joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5786d1
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x5b0ec8
call fcn.0055d388
sub esp, 0x198
mov eax, dword [0x632930]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, ebp
push 0x57656c
mov ecx, 0x7d94b8
mov dword [ebp - 0x10], eax
call fcn.005771f6
mov edi, eax
xor ebx, ebx
cmp dword [edi + 0xc], ebx
jne 0x578735
cmp esi, ebx
jne 0x578713
lea esi, [ebp - 0x1a0]
push esi
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, ebx
jne 0x578767
cmp byte [esi], 1
jne 0x578761
cmp byte [esi + 1], 1
jne 0x578761
mov dword [edi + 0xc], 0x57869e
call fcn.00575cde
mov esi, eax
cmp dword [esi + 0x30], ebx
jne 0x578774
push 0x1c
call fcn.0056c38c
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x57876b
push 0xa
call fcn.0056c280
jmp 0x57876d
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x5787d7
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x30], eax
cmp dword [esi + 0x34], ebx
jne 0x5787a6
push 0x1c
call fcn.0056c38c
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 1
je 0x57879d
push 0xa
call fcn.0056c280
jmp 0x57879f
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi + 0x34], eax
cmp dword [esi + 0x38], ebx
jne 0x5787d4
push 0x1c
call fcn.0056c38c
pop ecx
mov ecx, eax
mov dword [ebp - 0x1a4], ecx
cmp ecx, ebx
mov dword [ebp - 4], 2
je 0x5787cf
push 0xa
call fcn.0056bdc8
jmp 0x5787d1
xor eax, eax
mov dword [esi + 0x38], eax
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.0055d2e5
leave
ret 4
Function at 0x412565
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004123e4

Function at 0x41695c
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004162ca

Function at 0x416967
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00416505

Function at 0x414ab0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.camzt
lea edi, [esi - 0x10000]
push edi
jmp 0x414aca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414ad1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414ac0
mov eax, 1
add ebx, ebx
jne 0x414ae3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414ad8
jne 0x414af4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414ad8
xor ecx, ecx
sub eax, 3
jb 0x414b08
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414b7a
mov ebp, eax
add ebx, ebx
jne 0x414b13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414b20
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414b44
inc ecx
add ebx, ebx
jne 0x414b30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414b25
jne 0x414b41
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b25
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414b64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414b55
jmp 0x414ac6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414b64
add edi, ecx
jmp 0x414ac6
pop esi
mov edi, esi
mov ecx, 2
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414b82
cmp byte [edi], 5
jne 0x414b82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414b87
lea edi, [esi + 0x12000]
mov eax, dword [edi]
or eax, eax
je 0x414bff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x19bb8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19bf4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x414bb4
mov ecx, edi
jns 0x414be3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19bfc]
or eax, eax
je 0x414bf9
mov dword [ebx], eax
add ebx, 4
jmp 0x414bd1
call dword [esi + 0x19bf8]
mov ebp, dword [esi + 0x19c00]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x414c33
sub esp, 0xffffff80
jmp 0x401134
Function at 0x4041b0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x41812b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x41e330]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004064d0
push 4
mov dword [esp + 0x20], 0
call fcn.00406ee2
mov edi, eax
add esp, 4
test edi, edi
je 0x40422e
call fcn.0040613c
mov dword [edi], eax
call fcn.00405f6a
push 0
lea ecx, [esp + 0x14]
mov ebx, eax
call fcn.0040628c
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x404223
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0x10]
call fcn.004062b4
jmp 0x404230
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x406880
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41e330]
jne 0x40688a
repz ret
jmp fcn.0040a5db

Function at 0x413612
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040be9e
and dword [ebp - 4], 0
cmp dword [0x420310], 0
mov ebx, eax
jne 0x4136c3
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413774
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41b438
push edi
call esi
test eax, eax
je 0x413774
push eax
call fcn.0040be2c
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x420310], eax
call esi
push eax
call fcn.0040be2c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x420314], eax
call esi
push eax
call fcn.0040be2c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x420318], eax
call esi
push eax
call fcn.0040be2c
pop ecx
mov dword [0x420320], eax
test eax, eax
je 0x4136c3
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040be2c
pop ecx
mov dword [0x42031c], eax
mov eax, dword [0x42031c]
cmp eax, ebx
je 0x41371b
cmp dword [0x420320], ebx
je 0x41371b
push eax
call fcn.0040bea7
push dword [0x420320]
mov esi, eax
call fcn.0040bea7
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41371b
test edi, edi
je 0x41371b
call esi
test eax, eax
je 0x413712
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413712
test byte [ebp - 0xc], 1
jne 0x41371b
or dword [ebp + 0x10], 0x200000
jmp 0x413754
mov eax, dword [0x420314]
cmp eax, ebx
je 0x413754
push eax
call fcn.0040bea7
pop ecx
test eax, eax
je 0x413754
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413754
mov eax, dword [0x420318]
cmp eax, ebx
je 0x413754
push eax
call fcn.0040bea7
pop ecx
test eax, eax
je 0x413754
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x420310]
call fcn.0040bea7
pop ecx
test eax, eax
je 0x413774
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413776
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x10007c2e
pop dword [ebp - 0x10]
mov eax, 0x228dc49
add eax, 0xdd79fe5
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xe0ec8a4f
sub dword [ebp - 0x20], 0x929a4504
mov dword [ebp - 0x1c], 0xbb36e5b5
sub dword [ebp - 0x1c], 0x89039970
mov dword [ebp - 0x18], 0x183514bc
add dword [ebp - 0x18], 0x34172f72
mov dword [ebp - 0x14], 0xdb378a24
add dword [ebp - 0x14], 0x24c875dc
lea eax, [ebp - 0x20]
push eax
mov eax, 0x5c22eaae
add eax, 0xb3dd95a6
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x26eec01
sub dword [ebp - 0x20], 0x8dfc82ab
mov dword [ebp - 0x1c], 0xcb6acd10
sub dword [ebp - 0x1c], 0x89fe6b9b
mov dword [ebp - 0x18], 0xada1d703
add dword [ebp - 0x18], 0xb5cd9569
mov dword [ebp - 0x14], 0x26ddf6e8
sub dword [ebp - 0x14], 0x26ddf6e8
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x33fccaa8
add eax, 0xdc03b5a8
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x3acba
push 0
call eax
mov ecx, 0x5883
xor edx, edx
add edx, eax
mov ebx, 0x684f02aa
sub ebx, 0x584e08aa
add ebx, dword [ebp - 0x10]
mov esi, 0xc6172a05
sub esi, 0x2baca9ee
xor dword [ebp - 4], ebx
mov edi, dword [ebx]
add dword [ebp - 0xc], ecx
xor edi, esi
add dword [ebp - 0xc], edx
mov dword [edx], edi
add edx, 0xa4279a40
add edx, 0x5bd865c4
add ebx, 0x6fcda69a
add ebx, 0x9032596a
loop 0x10007d4c
add eax, 0x8b660575
sub eax, 0x8b64b096
xor ebx, ebx
add ebx, eax
add eax, 0x5f294859
sub eax, 0x5f294854
mov ecx, 0x7112f2c1
add ecx, 0x9eed0d3f
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x772500
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2bf000]
push edi
or ebp, 0xffffffff
jmp 0x772522
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x772529
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x772518
mov eax, 1
add ebx, ebx
jne 0x77253b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x77254c
jne 0x77256b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x77256b
dec eax
add ebx, ebx
jne 0x772558
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x772530
add ebx, ebx
jne 0x772567
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7725bd
xor ecx, ecx
sub eax, 3
jb 0x772583
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7725f2
sar eax, 1
mov ebp, eax
jmp 0x77258e
add ebx, ebx
jne 0x77258e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x77255c
inc ecx
add ebx, ebx
jne 0x77259c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x77255c
add ebx, ebx
jne 0x7725a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x77259e
jne 0x7725ba
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x77259e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7725dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7725ce
jmp 0x77251e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7725dc
add edi, ecx
jmp 0x77251e
pop esi
mov edi, esi
mov ecx, 0x13395
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x7725fa
cmp byte [edi], 0x90
jne 0x7725fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x7725ff
lea edi, [esi + 0x36f000]
mov eax, dword [edi]
or eax, eax
je 0x772677
