joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10dab43
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call fcn.010494fa
mov esi, eax
cmp esi, edi
jl 0x10dac6a
mov eax, dword [ebp - 0xc]
push edi
push edi
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 4]
call fcn.0106d07b
push dword [ebp - 4]
call fcn.0106d02f
test al, al
jne 0x10daba6
cmp dword [ebp - 4], edi
jne 0x10dabb7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01032e15
jmp 0x10dac64
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x10daba6
cmp dword [ebp - 0x14], edi
je 0x10dabda
mov esi, 0x80070057
jmp 0x10dac6a
cmp esi, 0x100000
ja 0x10dabd0
push esi
call fcn.010324a4
lea ecx, [ebp - 8]
mov ebx, eax
call fcn.0103a5a4
cmp ebx, edi
jne 0x10dac00
mov dword [ebp - 8], edi
mov esi, 0x8007000e
jmp 0x10dac6a
push edi
lea eax, [ebp - 0x18]
push eax
push esi
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10daba6
cmp dword [ebp - 0x18], esi
je 0x10dac23
mov esi, 0x8000ffff
jmp 0x10dac6a
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x74]
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
push esi
push ebx
push eax
call dword [ecx + 0xc]
mov esi, eax
cmp esi, edi
jl 0x10dac6a
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x20]
push eax
call fcn.010da4de
mov esi, eax
cmp esi, edi
jl 0x10dac6a
add ebx, 0x2c
push ebx
push dword [ebp + 8]
call fcn.01034ec1
mov esi, eax
cmp esi, edi
jge 0x10dac8f
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x10dac8f
test byte [eax + 0x3c], 2
je 0x10dac8f
push esi
push 0x1011bc4
push 0x21
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
lea ecx, [ebp - 0xc]
call fcn.01033b21
lea ecx, [ebp - 0x10]
call fcn.0103a897
lea ecx, [ebp - 8]
call fcn.0103a5a4
lea ecx, [ebp - 4]
call fcn.0106d05c
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10dd0cc
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 4]
push edi
xor ebx, ebx
call fcn.0106d02f
test al, al
jne 0x10dd0e9
test edi, edi
jne 0x10dd0f0
mov ebx, 0x80004005
jmp 0x10dd12a
mov esi, edi
push esi
call fcn.0106d02f
movzx eax, al
neg eax
sbb eax, eax
not eax
and eax, esi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x10dd121
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01032e15
mov ebx, eax
jmp 0x10dd126
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test ebx, ebx
jge 0x10dd14f
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x10dd14f
test byte [eax + 0x3c], 2
je 0x10dd14f
push ebx
push 0x1012790
push 0x13
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x10dd158
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, ecx
stosd dword es:[edi], eax
mov edi, dword [esi + 4]
push edi
call fcn.0106d02f
test al, al
jne 0x10dd184
test edi, edi
jne 0x10dd18b
mov ebx, 0x80004005
jmp 0x10dd1e5
mov eax, dword [ebp + 0x14]
mov esi, edi
push esi
mov dword [ebp - 0xc], eax
call fcn.0106d02f
mov ecx, dword [ebp + 0x10]
movzx eax, al
neg eax
sbb eax, eax
not eax
and eax, esi
mov esi, dword [ebp + 0xc]
neg ecx
sbb ecx, ecx
lea edx, [ebp - 0x14]
and ecx, edx
push ecx
lea ecx, [ebp + 0x14]
push ecx
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10dd1d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01032e15
mov ebx, eax
jmp 0x10dd1e1
cmp dword [ebp + 0x14], esi
je 0x10dd20a
mov ebx, 0x8004e109
test ebx, ebx
jge 0x10dd20a
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x10dd20a
test byte [eax + 0x3c], 2
je 0x10dd20a
push ebx
push 0x1012790
push 0x16
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
Function at 0x10dd4fc
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 4]
push edi
xor ebx, ebx
call fcn.0106d02f
test al, al
jne 0x10dd519
test edi, edi
jne 0x10dd520
mov ebx, 0x80004005
jmp 0x10dd569
mov esi, edi
push esi
call fcn.0106d02f
movzx eax, al
neg eax
sbb eax, eax
push 0
not eax
and eax, esi
mov esi, dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
push ecx
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10dd55b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01032e15
mov ebx, eax
jmp 0x10dd565
cmp dword [ebp + 0xc], esi
je 0x10dd58e
mov ebx, 0x8004e10a
test ebx, ebx
jge 0x10dd58e
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x10dd58e
test byte [eax + 0x3c], 2
je 0x10dd58e
push ebx
push 0x1012790
push 0x17
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x10dd7ff
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push dword [ebp + 8]
mov ebx, ecx
xor edi, edi
call esi
test eax, eax
jne 0x10dd86a
push dword [ebp + 8]
mov ecx, ebx
call fcn.010dd597
mov edi, eax
test edi, edi
jl 0x10dd845
push dword [ebp + 8]
call esi
test eax, eax
jne 0x10dd841
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01032e15
mov edi, eax
test edi, edi
jge 0x10dd86a
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x10dd86a
test byte [eax + 0x3c], 2
je 0x10dd86a
push edi
push 0x1012790
push 0x1f
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10ddbb1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
cmp dword [ebp + 8], ebx
je 0x10ddc61
cmp dword [esi + 0x10], ebx
jne 0x10ddc61
mov eax, dword [0x12d2c30]
mov ebx, 0x12d2c30
mov edi, 0x1012790
cmp eax, ebx
je 0x10ddc01
mov edx, dword [eax + 0x3c]
mov ecx, 0x8000004
and edx, ecx
cmp edx, ecx
jne 0x10ddc01
push dword [esi + 8]
push edi
push 0xf
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.010d103c
lea ecx, [esi + 4]
call fcn.0106d05c
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10ddc1f
push dword [esi + 8]
jmp 0x10ddd20
mov eax, dword [0x12d2c30]
cmp eax, ebx
je 0x10ddd27
mov eax, dword [eax + 0x3c]
mov ecx, 0x1000004
and eax, ecx
cmp eax, ecx
jne 0x10ddd27
mov ebx, dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x12d2c30]
push ebx
push edi
push 0x10
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0109c10b
jmp 0x10ddd27
mov edi, dword [esi + 4]
push edi
call fcn.0106d02f
test al, al
jne 0x10ddd27
cmp edi, ebx
je 0x10ddd27
mov edi, 0x1012790
cmp dword [esi], ebx
jne 0x10ddcd4
cmp dword [esi + 0x10], ebx
jne 0x10ddcd4
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x10ddcb0
mov edx, dword [eax + 0x3c]
mov ecx, 0x8000004
and edx, ecx
cmp edx, ecx
jne 0x10ddcb0
push edi
push 0x11
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.010dcdc0
mov ebx, dword [esi + 4]
push ebx
call fcn.0106d02f
movzx eax, al
neg eax
sbb eax, eax
not eax
and eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
neg eax
sbb eax, eax
inc eax
mov dword [esi], eax
xor ebx, ebx
lea ecx, [esi + 4]
call fcn.0106d05c
cmp dword [esi + 0x10], ebx
jne 0x10ddd27
cmp dword [esi], ebx
je 0x10ddd1d
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x10ddc17
mov edx, dword [eax + 0x3c]
mov ecx, 0x1000004
and edx, ecx
cmp edx, ecx
jne 0x10ddc17
push dword [esi + 8]
push edi
push 0x12
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.010d103c
jmp 0x10ddc17
push dword [esi + 0xc]
mov ecx, esi
call fcn.010dd7ff
pop edi
mov dword [esi + 0x10], 1
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10e0a10
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10e0a30
or eax, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ebp
ret 8

Function at 0x10e1c81
Capabilities:
Copy file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi + 0x10], ebx
jne 0x10e1c9a
xor edi, edi
jmp 0x10e1d48
lea eax, [ebp - 4]
push eax
call fcn.010dd46c
mov edi, eax
cmp edi, ebx
jl 0x10e1d23
push ebx
mov ecx, esi
call fcn.010ddbb1
push dword [esi + 0xc]
mov ecx, esi
call fcn.010dd7ff
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x10e1cdc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01032e15
jmp 0x10e1d1d
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x10e1cce
mov eax, dword [esi + 8]
push 0x2000
push eax
mov ecx, esi
call fcn.010e0a10
push dword [esi + 8]
mov ecx, esi
call fcn.010e197a
mov edi, eax
cmp edi, ebx
jl 0x10e1d23
