joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a3f40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5aa4f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
push 8
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00573d8c
mov edi, eax
add esp, 4
test edi, edi
je 0x5a3f8c
push 1
mov dword [ebp - 4], 0
call fcn.00571571
add esp, 4
mov dword [edi + 4], eax
jmp 0x5a3f8e
xor edi, edi
mov dword [esi + 0x34], edi
lea eax, [esi + 4]
mov dword [esi + 0xc], eax
lea ecx, [esi + 8]
mov dword [esi + 0x10], ecx
lea eax, [esi + 0x14]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x18]
mov dword [esi + 0x20], eax
lea eax, [esi + 0x24]
mov dword [esi + 0x2c], eax
lea eax, [esi + 0x28]
mov dword [esi + 0x30], eax
mov dword [ecx], 0
mov eax, dword [esi + 0x20]
mov ecx, dword [ebp + 8]
pop edi
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0xc]
mov dword [esi + 0x38], 0xffffffff
mov byte [esi + 0x3c], 0
mov dword [eax], 0
mov eax, dword [esi + 0x1c]
mov dword [eax], 0
mov eax, dword [esi + 0x2c]
mov dword [eax], 0
mov eax, dword [esi + 0x10]
mov dword [eax], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov eax, dword [esi + 0x30]
mov dword [eax], 0
mov dword [esi], vtable.Poco::HexBinaryDecoderBuf.0
mov eax, dword [ecx]
mov eax, dword [eax + 4]
mov eax, dword [eax + ecx + 0x38]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x40], eax
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x100014f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], edx
push edi
mov edi, dword [ebp + 0xc]
test esi, esi
je 0x10001520
test dl, 3
je 0x1000151d
movzx eax, byte [edx]
inc edx
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [edi + eax*4]
dec esi
jne 0x10001504
mov dword [ebp - 4], edx
lea eax, [edx + esi]
cmp esi, 0xc
jb 0x100015fc
sub eax, 0xc
mov dword [ebp + 8], eax
xor ecx, dword [edx]
mov ebx, dword [edx + 4]
mov edx, ebx
shr edx, 8
mov eax, ebx
shr eax, 0x10
and edx, 0xff
and eax, 0xff
mov esi, dword [edi + edx*4 + 0x1800]
mov edx, ecx
xor esi, dword [edi + eax*4 + 0x1400]
mov eax, ebx
shr eax, 0x18
shr edx, 8
and edx, 0xff
xor esi, dword [edi + eax*4 + 0x1000]
movzx eax, bl
mov edx, dword [edi + edx*4 + 0x2800]
mov ebx, dword [ebp - 4]
xor esi, dword [edi + eax*4 + 0x1c00]
mov eax, ecx
shr eax, 0x10
mov ebx, dword [ebx + 8]
and eax, 0xff
xor edx, dword [edi + eax*4 + 0x2400]
mov eax, ebx
shr eax, 8
and eax, 0xff
xor edx, dword [edi + eax*4 + 0x800]
mov eax, ebx
shr eax, 0x10
and eax, 0xff
xor edx, dword [edi + eax*4 + 0x400]
mov eax, ecx
shr eax, 0x18
xor edx, dword [edi + eax*4 + 0x2000]
movzx eax, cl
xor edx, dword [edi + eax*4 + 0x2c00]
movzx eax, bl
shr ebx, 0x18
xor edx, dword [edi + eax*4 + 0xc00]
xor edx, dword [edi + ebx*4]
mov eax, dword [ebp + 8]
xor edx, esi
mov ecx, edx
mov edx, dword [ebp - 4]
add edx, 0xc
mov dword [ebp - 4], edx
cmp edx, eax
jbe 0x10001532
add eax, 0xc
xor esi, esi
mov ebx, eax
sub ebx, edx
cmp edx, eax
cmova ebx, esi
test ebx, ebx
je 0x10001628
jmp 0x10001610
movzx eax, byte [edx]
lea edx, [edx + 1]
xor eax, ecx
inc esi
and eax, 0xff
shr ecx, 8
xor ecx, dword [edi + eax*4]
cmp esi, ebx
jb 0x10001610
pop edi
pop esi
mov eax, ecx
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100025f0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
shr ebx, 2
push esi
mov esi, ecx
mov dword [ebp - 4], 1
mov eax, ebx
