joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10035a70
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90c
mov eax, dword [0x1009d350]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x7f
lea eax, [ebp - 0x103]
push 0
push eax
mov dword [ebp - 0x908], ebx
mov byte [ebp - 0x104], 0
call fcn.1004e5f0
push 0x7f
lea eax, [ebp - 0x83]
push 0
push eax
mov byte [ebp - 0x84], 0
call fcn.1004e5f0
mov edi, dword [ebx]
mov dword [ebp - 0x90c], edi
mov ebx, dword [edi + 0x164]
mov eax, dword [ebx + 0x1eb4]
sub eax, dword [ebx + 0x1eb0]
add eax, 2
push eax
lea eax, [ebx + 0x1cb0]
push eax
push 0x3c
push edi
call fcn.10035155
mov eax, dword [ebx + 0x1eb0]
add esp, 0x28
movzx ecx, byte [eax]
inc eax
mov dword [ebx + 0x1eb0], eax
cmp ecx, 0x18
je 0x10035c17
cmp ecx, 0x23
je 0x10035bf3
cmp ecx, 0x27
jne 0x10035ca8
push 0
push ecx
push 0xfa
push 0xff
push str._c_c_c_c
lea eax, [ebp - 0x904]
push 0x800
push eax
call fcn.1002fd34
mov ebx, dword [ebx + 0x1cac]
add esp, 0x1c
push 4
pop esi
test ebx, ebx
je 0x10035bc6
mov ecx, dword [ebx]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10035b50
sub ecx, edx
lea edi, [esi + 1]
add edi, ecx
cmp edi, 0x7fa
jae 0x10035bb9
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x104]
push eax
push str._127_____127s
push dword [ebx]
call fcn.1004f31b
add esp, 0x10
test eax, eax
je 0x10035bb9
lea eax, [ebp - 0x84]
push eax
push 1
lea eax, [ebp - 0x104]
push eax
push 0
mov eax, 0x800
sub eax, esi
push str._c_s_c_s
push eax
lea eax, [ebp - 0x904]
add eax, esi
push eax
call fcn.1002fd34
add esp, 0x1c
mov esi, edi
mov ebx, dword [ebx + 4]
test ebx, ebx
jne 0x10035b4b
mov edi, dword [ebp - 0x90c]
push 0xf0
push 0xff
mov eax, 0x800
sub eax, esi
push str._c_c
push eax
lea eax, [ebp - 0x904]
add eax, esi
push eax
call fcn.1002fd34
add esp, 0x14
add esi, 2
jmp 0x10035c5d
add ebx, 0x1c28
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10035bfe
push 0xf0
mov eax, 0xff
push eax
push ebx
push 0
push 0x23
jmp 0x10035c39
add ebx, 0x1c08
mov ecx, ebx
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10035c22
push 0xf0
mov eax, 0xff
push eax
push ebx
push 0
push 0x18
push 0xfa
push eax
push str._c_c_c_c_s_c_c
sub ecx, edx
lea eax, [ebp - 0x904]
push 0x800
push eax
lea esi, [ecx + 6]
call fcn.1002fd34
add esp, 0x28
push 0
push esi
lea eax, [ebp - 0x904]
push eax
mov eax, dword [ebp - 0x908]
push dword [eax + 0x1a8]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x10035c92
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push edi
call fcn.10025321
add esp, 0xc
lea eax, [esi - 2]
push eax
lea eax, [ebp - 0x902]
push eax
push 0x3e
push edi
call fcn.10035155
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004bbda
leave
ret
Function at 0x1003679f
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x1009d350]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax + 0x6b8]
push edi
mov edi, dword [eax]
mov dword [ebp - 0x8c], eax
lea eax, [ebp - 0x88]
push eax
mov dword [ebp - 0x88], 0x80
lea eax, [ebp - 0x84]
push eax
mov eax, dword [esi + 0x154]
push 0
add eax, 4
push eax
lea ebx, [esi + 0x15c]
push dword [ebx]
push dword [esi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [esi + 0x148], 0
mov dword [esi + 0x14c], eax
jne 0x10036832
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push eax
lea eax, [esi + 0xc8]
push eax
call fcn.1004e760
mov eax, dword [ebp - 0x88]
add esp, 0xc
mov dword [esi + 0x148], eax
mov edx, dword [esi + 0x14c]
cmp edx, 4
jge 0x10036862
push str.Received_too_short_packet
push edi
call fcn.10025321
pop ecx
pop ecx
mov dword [esi + 0xc], 7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004bbda
leave
ret
push ebx
call fcn.1003643c
movzx eax, ax
mov dword [esi + 0xc], eax
pop ecx
sub eax, 3
je 0x100368d5
dec eax
je 0x10036947
dec eax
je 0x100368b3
dec eax
je 0x10036896
push str.Internal_error:_Unexpected_packet
push 0x10092414
push edi
call fcn.10025321
jmp 0x10036944
lea eax, [edx - 2]
push eax
mov eax, dword [ebx]
add eax, 2
push eax
push esi
call fcn.100365ad
add esp, 0xc
test eax, eax
je 0x10036947
jmp 0x10036853
push ebx
call fcn.10036425
movzx eax, ax
mov dword [esi + 8], eax
mov eax, dword [ebx]
add eax, 4
push eax
push 0x10081958
push edi
call fcn.100253dd
add esp, 0x10
jmp 0x10036947
cmp edx, 4
jle 0x10036947
push ebx
call fcn.10036425
pop ecx
movzx ecx, word [esi + 0x40]
inc ecx
cmp cx, ax
jne 0x10036947
lea eax, [edx - 4]
push eax
mov eax, dword [ebx]
add eax, 4
push eax
push 1
push dword [ebp - 0x8c]
call fcn.10025230
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x1003691c
push 5
push esi
call fcn.10037013
pop ecx
pop ecx
mov eax, ebx
jmp 0x10036853
mov eax, dword [esi + 0x14c]
sub eax, 4
cdq
add dword [edi + 0x90], eax
adc dword [edi + 0x94], edx
push dword [edi + 0x94]
push dword [edi + 0x90]
push edi
call fcn.1002dedc
add esp, 0xc
push dword [ebp - 0x8c]
call fcn.1002e288
pop ecx
test eax, eax
je 0x10036851
push 5
push esi
call fcn.10037013
pop ecx
pop ecx
push 0x2a
pop eax
jmp 0x10036853
Function at 0x1003696d
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 3
mov eax, dword [edi + 0x10]
pop esi
mov ebx, dword [eax]
mov eax, dword [ebp + 0xc]
sub eax, esi
je 0x10036aa9
dec eax
dec eax
je 0x10036a67
dec eax
je 0x10036a13
dec eax
je 0x100369b1
push str.tftp_rx:_internal_error
push 0x10092414
push ebx
call fcn.10025321
add esp, 0xc
push 0x47
jmp 0x10036b46
movzx eax, word [edi + 0x40]
inc dword [edi + 0x18]
push dword [edi + 0x18]
inc eax
and eax, 0xffff
push eax
push str.Timeout_waiting_for_block__d_ACK.__Retries___d_n
push ebx
call fcn.100253dd
mov eax, dword [edi + 0x18]
add esp, 0x10
cmp eax, dword [edi + 0x20]
jle 0x100369e6
mov dword [edi + 8], 0xffffff9d
mov dword [edi], esi
jmp 0x10036b7f
push dword [edi + 0x148]
lea eax, [edi + 0xc8]
push eax
push 0
push 4
push dword [edi + 0x160]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x10036b7f
jmp 0x10036b26
xor eax, eax
and dword [edi + 0x18], eax
lea esi, [edi + 0x160]
push 4
push esi
mov word [edi + 0x40], ax
call fcn.1003646e
movzx eax, word [edi + 0x40]
push eax
push esi
call fcn.10036452
add esp, 0x10
push dword [edi + 0x148]
lea eax, [edi + 0xc8]
push eax
push 0
push 4
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
js 0x10036b26
mov dword [edi], 1
jmp 0x10036b63
lea esi, [edi + 0x160]
push 5
push esi
call fcn.1003646e
movzx eax, word [edi + 0x40]
push eax
push esi
call fcn.10036452
add esp, 0x10
push dword [edi + 0x148]
lea eax, [edi + 0xc8]
push eax
push 0
push 4
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
push 3
pop eax
mov dword [edi], eax
jmp 0x10036b7f
lea eax, [edi + 0x15c]
push eax
call fcn.10036425
pop ecx
movzx ecx, word [edi + 0x40]
movzx esi, ax
lea eax, [ecx + 1]
and eax, 0xffff
cmp eax, esi
jne 0x10036acf
and dword [edi + 0x18], 0
jmp 0x10036ae6
cmp ecx, esi
jne 0x10036b6f
push esi
push str.Received_last_DATA_packet_block__d_again._n
push ebx
call fcn.100253dd
add esp, 0xc
mov word [edi + 0x40], si
lea esi, [edi + 0x160]
push 4
push esi
call fcn.1003646e
movzx eax, word [edi + 0x40]
push eax
push esi
call fcn.10036452
add esp, 0x10
push dword [edi + 0x148]
lea eax, [edi + 0xc8]
push eax
push 0
push 4
push dword [esi]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x10036b49
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push dword [edi + 0x10]
call fcn.10031aa6
push eax
push 0x10092414
push ebx
call fcn.10025321
add esp, 0x14
push 0x37
pop eax
jmp 0x10036b81
mov eax, dword [edi + 0x154]
xor ecx, ecx
add eax, 4
inc ecx
cmp dword [edi + 0x14c], eax
push 3
pop eax
cmovl ecx, eax
mov dword [edi], ecx
lea eax, [edi + 0x38]
push eax
call fcn.1004dcf4
pop ecx
jmp 0x10036b7f
push eax
push esi
push str.Received_unexpected_DATA_packet_block__d__expecting_block__d_n
push ebx
call fcn.100253dd
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1003df5a
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1009d350]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi + 0x1ac]
mov ebx, dword [esi]
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
mov dword [ebp - 0x1c], eax
or edi, 0xffffffff
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x1003dfb2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push dword [ebp - 0x1c]
push esi
call fcn.10025a4d
pop ecx
pop ecx
cmp edi, 0xffffffff
jne 0x1003dfd4
push str.Error_accept__ing_server_connect
push ebx
call fcn.10025321
pop ecx
pop ecx
push 0x1e
pop eax
jmp 0x1003e028
push str.Connection_accepted_from_server_n
push ebx
call fcn.100253dd
and dword [esi + 0x3f0], 0
push 1
push edi
mov dword [esi + 0x1ac], edi
call fcn.10043b54
xor ecx, ecx
inc ecx
mov dword [esi + 0x1bc], ecx
mov eax, dword [ebx + 0x1e8]
add esp, 0x10
test eax, eax
je 0x1003e026
push ecx
push edi
push dword [ebx + 0x1ec]
call eax
add esp, 0xc
test eax, eax
je 0x1003e026
push esi
call fcn.1003e3eb
pop ecx
push 0x2a
jmp 0x1003dfd1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004bbda
leave
ret

Function at 0x10040002
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
push 0x64
cdq
pop ebx
idiv ebx
mov edi, dword [ebp + 8]
xor esi, esi
mov ecx, dword [edi]
cmp eax, 2
je 0x1004002f
push str.Couldnt_set_desired_mode
push ecx
call fcn.10025321
pop ecx
pop ecx
push 0x11
pop eax
jmp 0x10040083
cmp dword [ebp + 0xc], 0xc8
je 0x10040049
push dword [ebp + 0xc]
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ecx
call fcn.100253dd
add esp, 0xc
mov eax, dword [ebp + 0x10]
cmp eax, 0x13
jne 0x10040059
push edi
call fcn.1003fdac
jmp 0x1004007e
cmp eax, 0x14
jne 0x10040066
push edi
call fcn.1003f03d
jmp 0x1004007e
cmp eax, 0x15
jne 0x10040073
push edi
call fcn.1003fd98
jmp 0x1004007e
cmp eax, 0x16
jne 0x10040081
push edi
call fcn.1003ff0e
mov esi, eax
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10044911
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov eax, dword [esi]
cmp dword [eax + 4], 3
jne 0x1004493b
mov ecx, dword [esi + 0xc]
test ecx, ecx
jne 0x1004492c
xor eax, eax
jmp 0x1004498e
push dword [eax + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call ecx
jmp 0x1004496c
cmp dword [esi + 8], 0
jne 0x1004495c
push 0x10081bc4
push dword [eax + 8]
call fcn.1004f200
pop ecx
pop ecx
mov dword [esi + 8], eax
test eax, eax
jne 0x1004495c
or eax, 0xffffffff
jmp 0x1004498e
push dword [esi + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.10051830
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x1004498c
cmp dword [esi + 8], eax
je 0x10044986
push dword [esi + 8]
call fcn.1004ef86
and dword [esi + 8], edi
pop ecx
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x10046f34
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10046f43
sub esi, ecx
lea ebx, [esi + esi]
push ebx
call dword [section..data]
mov edi, eax
pop ecx
test edi, edi
jne 0x10046f65
push 0x1b
pop eax
jmp 0x10046ff4
push esi
push dword [ebp + 0xc]
push edi
call fcn.10046ff9
add esp, 0xc
lea eax, [ebp - 8]
push 0xf0000000
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
mov esi, dword [ebp + 0x10]
test eax, eax
je 0x10046fe2
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8002
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x10046fd7
push 0
push ebx
push edi
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 0xc]
push eax
push esi
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
and dword [esi + 0x10], 0
push edi
mov byte [esi + 0x14], 0
call dword [0x1009d004]
pop ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1004701e
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1009d350]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push 0xf0000000
xor esi, esi
inc esi
push esi
push 0
mov dword [ebp - 0x28], eax
push 0
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x24], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x100470ee
push edi
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x28]
mov word [ebp - 0x18], 0x208
mov dword [ebp - 0x14], 0x6601
mov dword [ebp - 0x10], 8
call fcn.100470fc
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.10049d28
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
xor edi, edi
push edi
push edi
push 0x14
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x100470b7
mov esi, edi
jmp 0x100470e1
mov ecx, dword [ebp + 8]
push dword [ebp - 0x24]
mov eax, dword [ecx]
mov dword [ebx], eax
mov eax, dword [ecx + 4]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x24]
push eax
push ebx
push edi
push edi
push edi
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1004bbda
leave
ret
Function at 0x1004ae3a
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
pop ecx
test edi, edi
je 0x1004af24
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x1004aea3
push ecx
call dword [esi]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call dword [esi + 4]
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
call dword [esi + 8]
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov dword [ebp + 0x10], ebx
jmp 0x1004aea9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [edi + 4]
call dword [esi]
push dword [edi + 8]
call dword [esi]
mov eax, dword [ebp + 0x10]
pop ecx
xor ebx, ebx
pop ecx
test eax, eax
je 0x1004af1c
mov dword [ebp - 8], eax
mov ebx, eax
mov eax, dword [ebp - 4]
push 1
mov al, byte [eax]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push eax
push dword [edi + 4]
call dword [esi + 4]
mov ecx, dword [ebp - 4]
push 1
mov al, byte [ecx]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push eax
push dword [edi + 8]
inc ecx
mov dword [ebp - 4], ecx
call dword [esi + 4]
add esp, 0x18
dec ebx
jne 0x1004aec3
mov ebx, dword [ebp - 8]
jmp 0x1004af1c
push 1
push 0x1008ba77
push dword [edi + 4]
call dword [esi + 4]
push 1
push 0x1008ba78
push dword [edi + 8]
call dword [esi + 4]
add esp, 0x18
inc ebx
cmp ebx, dword [esi + 0x10]
jb 0x1004aefe
mov eax, edi
pop ebx
pop edi
pop esi
leave
ret
Function at 0x10065c72
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1005798b
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x10065caa
xor eax, eax
jmp 0x10065cd6
cmp esi, dword [ebp - 4]
je 0x10065cd3
cmp dword [ebp + 0xc], 0
je 0x10065cd3
push dword [edi + 0x9c]
call fcn.10065880
push dword [edi + 0x9c]
mov esi, eax
call fcn.100558c0
pop ecx
pop ecx
cmp esi, eax
je 0x10065ca6
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x10066730
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1009d350]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.10055618
mov dword [ebp - 0x14], eax
cmp dword [0x1009fd6c], edi
jne 0x10066821
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x100667ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10066901
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x10066901
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10066901
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x1009fd6c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x1009fd70], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x1009fd74], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1009fd7c], eax
test eax, eax
je 0x1006681e
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1009fd78], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10066846
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10066839
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x1006685b
push 4
pop eax
jmp 0x10066903
cmp dword [ebp - 0x14], edi
je 0x1006685b
push dword [0x1009fd6c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10066840
mov eax, dword [0x1009fd78]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x100668b9
cmp dword [0x1009fd7c], esi
je 0x100668b9
push eax
call ebx
push dword [0x1009fd7c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100668b9
test eax, eax
je 0x100668b9
call ecx
test eax, eax
je 0x100668ae
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100668ae
test byte [ebp - 8], 1
jne 0x100668b9
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x100668e9
mov eax, dword [0x1009fd70]
cmp eax, esi
je 0x100668e6
push eax
call ebx
test eax, eax
je 0x100668e6
call eax
mov edi, eax
test edi, edi
je 0x100668e6
mov eax, dword [0x1009fd74]
cmp eax, esi
je 0x100668e6
push eax
call ebx
test eax, eax
je 0x100668e6
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x1009fd6c]
call ebx
test eax, eax
je 0x10066901
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x10066903
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004bbda
leave
ret
Function at 0x10073040
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007fb00
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x1009d350]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0xbc], 0
mov dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x48]
xorps xmm0, xmm0
push eax
lea ecx, [ebp - 0xb8]
movlpd qword [ebp - 0xb8], xmm0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x6c], 0x6a09e667
mov dword [ebp - 0x68], 0xbb67ae85
mov dword [ebp - 0x64], 0x3c6ef372
mov dword [ebp - 0x60], 0xa54ff53a
mov dword [ebp - 0x5c], 0x510e527f
mov dword [ebp - 0x58], 0x9b05688c
mov dword [ebp - 0x54], 0x1f83d9ab
mov dword [ebp - 0x50], 0x5be0cd19
call fcn.1000d107
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 1
call fcn.1000d06a
push 0x20
lea edx, [ebp - 0x30]
mov ecx, esi
call fcn.10010d80
add esp, 4
cmp dword [ebp - 0x34], 0x10
jb 0x10073112
push dword [ebp - 0x48]
call fcn.1004bbd5
add esp, 4
cmp dword [ebp + 0x1c], 0x10
mov dword [ebp - 0x34], 0xf
mov dword [ebp - 0x38], 0
mov byte [ebp - 0x48], 0
jb 0x10073135
push dword [ebp + 8]
call fcn.1004bbd5
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004bbda
mov esp, ebp
pop ebp
ret