joyce8/EMBER2024-capa huggingface dataset:
Function at 0x9eab90
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov ecx, dword [eax + 0x10]
cmp edx, 3
ja case.default.0x9eaba0
jmp dword [edx*4 + 0x9eabf4]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.009ea570
mov dword [ebp + 8], eax
pop ebp
jmp fcn.009ea250
mov dword [ebp + 8], eax
pop ebp
jmp fcn.009ead40
push str.TFTP_finished
push 0xa5b564
push ecx
call fcn.009c32f0
add esp, 0xc
xor eax, eax
pop ebp
ret
push str.Internal_state_machine_error
push 0xa5b564
push ecx
call fcn.009c3230
add esp, 0xc
mov eax, 0x47
pop ebp
ret
Function at 0x9f0c10
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0xa83fb4]
mov dword [ebp - 8], 0x4020
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
test eax, eax
jne 0x9f0c62
push 3
push 2
push eax
push eax
push 6
call fcn.009f4f10
add esp, 0x14
test al, al
je 0x9f0c56
mov dword [0xa83fb4], 2
mov esp, ebp
pop ebp
ret
mov dword [0xa83fb4], 1
jmp 0x9f0c67
cmp eax, 2
je 0x9f0ca7
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x9f0c8e
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jg 0x9f0ca7
push 4
lea eax, [ebp - 8]
push eax
push 0x1001
push 0xffff
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esp, ebp
pop ebp
ret
Function at 0x9f17b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0xa7f064]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
push 0
mov eax, dword [ebx]
push dword [ebp + 0x10]
push ecx
mov eax, dword [eax + 8]
mov dword [edi], 0
push dword [eax + 0x98]
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x9f1851
push esi
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
cmp esi, 0x2733
jne 0x9f181b
pop esi
mov dword [edi], 0x51
or eax, 0xffffffff
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.009ab911
mov esp, ebp
pop ebp
ret
push 0x100
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.009d4f50
push eax
push str.Recv_failure:__s
push dword [ebx + 4]
call fcn.009c3230
mov eax, dword [ebx + 4]
add esp, 0x18
mov dword [eax + 0x930], esi
or eax, 0xffffffff
mov dword [edi], 0x38
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.009ab911
mov esp, ebp
pop ebp
ret

Function at 0x9f1870
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0xa7f064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [eax + 8]
mov eax, dword [ebx + 0x18]
mov eax, dword [eax + 0x1e8]
test dword [eax + 0x44], 0x800
jne 0x9f1990
push 0x80
lea eax, [ebp - 0x184]
mov dword [ebp - 0x188], 0x80
push 0
push eax
call fcn.00a03340
add esp, 0xc
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x184]
push eax
push dword [esi + 0x98]
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x9f1921
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov esi, eax
lea eax, [ebp - 0x104]
push 0x100
push eax
push esi
call fcn.009d4f50
push eax
push esi
push str.getsockname___failed_with_errno__d:__s
push ebx
call fcn.009c3230
add esp, 0x1c
mov eax, 2
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.009ab911
mov esp, ebp
pop ebp
ret
lea eax, [esi + 0x120]
push eax
lea eax, [esi + 0xf0]
push eax
push dword [ebp - 0x188]
lea eax, [ebp - 0x184]
push eax
call fcn.009c3e30
add esp, 0x10
test al, al
jne 0x9f1990
push edi
call fcn.00a0df09
mov esi, dword [eax]
call fcn.00a0df09
mov edi, eax
lea eax, [ebp - 0x104]
push 0x100
push eax
push esi
call fcn.009d4f50
push eax
push dword [edi]
push str.ssloc_inet_ntop___failed_with_errno__d:__s
push ebx
call fcn.009c3230
add esp, 0x1c
mov eax, 2
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.009ab911
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.009ab911
mov esp, ebp
pop ebp
ret
Function at 0x9ff330
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x9ff363
push 0x2e
push edi
call fcn.00a05990
add esp, 8
test eax, eax
je 0x9ff361
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x9ff660
