joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e560
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ac93a
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x100d800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x44], edi
mov byte [ebp - 0x44], 0
push dword [ebp - 0x44]
call fcn.100209b0
add esp, 4
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
push 0x104
lfence
call fcn.10018220
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edx, eax
test edx, edx
je 0x1001e75e
cmp edx, dword [ebp - 0x18]
ja 0x1001e75e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], edx
cmovae eax, dword [ebp - 0x28]
xor ecx, ecx
mov byte [ebp - 0x44], cl
push dword [ebp - 0x44]
mov word [eax + edx*2], cx
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x74]
call fcn.10018dc0
add esp, 4
lea ecx, [ebp - 0x28]
call fcn.10002a60
lea eax, [ebp - 0x5c]
mov byte [ebp - 4], 4
push eax
lea edx, [ebp - 0x74]
lea ecx, [ebp - 0x40]
call fcn.10014340
add esp, 4
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x60]
cmp edx, 8
jb 0x1001e688
mov ecx, dword [ebp - 0x74]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1001e67e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e78c
push edx
push ecx
call fcn.1006d8b6
add esp, 8
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x48]
cmp edx, 8
jb 0x1001e6c6
mov ecx, dword [ebp - 0x5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1001e6bc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e78c
push edx
push ecx
call fcn.1006d8b6
add esp, 8
xor eax, eax
mov dword [ebp - 0x4c], 0
push 8
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
call fcn.1006dc33
mov esi, eax
mov dword [ebp - 0x44], esi
mov byte [ebp - 4], 8
lea ecx, [esi + 4]
xorps xmm0, xmm0
lea edx, [ebp - 0x40]
movq qword [esi], xmm0
push 0
mov dword [esi], vtable.winlib::selfProtection::VerifiedDll.0
call fcn.10022110
mov edx, dword [ebp - 0x2c]
add esp, 8
mov dword [edi], esi
cmp edx, 8
jb 0x1001e73f
mov ecx, dword [ebp - 0x40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1001e735
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001e791
push edx
push ecx
call fcn.1006d8b6
add esp, 8
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006d58e
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x8c]
call fcn.1000a400
push eax
mov edx, str.GetSystemDirectoryW_failed:_returned_size
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xa4]
call fcn.10009e10
add esp, 4
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.1000a520
call fcn.100869bf
call fcn.100869bf
int3
Function at 0x1001f940
Capabilities:
Encrypt data using des via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100acb1d
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x100d800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0xf0000040
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
lea esi, [edi + 0x14]
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1001fb13
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movq qword [ebp - 0x1c], xmm0
push 0x18
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
call fcn.1006dc33
xorps xmm0, xmm0
mov dword [ebp - 0x1c], eax
add esp, 4
mov dword [ebp - 0x50], 0
lea ecx, [eax + 0x18]
mov dword [ebp - 0x14], ecx
movups xmmword [eax], xmm0
movq qword [eax + 0x10], xmm0
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x50]
call fcn.10009e80
mov dword [ebp - 4], 1
xorps xmm0, xmm0
movq qword [ebp - 0x28], xmm0
mov dword [ebp - 0x20], 0
push 8
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
call fcn.1006dc33
xorps xmm0, xmm0
mov dword [ebp - 0x28], eax
add esp, 4
mov dword [ebp - 0x50], 0
lea ecx, [eax + 8]
mov dword [ebp - 0x20], ecx
movq qword [eax], xmm0
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x50]
call fcn.10009e80
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call fcn.1001fb70
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], 0x208
mov dword [ebp - 0x48], 0x6603
mov dword [ebp - 0x44], 0x18
sub eax, ecx
je 0x1001fab9
test ecx, ecx
je 0x1001fa87
cmp eax, 0x18
ja 0x1001fa87
push eax
push ecx
lea eax, [ebp - 0x40]
push eax
call fcn.10083c30
add esp, 0xc
jmp 0x1001fab9
xorps xmm0, xmm0
movq qword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x40], xmm0
test ecx, ecx
jne 0x1001faa4
call fcn.10086f38
mov dword [eax], 0x16
jmp 0x1001fab4
cmp eax, 0x18
jbe 0x1001fab9
call fcn.10086f38
mov dword [eax], 0x22
call fcn.100869af
add edi, 0x18
lea eax, [ebp - 0x4c]
push edi
push 1
push 0
push 0x24
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x1001fb2f
push 0
push dword [ebp - 0x28]
push 1
