a0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
lea ecx, [edi + 0x20]
mov byte [ebp - 4], 2
push 0x100f6abe
call fcn.1002e920
mov dword [edi + 0x24], 0
lea ecx, [edi + 0x30]
mov byte [ebp - 4], 4
mov dword [edi + 0x28], 0
call fcn.10048f60
mov al, byte [ebp + 8]
mov byte [edi + 0xc], al
mov al, byte [ebp + 0xc]
mov byte [edi + 0xd], al
xor eax, eax
mov byte [edi + 0x3c], 1
mov word [edi + 0x2c], ax
mov ebx, dword [edi + 0x24]
mov dword [edi + 0x24], eax
test ebx, ebx
je 0x10079430
mov esi, dword [ebx]
push dword [esi + 4]
mov ecx, ebx
mov byte [ebp - 4], 5
call fcn.10033410
mov eax, dword [ebx]
push 0x18
mov byte [ebp - 4], 4
mov dword [eax + 4], esi
mov eax, dword [ebx]
mov dword [eax], esi
mov eax, dword [ebx]
mov dword [eax + 8], esi
mov dword [ebx + 4], 0
push dword [ebx]
call fcn.10005291
push 8
push ebx
call fcn.10005291
add esp, 0x10
mov ebx, dword [edi + 8]
mov dword [edi + 8], 0
test ebx, ebx
je 0x10079477
mov esi, dword [ebx]
push dword [esi + 4]
mov ecx, ebx
mov byte [ebp - 4], 6
call fcn.10033410
mov eax, dword [ebx]
push 0x18
mov dword [eax + 4], esi
mov eax, dword [ebx]
mov dword [eax], esi
mov eax, dword [ebx]
mov dword [eax + 8], esi
mov dword [ebx + 4], 0
push dword [ebx]
call fcn.10005291
push 8
push ebx
call fcn.10005291
add esp, 0x10
mov eax, edi
mov byte [edi + 0x3d], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1007fb50
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ebcd2
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1013d0b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x10], 0
je 0x1007fbac
mov dword [esi], 0x1010a7bc
mov dword [esi + 0x10], 0x1010a7c4
mov dword [esi + 0x68], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
push 0
push 0
lea edi, [esi + 0x18]
mov ecx, esi
push edi
call fcn.1007f820
mov eax, dword [esi + 0x10]
mov eax, dword [eax + 4]
mov dword [esi + eax + 0x10], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [esi + 0x10]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + esi + 0xc], eax
mov eax, dword [esi]
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + esi - 4], eax
mov eax, dword [esi]
push 8
mov dword [ebp - 4], 4
mov eax, dword [eax + 4]
mov dword [esi + eax], vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ecx + esi - 4], eax
mov dword [edi], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.10005973
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1007fc36
push 1
mov byte [ebp - 4], 5
call fcn.100bf564
add esp, 4
mov dword [ebx + 4], eax
jmp 0x1007fc38
xor ebx, ebx
lea eax, [edi + 4]
mov dword [edi + 0x34], ebx
mov dword [edi + 0xc], eax
lea ecx, [edi + 8]
mov ebx, dword [ebp + 8]
lea eax, [edi + 0x14]
mov dword [edi + 0x1c], eax
lea eax, [edi + 0x18]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [edi + 0x2c], eax
lea eax, [edi + 0x28]
mov dword [edi + 0x30], eax
mov dword [edi + 0x10], ecx
mov dword [ecx], 0
mov ecx, ebx
mov eax, dword [edi + 0x20]
not ecx
and ecx, 1
shl ecx, 2
mov edx, ecx
mov dword [eax], 0
or edx, 2
mov eax, dword [edi + 0x30]
mov dword [eax], 0
mov eax, dword [edi + 0xc]
mov dword [eax], 0
mov eax, dword [edi + 0x1c]
mov dword [eax], 0
mov eax, dword [edi + 0x2c]
mov dword [eax], 0
mov eax, ebx
and al, 2
mov dword [edi], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, ebx
mov dword [edi + 0x38], 0
cmovne edx, ecx
mov ecx, edx
or ecx, 8
and al, 8
cmove ecx, edx
mov eax, ecx
or eax, 0x10
and bl, 4
cmove eax, ecx
mov dword [edi + 0x3c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8