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0xa7f064]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push 0xf0000040
push 1
push 0
push 0
push eax
mov dword [ebp - 0x20], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x9ff74e
push esi
mov esi, dword [ebp + 0x10]
push 8
mov dword [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
mov dl, byte [esi + 1]
mov cl, byte [esi]
mov al, dl
shr al, 1
mov byte [ebp - 0xc], cl
shl cl, 7
or al, cl
shl dl, 6
mov cl, byte [esi + 2]
mov byte [ebp - 0xb], al
mov al, cl
shr al, 2
or al, dl
shl cl, 5
mov dl, byte [esi + 3]
mov byte [ebp - 0xa], al
mov al, dl
shr al, 3
or al, cl
shl dl, 4
mov cl, byte [esi + 4]
mov byte [ebp - 9], al
mov al, cl
shr al, 4
or al, dl
shl cl, 3
mov dl, byte [esi + 5]
mov byte [ebp - 8], al
mov al, dl
shr al, 5
or al, cl
shl dl, 2
mov cl, byte [esi + 6]
mov byte [ebp - 7], al
mov al, cl
shr al, 6
add cl, cl
or al, dl
mov dword [ebp - 0x10], 8
mov byte [ebp - 6], al
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 5], cl
call fcn.00a02ca0
add esp, 8
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
pop esi
test eax, eax
jne 0x9ff75f
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor al, al
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.009ab911
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
push dword [ebp - 0x20]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [edi + 4], eax
lea eax, [ebp - 0x20]
push eax
push edi
push 0
push 0
push 0
push dword [ebp - 0x24]
mov dword [edi], ecx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop edi
call fcn.009ab911
mov esp, ebp
pop ebp
ret
Function at 0xa002c0
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
push 0x11
push str.WWW_Authenticate:
push esi
call fcn.009c6ea0
add esp, 0xc
test eax, eax
je 0xa002f0
mov eax, dword [edi + 0xe8]
mov dword [ebp + 0xc], eax
cmp eax, 0x191
je 0xa00314
push 0x13
push str.Proxy_authenticate:
push esi
call fcn.009c6ea0
add esp, 0xc
test eax, eax
je 0xa0035b
mov eax, dword [edi + 0xe8]
mov dword [ebp + 0xc], eax
cmp eax, 0x197
jne 0xa0035b
push esi
call fcn.009ca6c0
mov esi, eax
add esp, 4
test esi, esi
jne 0xa0032b
pop edi
lea eax, [esi + 0x1b]
pop esi
pop ebx
pop ebp
ret
cmp dword [ebp + 0xc], 0x197
push esi
sete al
movzx eax, al
push eax
push edi
call fcn.009cc230
push esi
mov edi, eax
call dword [0xa7f0fc]
add esp, 0x10
test edi, edi
je 0xa004f7
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret
push 0xf
push str.Content_Length:
push esi
call fcn.009c6ea0
add esp, 0xc
test eax, eax
je 0xa003b6
mov ecx, dword [edi + 0xe8]
lea eax, [ecx - 0xc8]
cmp eax, 0x64
jae 0xa00396
push ecx
push str.Ignoring_Content_Length_in_CONNECT__03d_response
push edi
call fcn.009c32f0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x10]
add eax, 0x208
push eax
push 0xa
lea eax, [esi + 0xf]
push 0
push eax
call fcn.009d5af0
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 5
push str.close
push 0xb
push str.Connection:
push esi
call fcn.009ca620
add esp, 0x14
test al, al
jne 0xa004ed
push 0x12
push str.Transfer_Encoding:
push esi
call fcn.009c6ea0
add esp, 0xc
test eax, eax
je 0xa00454
mov ecx, dword [edi + 0xe8]
lea eax, [ecx - 0xc8]
cmp eax, 0x64
jae 0xa00410
push ecx
push str.Ignoring_Transfer_Encoding_in_CONNECT__03d_response
push edi
call fcn.009c32f0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 7
push str.chunked
push 0x12
push str.Transfer_Encoding:
push esi
call fcn.009ca620
add esp, 0x14
test al, al
je 0xa004f7
push str.CONNECT_responded_chunked
push edi
call fcn.009c32f0
mov eax, dword [ebp + 0x10]
push edi
mov byte [eax + 0x214], 1
call fcn.009f53d0
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push 5
push str.close
push 0x11
push str.Proxy_Connection:
push esi
call fcn.009ca620
add esp, 0x14
test al, al
jne 0xa004ed
push 7
push str.HTTP_1.