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x1001fb48
lea ecx, [ebp - 0x28]
call fcn.10020530
lea ecx, [ebp - 0x1c]
call fcn.10020530
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006d58e
mov esp, ebp
pop ebp
ret 8
push str.CryptAcquireContext_failed
lea ecx, [ebp - 0x68]
call fcn.10005d60
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], 0
call fcn.1000a520
push str.Encrypt:_CryptImportKey_failed
lea ecx, [ebp - 0x68]
call fcn.10005d60
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 3
call fcn.1000a520
push str.Encrypt:_CryptSetKeyParam_IV__failed
lea ecx, [ebp - 0x68]
call fcn.10005d60
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 4
call fcn.1000a520
int3
Function at 0x10020ad0
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100acd05
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x100d800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], ebx
lea ecx, [ebp - 0x18]
push dword [ebp + 0xc]
xorps xmm0, xmm0
push dword [ebp + 8]
movlpd qword [ebp - 0x18], xmm0
call fcn.10020ab0
mov esi, dword [ebp - 0x14]
add esp, 8
test esi, esi
jne 0x10020b37
mov dword [ebx], esi
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], 0xf
mov byte [ebx], 0
jmp 0x10020c7b
mov ecx, dword [ebp - 0x18]
mov edx, ecx
lea eax, [esi + ecx]
cmp eax, edx
je 0x10020b80
mov cl, byte [edx]
cmp cl, 0x2b
je 0x10020b70
cmp cl, 0x2f
je 0x10020b70
cmp cl, 0x3d
je 0x10020b70
cmp cl, 0x30
jl 0x10020b5e
cmp cl, 0x39
jle 0x10020b70
cmp cl, 0x61
jl 0x10020b68
cmp cl, 0x7a
jle 0x10020b70
sub cl, 0x41
cmp cl, 0x19
ja 0x10020b75
inc edx
cmp edx, eax
jne 0x10020b43
mov ecx, dword [ebp - 0x18]
cmp eax, edx
jne 0x10020c99
push 0
push 0
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0
push eax
push 0
push 1
push esi
push ecx
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x10020cba
mov edi, dword [ebp - 0x34]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xf
mov byte [ebp - 0x30], 0
cmp edi, 0xf
ja 0x10020bdd
push edi
lea eax, [ebp - 0x30]
mov dword [ebp - 0x20], edi
push 0
push eax
call fcn.10083a60
mov byte [ebp + edi - 0x30], 0
mov esi, dword [ebp - 0x30]
jmp 0x10020c39
cmp edi, 0x7fffffff
ja 0x10020cd6
mov esi, edi
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x10020bfd
mov esi, 0x7fffffff
jmp 0x10020c07
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
xor ecx, ecx
mov eax, esi
add eax, 1
setb cl
neg ecx
or ecx, eax
push ecx
lea ecx, [ebp - 0x30]
call fcn.10005eb0
push edi
mov dword [ebp - 0x1c], esi
mov esi, eax
push 0
push esi
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], edi
call fcn.10083a60
mov byte [esi + edi], 0
mov dword [ebp - 0x30], esi
add esp, 0xc
push 0
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x34]
cmp dword [ebp - 0x1c], 0x10
lea eax, [ebp - 0x30]
push 0
push ecx
cmovae eax, esi
push eax
push 1
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x10020cdb
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.10007b10
lea ecx, [ebp - 0x30]
call fcn.10003840
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006d58e
mov esp, ebp
pop ebp
ret
push str.winlib::base64::Decode___failed
lea ecx, [ebp - 0x50]
call fcn.10005d60
lea edx, [ebp - 0x50]
mov dword [ebp - 4], 0
mov ecx, 0xd
call fcn.1000a4f0
push str.CryptStringToBinaryA_sizing_
lea ecx, [ebp - 0x50]
call fcn.10005d60
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], 1
call fcn.1000a520
call fcn.10004010
push str.CryptStringToBinaryA_base64::Decode_
lea ecx, [ebp - 0x50]
call fcn.10005d60
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 3
call fcn.1000a520
int3
Function at 0x100289e0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [0x100d800c]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, eax
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x10028c16
mov eax, 1
mov dword [esp + 0x10], eax
cmp dword [esp + 0x18], eax
jle 0x10028c0f
mov edx, dword [ecx + eax*4]
mov eax, edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 7
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10028a52
sub eax, esi
lea ecx, [esp + 0x1c]
sar eax, 1
push eax
push edx
call fcn.10004420
cmp dword [esp + 0x30], 8
lea edi, [esp + 0x1c]
mov ebx, dword [esp + 0x1c]
cmovae edi, ebx
cmp dword [esp + 0x2c], 0x10
jne 0x10028aba
movzx ecx, word [edi]
mov esi, 0x2d
mov edx, 0x10
mov eax, str._ScheduledUpdate
cmp ecx, esi
jb 0x10028aba
sub edi, eax
cmp cx, si
ja 0x10028aba
cmp edx, 1
je 0x10028b96
movzx ecx, word [edi + eax + 2]
add eax, 2
dec edx
movzx esi, word [eax]
cmp cx, si
jae 0x10028a9e
mov eax, dword [esp + 0x30]
lea edi, [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