xor ecx, ecx
shr eax, 1
add eax, 3
mov dword [esi], eax
add esi, 0x10
push edi
test ebx, ebx
je 0x10002625
mov eax, dword [edx]
lea edx, [edx + 4]
mov dword [esi + ecx*4], eax
inc ecx
cmp ecx, ebx
jb 0x10002618
mov eax, dword [esi + ebx*4 - 4]
lea ecx, [ebx + 0xe]
lea ecx, [ebx + ecx*2]
lea edi, [esi + ecx*4]
mov dword [ebp + 8], edi
xor edi, edi
mov ecx, dword [ebp + 8]
lea ebx, [ebx]
test edi, edi
jne 0x100026a6
movzx ecx, al
mov edi, ebx
movzx edx, byte [ecx + 0x100b3380]
mov ecx, eax
shr ecx, 0x18
shl edx, 8
movzx ecx, byte [ecx + 0x100b3380]
or edx, ecx
mov ecx, eax
shr ecx, 0x10
and ecx, 0xff
shr eax, 8
and eax, 0xff
shl edx, 8
movzx ecx, byte [ecx + 0x100b3380]
movzx eax, byte [eax + 0x100b3380]
or edx, ecx
mov ecx, dword [ebp - 4]
xor eax, ecx
shl edx, 8
add ecx, ecx
or eax, edx
test ecx, 0x100
mov edx, 0x1b
cmovne ecx, edx
mov dword [ebp - 4], ecx
jmp 0x100026f9
cmp edi, 4
jne 0x100026fc
cmp ebx, 6
jbe 0x100026fc
mov ecx, eax
shr ecx, 0x10
and ecx, 0xff
movzx edx, byte [ecx + 0x100b3380]
mov ecx, eax
shr ecx, 0x18
movzx ecx, byte [ecx + 0x100b3380]
shl ecx, 8
or edx, ecx
mov ecx, eax
shr ecx, 8
and ecx, 0xff
shl edx, 8
movzx eax, al
movzx ecx, byte [ecx + 0x100b3380]
movzx eax, byte [eax + 0x100b3380]
or edx, ecx
shl edx, 8
or eax, edx
mov ecx, dword [ebp + 8]
xor eax, dword [esi]
dec edi
mov dword [esi + ebx*4], eax
add esi, 4
cmp esi, ecx
jne 0x10002640
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10004200
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jae 0x10004216
xor eax, eax
mov esp, ebp
pop ebp
ret
call fcn.10004370
cmp eax, 7
jb 0x10004210
mov edx, 7
lea ecx, [ebp - 0x10]
call fcn.10004350
mov eax, dword [ebp - 0xc]
shr eax, 0x1d
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10004240
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jae 0x10004256
xor eax, eax
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
call fcn.100042f0
test eax, eax
je 0x10004250
mov eax, dword [ebp - 4]
shr eax, 0x1a
and eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x10004320
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 5
jae 0x10004336
xor eax, eax
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
call fcn.100042f0
neg eax
sbb eax, eax
and eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10005c20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov dword [ecx], 0
mov dword [ecx + 0x34], 0
mov byte [ecx + 0x1f], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x24], 0
mov dword [ecx + 0x468], 0xffffffff
mov dword [ecx + 0x46c], 0xffffffff
call fcn.100062d0
xor edx, edx
lea esi, [ecx + 0x60]
mov edi, edi
mov ecx, edx
lea esi, [esi + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [esi - 4], eax
cmp edx, 0x100
jb 0x10005c60
pop esi
ret
Function at 0x1000e4f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
movzx esi, word [ecx]
mov eax, esi
mov dword [ebp - 4], ebx
xor eax, 0x7f0
shr esi, 4
shr eax, 4
mov edx, dword [edi + esi*4]
mov eax, dword [edi + eax*4]
mov dword [ebp + 0xc], eax
movzx eax, word [ecx + 0x10]
mov esi, dword [ebp + 0xc]
shr eax, 4
mov dword [ebp - 0x14], edx
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x1000e577
mov esi, ecx
mov dword [ebp - 8], eax
add ebx, 4
push edi
push ebx
mov ecx, esi
call fcn.10010440
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x20]
push edi
push eax
lea ecx, [esi + 0x10]
call fcn.10010440
mov edx, dword [ebp - 0x14]
add ebx, 0x440
add esi, 0x20
dec dword [ebp - 8]
jne 0x1000e544
mov ecx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp - 4]
mov ebx, dword [ebx]
cmp ebx, 0x10
jbe 0x1000e657
mov eax, dword [ebp - 4]
add ebx, 0xfffffff1
add eax, 0x44
shr ebx, 1
mov dword [ebp - 0x10], eax
movzx eax, word [ecx + 0x10]
xor eax, 0x7f0
shr eax, 4
add esi, dword [edi + eax*4]
lea eax, [ebx + 0x180]
mov dword [ebp + 0xc], esi
lea eax, [ecx + eax*2]
jmp 0x1000e5b0
dec ebx
sub eax, 2
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], ebx
lea eax, [ebx + 0x80]
mov ebx, dword [ebp + 8]
mov edx, eax
shr eax, 1
and edx, 1
neg edx
shr edx, 4
movzx ecx, word [ebx + eax*2 + 0x200]
and edx, 0x7f
shr ecx, 4
xor ecx, edx
add esi, dword [edi + ecx*4]
cmp eax, 2
jae 0x1000e5c3
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
movzx ecx, word [eax]
mov eax, ecx
xor ecx, 0x7f0
shr eax, 4
shr ecx, 4
mov eax, dword [edi + eax*4]
add eax, esi
mov dword [edx + ebx*8], eax
mov eax, dword [edi + ecx*4]
add eax, esi
mov esi, dword [ebp + 0xc]
mov dword [edx + ebx*8 + 4], eax
mov eax, dword [ebp - 8]
test ebx, ebx
jne 0x1000e5b0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx]
lea ebx, [eax*4 - 0x40]
mov eax, dword [ebp - 0xc]
cmp eax, 1
jbe 0x1000e657
lea esi, [ecx + 0x484]
lea edi, [eax - 1]
lea esp, [esp]
push ebx
push edx
push esi
call fcn.1009b860
mov edx, dword [ebp - 0x10]
add esp, 0xc
add esi, 0x440
dec edi
jne 0x1000e640
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x1000e7e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov edi, ecx
or edx, 0x100
mov esi, edx
shr edx, 1
and esi, 1
neg esi
shr esi, 4
movzx ecx, word [edi + edx*2]
and esi, 0x7f
shr ecx, 4
xor ecx, esi
add eax, dword [ebx + ecx*4]
cmp edx, 2
jae 0x1000e7f3
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x1000e820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, 0x100
mov dword [ebp - 4], ecx
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
or edx, esi
add edi, edi
mov ecx, esi
and ecx, edi
mov eax, edx
add ecx, esi
shr eax, 8
add eax, ecx
mov ecx, dword [ebp - 4]
movzx ecx, word [ecx + eax*2]
mov eax, edx
shr eax, 7
add edx, edx
and eax, 1
shr ecx, 4
neg eax
shr eax, 4
and eax, 0x7f
xor ecx, eax
mov eax, dword [ebp + 0xc]
add ebx, dword [eax + ecx*4]
mov ecx, edx
xor ecx, edi
not ecx
and esi, ecx
cmp edx, 0x10000
jb 0x1000e836
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x10010440
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov dword [ebp - 8], edx
xor ebx, ebx
push esi
mov edx, ecx
push edi
mov dword [ebp - 4], edx
mov edi, ebx
mov esi, ebx
shr esi, 2
shr edi, 1
mov eax, edi
and eax, 1
movzx ecx, word [edx + esi*2 + 4]
neg eax
shr eax, 4
neg esi
and eax, 0x7f
shr ecx, 4
xor ecx, eax
and esi, 0x7f0
movzx eax, word [edx + 2]
xor esi, eax
mov eax, dword [ebp + 0xc]
shr esi, 4
mov edx, dword [eax + ecx*4]
add edx, dword [eax + esi*4]
mov eax, dword [ebp - 4]
mov esi, dword [ebp + 0xc]
add edx, dword [ebp - 8]
movzx ecx, word [eax + edi*2 + 8]
mov edi, dword [ebp + 8]
mov eax, ecx
shr eax, 4
xor ecx, 0x7f0
shr ecx, 4
mov eax, dword [esi + eax*4]
add eax, edx
mov dword [edi + ebx*4], eax
mov eax, dword [esi + ecx*4]
add eax, edx
mov edx, dword [ebp - 4]
mov dword [edi + ebx*4 + 4], eax
add ebx, 2
cmp ebx, 8
jb 0x10010453
