joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ecf8
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x10081730]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 4
mov eax, 0x1005c144
call fcn.10031c17
mov edi, dword [ebp + 0x230]
xor esi, esi
push esi
lea ecx, [ebp]
mov dword [ebp - 0x10], esi
mov dword [ebp + 0x18], 7
call fcn.100011bf
push 0x206
lea eax, [ebp + 0x1e]
push esi
push eax
mov dword [ebp - 4], esi
mov word [ebp + 0x1c], si
call fcn.10031d30
add esp, 0xc
call fcn.10008250
cmp eax, 1
jne 0x1001ed69
push str.C:kingsi_Defense3IDFSEXE.exe
lea ecx, [ebp]
call fcn.10001664
jmp 0x1001ed8d
push 0x208
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp]
push str._sI_Defense3IDFSEXE.exe
push eax
call fcn.10007397
add esp, 0xc
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x1001ed99
lea eax, [ebp + 4]
push esi
push eax
call fcn.10032ebb
test eax, eax
pop ecx
pop ecx
mov ecx, edi
jne 0x1001edaf
push 0x10071690
jmp 0x1001edb4
push 0x10071698
call fcn.10001681
push esi
push 1
lea ecx, [ebp]
call fcn.1000131a
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.10031c08
add ebp, 0x228
leave
ret
Function at 0x1001f155
Capabilities:
Get file version info

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x10081730]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 0x10
mov eax, 0x1005c219
call fcn.10031c17
mov edi, dword [ebp + 0x230]
xor esi, esi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
push 0x206
lea eax, [ebp + 0x1e]
push esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
mov word [ebp + 0x1c], si
call fcn.10031d30
add esp, 0xc
cmp dword [ebp + 0x248], esi
je 0x1001f1c3
cmp dword [ebp + 0x24c], 8
mov eax, dword [ebp + 0x238]
jae 0x1001f1c0
lea eax, [ebp + 0x238]
push eax
jmp 0x1001f1c8
push 0x10071df0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x104
lea ecx, [ebp + 0x1c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x1c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
cmp ebx, esi
jne 0x1001f20e
push esi
mov ecx, edi
call fcn.10001681
push esi
push 1
lea ecx, [ebp + 0x234]
call fcn.1000131a
mov eax, edi
jmp 0x1001f2bd
push ebx
call fcn.1003144f
pop ecx
mov edi, eax
push edi
push ebx
push dword [ebp - 0x18]
lea eax, [ebp + 0x1c]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
cmp eax, esi
jne 0x1001f23b
push edi
call fcn.100336aa
pop ecx
mov ecx, dword [ebp - 0x10]
push esi
call fcn.10001681
jmp 0x1001f2ac
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x100606f0
push edi
call sub.VERSION.dll_VerQueryValueW
push esi
lea ecx, [ebp]
mov dword [ebp + 0x18], 7
call fcn.100011bf
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
lea eax, [ebp]
push str._04d._02d._02d._02d
push eax
mov byte [ebp - 4], 1
call fcn.10007397
add esp, 0x18
cmp edi, esi
je 0x1001f295
push edi
call fcn.100336aa
pop ecx
mov ecx, dword [ebp - 0x10]
lea eax, [ebp]
push eax
call fcn.1000163e
push esi
push 1
lea ecx, [ebp]
call fcn.1000131a
push esi
push 1
lea ecx, [ebp + 0x234]
call fcn.1000131a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.10031c08
add ebp, 0x228
leave
ret
Function at 0x1001fc9a
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0xf8], ebx
jne 0x1001fd51
push edi
push dword [esp + 0x10]
lea ecx, [esi + 0x8c]
call fcn.10001664
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
push esi
push ebx
push 0x1001fc5b
mov dword [esi + 0xf0], eax
mov dword [esi + 0xf4], edi
call fcn.100359d8
add esp, 0xc
cmp edi, ebx
mov dword [esi + 0xf8], eax
jne 0x1001fced
push 0xffffffffffffffff
jmp 0x1001fcee
push edi
push dword [esi + 0xc8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x1001fd42
push ebx
push dword [esi + 0xf8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0x44]
cmp eax, ebx
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [esi + 0x84], 1
je 0x1001fd28
push eax
call edi
mov dword [esi + 0x44], ebx
mov eax, dword [esi + 0x40]
cmp eax, ebx
je 0x1001fd35
push eax
call edi
mov dword [esi + 0x40], ebx
mov eax, dword [esi + 0x3c]
cmp eax, ebx
je 0x1001fd42
push eax
call edi
mov dword [esi + 0x3c], ebx
cmp dword [esi + 0xf8], ebx
pop edi
je 0x1001fd51
mov dword [esi + 0xf8], ebx
xor eax, eax
pop esi
inc eax
pop ebx
ret 0xc