cmp eax, 8
cmovae edi, ebx
cmp ecx, 0xd
jne 0x10028b0d
mov edx, ecx
mov esi, 0x2d
movzx ecx, word [edi]
mov eax, str._ManualUpdate
cmp ecx, esi
jb 0x10028b05
sub edi, eax
cmp cx, si
ja 0x10028b05
cmp edx, 1
je 0x10028ba2
movzx ecx, word [edi + eax + 2]
add eax, 2
dec edx
movzx esi, word [eax]
cmp cx, si
jae 0x10028ae9
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
cmp eax, 8
lea edi, [esp + 0x1c]
cmovae edi, ebx
cmp ecx, 0xa
jne 0x10028b50
mov edx, ecx
mov esi, 0x2d
movzx ecx, word [edi]
mov eax, str._Bootstrap
cmp ecx, esi
jb 0x10028b4c
sub edi, eax
cmp cx, si
ja 0x10028b4c
cmp edx, 1
je 0x10028bae
movzx ecx, word [edi + eax + 2]
add eax, 2
dec edx
movzx esi, word [eax]
cmp cx, si
jae 0x10028b34
mov eax, dword [esp + 0x30]
cmp eax, 8
lea edi, [esp + 0x1c]
cmovae edi, ebx
cmp dword [esp + 0x2c], 0xd
jne 0x10028bc4
movzx ecx, word [edi]
mov esi, 0x2d
mov edx, 0xd
mov eax, str._PolicyUpdate
cmp ecx, esi
jb 0x10028bc4
sub edi, eax
cmp cx, si
ja 0x10028bc4
cmp edx, 1
je 0x10028bba
movzx ecx, word [edi + eax + 2]
add eax, 2
dec edx
movzx esi, word [eax]
cmp cx, si
jae 0x10028b7c
jmp 0x10028bc4
mov dword [0x100dd610], 0
jmp 0x10028bc4
mov dword [0x100dd610], 1
jmp 0x10028bc4
mov dword [0x100dd610], 2
jmp 0x10028bc4
mov dword [0x100dd610], 3
mov edi, dword [esp + 0x30]
cmp edi, 8
jb 0x10028bf8
lea ecx, [edi*2 + 2]
mov eax, ebx
cmp ecx, 0x1000
jb 0x10028bee
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10028c28
push ecx
push ebx
call fcn.1006d8b6
add esp, 8
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
mov dword [esp + 0x10], eax
cmp eax, dword [esp + 0x18]
jl 0x10028a32
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1006d58e
mov esp, ebp
pop ebp
ret
call fcn.100869bf
int3
Function at 0x1002cc50
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae410
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x100d800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0
push eax
push 0x104
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002cd36
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.QualityCompat
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1002cd2b
cmp dword [ebp - 0x14], 1
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
je 0x1002cd03
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push str.cadca5fe_87d3_4b96_b7fb_a231484277cc
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1002cd20
cmp eax, 2
jne 0x1002cd20
push 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 4
push 0
push str.cadca5fe_87d3_4b96_b7fb_a231484277cc
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x1002cd2b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x1002cd36
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006d58e
mov esp, ebp
pop ebp
ret
Function at 0x1002ec90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x1002ecc2
jl 0x1002ecb5
test ecx, ecx
jne 0x1002ecc2
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1002ed8c
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.10013370
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x1002ed2e
jg 0x1002eced
test esi, esi
je 0x1002ed2e
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x1002ed05
mov eax, dword [esp + 0x10]
jl 0x1002ecff
cmp eax, esi
jae 0x1002ed05
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.10083c30
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x1002ed59
mov eax, dword [ebx]
mov esi, dword [eax + 0x1c]
mov ecx, esi
call dword [0x100b42b0]
mov ecx, ebx
call esi
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x1002ed75
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x1002ecd4
jl 0x1002ed75
test ecx, ecx
jne 0x1002ecd4
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x1002edcb
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x1002edcb
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.10083c30
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x1002ee3b
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x1002edf1
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x1002ee24
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.1008e422
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x1002ee4f
cmp edi, eax
ja 0x1002ee00
test ecx, ecx
je 0x1002ee3b
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.1008e422
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002fe40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae82f
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x100d800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], 0
mov dword [ebx], 0x100c323c
mov dword [ebx + 0x10], 0x100c322c
mov dword [ebx + 0x70], 0
mov dword [ebx + 0x90], 0
mov dword [ebx + 0x94], 0
mov dword [ebx + 0x98], 0
mov dword [ebx + 0x68], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov dword [ebp - 4], 0
mov eax, dword [ebx]
mov dword [ebp - 0x10], 1
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ecx + ebx - 4], eax
mov eax, dword [ebx]
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov esi, dword [eax + 4]
add esi, ebx
mov ecx, esi
mov dword [ebp - 0x14], esi
call fcn.10010820
lea eax, [ebx + 0x18]
mov dword [esi + 0x3c], 0
mov dword [esi + 0x38], eax
mov eax, dword [esi + 0x30]
mov edi, dword [eax + 4]
mov dword [ebp - 0x20], edi
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100b42b0]
mov ecx, edi
call esi
lea eax, [ebp - 0x24]
mov dword [ebp - 4], 3
push eax
call fcn.10031e20
mov edi, eax
add esp, 4
mov ecx, dword [edi]
push 0x20
mov esi, dword [ecx + 0x30]
mov ecx, esi
call dword [0x100b42b0]
mov ecx, edi
call esi
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x20]
movzx ecx, ax
mov dword [ebp - 0x18], ecx
test edi, edi
je 0x1002ff7b
mov eax, dword [edi]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x100b42b0]
mov ecx, edi
call esi
mov edi, eax
test edi, edi
je 0x1002ff7b
mov ecx, dword [edi]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x100b42b0]
mov ecx, edi
call esi
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp dword [ecx + 0x38], 0
mov word [ecx + 0x40], ax
jne 0x1002ff99
mov eax, dword [ecx + 0xc]
push 0
or eax, 4
push eax
call fcn.100107b0
mov eax, dword [ebx + 0x10]
mov eax, dword [eax + 4]
mov dword [ebx + eax + 0x10], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + ebx + 0xc], eax
mov eax, dword [ebx]
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ecx + ebx - 4], eax
mov dword [ebp - 4], 6
mov eax, dword [ebx]
push ecx
lea ecx, [ebx + 0x18]
mov eax, dword [eax + 4]
mov dword [ebx + eax], vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebx]
mov edx, dword [eax + 4]
lea eax, [edx - 0x68]
mov dword [edx + ebx - 4], eax
call fcn.100310d0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100310d0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ab8c0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x100d800c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
call fcn.1006dc33
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.1006f644
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov dword [eax], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [eax + 0x38], 0
mov dword [eax + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10034140
Capabilities:
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100aec47
mov eax, dword fs:[0]
push eax
sub esp, 0xcc
mov eax, dword [0x100d800c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0xd4], ebx
lea esi, [ebx + 4]
mov dword [ebp - 0xd8], ebx
mov dword [esi], 0
lea edi, [ebx + 8]
mov dword [ebp - 4], 0
mov dword [edi], 0
mov ecx, dword [ebp + 8]
and ecx, dword [ebp + 0xc]
mov byte [ebp - 4], 1
setne al
mov byte [ebx], al
test ecx, ecx
je 0x1003423c
push 0xf0000000
push dword [ebp + 0x10]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
cmp eax, 1
je 0x1003423c
push 0xc0
lea eax, [ebp - 0xd0]
push 0
push eax
call fcn.10083a60
call fcn.10059440
add esp, 8
lea ecx, [ebp - 0xc8]
mov eax, dword [eax]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], 3
call fcn.10012d10
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0xd0]
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100b42b0]
mov ecx, edi
call esi
cmp dword [ebp - 0xcc], eax
setl byte [ebp - 0x18]
jl 0x100342ed
push str.CryptAcquireContextW_failed:
lea ecx, [ebp - 0xd0]
call fcn.10023460
jmp 0x100342cd
cmp byte [ebx], 0
je 0x100342fb
push edi
push 0
push 0
push dword [ebp + 0x14]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
cmp eax, 1
je 0x100342fb
push 0xc0
lea eax, [ebp - 0xd0]
push 0
push eax
call fcn.10083a60
call fcn.10059440
add esp, 8
lea ecx, [ebp - 0xc8]
mov eax, dword [eax]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], 3
call fcn.10012d10
mov byte [ebp - 4], 3
mov edi, dword [ebp - 0xd0]
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100b42b0]
mov ecx, edi
call esi
cmp dword [ebp - 0xcc], eax
setl byte [ebp - 0x18]
jl 0x100342ed
push str.CryptCreateHash_failed:
lea ecx, [ebp - 0xd0]
call fcn.100230c0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xd4], eax
mov ecx, esi
lea eax, [ebp - 0xd4]
push eax
call fcn.10023540
mov byte [ebp - 0x18], 1
lea ecx, [ebp - 0xd0]
call fcn.10021180
mov byte [ebx], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006d58e
mov esp, ebp
pop ebp
ret 0x10