push ebx
push dword [ebp - 4]
mov ecx, esi
mov dword [esi + 0x10], ebx
call fcn.010dd717
mov edi, eax
cmp edi, ebx
jge 0x10e1d48
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x10e1d48
test byte [eax + 0x3c], 2
je 0x10e1d48
push edi
push 0x1012790
push 0x18
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10e1d75
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push 0x1012898
push esi
mov dword [ebp - 4], esi
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
lea ecx, [ebp - 4]
mov edi, eax
call fcn.010e0e01
cmp edi, esi
jne 0x10e1da4
mov dword [ebp - 4], esi
jmp 0x10e1dbe
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push esi
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x10e1df5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.01032e15
mov ebx, eax
cmp ebx, esi
jge 0x10e1df5
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x10e1df5
test byte [eax + 0x3c], 2
je 0x10e1df5
push ebx
push 0x1012790
push 0x19
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
lea ecx, [ebp - 4]
call fcn.010e0e01
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x10e5ee5
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [esi], eax
cmp ebx, eax
je 0x10e5f39
lea eax, [ebp - 8]
push eax
push ebx
call fcn.01034ec1
mov edi, eax
test edi, edi
jl 0x10e604a
push 0x10128fc
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
call fcn.010e5de6
mov edi, eax
add esp, 0xc
test edi, edi
jl 0x10e604a
mov edi, dword [ebp - 4]
jmp 0x10e5f3f
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
cmp dword [ebp + 0xc], 0
je 0x10e5f55
push ebx
mov ecx, esi
call fcn.010dd7ff
push edi
mov ecx, esi
call fcn.010dd7ff
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10e5f79
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10e5f97
push eax
call fcn.01032e15
mov edi, eax
jmp 0x10e6046
push ebx
mov ecx, esi
call fcn.010dd7ff
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x10e5f97
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10e5f6c
push ebx
mov ecx, esi
call fcn.010e1933
cmp eax, 0x80070002
jne 0x10e6015
cmp dword [ebp + 0xc], 0
jne 0x10e5fe6
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x10e5fd8
mov edx, dword [eax + 0x3c]
mov ecx, 0x8000004
and edx, ecx
cmp edx, ecx
jne 0x10e5fd8
push 0x1012790
push 0xd
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.010dcdc0
push 0x4000200e
push 4
mov ecx, esi
call fcn.010e1d75
push edi
mov ecx, esi
call fcn.010e1315
mov edi, eax
test edi, edi
jl 0x10e604a
push ebx
mov ecx, esi
call fcn.010e197a
mov edi, eax
test edi, edi
jl 0x10e604a
push 0x2000
push ebx
mov ecx, esi
call fcn.010e0a10
and dword [esi + 0x10], 0
jmp 0x10e6022
mov edi, eax
test eax, eax
jl 0x10e604a
mov dword [esi + 0x10], 1
mov eax, dword [ebp - 8]
test eax, eax
je 0x10e6046
and dword [ebp - 8], 0
push eax
lea ecx, [esi + 8]
call fcn.0103bf50
mov eax, dword [ebp - 4]
and dword [ebp - 4], 0
push eax
lea ecx, [esi + 0xc]
call fcn.0103bf50
test edi, edi
jge 0x10e606f
mov eax, dword [0x12d2c30]
cmp eax, 0x12d2c30
je 0x10e606f
test byte [eax + 0x3c], 2
je 0x10e606f
push edi
push 0x1012790
push 0xe
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01032571
lea ecx, [ebp - 4]
call fcn.01033b21
lea ecx, [ebp - 8]
call fcn.01033b21
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x10eaa5a
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5a4d
mov ecx, dword [ebp + 8]
mov edi, edi
cmp word [ecx], ax
je 0x10eaa70
pop ebp
xor eax, eax
ret
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x10eaa6c
xor edx, edx
mov ecx, 0x10b
cmp word [eax + 0x18], cx
pop ebp
sete dl
mov eax, edx
ret
Function at 0x11c7079
Capabilities:
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x12d5f24], 0
push ebx
jne 0x11c70f6
push eax
push ebx
push ecx
push edx
xor eax, eax
cpuid
xor eax, eax
xor ebx, 0x756e6547
sete al
xor ebx, ebx
xor ecx, 0x6c65746e
sete bl
and eax, ebx
xor ecx, ecx