Function at 0x1001fdb9
Capabilities:
Get routing table

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push 0x3c
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0x3c
mov esi, eax
push 0
push esi
call fcn.10031d30
and dword [ebp - 4], 0
add esp, 0xc
push 0xf
pop ebx
push 1
lea eax, [ebp - 4]
push eax
push esi
call sub.IPHLPAPI.DLL_GetIpForwardTable
test eax, eax
jne 0x1001fdfa
xor ebx, ebx
jmp 0x1001fe38
cmp eax, 0x7a
je 0x1001fe06
cmp eax, 0xe8
jne 0x1001fe38
mov eax, dword [ebp - 4]
xor ecx, ecx
push 0x3c
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1003144f
mov esi, eax
test esi, esi
pop ecx
jne 0x1001fe26
xor ebx, ebx
push 1
lea eax, [ebp - 4]
push eax
push esi
call sub.IPHLPAPI.DLL_GetIpForwardTable
test eax, eax
je 0x1001fe38
xor esi, esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x1002114e
Capabilities:
Reference kornet dns server

Disassembly:
push 0x70
mov eax, 0x1005c47f
call fcn.10031c17
lea eax, [ebp - 0x7c]
push eax
push 0
push str.168.126.63.1
call dword [sym.imp.WS2_32.dll_inet_addr]
push eax
call sub.IPHLPAPI.DLL_GetBestRoute
or dword [ebp - 4], 0xffffffff
test eax, eax
jne 0x100211cf
push dword [ebp - 0x70]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000220b
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 4], 2
call fcn.100076d4
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push 0
push eax
mov byte [ebp - 4], 3
call fcn.10001537
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.1000131a
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10001c21
xor eax, eax
inc eax
jmp 0x100211d1
xor eax, eax
call fcn.10031cef
ret
Function at 0x1002130d
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push 0x1d0
mov eax, 0x1005c4fd
call fcn.10031c80
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1dc]
call fcn.10001681
and dword [ebp - 4], 0
lea eax, [ebp - 0x1dc]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.100076f1
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp - 0x1dc]
call fcn.1000131a
xor eax, eax
mov byte [ebp - 0x1c0], 0
lea edi, [ebp - 0x1bf]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1bc]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1002139f
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x10021381
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10021399
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c0], eax
call dword [sym.imp.WS2_32.dll_WSACleanup]
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10001c21
mov eax, dword [ebp - 0x1c0]
call fcn.10031d03
ret

Function at 0x100213b7
Capabilities:
Get session user name

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x10081730]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x3c
mov eax, 0x1005c535
call fcn.10031c17
xor esi, esi
push 0x206
lea eax, [ebp + 2]
push esi
push eax
mov dword [ebp - 0x10], 0x104
mov word [ebp], si
call fcn.10031d30
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x10021462
push str.SYSTEM
lea ecx, [ebp - 0x48]
call fcn.10001681
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], esi
call fcn.10001681
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 1
call fcn.1000707e
pop ecx
mov bl, al
pop ecx
dec bl
neg bl
push esi
sbb bl, bl
push 1
lea ecx, [ebp - 0x2c]
inc bl
call fcn.1000131a
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.1000131a
xor eax, eax
test bl, bl
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10031c08
add ebp, 0x20c
leave
ret
Function at 0x100218d5
Capabilities:
Get session information

Disassembly:
push 0x84
mov eax, 0x1005c68f
call fcn.10031c80
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x68], ebx
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x30], 7
call fcn.100011bf
xor esi, esi
inc esi
mov ecx, edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x54], ebx
call fcn.10001dc7
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x60]
push eax
push esi
push ebx
push ebx
mov dword [ebp - 0x68], esi
call sub.WTSAPI32.dll_WTSEnumerateSessionsW
cmp dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], ebx
jbe 0x10021a50
mov dword [ebp - 0x58], ebx
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x58]
lea esi, [ecx + eax]
lea edi, [ebp - 0x74]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x64]
push eax
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x50]
push eax
push 0xe
movsd dword es:[edi], dword [esi]
push dword [ebp - 0x74]
mov dword [ebp - 0x64], 0x104
push ebx
mov dword [ebp - 0x50], ebx
call sub.WTSAPI32.dll_WTSQuerySessionInformationW
test eax, eax
je 0x10021a3a
mov esi, dword [ebp - 0x50]
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 7
call fcn.100011bf
mov eax, dword [esi]
sub eax, ebx
mov byte [ebp - 4], 2
je 0x100219a8
dec eax
dec eax
je 0x100219a1
sub eax, 4
je 0x1002199a
sub eax, 0xb
jne 0x100219b5
push str.AF_NETBIOS
jmp 0x100219ad
push str.AF_IPX
jmp 0x100219ad
push str.AF_INET
jmp 0x100219ad
push str.AF_UNSPEC
lea ecx, [ebp - 0x2c]
call fcn.10001664
push str.AF_INET
lea ecx, [ebp - 0x90]
call fcn.10001681
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 3
call fcn.1000707e
pop ecx
mov bl, al
pop ecx
dec bl
neg bl
push 0
sbb bl, bl
push 1
lea ecx, [ebp - 0x90]
inc bl
mov byte [ebp - 4], 2
call fcn.1000131a
test bl, bl
je 0x10021a28
movzx eax, byte [esi + 9]
push eax
movzx eax, byte [esi + 8]
push eax
movzx eax, byte [esi + 7]
push eax
movzx eax, byte [esi + 6]
push eax
push str._u._u._u._u
push dword [ebp - 0x5c]
call fcn.10007397
add esp, 0x18
push dword [ebp - 0x50]
call sub.WTSAPI32.dll_WTSFreeMemory
push 0
push 1
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.1000131a
xor ebx, ebx
inc dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
add dword [ebp - 0x58], 0xc
cmp eax, dword [ebp - 0x54]
jb 0x10021934
xor esi, esi
inc esi
push ebx
push esi
lea ecx, [ebp - 0x48]
call fcn.1000131a
mov eax, dword [ebp - 0x5c]
call fcn.10031d03
ret
Function at 0x100224a0
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x10081730]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 0x5c
mov eax, 0x1005c801
call fcn.10031c17
mov eax, dword [ebp + 0x234]
mov ebx, dword [ebp + 0x230]
push 0x10
mov dword [ebp - 0x14], eax
xor esi, esi
lea eax, [ebp - 0x24]
push esi
push eax
call fcn.10031d30
push 0x44
pop edi
push edi
lea eax, [ebp - 0x68]
push esi
push eax
call fcn.10031d30
add esp, 0x18
mov ecx, ebx
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x3c], 1
mov word [ebp - 0x38], si
mov dword [ebp - 0x10], esi
call fcn.10008a6d
test eax, eax
jbe 0x100225d8
mov edi, dword [ebp - 0x14]
push esi
lea ecx, [ebp]
mov dword [ebp + 0x18], 7
call fcn.100011bf
cmp dword [edi + 0x18], 8
mov dword [ebp - 4], esi
jb 0x10022535
lea eax, [edi + 4]
mov edi, dword [eax]
jmp 0x10022538
add edi, 4
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.1000a059
cmp dword [eax + 0x18], 8
jb 0x1002254d
mov eax, dword [eax + 4]
jmp 0x10022550
add eax, 4
push edi
push eax
lea eax, [ebp]
push str.route_add__s__s
push eax
call fcn.10007397
push 0x206
lea eax, [ebp + 0x1e]
push esi
push eax
mov word [ebp + 0x1c], si
call fcn.10031d30
mov eax, dword [ebp + 4]
add esp, 0x1c
cmp dword [ebp + 0x18], 8
jae 0x10022582
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.1003405d
pop ecx
pop ecx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push dword [ebp + 0x238]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea ecx, [ebp]
call fcn.1000131a
inc dword [ebp - 0x10]
mov ecx, ebx
call fcn.10008a6d
cmp dword [ebp - 0x10], eax
jb 0x10022512
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.10031c08
add ebp, 0x228
leave
ret
Function at 0x100225fd
Capabilities:
Create process on windows

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x10081730]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 0x58
mov eax, 0x1005c831
call fcn.10031c17
mov edi, dword [ebp + 0x230]
push 0x10
xor esi, esi
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.10031d30
push 0x44
pop ebx
push ebx
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.10031d30
add esp, 0x18
mov dword [ebp - 0x64], ebx
mov ecx, edi
mov dword [ebp - 0x38], 1
mov word [ebp - 0x34], si
xor ebx, ebx
mov dword [ebp - 0x10], esi
call fcn.10008a6d
test eax, eax
jbe 0x1002270d
push esi
lea ecx, [ebp]
mov dword [ebp + 0x18], 7
call fcn.100011bf
push dword [ebp - 0x10]
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.1000a059
cmp dword [eax + 0x18], 8
jb 0x10022690
mov eax, dword [eax + 4]
jmp 0x10022693
add eax, 4
push eax
lea eax, [ebp]
push str.route_delete__s
push eax
call fcn.10007397
push 0x206
lea eax, [ebp + 0x1e]
push esi
push eax
mov word [ebp + 0x1c], si
call fcn.10031d30
mov eax, dword [ebp + 4]
add esp, 0x18
cmp dword [ebp + 0x18], 8
jae 0x100226c4
lea eax, [ebp + 4]
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.1003405d
pop ecx
pop ecx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea ecx, [ebp]
mov ebx, eax
call fcn.1000131a
inc dword [ebp - 0x10]
mov ecx, edi
call fcn.10008a6d
cmp dword [ebp - 0x10], eax
jb 0x10022668
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.10031c08
add ebp, 0x228
leave
ret
Function at 0x10023f8f
Capabilities:
Get mac address on windows

Disassembly:
push ebp
sub esp, 0x70
lea ebp, [esp - 4]
mov eax, dword [0x10081730]
xor eax, ebp
mov dword [ebp + 0x70], eax
push 0x54
mov eax, 0x1005cb89
call fcn.10031c17
mov eax, dword [ebp + 0x7c]
xor ebx, ebx
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x20], ebx
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x28], ebx
xor edi, edi
inc edi
lea eax, [ebp + 0x1c]
push edi
push eax
mov dword [ebp - 4], ebx
call fcn.10023d50
cmp eax, edi
pop ecx
pop ecx
je 0x10023ffd
xor edi, edi
lea ecx, [ebp + 0x1c]
call fcn.1000a6fe
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
call fcn.10031c08
add ebp, 0x74
leave
ret
lea ecx, [ebp]
call fcn.10009166
lea eax, [ebp + 0x2c]
push eax
push ebx
mov byte [ebp - 4], 1
mov dword [ebp + 0x2c], ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x10024154
mov dword [ebp + 0x30], ebx
mov dword [ebp + 0x34], ebx
push fcn.100320a5
push dword [ebp + 0x2c]
mov byte [ebp - 4], 2
call fcn.10032182
pop ecx
push eax
lea ecx, [ebp + 0x30]
call fcn.10020930
mov esi, dword [ebp + 0x30]
lea eax, [ebp + 0x2c]
push eax
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x10024144
jmp 0x1002413c
push ebx
lea ecx, [ebp + 0x54]
mov dword [ebp + 0x6c], 7
call fcn.100011bf
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
lea eax, [ebp + 0x54]
push str._02X__02X__02X__02X__02X__02X
push eax
mov byte [ebp - 4], 3
call fcn.10007397
add esp, 0x20
lea eax, [esi + 0x1d8]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000220b
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0x38]
push eax
mov byte [ebp - 4], 4
call fcn.100076d4
pop ecx
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.10001c21
push 0x10070c74
lea ecx, [ebp + 0x38]
call fcn.10020629
test eax, eax
jne 0x100240fd
push 0x100604d0
lea ecx, [ebp + 0x38]
call fcn.10001664
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x54]
push eax
lea ecx, [ebp - 0x60]
call fcn.100093d3
push eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 7
call fcn.1000aab1
lea ecx, [ebp - 0x60]
call fcn.1001c934
push ebx
push edi
lea ecx, [ebp + 0x38]
call fcn.1000131a
push ebx
push edi
lea ecx, [ebp + 0x54]
call fcn.1000131a
mov esi, dword [esi]
cmp esi, ebx
jne 0x1002405a
mov ecx, dword [ebp + 0x34]
cmp ecx, ebx
mov byte [ebp - 4], 1
je 0x10024154
call fcn.100202f8
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x20]
lea ecx, [ebp + 0x30]
call fcn.1000578a
jmp 0x10024187
lea ecx, [ebp + 0x30]
call fcn.10001a05
push eax
lea ecx, [ebp]
call fcn.1000b3a3
mov ecx, dword [ebp + 0x18]
push eax
call fcn.1000b7d3
lea ecx, [ebp + 0x30]
call fcn.10008b36
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x24]
lea ecx, [ebp + 0x10]
call fcn.1000578a
lea eax, [ebp + 0x30]
push eax
lea ecx, [ebp + 0x10]
call fcn.10008b0f
test al, al
je 0x10024165
lea ecx, [ebp]
mov byte [ebp - 4], bl
call fcn.1000b230
jmp 0x10023fd6
Function at 0x10024798
Capabilities:
Create thread
Terminate thread

Disassembly:
push 0xa4
mov eax, 0x1005ccb1
call fcn.10031cb6
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xb0], esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0xa8]
call fcn.10020a27
push edi
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 2
call fcn.10001664
push ebx
lea ecx, [ebp - 0x8c]
call fcn.10001664
mov eax, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
push 0xffffffffffffffff
mov dword [ebp - 0x6c], eax
push esi
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x70], edi
call fcn.10001537
push 0xffffffffffffffff
push esi
lea eax, [ebp + 0x38]
push eax
lea ecx, [ebp - 0x4c]
call fcn.10001537
lea ecx, [ebp - 0x30]
call fcn.1000939a
push esi
push esi
lea eax, [ebp - 0xa8]
push eax
push 0x100241b6
push esi
push esi
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
push edi
push ebx
mov dword [ebp - 0xb0], ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1002489f
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 0xac]
push 0x100604d0
call fcn.10001681
jmp 0x100248c0
cmp ebx, esi
mov dword [ebp - 4], 2
je 0x100248b1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xac]
lea eax, [ebp - 0x30]
push eax
call fcn.1000163e
lea ecx, [ebp - 0xa8]
call fcn.10020a53
push esi
push 1
lea ecx, [ebp + 0x1c]
call fcn.1000131a
push esi
push 1
lea ecx, [ebp + 0x38]
call fcn.1000131a
mov eax, dword [ebp - 0xac]
call fcn.10031d12
ret

Function at 0x10024bc0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
lea eax, [esp + 8]
push eax
push dword [esp + 8]
push 0
push 1
push 0
push dword [ecx + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
neg eax
sbb al, al
inc al
ret 8
Function at 0x100253d9
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push 0x44
mov eax, 0x1005cdb5
call fcn.10031c80
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x50]
push esi
push eax
mov dword [ebp - 0x34], ecx
call fcn.10007674
pop ecx
pop ecx
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x50]
call fcn.1000131a
mov eax, dword [esi + 0x14]
cmp eax, edi
jbe 0x100254bc
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x30], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1003144f
mov ebx, eax
mov eax, dword [ebp - 0x30]
add eax, eax
push eax
push edi
push ebx
call fcn.10031d30
mov eax, dword [ebp - 0x30]
add eax, eax
add esp, 0x10
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x30], eax
jb 0x1002544b
mov ecx, dword [esi + 4]
jmp 0x1002544e
lea ecx, [esi + 4]
push eax
push ecx
push ebx
call fcn.100329c0
add esp, 0xc
push dword [ebp - 0x30]
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x34]
push ebx
push edi
push 1
push edi
push dword [eax + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x10025479
xor al, al
jmp 0x100254be
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 7
call fcn.100011bf
mov ecx, dword [ebp - 0x34]
mov eax, dword [ecx]
lea edx, [ebp - 0x2c]
push edx
push dword [ebp - 0x30]
mov dword [ebp - 4], edi
push ebx
call dword [eax + 0x14]
push ebx
call fcn.100336aa
pop ecx
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x2c]
push eax
mov ecx, esi
call fcn.10001537
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.1000131a
mov al, 1
call fcn.10031d03
ret 8
Function at 0x100257fe
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0xf0000000
push 1
push 0x10072380
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x10025829
xor eax, eax
jmp 0x10025904
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x8003
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
push esi
jne 0x1002584d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x10025822
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push dword [ebp + 0x14]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x10025873
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
jmp 0x10025842
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 8]
push 0x6801
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x10025898
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x10025867
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], esi
push dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
call fcn.100329c0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
push esi
push 1
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
push dword [ebp - 0xc]
jne 0x100258eb
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x10025903
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x10]
mov dword [edi], eax
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 0x10