push esi
call fcn.00a13160
add esp, 0xc
test eax, eax
jne 0xa004f7
mov al, byte [esi + 7]
cmp al, 0x30
je 0xa0048e
cmp al, 0x31
jne 0xa004f7
cmp byte [esi + 8], 0x20
jne 0xa004f7
mov cl, byte [esi + 9]
mov al, cl
sub al, 0x30
cmp al, 9
ja 0xa004f7
mov dl, byte [esi + 0xa]
mov al, dl
sub al, 0x30
cmp al, 9
ja 0xa004f7
mov dh, byte [esi + 0xb]
mov al, dh
sub al, 0x30
cmp al, 9
ja 0xa004f7
mov al, byte [esi + 0xc]
cmp al, 0x30
jl 0xa004c0
cmp al, 0x39
jle 0xa004f7
movsx eax, cl
lea ecx, [eax + eax*4]
movsx eax, dl
lea eax, [eax + ecx*2]
lea ecx, [eax + eax*4]
movsx eax, dh
lea eax, [eax + ecx*2]
add eax, 0xffffeb30
mov dword [edi + 0xe8], eax
mov dword [edi + 0xd84], eax
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov byte [eax + 0x215], 1
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0xa01d10
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
mov ecx, dword [ebx + 0xc]
mov eax, dword [ebx + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0xa7f0f8]
mov esi, eax
add esp, 4
test esi, esi
jne 0xa01d3d
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [esi + 0xc]
mov dword [esi], ebx
mov dword [esi + 4], ecx
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [esi + 8], eax
mov eax, dword [ebp + 0x10]
push edi
lea edi, [ebx + 4]
cmp eax, dword [ebx + 0x10]
jbe 0xa01d88
mov eax, dword [ebx]
push ecx
call eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push dword [ebp + 0xc]
push dword [esi + 4]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebx + 0xc]
push dword [esi + 4]
mov dword [ebp - 8], eax
push eax
mov eax, dword [ebx + 8]
call eax
mov eax, dword [ebx + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], eax
jmp 0xa01d8e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [esi + 4]
mov eax, dword [ebx]
call eax
push dword [esi + 8]
mov eax, dword [ebx]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0xa01de9
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
nop
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0xa01db0
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
cmp ebx, dword [eax + 0x10]
jae 0xa01e19
mov eax, dword [edi]
push 1
push 0xa68241
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0xa68242
push dword [esi + 8]
call eax
mov eax, dword [ebp + 8]
inc ebx
add esp, 0x18
cmp ebx, dword [eax + 0x10]
jb 0xa01df1
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xa01e30
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push dword [ebp + 0x10]
call fcn.009c4d10
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], eax
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 0x14]
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [0xa7f0f8]
mov esi, eax
add esp, 8
test esi, esi
je 0xa01f92
lea ecx, [esi + 0xc]
mov dword [esi], ebx
mov dword [esi + 4], ecx
mov eax, dword [ebx + 0xc]
add eax, ecx
mov dword [esi + 8], eax
mov eax, dword [ebp - 8]
push edi
lea edi, [ebx + 4]
cmp eax, dword [ebx + 0x10]
jbe 0xa01eb0
mov eax, dword [ebx]
push ecx
call eax
push dword [ebp - 8]
mov eax, dword [ebp + 0xc]
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
mov eax, dword [esi + 8]
add eax, dword [ebx + 0xc]
push dword [esi + 4]
mov dword [ebp + 0xc], eax
push eax
mov eax, dword [ebx + 8]
call eax
mov eax, dword [ebx + 0x14]
add esp, 0x18
mov dword [ebp - 8], eax
push dword [esi + 4]
mov eax, dword [ebx]
call eax
push dword [esi + 8]
mov eax, dword [ebx]
call eax
mov eax, dword [ebp - 8]
add esp, 8
xor ebx, ebx
test eax, eax
je 0xa01f09
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 4]
mov eax, dword [edi]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push 1