xor edx, 0x49656e69
sete cl
and eax, ecx
mov dword [ebp - 4], eax
mov eax, 1
cpuid
xor ecx, ecx
xor edx, edx
mov ebx, 0xff0
and ebx, eax
mov dword [ebp - 8], ebx
pop edx
pop ecx
pop ebx
pop eax
cmp dword [ebp - 4], 0
mov eax, 1
je 0x11c70ea
cmp dword [ebp - 8], 0x660
jae 0x11c70ea
xor eax, eax
mov eax, dword [eax*4 + 0x12d3040]
mov dword [0x12d5f24], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x40], 0x67452301
mov dword [eax + 0x44], 0xefcdab89
mov dword [eax + 0x48], 0x98badcfe
mov dword [eax + 0x4c], 0x10325476
mov dword [eax + 0x50], 0xc3d2e1f0
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x11c72cd
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
pop ebp
ret 4

Function at 0x11c7318
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x70
push ebx
push esi
lea eax, [ebp - 0x68]
mov esi, eax
lea ecx, [edx + 8]
sub edx, esi
push edi
mov esi, 4
lea ecx, [ecx]
mov edi, dword [edx + eax]
bswap edi
mov dword [eax - 8], edi
mov edi, dword [ecx - 4]
bswap edi
mov dword [eax - 4], edi
mov edi, dword [ecx]
bswap edi
mov dword [eax], edi
mov edi, dword [ecx + 4]
bswap edi
mov dword [eax + 4], edi
add ecx, 0x10
add eax, 0x10
sub esi, 1
jne 0x11c7337
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edi, dword [eax + 0x14]
mov esi, dword [eax + 0x10]
mov edx, dword [eax + 4]
mov dword [ebp - 0x18], ecx
mov ecx, dword [eax + 8]
mov dword [ebp - 0xc], ecx
mov ecx, dword [eax + 0xc]
mov dword [ebp - 0x28], edi
mov edi, dword [eax + 0x18]
mov eax, dword [eax + 0x1c]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], edi
xor eax, eax
jmp 0x11c7393
Function at 0x11c7ee8
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x12d3ad4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0x24]
push edi
mov ecx, ebx
and ecx, 0x3f
mov edi, 0x40
sub edi, ecx
mov dword [ebp - 0x50], eax
cmp edi, 8
ja 0x11c7f1d
add edi, 0x40
lea edx, [edi - 8]
push edx
lea eax, [ebp - 0x4c]
push 0
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [esi + 0x20]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ebx
shr edx, 0x1d
or ecx, edx
add esp, 0xc
mov dword [ebp - 0x58], ecx
push 2
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp + edi - 0x54]
lea eax, [ebx*8]
push edx
mov byte [ebp - 0x4c], 0x80
mov dword [ebp - 0x54], eax
call fcn.011c9dd0
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
call fcn.011c7dea
mov ecx, dword [ebp - 0x50]
push 8
push esi
push ecx
call fcn.011c9dd0
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov eax, 0x40
add esi, 0x28
mov byte [esi], 0
inc esi
sub eax, 1
jne 0x11c7fbe
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0128e47a
mov esp, ebp
pop ebp
ret 8

Function at 0x1204ffa
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov edi, edi
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor edx, edx
movzx eax, word [ecx + 0x14]
push ebx
lea eax, [eax + ecx + 0x18]
push esi
movzx esi, word [ecx + 6]
test esi, esi
push edi
jbe 0x1205037
mov edi, dword [ebp + 0xc]
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x120502f
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x1205039
inc edx
add eax, 0x28
cmp edx, esi
jb 0x120501f
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x12753dd
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp edi, ebx
jne 0x1275405
mov dword [ebp + 8], 0x80070057
jmp 0x1275557
push esi
call fcn.0127529a
mov dword [ebp + 8], eax
cmp eax, ebx
jne 0x1275539
push 0xf0000000
push 0x18
push ebx
push ebx
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1275449
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1275441
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp + 8], eax
jmp 0x1275539
push 4
mov ecx, 0x1021f98
mov eax, edi
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1275477
cmp dx, bx
je 0x1275473
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1275477
add eax, esi
add ecx, esi
cmp dx, bx
jne 0x1275453
xor eax, eax
jmp 0x127547c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x1275490
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x8004
jmp 0x1275510
mov ecx, 0x1021f48
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x12754bb
cmp dx, bx
je 0x12754b7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x12754bb
add eax, esi
add ecx, esi
cmp dx, bx
jne 0x1275497
xor eax, eax
jmp 0x12754c0
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x12754d1
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x800c
jmp 0x1275510
mov ecx, 0x1021ef8
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x12754fc
cmp dx, bx
je 0x12754f8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x12754fc
add eax, esi
add ecx, esi
cmp dx, bx
jne 0x12754d8
xor eax, eax
jmp 0x1275501
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x1275532
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x800e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x127542d
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 0xc], ecx
jmp 0x1275556
mov dword [ebp + 8], 0x80049e5b
cmp dword [ebp - 8], ebx
je 0x1275547
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 4], ebx
je 0x1275556
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
mov eax, dword [ebp + 8]
pop edi
pop ebx
leave
ret 4
Function at 0x1275ae7
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
cmp eax, esi
je 0x1275ca1
cmp dword [ebp + 0x10], esi
je 0x1275ca1
mov ebx, dword [ebp + 0x14]
cmp ebx, esi
je 0x1275ca1
cmp dword [ecx + 0x20], esi
jne 0x1275b2a
mov esi, 0x80049e51
jmp 0x1275bf6
mov ecx, dword [ebx]
push edi
push 4
mov dword [ebp + 0x14], ecx
mov dword [ebx], esi
mov ecx, 0x1021e20
pop edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1275b5e
cmp dx, si
je 0x1275b5a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1275b5e
add eax, edi
add ecx, edi
cmp dx, si
jne 0x1275b3a
xor eax, eax
jmp 0x1275b63
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
jne 0x1275b70
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 1
jmp 0x1275bee
mov eax, dword [ebp + 8]
mov ecx, 0x1021dc8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1275b9c
cmp dx, si
je 0x1275b98
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1275b9c
add eax, edi
add ecx, edi
cmp dx, si
jne 0x1275b78
xor eax, eax
jmp 0x1275ba1
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
jne 0x1275bae
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 2
jmp 0x1275bee
mov eax, dword [ebp + 8]
mov ecx, 0x1021d70
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1275bda
cmp dx, si
je 0x1275bd6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1275bda
add eax, edi
add ecx, edi
cmp dx, si
jne 0x1275bb6
xor eax, eax
jmp 0x1275bdf
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
jne 0x1275c97
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 3
je 0x1275c07
mov esi, 0x80049e2e
pop edi
push dword [ebp - 0xc]
call fcn.010324e9
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
mov eax, dword [ebp + 0xc]
push eax
mov dword [ebp - 8], eax
call fcn.010324da
mov edi, eax
pop ecx
mov dword [ebp - 0xc], edi
cmp edi, esi
jne 0x1275c24
mov esi, 0x8007000e
jmp 0x1275bf5
push dword [ebp - 8]
push dword [ebp + 0x10]
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push edi
push esi
push 1
push esi
push dword [eax + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x1275c64
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x1275c60
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x1275bf5
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
mov dword [ebx], eax
cmp dword [ebp + 0x18], esi
je 0x1275bf5
cmp dword [ebp + 0x14], eax
jae 0x1275c80
mov esi, 0x80049e19
jmp 0x1275bf5
push eax
mov eax, edi
add eax, 0x10
push eax
push dword [ebp + 0x18]
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x1275bf5
mov esi, 0x80049e5b
jmp 0x1275bf5
mov esi, 0x80070057
jmp 0x1275bf6