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x100110d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push esi
mov esi, ecx
mov ecx, 0x20
push edi
mov eax, dword [esi + 4]
cmp eax, ecx
mov dword [esi + 0x78], 0
cmova eax, ecx
mov dword [esi + 0x7c], 0
mov dword [esi + 0x54], eax
mov eax, dword [esi]
mov dword [esi + 0x30], 1
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 1
mov dword [esi + 0x70], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x90], 0xffffffff
mov dword [esi + 0x94], 0xffffffff
mov dword [esi + 0x68], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0
mov dword [esi + 0x50], 0
mov dword [esi + 0x60], 0
mov dword [esi + 0x64], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x84], 0
mov dword [esi + 0x58], 0
cmp eax, dword [esi + 0x20]
je 0x100111cc
lea edi, [esi + 0xc8]
mov ebx, ecx
lea ecx, [ecx]
cmp dword [edi + 8], 0
je 0x100111ad
mov ecx, edi
call fcn.10011080
add edi, 0x28
dec ebx
jne 0x100111a0
mov edx, dword [esi + 0x5c]
test edx, edx
je 0x100111c7
mov eax, dword [esi + 0x14]
mov ecx, eax
mov eax, dword [eax + 4]
call eax
mov dword [esi + 0x5c], ebx
mov eax, dword [esi]
mov dword [esi + 0x20], eax
mov edx, dword [esi + 0x10]
lea ecx, [esi + 0x98]
call fcn.10011ff0
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea eax, [ecx + 5]
lea eax, [eax + eax*4]
lea ebx, [esi + eax*8]
lea eax, [ecx + 1]
mov ecx, ebx
mov dword [esi + 0x58], eax
call fcn.10011050
mov edi, eax
test edi, edi
jne 0x1001123f
lea ecx, [ebx + 0x20]
call fcn.10012c00
mov edi, eax
test edi, edi
jne 0x1001123f
lea ecx, [ebx + 0x1c]
call fcn.10012c00
mov edi, eax
test edi, edi
jne 0x1001123f
push ebx
call fcn.10012180
mov edi, eax
test edi, edi
je 0x10011251
mov ecx, esi
mov dword [esi + 0x44], 0
call fcn.100110b0
test edi, edi
jle 0x1001124a
movzx edi, di
or edi, 0x80070000
test edi, edi
je 0x10011251
mov dword [esi + 0x40], edi
cmp dword [esi + 0x38], 0
jne 0x1001126a
cmp dword [esi + 0x40], 0
jne 0x1001126a
cmp dword [esi + 0x3c], 0
jne 0x1001126a
mov dword [esi + 0x44], 0
xor eax, eax
cmp dword [esi + 0x44], eax
cmovne edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x100128e0
Capabilities:
Hash data using sha256

Disassembly:
push ebx
mov ebx, ecx
push esi
mov esi, edx
push edi
mov edx, dword [ebx + 8]
and edx, 0x3f
mov byte [edx + ebx + 0x40], 0x80
inc edx
cmp edx, 0x38
jbe 0x10012927
cmp edx, 0x40
je 0x10012919
mov ecx, 0x40
lea edi, [ebx + 0x40]
sub ecx, edx
add edi, edx
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebx]
lea edx, [ebx + 0x40]
push 1
lea ecx, [ebx + 0x20]
call eax
xor edx, edx
mov eax, 0x38
sub eax, edx
push eax
lea eax, [ebx + 0x40]
add eax, edx
push 0
push eax
call fcn.1009c990
mov ecx, dword [ebx + 8]
lea edi, [ebx + 0x20]
mov eax, dword [ebx + 0xc]
lea edx, [ebx + 0x40]
shld eax, ecx, 3
add esp, 0xc
shl ecx, 3
bswap eax
bswap ecx
mov dword [ebx + 0x78], eax
mov eax, dword [ebx]
mov dword [ebx + 0x7c], ecx
mov ecx, edi
push 1
call eax
mov edx, 4
lea esp, [esp]
mov ecx, dword [edi + 4]
lea esi, [esi + 8]
mov eax, dword [edi]
lea edi, [edi + 8]
bswap eax
mov dword [esi - 8], eax
bswap ecx
mov dword [esi - 4], ecx
dec edx
jne 0x10012970
pop edi
pop esi
mov ecx, ebx
pop ebx
jmp fcn.100129b0

Function at 0x100129a0
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [section..data]
mov dword [ecx], eax
jmp fcn.100129b0

Function at 0x100129b0
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x20], 0x6a09e667
mov dword [ecx + 0x24], 0xbb67ae85
mov dword [ecx + 0x28], 0x3c6ef372
mov dword [ecx + 0x2c], 0xa54ff53a
mov dword [ecx + 0x30], 0x510e527f
mov dword [ecx + 0x34], 0x9b05688c
mov dword [ecx + 0x38], 0x1f83d9ab
mov dword [ecx + 0x3c], 0x5be0cd19
ret

Function at 0x10012de0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0
push dword [ebp + 8]
push edx
push 0
push 0
call fcn.1009ca20
add esp, 0x18
mov dword [esi], eax
mov ecx, eax
call fcn.10012c80
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x10012e10
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 4
push dword [ebp + 8]
push edx
push 0
push 0
call fcn.1009ca20
mov edi, eax
add esp, 0x18
mov ecx, edi
mov dword [esi], edi
call fcn.10012c80
mov esi, eax
test edi, edi
je 0x10012e64
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x10012e62
call fcn.10012c10
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x10012f20
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx], edx
dec edx
je 0x10012f46
sub edx, 3
je 0x10012f37
sub edx, 6
jne 0x10012f4d
add ecx, 0x10
jmp fcn.100129a0
mov dword [ecx + 8], 0xffffffff
mov dword [ecx + 0xc], 0xffffffff
ret
mov dword [ecx + 4], 0xffffffff
ret
Function at 0x10013280
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, edx
mov ebx, ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push edi
mov edi, dword [ebp + 8]
test esi, esi
je 0x100132c4
mov ecx, dword [ebp + 0x10]
lea ecx, [ecx]
test bl, 3
je 0x100132c4
movzx eax, byte [ebx]
inc ebx
xor eax, edi
mov dword [ebp - 4], ebx
shrd edi, edx, 8
and eax, 0xff
shr edx, 8
xor edi, dword [ecx + eax*8]
xor edx, dword [ecx + eax*8 + 4]
dec esi
jne 0x100132a0
lea ecx, [ebx + esi]
mov dword [ebp + 0xc], ecx
cmp esi, 0xc
jb 0x10013410
sub ecx, 0xc
mov dword [ebp + 0xc], ecx
lea esp, [esp]
mov esi, dword [ebp - 4]
mov ebx, dword [ebx]
xor ebx, edi
mov edi, dword [ebp + 0x10]
mov eax, ebx
mov dword [ebp - 8], ebx
xor edx, dword [esi + 4]
mov ecx, edx
shr eax, 0x10
and eax, 0xff
mov esi, dword [esi + 8]
mov edx, ebx
mov ebx, dword [ebp + 0x10]
shr edx, 8
and edx, 0xff
mov edi, dword [edi + edx*8 + 0x5000]
xor edi, dword [ebx + eax*8 + 0x4800]
mov edx, dword [ebx + edx*8 + 0x5004]
xor edx, dword [ebx + eax*8 + 0x4804]
mov eax, ecx
shr eax, 8
and eax, 0xff
xor edi, dword [ebx + eax*8 + 0x3000]
xor edx, dword [ebx + eax*8 + 0x3004]
mov eax, ecx
shr eax, 0x10
and eax, 0xff
xor edi, dword [ebx + eax*8 + 0x2800]
xor edx, dword [ebx + eax*8 + 0x2804]
mov eax, esi
shr eax, 8
and eax, 0xff
xor edi, dword [ebx + eax*8 + 0x1000]
xor edx, dword [ebx + eax*8 + 0x1004]
mov eax, esi
mov esi, ebx
shr eax, 0x10
mov ebx, dword [ebp - 8]
and eax, 0xff
xor edi, dword [esi + eax*8 + 0x800]
xor edx, dword [esi + eax*8 + 0x804]
mov eax, ebx
shr eax, 0x18
xor edi, dword [esi + eax*8 + 0x4000]
xor edx, dword [esi + eax*8 + 0x4004]
mov eax, ecx
shr eax, 0x18
xor edi, dword [esi + eax*8 + 0x2000]
xor edx, dword [esi + eax*8 + 0x2004]
movzx eax, bl
mov ebx, dword [ebp - 4]
xor edi, dword [esi + eax*8 + 0x5800]
xor edx, dword [esi + eax*8 + 0x5804]
movzx eax, cl
mov ecx, dword [ebx + 8]
add ebx, 0xc
mov dword [ebp - 4], ebx
xor edi, dword [esi + eax*8 + 0x3800]
xor edx, dword [esi + eax*8 + 0x3804]
movzx eax, cl
shr ecx, 0x18
xor edi, dword [esi + eax*8 + 0x1800]
xor edx, dword [esi + eax*8 + 0x1804]
xor edi, dword [esi + ecx*8]
xor edx, dword [esi + ecx*8 + 4]
mov ecx, dword [ebp + 0xc]
cmp ebx, ecx
jbe 0x100132e0
add ecx, 0xc
mov dword [ebp + 0xc], ecx
jmp 0x10013413
mov esi, dword [ebp + 0x10]
xor eax, eax
sub ecx, ebx
cmp ebx, dword [ebp + 0xc]
cmova ecx, eax
mov dword [ebp + 0x10], ecx
test ecx, ecx
je 0x10013446
movzx ecx, byte [ebx]
lea ebx, [ebx + 1]
xor ecx, edi
inc eax
shrd edi, edx, 8
and ecx, 0xff
shr edx, 8
xor edi, dword [esi + ecx*8]
xor edx, dword [esi + ecx*8 + 4]
cmp eax, dword [ebp + 0x10]
jb 0x10013424
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10016470
Capabilities:
Hash data using sha256

Disassembly:
mov dword [ecx + 0x10], 0xffffffff
mov dword [ecx + 0x14], 0xffffffff
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x1c], 0
mov dword [ecx + 0x20], 0
add ecx, 0x28
jmp fcn.10012f20

Function at 0x1001ca90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100af458
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100df0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.10019ec0
lea ecx, [esi + 0x10]
mov dword [ebp - 4], 0
mov dword [esi + 0xc], 0
call fcn.10019ec0
mov dword [esi + 0x1c], 0
mov eax, esi
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001ef20
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ab41b
mov eax, dword fs:[0]
push eax
sub esp, 0x88
push ebx
push esi
push edi
mov eax, dword [0x100df0c0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
cmp byte [0x101f5e60], 0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x1001ef99
mov edx, edi
lea ecx, [ebp - 0x24]
call fcn.1001b700
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x24]
mov esi, eax
call fcn.1009cfdf
add esp, 4
test esi, esi
je 0x1001f07f
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.10024200
mov esi, eax
cmp esi, 1
je 0x1001efbf
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1001ef85
call ebx
cmp eax, 0xb7
je 0x1001f07f
test esi, esi
je 0x1001f07f
lea ecx, [ebp - 0x18]
call fcn.10019ec0
cmp esi, 1
mov dword [ebp - 4], 0
lea edx, [ebp - 0x18]
mov ecx, edi
setne al
movzx eax, al
push eax
call fcn.10023cf0
test al, al
je 0x1001f06d
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1001f007
push dword [ebp - 0x18]
mov bl, 1
jmp 0x1001f0d8
call ebx
cmp eax, 0xb7
je 0x1001f01a
push dword [ebp - 0x18]
xor bl, bl
jmp 0x1001f0d8
lea ecx, [ebp - 0x5c]
call fcn.100201f0
lea ecx, [ebp - 0x34]
call fcn.10019ec0
push 0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 1
call fcn.100205f0
test al, al
jne 0x1001f054
push dword [ebp - 0x34]
xor bl, bl
call fcn.1009cfdf
add esp, 4
push dword [ebp - 0x18]
jmp 0x1001f0d8
mov ebx, dword [ebp - 0x3c]
push dword [ebp - 0x34]
shr ebx, 4
and bl, 1
call fcn.1009cfdf
add esp, 4
push dword [ebp - 0x18]
jmp 0x1001f0d8
push dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
call fcn.1009cfdf
add esp, 4
call ebx
cmp eax, 0xb7
je 0x1001f09c
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x94]
call fcn.100201f0
lea ecx, [ebp - 0x6c]
call fcn.10019ec0
push 0
push edi
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 2
call fcn.100205f0
test al, al
jne 0x1001f0cc
xor bl, bl
jmp 0x1001f0d5
mov ebx, dword [ebp - 0x74]
shr ebx, 4
and bl, 1
push dword [ebp - 0x6c]
call fcn.1009cfdf
mov al, bl
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret