joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10034fd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
add ecx, eax
lea ebp, [esp + 8]
mov dword [ebp], 1
mov dword [ebp + 4], eax
mov dword [ebp + 8], ecx
mov word [ebp + 0xc], 0
lea ebx, [esp + 0x18]
push ebp
push ebx
call fcn.1005a1be
add esp, 8
mov eax, 0x800
mov ecx, esp
mov dword [ecx], eax
xor edi, edi
lea esi, [esp + 4]
mov dword [esi], edi
push edi
push eax
call fcn.1005817c
add esp, 8
mov dword [ebp], eax
mov dword [ebp + 4], edx
mov dword [ebp + 8], edi
mov eax, dword [esp + 0x3c]
mov edi, dword [eax]
mov ebx, dword [ebx + 4]
mov ebp, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov eax, esp
push eax
push edx
push esi
push 0
push ebx
push edi
call ebp
cmp eax, 0xea
jne 0x10035061
push dword [esp]
lea eax, [esp + 0xc]
push eax
call fcn.1005a149
add esp, 8
mov edx, dword [esp + 0xc]
jmp 0x10035039
test eax, eax
jne 0x10035082
mov eax, dword [esp]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 4]
cmp eax, 0xb
mov esi, dword [esp + 0x38]
jbe 0x100350ae
mov dword [esi + 8], 0xde
jmp 0x10035089
mov esi, dword [esp + 0x38]
mov dword [esi + 8], eax
mov dword [esi + 4], 0
mov dword [esi], 0x80000000
lea edi, [esp + 8]
push edi
call fcn.10001480
add esp, 4
push edi
call fcn.1005a250
add esp, 4
jmp 0x100350c2
mov ecx, dword [esp + 0x10]
mov dword [esi + 8], ecx
movsd xmm0, qword [esp + 8]
movsd qword [esi], xmm0
mov byte [esi + 0xc], al
lea edi, [esp + 0x18]
push edi
call fcn.10001480
add esp, 4
push edi
call fcn.1005a653
add esp, 4
mov eax, esi
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10039b79
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov edx, dword [esp + 0x6c]
mov eax, dword [edx + 0x20]
mov ecx, dword [edx + 0x30]
cmp ecx, eax
jb 0x10039d3e
lea ecx, [esp + 0x30]
push eax
push dword [edx + 0x2c]
push 1
push ecx
call fcn.1005a951
add esp, 0xc
xor ebx, ebx
lea edi, [esp + 0x40]
push ebx
push ebx
push edi
call fcn.1005a951
add esp, 0xc
lea ebp, [esp + 0x4c]
push ebx
push ebx
push ebp
call fcn.1005a951
add esp, 0x10
lea esi, [esp + 0x24]
sub esp, 4
push ebx
push ebx
push esi
call fcn.1005a951
add esp, 0x10
lea ecx, [esp + 0x30]
mov eax, dword [ecx + 8]
mov dword [esi - 0x1c], eax
movsd xmm0, qword [ecx]
movsd qword [esi - 0x24], xmm0
movsd xmm0, qword [edi]
movsd qword [esi - 0x18], xmm0
mov eax, dword [edi + 8]
mov edi, dword [esp + 0x6c]
mov dword [esi - 0x10], eax
movsd xmm0, qword [ebp]
movsd qword [esi - 0xc], xmm0
mov eax, dword [ebp + 8]
mov dword [esi - 4], eax
mov eax, esp
push 4
push eax
push ebp
call fcn.1005a972
add esp, 0xc
lea eax, [edi + 0x68]
push ebx
push ebx
push ebp
push eax
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x10039cba
cmp eax, 0x80090318
je 0x10039d0c
test eax, eax
jne 0x10039cfb
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov edx, dword [edi + 0x2c]
mov ebx, edi
mov edi, dword [edi + 0x30]
sub eax, edx
mov esi, eax
mov dword [ebx + 0x18], 0
add esi, ecx
jb 0x10039d4a
cmp edi, esi
jb 0x10039d56
mov edi, dword [esp + 0x6c]
lea esi, [edi + 0x10]
add edx, eax
push ecx
push edx
push esi
call fcn.1009b474
add esp, 0xc
xor eax, eax
mov dword [edi + 0xc], eax
mov dword [edi + 8], eax
cmp dword [esp + 0x28], 5
mov ecx, dword [edi + 0x20]
jne 0x10039c9b
mov eax, dword [esp + 0x24]
sub ecx, eax
push ecx
push edi
call fcn.100390cf
add esp, 8
mov eax, dword [edi + 0x20]
xor ecx, ecx
or eax, dword [edi + 0x24]
sete cl
mov dword [edi + 0xa8], ecx
jmp 0x10039d2d
cmp eax, 0x90317
je 0x10039d19
cmp eax, 0x90321
jne 0x10039cfb
mov dword [edi + 0x50], 0x10000
mov byte [edi + 0x54], 0
xor ecx, ecx
cmp dword [esp + 0x28], 5
mov eax, dword [edi + 0x20]
jne 0x10039ce3
mov ecx, dword [esp + 0x24]
sub eax, ecx
push eax
push edi
call fcn.100390cf
add esp, 8
mov dword [edi + 0xa8], 0
jmp 0x10039d2d
mov ecx, dword [esp + 0x68]
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], 0
jmp 0x10039d36
cmp dword [esp + 0x10], 4
jne 0x10039d24
mov eax, dword [esp + 0xc]
jmp 0x10039d27
mov eax, dword [esp + 0x68]
mov word [eax], 0x104
jmp 0x10039d36
xor eax, eax
inc eax
mov dword [edi + 0xa8], eax
mov eax, dword [esp + 0x68]
mov word [eax], 4
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x101089e8
push ecx
push eax
call fcn.10101620
push 0x101089f8
push esi
push eax
call fcn.10101640
push 0x101089f8
push edi
push esi
call fcn.10101620
Function at 0x10039d62
Capabilities:
Decrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov edx, dword [esp + 0x6c]
mov eax, dword [edx + 0xe0]
mov ecx, dword [edx + 0xf0]
cmp ecx, eax
jb 0x10039f57
lea ecx, [esp + 0x30]
push eax
push dword [edx + 0xec]
push 1
push ecx
call fcn.1005a951
add esp, 0xc
xor ebx, ebx
lea edi, [esp + 0x40]
push ebx
push ebx
push edi
call fcn.1005a951
add esp, 0xc
lea ebp, [esp + 0x4c]
push ebx
push ebx
push ebp
call fcn.1005a951
add esp, 0x10
lea esi, [esp + 0x24]
sub esp, 4
push ebx
push ebx
push esi
call fcn.1005a951
add esp, 0x10
lea ecx, [esp + 0x30]
mov eax, dword [ecx + 8]
mov dword [esi - 0x1c], eax
movsd xmm0, qword [ecx]
movsd qword [esi - 0x24], xmm0
movsd xmm0, qword [edi]
movsd qword [esi - 0x18], xmm0
mov eax, dword [edi + 8]
mov edi, dword [esp + 0x6c]
mov dword [esi - 0x10], eax
movsd xmm0, qword [ebp]
movsd qword [esi - 0xc], xmm0
mov eax, dword [ebp + 8]
mov dword [esi - 4], eax
mov eax, esp
push 4
push eax
push ebp
call fcn.1005a972
add esp, 0xc
lea eax, [edi + 0x128]
push ebx
push ebx
push ebp
push eax
call dword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x90316
jg 0x10039eca
cmp eax, 0x80090318
je 0x10039f25
test eax, eax
jne 0x10039f14
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov edx, dword [edi + 0xec]
mov ebx, edi
mov edi, dword [edi + 0xf0]
sub eax, edx
mov esi, eax
mov dword [ebx + 0xd8], 0
add esi, ecx
jb 0x10039f63
cmp edi, esi
jb 0x10039f6f
mov edi, dword [esp + 0x6c]
lea esi, [edi + 0xd0]
add edx, eax
push ecx
push edx
push esi
call fcn.1009b474
add esp, 0xc
xor eax, eax
mov dword [edi + 0xcc], eax
mov dword [edi + 0xc8], eax
cmp dword [esp + 0x28], 5
mov ecx, dword [edi + 0xe0]
jne 0x10039ea5
mov eax, dword [esp + 0x24]
sub ecx, eax
push ecx
push edi
call fcn.1003903d
add esp, 8
mov eax, dword [edi + 0xe0]
xor ecx, ecx
or eax, dword [edi + 0xe4]
sete cl
mov dword [edi + 0x154], ecx
jmp 0x10039f46
cmp eax, 0x90317
je 0x10039f32
cmp eax, 0x90321
jne 0x10039f14
mov dword [edi + 0x110], 0x10000
mov byte [edi + 0x114], 0
xor ecx, ecx
cmp dword [esp + 0x28], 5
mov eax, dword [edi + 0xe0]
jne 0x10039efc
mov ecx, dword [esp + 0x24]
sub eax, ecx
push eax
push edi
call fcn.1003903d
add esp, 8
mov dword [edi + 0x154], 0
jmp 0x10039f46
mov ecx, dword [esp + 0x68]
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], 0
jmp 0x10039f4f
cmp dword [esp + 0x10], 4
jne 0x10039f3d
mov eax, dword [esp + 0xc]
jmp 0x10039f40
mov eax, dword [esp + 0x68]
mov word [eax], 0x104
jmp 0x10039f4f
xor eax, eax
inc eax
mov dword [edi + 0x154], eax
mov eax, dword [esp + 0x68]
mov word [eax], 4
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x101089e8
push ecx
push eax
call fcn.10101620
push 0x101089f8
push esi
push eax
call fcn.10101640
push 0x101089f8
push edi
push esi
call fcn.10101620
Function at 0x10039f7b
Capabilities:
Encrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov eax, dword [esp + 0x88]
mov ebx, dword [esp + 0x84]
cmp dword [eax + 8], ebx
jb 0x1003a0fb
mov edi, dword [esp + 0x7c]
mov esi, dword [eax]
lea ebp, [esi + ebx]
mov ecx, dword [eax + 4]
add ecx, ebp
lea eax, [edi + 0x40]
mov dword [esp], eax
mov eax, dword [edi + 0x48]
cmp eax, ecx
jae 0x10039fc6
push 0
push ecx
push dword [esp + 8]
call fcn.10047536
add esp, 0xc
mov eax, dword [edi + 0x48]
cmp esi, ebp
ja 0x1003a10c
cmp eax, ebp
jb 0x1003a118
mov eax, dword [edi + 0x44]
add eax, esi
push 0x10108a68
push ebx
push dword [esp + 0x88]
push ebx
push eax
call fcn.10059d15
add esp, 0x14
mov eax, dword [edi + 0x48]
cmp eax, esi
jb 0x1003a11f
lea eax, [esp + 4]
push esi
push dword [edi + 0x44]
push 7
push eax
call fcn.1005a951
add esp, 0x10
mov eax, dword [edi + 0x48]
cmp eax, ebp
jb 0x1003a12b
add esi, dword [edi + 0x44]
lea eax, [esp + 0x10]
push ebx
push esi
push 1
push eax
call fcn.1005a951
add esp, 0x10
mov ecx, dword [edi + 0x48]
mov eax, ecx
sub eax, ebp
jb 0x1003a137
add ebp, dword [edi + 0x44]
lea esi, [esp + 0x4c]
push eax
push ebp
push 6
push esi
call fcn.1005a951
add esp, 0x10
lea ebp, [esp + 0x40]
sub esp, 4
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.1005a951
add esp, 0x10
mov eax, dword [esp + 0xc]
mov dword [ebp - 0x1c], eax
movsd xmm0, qword [esp + 4]
movsd qword [ebp - 0x24], xmm0
movsd xmm0, qword [esp + 0x10]
movsd qword [ebp - 0x18], xmm0
mov eax, dword [esp + 0x18]
mov dword [ebp - 0x10], eax
movsd xmm0, qword [esi]
movsd qword [ebp - 0xc], xmm0
mov eax, dword [esi + 8]
mov dword [ebp - 4], eax
lea eax, [esp + 0x1c]
lea esi, [esp + 0x58]
push 4
push eax
push esi
call fcn.1005a972
add esp, 0xc
lea eax, [edi + 0x68]
push ebx
push esi
push ebx
push eax
call dword [sym.imp.secur32.dll_EncryptMessage]
test eax, eax
je 0x1003a0cd
mov ecx, dword [esp + 0x78]
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], 0
jmp 0x1003a0f3
mov eax, dword [esp + 0x28]
add eax, dword [esp + 0x1c]
add eax, dword [esp + 0x34]
push eax
push dword [esp + 4]
call fcn.100a6e7d
add esp, 8
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x38], ebx
mov eax, dword [esp + 0x78]
mov byte [eax], 4
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10108a48
push 0x3e
push str.assertion_failed:_buf.len_____sizes.cbMaximumMessage_as_usize
call fcn.10101280
push 0x10108a58
push ebp
push esi
call fcn.10101640
push 0x10108a58
jmp 0x1003a130
push 0x10108a78
push eax
push esi
call fcn.10101620
push 0x10108a88
push eax
push ebp
call fcn.10101620
push 0x10108a98
push ecx
push ebp
call fcn.10101600
Function at 0x1003a143
Capabilities:
Encrypt data via sspi

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x64
mov eax, dword [esp + 0x88]
mov ebx, dword [esp + 0x84]
cmp dword [eax + 8], ebx
jb 0x1003a2ea
mov edi, dword [esp + 0x7c]
mov esi, dword [eax]
lea ebp, [esi + ebx]
mov ecx, dword [eax + 4]
add ecx, ebp
lea eax, [edi + 0x100]
mov dword [esp], eax
mov eax, dword [edi + 0x108]
cmp eax, ecx
jae 0x1003a197
push 0
push ecx
push dword [esp + 8]
call fcn.10047536
add esp, 0xc
mov eax, dword [edi + 0x108]
cmp esi, ebp
ja 0x1003a2fb
cmp eax, ebp
jb 0x1003a307
mov eax, dword [edi + 0x104]
add eax, esi
push 0x10108a68
push ebx
push dword [esp + 0x88]
push ebx
push eax
call fcn.10059d15
add esp, 0x14
mov eax, dword [edi + 0x108]
cmp eax, esi
jb 0x1003a30e
lea eax, [esp + 4]
push esi
push dword [edi + 0x104]
push 7
push eax
call fcn.1005a951
add esp, 0x10
mov eax, dword [edi + 0x108]
cmp eax, ebp
jb 0x1003a31a
add esi, dword [edi + 0x104]
lea eax, [esp + 0x10]
push ebx
push esi
push 1
push eax
call fcn.1005a951
add esp, 0x10
mov ecx, dword [edi + 0x108]
mov eax, ecx
sub eax, ebp
jb 0x1003a326
add ebp, dword [edi + 0x104]
lea esi, [esp + 0x4c]
push eax
push ebp
push 6
push esi
call fcn.1005a951
add esp, 0x10
lea ebp, [esp + 0x40]
sub esp, 4
xor ebx, ebx
push ebx
push ebx
push ebp
call fcn.1005a951
add esp, 0x10
mov eax, dword [esp + 0xc]
mov dword [ebp - 0x1c], eax
movsd xmm0, qword [esp + 4]
movsd qword [ebp - 0x24], xmm0
movsd xmm0, qword [esp + 0x10]
movsd qword [ebp - 0x18], xmm0
mov eax, dword [esp + 0x18]
mov dword [ebp - 0x10], eax
movsd xmm0, qword [esi]
movsd qword [ebp - 0xc], xmm0
mov eax, dword [esi + 8]
mov dword [ebp - 4], eax
lea eax, [esp + 0x1c]
lea esi, [esp + 0x58]
push 4
push eax
push esi
call fcn.1005a972
add esp, 0xc
lea eax, [edi + 0x128]
push ebx
push esi
push ebx
push eax
call dword [sym.imp.secur32.dll_EncryptMessage]
test eax, eax
je 0x1003a2b6
mov ecx, dword [esp + 0x78]
mov dword [ecx + 4], eax
mov eax, ecx
mov dword [ecx], 0
jmp 0x1003a2e2
mov eax, dword [esp + 0x28]
add eax, dword [esp + 0x1c]
add eax, dword [esp + 0x34]
push eax
push dword [esp + 4]
call fcn.100a6e7d
add esp, 8
mov dword [edi + 0xfc], ebx
mov dword [edi + 0xf8], ebx
mov eax, dword [esp + 0x78]
mov byte [eax], 4
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10108a48
push 0x3e
push str.assertion_failed:_buf.len_____sizes.cbMaximumMessage_as_usize
call fcn.10101280
push 0x10108a58
push ebp
push esi
call fcn.10101640
push 0x10108a58
jmp 0x1003a31f
push 0x10108a78
push eax
push esi
call fcn.10101620
push 0x10108a88
push eax
push ebp
call fcn.10101620
push 0x10108a98
push ecx
push ebp
call fcn.10101600
Function at 0x10048196
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x5c
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x74]
lea eax, [edi + 0xa8]
lea ebx, [esp + 0x10]
push dword [esp + 0x78]
push eax
push ebx
call fcn.1002f75d
add esp, 0xc
cmp byte [ebx], 5
jne 0x100481c7
mov byte [esi], 5
jmp 0x1004820d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp cl, 4
jne 0x100481d8
mov cl, 4
jmp 0x10048200
mov dword [esp], ecx
mov dword [esp + 4], eax
mov eax, dword [0x1017e714]
mov eax, dword [eax]
test eax, eax
je 0x10048217
push edi
call fcn.1005ddf7
add esp, 4
mov ecx, dword [esp]
mov eax, dword [esp + 4]
mov edx, ecx
shrd edx, eax, 8
shl edx, 8
movzx ecx, cl
or ecx, edx
mov dword [esi + 4], eax
mov dword [esi], ecx
mov eax, esi
add esp, 0x5c
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebp, dword [0x1017d4ac]
mov al, byte [ebp + 8]
movzx ecx, al
lea edx, [ecx - 1]
cmp edx, 2
jae 0x100482de
movzx eax, al
push eax
push dword [ebp]
call fcn.1008c89d
add esp, 8
test al, al
je 0x100481ea
mov ecx, dword [ebp]
mov edx, dword [ecx + 0x20]
test edx, edx
je 0x100482fc
lea eax, [ecx + 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [ecx + 0x1c]
mov ebp, dword [ecx + 0x24]
mov ecx, dword [ecx + 0x28]
mov dword [esp + 8], ecx
lea ecx, [esp + 0x48]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov dword [ecx + 8], ebp
mov eax, dword [esp + 8]
mov dword [ecx + 0xc], eax
xor eax, eax
mov dword [ecx + 0x10], eax
mov edx, esp
lea ebp, [esp + 0x28]
mov dword [ebp], edx
mov dword [ebp + 4], fcn.100b9e40
mov dword [esp + 0x10], 0x1010a7b0
xor edx, edx
inc edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], edx
lea eax, [esp + 0x3c]
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov dword [eax + 8], 0x101099f8
lea ebx, [esp + 0x30]
push eax
push dword [esp + 0x10]
push ebx
call fcn.100779c8
add esp, 0xc
push ebx
mov eax, dword [0x1017d4ac]
push dword [eax]
call fcn.1008cd25
add esp, 8
jmp 0x100481ea
test ecx, ecx
je 0x100481ea
push ebp
call fcn.100ff6f5
add esp, 4
test al, al
jne 0x1004822f
jmp 0x100481ea
push 0x1010a784
push 0x22
push str.FieldSet_corrupted__this_is_a_bug_main.rs_srcprotoh1dispatch.rs
call fcn.10101180
Function at 0x10051aff
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [esp + 0x78]
mov ecx, dword [eax + 4]
mov dword [esp + 4], ecx
mov eax, dword [eax + 8]
push 0
mov dword [esp + 0x14], eax
push eax
call fcn.100a7964
add esp, 8
mov ebx, edx
mov dword [esp + 0xc], eax
test eax, eax
je 0x10051c9f
mov esi, dword [esp + 4]
lea eax, [esi + 0x2c]
mov dword [esp + 0x34], eax
imul eax, dword [esp + 0x10], 0x34
mov dword [esp + 0x38], eax
xor edi, edi
lea edx, [esp + 0x18]
mov ebp, dword [esp + 0xc]
cmp dword [esp + 0x38], edi
je 0x10051c9f
movzx eax, word [esi + 0x30]
mov word [esp + 0xa], ax
mov eax, dword [esi + 0x20]
test eax, eax
je 0x10051bb1
mov ecx, dword [esp + 0x34]
add ecx, edi
mov edx, dword [esp + 4]
push dword [edx + edi + 0x28]
push dword [edx + edi + 0x24]
push ecx
lea ecx, [esp + 0x24]
push ecx
call dword [eax]
lea edx, [esp + 0x28]
add esp, 0x10
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov al, byte [esp + 0x1c]
mov byte [esp + 3], al
lea eax, [esp + 0x1d]
movsd xmm0, qword [eax]
movsd qword [esp + 0x28], xmm0
mov eax, dword [eax + 7]
mov dword [esp + 0x2f], eax
jmp 0x10051bc5
mov eax, dword [esp + 4]
mov al, byte [eax + edi + 0x24]
mov byte [esp + 3], al
mov dword [esp + 0x14], 0
lea eax, [esi + 0x18]
mov ecx, dword [esi + 0xc]
push dword [esi + 0x14]
push dword [esi + 0x10]
push eax
push edx
call dword [ecx]
add esp, 0x10
mov al, byte [esi + 0x1c]
cmp dword [esi], 0
je 0x10051bf9
mov ecx, dword [esp + 4]
mov edx, dword [ecx + edi + 4]
mov dword [esp + 0x40], edx
mov ecx, dword [ecx + edi + 8]
mov dword [esp + 0x3c], ecx
xor ecx, ecx
inc ecx
jmp 0x10051bfb
xor ecx, ecx
mov edx, dword [esp + 0x2f]
mov dword [esp + 0x4b], edx
movups xmm0, xmmword [esp + 0x18]
movzx edx, word [esp + 0x28]
mov word [esp + 0x18], dx
mov dl, byte [esp + 0x2a]
mov byte [esp + 0x1a], dl
movsd xmm1, qword [esp + 0x28]
movsd qword [esp + 0x44], xmm1
movups xmmword [esp + 0x50], xmm0
mov dword [ebx + edi], ecx
mov ecx, dword [esp + 0x40]
mov dword [ebx + edi + 4], ecx
mov ecx, dword [esp + 0x3c]
mov dword [ebx + edi + 8], ecx
movups xmm0, xmmword [esp + 0x50]
movups xmmword [ebx + edi + 0xc], xmm0
mov byte [ebx + edi + 0x1c], al
movzx eax, word [esp + 0x18]
mov word [ebx + edi + 0x1d], ax
mov al, byte [esp + 0x1a]
mov byte [ebx + edi + 0x1f], al
mov eax, dword [esp + 0x14]
mov dword [ebx + edi + 0x20], eax
mov al, byte [esp + 3]
mov byte [ebx + edi + 0x24], al
movsd xmm0, qword [esp + 0x44]
movsd qword [ebx + edi + 0x25], xmm0
mov eax, dword [esp + 0x4b]
mov dword [ebx + edi + 0x2c], eax
movzx eax, word [esp + 0xa]
mov word [ebx + edi + 0x30], ax
dec ebp
add esi, 0x34
add edi, 0x34
test ebp, ebp
lea edx, [esp + 0x18]
jne 0x10051b4f
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x1005a7c1
Capabilities:
Get client handle via schannel
Get inbound credentials handle via credssp
Get outbound credentials handle via credssp

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x50
mov edi, dword [esp + 0x68]
mov al, byte [esp + 0x6c]
mov byte [esp + 3], al
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
xorps xmm0, xmm0
movups xmmword [esp + 0x40], xmm0
movups xmmword [esp + 0x34], xmm0
movups xmmword [esp + 0x24], xmm0
mov dword [esp + 0x18], 4
mov dword [esp + 0x48], 0x400010
cmp dword [edi + 0xc], 0x80000000
je 0x1005a817
mov eax, dword [edi + 0x14]
mov dword [esp + 0x30], eax
mov eax, dword [edi + 0x10]
mov dword [esp + 0x34], eax
cmp dword [edi + 0x18], 0x80000000
je 0x1005a847
mov eax, dword [edi + 0x1c]
mov ecx, dword [edi + 0x20]
add ecx, eax
lea edx, [esp + 0xc]
mov dword [edx], eax
mov dword [edx + 4], ecx
lea eax, [esp + 3]
mov dword [edx + 8], eax
push 0
push edx
call fcn.10059630
add esp, 8
mov dword [esp + 0x38], eax
mov esi, dword [esp + 0x64]
mov eax, dword [edi + 4]
mov ecx, dword [edi + 8]
lea ecx, [eax + ecx*4]
lea ebx, [esp + 0xc]
push ecx
push eax
push ebx
call fcn.100596f8
add esp, 0xc
mov edi, dword [ebx + 4]
mov eax, dword [ebx + 8]
lea ecx, [esp + 0x18]
mov dword [ecx + 4], eax
xor eax, eax
cmp byte [esp + 3], 1
mov dword [ecx + 8], edi
mov edx, 2
sbb edx, eax
lea ebx, [esp + 4]
push eax
push ebx
push eax
push eax
push ecx
push eax
push edx
push str.Microsoft_Unified_Security_Protocol_Provider
push eax
call dword [sym.imp.secur32.dll_AcquireCredentialsHandleA]
test eax, eax
je 0x1005a8a7
mov dword [esi + 4], eax
mov dword [esi], 0
jmp 0x1005a8d8
mov ebx, dword [esp + 4]
mov ebp, dword [esp + 8]
mov al, byte [0x1017f1d9]
push 4
push 0x10
call fcn.10007540
add esp, 8
test eax, eax
je 0x1005a8f9
xor ecx, ecx
inc ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebp
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1005a8ef
shl eax, 2
push 4
push eax
push edi
call fcn.10007550
add esp, 0xc
mov eax, esi
add esp, 0x50
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x10
push 4
call fcn.10101000

Function at 0x1005afb1
Capabilities:
Get remote cert context via schannel

Disassembly:
push esi
push eax
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, esp
mov dword [ecx], 0
push ecx
push 0x53
push eax
call dword [sym.imp.secur32.dll_QueryContextAttributesW]
test eax, eax
je 0x1005afdc
mov dword [esi], 0
mov dword [esi + 4], eax
jmp 0x1005afe5
mov eax, dword [esp]
mov dword [esi + 4], eax
mov byte [esi], 4
mov eax, esi
add esp, 4
pop esi
ret
Function at 0x10066036
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x24]
push dword [esp + 0x20]
call fcn.10083245
add esp, 4
test al, al
je 0x10066078
mov byte [esi + 0x1a], 3
mov eax, dword [edi]
test eax, eax
je 0x10066188
lea ecx, [edi + 0xc]
push dword [edi + 8]
push dword [edi + 4]
push ecx
call dword [eax + 0xc]
add esp, 0xc
jmp 0x10066188
push edi
mov esi, dword [esp + 0x24]
push esi
call fcn.10082519
add esp, 8
movzx ecx, word [esi + 0x38]
mov word [esp + 2], ax
and cx, ax
movzx ebp, cx
xor esi, esi
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0x1c]
mov ecx, ebp
mov ebp, ecx
xor ecx, ecx
cmp ebp, eax
jae 0x100660a0
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0x18]
movzx edi, word [eax + ebp*4]
cmp edi, 0xffff
je 0x1006614e
movzx eax, word [eax + ebp*4 + 2]
mov ecx, dword [esp + 0x20]
movzx ecx, word [ecx + 0x38]
mov edx, ecx
and edx, eax
mov ebx, esi
mov esi, ebp
sub esi, edx
and esi, ecx
cmp esi, ebx
mov esi, ebx
jb 0x1006614e
cmp ax, word [esp + 2]
jne 0x10066147
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0x28]
cmp eax, edi
jbe 0x100661d4
mov eax, dword [esp + 0x20]
mov eax, dword [eax + 0x24]
imul edx, edi, 0x34
mov dword [esp + 4], eax
mov ecx, dword [eax + edx + 0x20]
test ecx, ecx
setne al
mov esi, dword [esp + 0x24]
cmp dword [esi], 0
mov esi, ebx
sete bh
cmp al, bh
je 0x10066147
mov eax, dword [esp + 4]
add eax, edx
add eax, 0x20
test ecx, ecx
je 0x1006613b
push dword [esp + 0x24]
push eax
call fcn.100ae80f
add esp, 8
test al, al
je 0x10066147
jmp 0x10066192
mov al, byte [eax + 4]
mov ecx, dword [esp + 0x24]
cmp al, byte [ecx + 4]
je 0x100661be
inc esi
inc ebp
jmp 0x10066097
cmp esi, 0x200
setae al
mov edx, dword [esp + 0x20]
mov ecx, dword [edx]
xor ecx, 2
or ecx, dword [edx + 4]
setne cl
and cl, al
mov eax, dword [esp + 0x24]
movups xmm0, xmmword [eax]
mov esi, dword [esp + 0x1c]
mov dword [esi], edx
movups xmmword [esi + 4], xmm0
mov dword [esi + 0x14], ebp
movzx eax, word [esp + 2]
mov word [esi + 0x18], ax
mov byte [esi + 0x1a], cl
mov eax, esi
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [esp + 0x24]
mov eax, dword [edx]
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov dword [esi], ecx
mov dword [esi + 4], ebp
mov dword [esi + 8], edi
mov byte [esi + 0x1a], 2
test eax, eax
je 0x10066188
lea ecx, [edx + 0xc]
push dword [edx + 8]
push dword [edx + 4]
jmp 0x1006606c
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov dword [esi], eax
mov dword [esi + 4], ebp
mov dword [esi + 8], edi
mov byte [esi + 0x1a], 2
jmp 0x10066188
push 0x10111c0c
push eax
push edi
call fcn.10101330