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x376d5c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x376e88]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x77262c
mov ecx, edi
jns 0x77265b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x376e8c]
or eax, eax
je 0x772671
mov dword [ebx], eax
add ebx, 4
jmp 0x772649
call dword [esi + 0x376e9c]
mov ebp, dword [esi + 0x376e90]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7726ab
sub esp, 0xffffff80
jmp 0x6080fc
Function at 0x433566
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x433575
pop dword [ebp - 0x30]
mov eax, 0x68d79bfc
sub eax, 0x68946687
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x3359500c
add dword [ebp - 0x40], 0x1af8f53f
mov dword [ebp - 0x3c], 0x4f7c02b6
sub dword [ebp - 0x3c], 0x1d48b671
mov dword [ebp - 0x38], 0x2b6d80f0
sub dword [ebp - 0x38], 0xdf213cc2
mov dword [ebp - 0x34], 0xded8cd16
sub dword [ebp - 0x34], 0xded8cd16
lea eax, [ebp - 0x40]
push eax
mov eax, 0x13061bc6
add eax, 0xed3d964e
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x7c5bd652
sub dword [ebp - 0x40], 0x7e96cfc
mov dword [ebp - 0x3c], 0x3f5c0826
add dword [ebp - 0x3c], 0x210594f
mov dword [ebp - 0x38], 0x64b32430
sub dword [ebp - 0x38], 0x143b7c4
mov dword [ebp - 0x34], 0x19ad7b7e
sub dword [ebp - 0x34], 0x19ad7b7e
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x66906e34
sub eax, 0x664cbbc4
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x42712
push 0
call eax
mov ecx, 0xd3c07b0d
sub ecx, 0xd3c03e9f
mov edi, eax
mov esi, 0xa5bb5b65
sub esi, 0xa5750d65
add esi, dword [ebp - 0x30]
mov ebx, 0xc4223988
xor dword [ebp - 0x1c], 0xdaf3a3f5
mov edx, dword [esi]
xor dword [ebp - 0x1c], ecx
sub edx, ebx
mov dword [ebp - 0x10], 0xc8fe0e55
mov dword [edi], edx
mov dword [ebp - 0x24], 0xf36b9dfc
add edi, 4
add esi, 0x4de862fb
sub esi, 0x4de862f7
loop 0x433691
add eax, 0xe48b
xor ebx, ebx
add ebx, eax
add eax, 0xc8bfdf19
add eax, 0x374020ec
mov ecx, 0x400000
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x4014a8
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
jmp 0x401518
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._recv_16
sub esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x401518
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._closesocket_4
sub esp, 4
call sym._WSACleanup_0
mov dword [esp], 1
call sym._exit
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jl 0x4014bd
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x402020
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x40206b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402064
test esi, esi
je 0x402064
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402040
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402250
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
lea esi, [esp + 0x24]
lea ebx, [eax + 0x40]
mov dword [esp + 4], 1
mov dword [esp + 0xc], ebx
mov dword [esp], str.Mingw_runtime_failure:_n
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x4022a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, edx
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x3c
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov dword [esp], ebx
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402374
mov eax, dword [esp + 0x28]
cmp eax, 0x40
je 0x4022de
cmp eax, 4
jne 0x402300
test esi, esi
je 0x4022f2
xor eax, eax
movzx ecx, byte [edi + eax]
mov byte [ebx + eax], cl
add eax, 1
cmp eax, esi
jb 0x4022e4
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x20]
lea ebp, [esp + 0x10]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov ecx, dword [esp + 0x28]
test esi, esi
je 0x40233f
xor edx, edx
movzx eax, byte [edi + edx]
mov byte [ebx + edx], al
add edx, 1
cmp edx, esi
jb 0x402331
cmp ecx, 0x40
je 0x4022f2
cmp ecx, 4
je 0x4022f2
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402250
lea esi, [esi]
Function at 0x1009b454
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x1014fef1
call fcn.10147df8
mov esi, ecx
mov dword [ebp - 0x14], esi
call fcn.1008f6dc
xor ebx, ebx
mov dword [esi], vtable.ScObjects::Thread.0
push 0x10
mov dword [ebp - 4], ebx
mov dword [esi + 0x10], ebx
mov byte [esi + 0x14], bl
call fcn.1007acd9
mov dword [ebp - 0x14], eax
pop ecx
test eax, eax
je 0x1009b49b
mov dword [eax], vtable.ScObjects::ThreadData.0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x1009b49d
mov eax, ebx
mov dword [esi + 8], eax
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push 0x1009b680
push ebx
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
cmp ecx, 0xffffffff
jne 0x1009b4d0
mov eax, dword [esi + 8]
mov dword [esi + 0x10], 0x20
mov dword [esi + 0xc], ebx
mov dword [eax + 4], ebx
jmp 0x1009b4dc
mov eax, dword [ebp - 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
mov dword [eax + 4], ecx
mov eax, esi
call fcn.10147dc1
ret

Function at 0x1009b790
Capabilities:
Resume thread

Disassembly:
cmp dword [ecx + 0x10], 0
jne 0x1009b7a2
mov eax, dword [ecx + 8]
push dword [eax + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
ret

Function at 0x100a1d60
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0x2c
mov eax, 0x10150bd0
call fcn.10147e2c
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x38], esi
mov ecx, esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], edi
call fcn.1009b955
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], 1
call fcn.100a1e88
test eax, eax
jne 0x100a1da4
push 0xffffffffffffffff
push 0x10159980
mov ecx, esi
call fcn.1007acd9
jmp 0x100a1dea
lea ecx, [ebp - 0x20]
push ecx
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ecx, esi
push 0xffffffffffffffff
push 0x10159980
test eax, eax
je 0x100a1d9d
call fcn.1007acd9
movzx eax, byte [ebp + edi - 0x20]
push eax
lea eax, [ebp - 0x30]
push 0x10165c80
push eax
call fcn.1007acd9
lea eax, [ebp - 0x30]
push eax
push esi
call fcn.1007acd9
add esp, 0x14
inc edi
cmp edi, 0x10
jb 0x100a1dc3
mov eax, esi
call fcn.10147dd6
ret

Function at 0x100a1e88
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push esi
mov esi, dword [0x107d4410]
test esi, esi
jne 0x100a1edc
push edi
push esi
push 1
push esi
push esi
mov edi, 0x107d4410
push edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x100a1ed5
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x100a1ed5
push 8
push 1
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x100a1ed5
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [0x107d4410], esi
jmp 0x100a1edb
mov esi, dword [0x107d4410]
pop edi
mov eax, esi
pop esi
ret
Function at 0x100a2070
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push 0x54
mov eax, 0x10150c7f
call fcn.10147e2c
mov ebx, dword [ebp + 8]
xor eax, eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x50], ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x44], eax
call fcn.100a1e88
and dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x48], eax
call fcn.1009b955
mov ecx, ebx
mov dword [ebp - 4], 1
call fcn.1009b955
push edi
mov eax, 0x10165d08
mov dword [ebp - 0x44], 1
push eax
push esi
push eax
push edi
push ebx
call fcn.1007acd9
pop ecx
pop ecx
push eax
call fcn.1007acd9
pop ecx
pop ecx
push eax
call fcn.1007acd9
pop ecx
pop ecx
push eax
call fcn.1007acd9
pop ecx
pop ecx
push eax
call fcn.1007acd9
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
test eax, eax
jne 0x100a2105
push 0xffffffffffffffff
push 0x10159980
mov ecx, ebx
call fcn.1007acd9
jmp 0x100a21c1
lea ecx, [ebp - 0x3c]
xor esi, esi
push ecx
push esi
push esi
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x100a20f2
push esi
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x100a20f2
push 4
pop ecx
push esi
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x40], esi
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x4c], ecx
push eax
push ecx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x100a20f2
push dword [ebp - 0x40]
call fcn.1007acd9
mov edi, eax
pop ecx
test edi, edi
je 0x100a20f2
push esi
lea eax, [ebp - 0x40]
push eax
push edi
push 2
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ecx, ebx
push 0xffffffffffffffff
push 0x10159980
test eax, eax
jne 0x100a2185
call fcn.1007acd9
jmp 0x100a21ba
call fcn.1007acd9
cmp dword [ebp - 0x40], esi
jbe 0x100a21ba
cmp esi, 0x28
jae 0x100a21ba
movzx eax, byte [esi + edi]
push eax
lea eax, [ebp - 0x38]
push 0x10165c80
push eax
call fcn.1007acd9
lea eax, [ebp - 0x38]
push eax
push ebx
call fcn.1007acd9
add esp, 0x14
inc esi
cmp esi, dword [ebp - 0x40]
jb 0x100a218f
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
cmp dword [ebp - 0x3c], 0
je 0x100a21d0
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
lea ecx, [ebp - 0x60]
call fcn.1007acd9
mov eax, ebx
call fcn.10147dd6
ret