push eax
push dword [esi + 8]
mov eax, dword [edi]
call eax
add esp, 0x18
sub dword [ebp - 8], 1
jne 0xa01ed0
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
cmp ebx, dword [eax + 0x10]
jae 0xa01f39
mov eax, dword [edi]
push 1
push 0xa68241
push dword [esi + 4]
call eax
mov eax, dword [edi]
push 1
push 0xa68242
push dword [esi + 8]
call eax
mov eax, dword [ebp + 8]
inc ebx
add esp, 0x18
cmp ebx, dword [eax + 0x10]
jb 0xa01f11
push dword [ebp + 0x18]
call fcn.009c4d10
mov ecx, dword [esi]
push eax
push dword [ebp + 0x14]
push dword [esi + 4]
mov eax, dword [ecx + 4]
call eax
mov edi, dword [ebp + 0x1c]
add esp, 0x10
mov ebx, dword [esi]
test edi, edi
jne 0xa01f61
mov edi, dword [ebx + 0xc]
add edi, dword [esi + 8]
push dword [esi + 4]
mov eax, dword [ebx + 8]
push edi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push edi
push dword [esi + 8]
call eax
push dword [esi + 8]
mov eax, dword [ebx + 8]
push edi
call eax
push esi
call dword [0xa7f0fc]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov eax, 0x1b
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xa02050
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xa02085
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x800c
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push dword [ebp + 0x10]
call fcn.009c4d10
add esp, 4
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [ebp - 4], 0x20
jne 0xa020d3
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 8]
test eax, eax
je 0xa020e1
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0xa020f1
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0xa02ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0xa02ced
push ebx
mov ebx, dword [ebp + 8]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0xa02cb2
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0xa02d00
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xa02d43
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x8002
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push dword [ebp + 0x10]
call fcn.009c4d10
add esp, 4
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [ebp - 4], 0x10
jne 0xa02d91
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 8]
test eax, eax
je 0xa02d9f
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0xa02daf
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov esp, ebp
pop ebp
ret

Function at 0xa1b30f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a1afcf
Function at 0xa216ec
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a2156b

Function at 0xa27c4f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x40c006
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ecx, 0xcbf
mov ebx, edx
xor word [eax], dx
lea edx, [ebx + edx]
xchg dh, dl
lea eax, [eax + 2]
loop 0x40c00e
pop ebx
ret
Function at 0x401b20
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
push 3
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401b59
push 0
mov ecx, dword [ebp + 8]
push ecx
push str.Eroare_LoadLibrary:_verifica_daca_exista_fisierul
mov edx, dword [0x598ee4]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x401b96
mov eax, dword [ebp - 4]
mov dword [0x598ea4], eax
push 0
push 0x401aa0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesA]
test eax, eax
jne 0x401b87
push str.eroare_enum_res_types_n
call fcn.0051a7d4
add esp, 4
xor eax, eax
jmp 0x401b96
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x402eb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
not eax
cmp edx, 8
jb 0x402f86
mov esi, edx
shr esi, 3
push edi
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x547068]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x547068]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x547068]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x547068]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x547068]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x547068]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x547068]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x547068]
inc ecx
sub edx, 8
sub esi, 1
jne 0x402ec2
pop edi
test edx, edx
je 0x402fab
lea ebx, [ebx]
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x547068]
inc ecx
sub edx, 1
jne 0x402f90
not eax
pop esi
ret

Function at 0x402fb0
Capabilities:
Read file on windows

Disassembly:
push ecx
test byte [esi], 1
push edi
mov edi, eax
jne 0x402fe1
mov ecx, dword [esi + 4]
push 0
lea eax, [esp + 8]
push eax
push edi
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x402fda
mov dword [esi + 8], 7
pop edi
pop ecx
ret
mov eax, dword [esp + 4]
pop edi
pop ecx
ret
mov ecx, dword [esi + 0x14]
mov eax, dword [esi + 0x10]
push ebx
lea ebx, [ecx + edi]
cmp ebx, eax
pop ebx
jbe 0x402ff4
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 4]
push edi
add eax, ecx
push eax
push edx
call fcn.0051a400
add esp, 0xc
add dword [esi + 0x14], edi
mov eax, edi
pop edi
pop ecx
ret
Function at 0x403c70
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
cmp byte [ecx], 0
mov dword [esp], 0xc
mov dword [esp + 4], 0
mov dword [esp + 8], 1
mov dword [esp + 0x10], ecx
je 0x403ca0
cmp byte [ecx + 1], 0x3a
jne 0x403ca0
add ecx, 2
cmp byte [ecx], 0x5c
jne 0x403ca6
inc ecx
mov al, byte [ecx]
push ebx
push ebp
push esi
push edi
test al, al
je 0x403cda
mov edi, dword [esp + 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp al, 0x5c
je 0x403cd0
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x403cc0
xor esi, esi
jmp 0x403cd6
mov esi, ecx
test ecx, ecx
jne 0x403ce7
test edi, edi
jne 0x403cea
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
mov byte [ecx], 0
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x10]
push eax
push ecx
call ebx
test eax, eax
jne 0x403d03
call ebp
cmp eax, 0xb7
jne 0x403d20
test esi, esi
je 0x403cda
lea ecx, [esi + 1]
mov byte [esi], 0x5c
mov al, byte [ecx]
test al, al
jne 0x403cc0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
test esi, esi
je 0x403d27
mov byte [esi], 0x5c
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret

Function at 0x403d40
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x10]
cmp word [ecx], 0
mov dword [esp], 0xc
mov dword [esp + 4], 0
mov dword [esp + 8], 1
mov dword [esp + 0x10], ecx
je 0x403d72
cmp word [ecx + 2], 0x3a
jne 0x403d72
add ecx, 4
cmp word [ecx], 0x5c
jne 0x403d7b
add ecx, 2
movzx eax, word [ecx]
push ebx
push ebp
push esi
push edi
test ax, ax
je 0x403dc0
mov edi, dword [esp + 0x24]
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
movzx eax, ax
test ax, ax
je 0x403db2
nop
cmp ax, 0x5c
je 0x403db6
movzx eax, word [ecx + 2]
add ecx, 2
test ax, ax
jne 0x403da0
xor esi, esi
jmp 0x403dbc
mov esi, ecx
test ecx, ecx
jne 0x403dcd
test edi, edi
jne 0x403dd2
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
xor eax, eax
mov word [ecx], ax
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
push edx
call ebx
test eax, eax
jne 0x403deb
call ebp
cmp eax, 0xb7
jne 0x403e0f
test esi, esi
je 0x403dc0
mov eax, 0x5c
lea ecx, [esi + 2]
mov word [esi], ax
movzx eax, word [ecx]
test ax, ax
jne 0x403d97
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
test esi, esi
je 0x403e1b
mov ecx, 0x5c
mov word [esi], cx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret