joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10b93e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x113bd86
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1161d94]
mov edx, dword [eax + 0xc]
mov esi, ecx
xor ebx, ebx
mov ecx, 0x1161d94
mov dword [ebp - 0x120], ebx
call edx
lea edi, [eax + 0x10]
mov dword [ebp - 0x128], edi
push ebx
push 0x1016f24
lea eax, [ebp - 0x120]
push eax
push 0x1016ea8
lea ecx, [ebp - 0x11c]
push 2
push ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x124], ebx
call fcn.01075110
add esp, 0x18
cmp dword [esi + 0x30], ebx
mov byte [ebp - 4], 1
je 0x10b946c
mov eax, 0x80070032
jmp 0x10b94b9
push ebx
push ebx
lea edx, [ebp - 0x124]
push edx
push 0x1162ab4
mov ecx, esi
call fcn.010b8f00
cmp eax, ebx
mov dword [ebp - 0x120], eax
jl 0x10b94bf
mov ecx, dword [esi + 0x14]
cmp ecx, ebx
jne 0x10b9499
mov eax, 0x8000ffff
jmp 0x10b94b9
add ecx, 0xffffffff
cmp ecx, ebx
mov dword [esi + 0x14], ecx
jne 0x10b94bf
push 1
push ebx
lea eax, [ebp - 0x124]
push eax
push 0x1162ab4
mov ecx, esi
call fcn.010b8f00
mov dword [ebp - 0x120], eax
lea ecx, [ebp - 0x11c]
mov esi, eax
mov byte [ebp - 4], bl
call fcn.01075230
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10b94f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret
Function at 0x10c2600
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
push 0x101f020
lea eax, [ebp - 0x114]
push eax
push 0x101efa8
lea ecx, [ebp - 0x110]
push 2
push ecx
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x124], esi
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x12c], esi
mov dword [ebp - 0x128], esi
call fcn.01075110
add esp, 0x18
push esi
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x11c], esi
mov dword [ebp - 0x118], esi
call fcn.01096870
cmp eax, esi
mov dword [ebp - 0x114], eax
jl 0x10c2727
lea edx, [ebp - 0x120]
push edx
lea ecx, [ebp - 0x11c]
call fcn.010959e0
cmp eax, esi
mov dword [ebp - 0x114], eax
jl 0x10c2727
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x11c]
call fcn.01095900
cmp eax, esi
mov dword [ebp - 0x114], eax
jl 0x10c2727
lea ecx, [ebp - 0x124]
push ecx
lea ecx, [ebp - 0x11c]
call fcn.010c2460
cmp eax, esi
mov dword [ebp - 0x114], eax
jge 0x10c26fc
mov edx, dword [0x1162a8c]
push edx
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, eax
cmp ecx, esi
je 0x10c2721
cmp dword [ecx], esi
je 0x10c2721
xor eax, eax
mov dword [ebp - 0x114], eax
mov ecx, dword [ecx]
jmp 0x10c2702
mov ecx, dword [ebp - 0x124]
mov edx, dword [ebp - 0x12c]
mov dword [edi], ecx
mov ecx, dword [ebp - 0x120]
mov dword [edi + 0xc], ecx
mov ecx, dword [ebp - 0x128]
mov dword [edi + 4], edx
mov dword [edi + 8], ecx
jmp 0x10c2727
mov eax, dword [ebp - 0x114]
cmp dword [ebp - 0x11c], esi
mov edi, eax
je 0x10c2739
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
lea ecx, [ebp - 0x110]
call fcn.01075230
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.010840d6
mov esp, ebp
pop ebp
ret 4
Function at 0x10c2ef0
Capabilities:
Encrypt data using des via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 0xf0000048
mov dword [ebp - 0x20], 0x101f7a4
mov dword [ebp - 0x1c], 0x18
mov dword [ebp - 0x18], 0x101f774
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 0
call fcn.01127f00
test al, al
je 0x10c2f52
mov eax, dword [ebp + esi*8 - 0x1c]
mov ecx, dword [ebp + esi*8 - 0x20]
push eax
push ecx
push 0x101f718
push 0x101f688
push 3
call fcn.01128b70
add esp, 0x14
mov edx, dword [ebp - 4]
mov edi, dword [ebp + esi*8 - 0x1c]
mov ebx, dword [ebp + esi*8 - 0x20]
push edx
push edi
push ebx
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x10c3045
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090009
mov dword [ebp - 0xc], eax
jne 0x10c2fc6
test byte [ebp - 4], 0x40
je 0x10c2fc6
call fcn.01127f00
test al, al
je 0x10c2fa7
push 0x101f600
push 0x101f570
push 0
call fcn.01128b70
add esp, 0xc
mov eax, dword [ebp - 4]
and eax, 0xffffffbf
push eax
push edi
push ebx
push 0
lea ecx, [ebp - 8]
push ecx
mov dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x10c3020
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x10c2fd9
add esi, 1
cmp esi, 2
jb 0x10c2f24
test eax, eax
je 0x10c3048
call fcn.01127f00
test al, al
mov esi, dword [ebp - 0xc]
je 0x10c2ffe
push esi
push 0x101f508
push 0x101f478
push 0
call fcn.01128b70
add esp, 0x10
test esi, esi
jle 0x10c300e
and esi, 0xffff
or esi, 0x80070000
mov eax, esi
test eax, eax
jl 0x10c3019
mov eax, 0x8004886b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.01127f00
test al, al
je 0x10c2fdd
mov edx, edi
push edx
mov eax, ebx
push eax
push 0x101f410
push 0x101f380
push 3
call fcn.01128b70
add esp, 0x14
jmp 0x10c2fdd
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x10c2fdd
mov esi, dword [ebp - 0x10]
mov dword [esi + 0x260], ecx
call fcn.01127f00
test al, al
je 0x10c3072
push 0x101f348
push 0x101f2b8
push 1
call fcn.01128b70
add esp, 0xc
mov ecx, dword [0x1162cd4]
mov eax, dword [ecx + 0x260]
add esi, 0x25c
push esi
push 0xc00000
push 0x6603
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
jne 0x10c30a6
call fcn.01071a70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10c6000
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x18]
test ecx, ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x10235f0
mov byte [ebp - 1], 0x24
jne 0x10c6026
pop edi
mov eax, 0x80070057
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp dword [ebp + 0x1c], 0
jne 0x10c6035
mov esi, 0x1023638
mov byte [ebp - 1], 0x3d
mov al, byte [ebp + 0x10]
test al, al
je 0x10c6097
movsx ax, al
mov word [ecx], ax
mov eax, dword [ebp + 0x14]
add ecx, 2
test eax, eax
je 0x10c6097
movsx edx, byte [eax]
mov word [ecx], dx
movsx edx, byte [eax + 1]
mov word [ecx + 2], dx
movsx edx, byte [eax + 2]
mov word [ecx + 4], dx
movsx edx, byte [eax + 3]
mov word [ecx + 6], dx
movsx edx, byte [eax + 4]
mov word [ecx + 8], dx
movsx edx, byte [eax + 5]
mov word [ecx + 0xa], dx
movsx edx, byte [eax + 6]
mov word [ecx + 0xc], dx
movsx edx, byte [eax + 7]
mov word [ecx + 0xe], dx
movsx ax, byte [eax + 8]
mov word [ecx + 0x10], ax
add ecx, 0x12
mov edx, dword [ebp + 0xc]
cmp edx, 3
push ebx
jb 0x10c6121
mov eax, 0xaaaaaaab
mul edx
shr edx, 1
mov dword [ebp + 0x18], edx
mov al, byte [edi + 1]
mov dl, byte [edi]
mov bl, al
and al, 0xf
and dl, 3
shr bl, 4
add al, al
shl dl, 4
or dl, bl
mov bl, byte [edi + 2]
add al, al
shr bl, 6
or al, bl
mov bl, byte [edi + 2]
mov byte [ebp + 0xb], al
movzx eax, byte [edi]
sub dword [ebp + 0xc], 3
shr eax, 2
movsx eax, byte [eax + esi]
mov word [ecx], ax
movzx edx, dl
movsx eax, byte [edx + esi]
movzx edx, byte [ebp + 0xb]
add ecx, 2
mov word [ecx], ax
movsx eax, byte [edx + esi]
and bl, 0x3f
add ecx, 2
mov word [ecx], ax
movzx edx, bl
movsx eax, byte [edx + esi]
add ecx, 2
mov word [ecx], ax
add ecx, 2
add edi, 3
sub dword [ebp + 0x18], 1
jne 0x10c60b0
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x10c61bd
cmp edx, 1
jne 0x10c616b
mov dl, byte [edi]
mov al, dl
movzx edx, dl
and al, 3
shr edx, 2
movsx edx, byte [edx + esi]
shl al, 4
mov word [ecx], dx
movzx eax, al
movsx edx, byte [eax + esi]
movsx ax, byte [ebp - 1]
add ecx, 2
mov word [ecx], dx
add ecx, 2
pop ebx
mov word [ecx], ax
pop edi
mov word [ecx + 2], ax
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x18
cmp edx, 2
jne 0x10c61bd
mov dl, byte [edi]
mov al, byte [edi + 1]
mov byte [ebp + 0x13], dl
movzx edi, byte [ebp + 0x13]
and dl, 3
mov bl, al
shl dl, 4
shr bl, 4
or dl, bl
and al, 0xf
shr edi, 2
movsx di, byte [edi + esi]
mov word [ecx], di
add al, al
movzx edx, dl
movsx edx, byte [edx + esi]
add al, al
movzx eax, al
add ecx, 2
mov word [ecx], dx
movsx edx, byte [eax + esi]
movsx ax, byte [ebp - 1]
add ecx, 2
mov word [ecx], dx
mov word [ecx + 2], ax
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x10c7ff0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x113c23b
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
xor esi, esi
push esi
push 0x1025108
lea ecx, [ebp - 0x120]
push ecx
push 0x1025080
lea edx, [ebp - 0x11c]
push 2
push edx
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], esi
call fcn.01075110
add esp, 0x18
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push esi
push esi
push edi
mov dword [ebp - 4], esi
call ebx
mov esi, eax
test esi, esi
jne 0x10c80b9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10c8079
call esi
jmp 0x10c8085
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x120], eax
call fcn.01127f00
test al, al
je 0x10c8151
mov eax, dword [ebp - 0x120]
push eax
push edi
push 0x1025028
push 0x1024fa0
push 0
call fcn.01128b70
add esp, 0x14
jmp 0x10c8151
mov ecx, dword [ebp - 0x124]
push esi
call fcn.010b6570
push esi
push eax
push edi
call ebx
test eax, eax
jne 0x10c8117
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10c80de
call esi
jmp 0x10c80ea
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x120], eax
call fcn.01127f00
test al, al
je 0x10c8151
mov ecx, dword [ebp - 0x120]
push ecx
push edi
push 0x1025028
push 0x1024f18
push 0
call fcn.01128b70
add esp, 0x14
jmp 0x10c8151
mov edi, dword [ebp - 0x124]
mov edx, dword [edi]
test edx, edx
jne 0x10c8127
xor eax, eax
jmp 0x10c8141
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10c8130
sub eax, esi
sar eax, 1
js 0x10c8189
cmp eax, dword [edx - 8]
jg 0x10c8189
mov dword [edx - 0xc], eax
mov edx, dword [edi]
mov word [edx + eax*2], 0
mov esi, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], 0xffffffff
call fcn.01075230
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 8
push 0x80070057
call fcn.01071710
int3
Function at 0x10c8ad0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
je 0x10c8b1a
push edi
lea ecx, [esi + 4]
call fcn.01097700
test eax, eax
je 0x10c8b62
cmp dword [esi], 0
je 0x10c8aff
mov eax, dword [esi + 8]
test eax, eax
je 0x10c8aff
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esi + 8]
test eax, eax
je 0x10c8b14
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], 0
mov dword [esi], 0
mov eax, dword [ebp + 8]
push edi
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
mov dword [esi + 8], eax
je 0x10c8b54
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x10c8b6a
mov ecx, dword [ebp + 0x10]
mov edx, dword [esi + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
add eax, 1
mov dword [esi], eax
cmp dword [esi], 0
je 0x10c8b62
push edi
lea ecx, [esi + 4]
call fcn.0107f660
mov eax, dword [esi]
pop edi
pop esi
pop ebp
ret 0xc
push edi
lea ecx, [esi + 4]
mov dword [esi], 1
call fcn.0107f660
mov eax, dword [esi]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x10cf190
Capabilities:
Monitor local ipv4 address changes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x114120b
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0
push 0x1029f70
lea eax, [ebp - 0x120]
push eax
push 0x1029ef0
lea ecx, [ebp - 0x11c]
push 2
push ecx
mov dword [ebp - 0x120], 0
call fcn.01075110
add esp, 0x18
mov eax, dword [esi + 0x10]
test eax, eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x124], 0
je 0x10cf21c
push eax
call dword [sym.imp.WS2_32.dll_WSACloseEvent]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.WS2_32.dll_WSACreateEvent]
test eax, eax
mov dword [esi + 0x10], eax
jne 0x10cf267
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
test eax, eax
jg 0x10cf239
call esi
jmp 0x10cf245
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x120], eax
call fcn.01127f00
test al, al
je 0x10cf2c7
mov edx, dword [ebp - 0x120]
push edx
push 0x1029eb0
push 0x1029e30
jmp 0x10cf2bd
push esi
lea eax, [ebp - 0x124]
push eax
call sub.iphlpapi.dll_NotifyAddrChange
test eax, eax
je 0x10cf2c7
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call esi
cmp eax, 0x3e5
je 0x10cf2c7
call esi
test eax, eax
jg 0x10cf291
call esi
jmp 0x10cf29d
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x120], eax
call fcn.01127f00
test al, al
je 0x10cf2c7
mov ecx, dword [ebp - 0x120]
push ecx
push 0x1029db8
push 0x1029d38
push 0
call fcn.01128b70
add esp, 0x10
mov esi, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], 0xffffffff
call fcn.01075230
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 4
Function at 0x10dbf20
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x113f05c
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0x1032ea8
lea eax, [ebp - 0x11d]
push eax
push 0x1032e20
mov esi, ecx
lea ecx, [ebp - 0x11c]
push 2
push ecx
mov byte [ebp - 0x11d], 0
call fcn.010c6980
add esp, 0x18
mov edx, dword [0x1161d94]
mov eax, dword [edx + 0xc]
mov ecx, 0x1161d94
mov dword [ebp - 4], 0
call eax
add eax, 0x10
mov dword [ebp - 0x124], eax
mov edx, dword [0x1161d94]
mov eax, dword [edx + 0xc]
mov ecx, 0x1161d94
mov byte [ebp - 4], 1
call eax
add eax, 0x10
mov dword [ebp - 0x12c], eax
mov edx, dword [0x1161d94]
mov eax, dword [edx + 0xc]
mov ecx, 0x1161d94
mov byte [ebp - 4], 2
call eax
add eax, 0x10
mov dword [ebp - 0x130], eax
mov ebx, dword [ebp + 8]
push 1
lea ecx, [ebp - 0x124]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x128], esp
shr ebx, 4
push 0x100f6f8
mov byte [ebp - 4], 3
and bl, 1
call fcn.0107f6b0
add esi, 0x30
mov ecx, esi
call fcn.011183a0
test eax, eax
jl 0x10dc020
mov edx, dword [ebp - 0x124]
cmp dword [edx - 0xc], 0
je 0x10dc020
test bl, bl
jne 0x10dc028
jmp 0x10dc0cb
test bl, bl
je 0x10dc0d2
push 1
lea eax, [ebp - 0x12c]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x10122f0
mov dword [ebp - 0x128], 0
call fcn.0107f6b0
mov ecx, esi
call fcn.011183a0
test eax, eax
jl 0x10dc0d2
mov eax, dword [ebp - 0x12c]
cmp dword [eax - 0xc], 0
je 0x10dc0d2
lea ecx, [ebp - 0x128]
push ecx
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x134], esp
mov ebx, esp
push eax
call fcn.01081e90
add eax, 0x10
add esp, 4
mov dword [ebx], eax
call fcn.01134050
test eax, eax
jl 0x10dc0d2
cmp dword [ebp - 0x128], 0
je 0x10dc0cb
push 1
lea edx, [ebp - 0x130]
push edx
push ecx
mov ecx, esp
mov dword [ebp - 0x134], esp
push 0x1032e10
call fcn.0107f6b0
mov ecx, esi
call fcn.011183a0
test eax, eax
jl 0x10dc0d2
mov eax, dword [ebp - 0x130]
cmp dword [eax - 0xc], 0
je 0x10dc0d2
mov byte [ebp - 0x11d], 1
mov bl, byte [ebp - 0x11d]
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 2
call fcn.0109c040
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 1
call fcn.0109c040
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 0
call fcn.0109c040
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], 0xffffffff
call fcn.010c6aa0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 4
Function at 0x10dd5b0
Capabilities:
Acquire credentials from windows credential manager

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x113f311
mov eax, dword fs:[0]
push eax
sub esp, 0x128
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push esi
push 0x10341c8
push 0x1034188
lea eax, [ebp - 0x120]
push eax
push 0x1034100
lea ecx, [ebp - 0x11c]
push 2
xor ebx, ebx
push ecx
mov dword [ebp - 0x120], ebx
call fcn.01075110
add esp, 0x1c
mov edx, dword [0x1161d94]
mov eax, dword [edx + 0xc]
mov ecx, 0x1161d94
mov dword [ebp - 4], ebx
call eax
add eax, 0x10
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x130], ebx
mov dword [ebp - 0x128], ebx
mov dword [ebp - 0x12c], 0x1015ad8
lea ecx, [ebp - 0x124]
push ecx
push esi
mov byte [ebp - 4], 2
mov dword [ebp - 0x134], ebx
mov dword [edi], ebx
call fcn.010dce50
mov ecx, dword [ebp - 0x124]
lea edx, [ebp - 0x130]
push edx
lea eax, [ebp - 0x134]
push eax
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_CredEnumerateW]
test eax, eax
jne 0x10dd6dd
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x490
jne 0x10dd69c
mov dword [ebp - 0x120], ebx
jmp 0x10dd70c
call esi
test eax, eax
jg 0x10dd6a6
call esi
jmp 0x10dd6b2
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x120], eax
call fcn.01127f00
test al, al
je 0x10dd70c
mov edx, dword [ebp - 0x120]
push edx
push 0x1016714
push 0x1034078
push ebx
call fcn.01128b70
add esp, 0x10
jmp 0x10dd70c
mov esi, dword [ebp - 0x130]
cmp esi, ebx
je 0x10dd70c
cmp dword [ebp - 0x134], ebx
je 0x10dd70c
mov eax, dword [ebp - 0x12c]
mov edx, dword [eax + 4]
lea ecx, [ebp - 0x12c]
call edx
mov dword [ebp - 0x128], esi
mov dword [edi], 1
mov esi, dword [ebp - 0x120]
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 1
call fcn.010b5ef0
mov eax, dword [ebp - 0x124]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10dd746
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], 0xffffffff
call fcn.01075230
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 8
Function at 0x10e8000
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
xor ebx, ebx
push 0x1f5
mov dword [ebp - 4], ebx
call fcn.010e7f20
mov edi, eax
cmp edi, ebx
je 0x10e8053
mov ecx, dword [ebp + 8]
push esi
lea eax, [ebp - 4]
push eax
push 1
push ecx
call fcn.010e7e50
mov esi, eax
cmp esi, ebx
je 0x10e804b
mov edx, dword [esi]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x10e8044
mov ebx, 1
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10e9910
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x113c1c8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x115f604]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [0x1161d94]
mov edx, dword [eax + 0xc]
mov ecx, 0x1161d94
call edx
add eax, 0x10
mov dword [esi], eax
lea ecx, [esi + 4]
mov dword [ebp - 4], 0
call fcn.010bb570
mov eax, dword [0x1161d94]
mov edx, dword [eax + 0xc]
mov ecx, 0x1161d94
call edx
add eax, 0x10
mov dword [esi + 0x30], eax
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10ece90
Capabilities:
Set http header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11464a6
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1161d94]
mov edx, dword [eax + 0xc]
mov esi, dword [ebp + 8]
mov ecx, 0x1161d94
mov dword [ebp - 0x120], 0
call edx
add eax, 0x10
mov dword [ebp - 0x124], eax
push 0
push 0x103f1c8
lea eax, [ebp - 0x120]
push eax
push 0x103f158
lea ecx, [ebp - 0x11c]
push 2
push ecx
mov dword [ebp - 4], 0
call fcn.01075110
add esp, 0x18
push 0x22
push 0x103f110
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.01076ac0
mov edi, dword [ebp - 0x124]
push 0xa0000000
push 0xffffffffffffffff
push edi
push esi
call dword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
test eax, eax
jne 0x10ecf66
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10ecf52
call esi
mov dword [ebp - 0x120], eax
jmp 0x10ecf6c
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x120], eax
jmp 0x10ecf6c
mov eax, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
mov esi, eax
mov byte [ebp - 4], 0
call fcn.01075230
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10ecfa0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 4