joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41cb70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x43c6e8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x454a10]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov eax, dword [0x454a10]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [esp + 0x30]
push 0
lea ecx, [esp + 0xc]
call fcn.00419ed0
push 0x4599d4
mov ecx, esi
mov dword [esp + 0x2c], 0
call fcn.00421d68
push 6
mov esi, eax
push 0x443b3c
push esi
call fcn.00424f2f
add esp, 0xc
test eax, eax
jne 0x41cbdb
add esi, 6
push esi
lea ecx, [esp + 0xc]
call fcn.0040e250
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
call fcn.00419bc0
lea ecx, [esp + 8]
mov esi, eax
call fcn.00419680
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.00421d59
add esp, 0x24
ret

Function at 0x41d090
Capabilities:
Inspect section memory permissions

Disassembly:
push 0xffffffffffffffff
push 0x43db08
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x454a10]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x2c]
xor esi, esi
xor ebp, ebp
mov dword [esp + 0x20], esi
mov dword [edi], vtable.vcfoundation::io::Win32FileChannel.0
mov dword [edi + 8], eax
test eax, 0x100
je 0x41d0dc
mov ebp, 0x20000000
test eax, 0x200
je 0x41d0e9
or ebp, 0x80000000
test eax, 0x400
je 0x41d0f6
or ebp, 0x8000000
test eax, 0x800
je 0x41d103
or ebp, 0x10000000
test al, 0x10
je 0x41d11f
test al, 0x20
je 0x41d112
mov ebx, 1
jmp 0x41d12a
mov ebx, esi
test al, 8
sete bl
lea ebx, [ebx + ebx + 2]
jmp 0x41d12a
mov ebx, esi
test al, 8
setne bl
lea ebx, [ebx + ebx + 3]
test al, 1
je 0x41d133
mov esi, 0x80000000
test al, 2
je 0x41d13d
or esi, 0x40000000
mov ecx, dword [esp + 0x28]
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
call edx
push 0
push ebp
push ebx
push 0
push 7
push esi
push eax
call fcn.004188e0
mov dword [edi + 0xc], eax
add esp, 0x1c
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
Function at 0x41dca0
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffffffffff
push 0x43dc28
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov eax, dword [0x454a10]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x18], ebx
mov esi, dword [esp + 0x3c]
lea eax, [esp + 0x14]
push eax
xor edi, edi
push esi
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], edi
call fcn.0041db30
mov eax, dword [ebx + 0xc]
mov ebp, dword [ebx + 8]
mov dword [esp + 0x34], edi
lea edi, [esi - 1]
mov dword [esp + 0x3c], eax
cmp ebp, eax
je 0x41dd51
mov ebx, dword [esp + 0x20]
nop
mov esi, dword [ebp]
test esi, esi
je 0x41dd46
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
call eax
mov ecx, eax
shl ecx, 9
not ecx
add eax, ecx
mov ecx, eax
shr ecx, 0xe
xor ecx, eax
mov eax, ecx
shl eax, 4
add eax, ecx
mov ecx, dword [esi]
mov edx, eax
shr edx, 0xa
xor edx, eax
and edx, edi
lea eax, [ebx + edx*4]
mov edx, dword [eax]
mov dword [esi], edx
mov dword [eax], esi
mov esi, ecx
test ecx, ecx
jne 0x41dd07
mov eax, dword [esp + 0x3c]
add ebp, 4
cmp ebp, eax
jne 0x41dd00
mov ebx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
lea esi, [ebx + 4]
push eax
mov ecx, esi
call fcn.0041dba0
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 4]
sar ecx, 2
mov dword [esp + 0x3c], ecx
fild dword [esp + 0x3c]
fmul qword [0x443c48]
call fcn.00423400
mov dword [ebx + 0x18], eax
mov eax, dword [esp + 0x20]
mov dword [ebx + 0x14], edi
test eax, eax
je 0x41dd93
push eax
call fcn.00421dcd
add esp, 4
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4

Function at 0x421d59
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x454a10]
jne 0x421d63
repz ret
jmp fcn.004268b2
Function at 0x42e16b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042602a
and dword [ebp - 4], 0
cmp dword [0x45a420], 0
mov ebx, eax
jne 0x42e21c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42e2cd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42e2cd
push eax
call fcn.00425fb8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45a420], eax
call esi
push eax
call fcn.00425fb8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45a424], eax
call esi
push eax
call fcn.00425fb8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45a428], eax
call esi
push eax
call fcn.00425fb8
pop ecx
mov dword [0x45a430], eax
test eax, eax
je 0x42e21c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00425fb8
pop ecx
mov dword [0x45a42c], eax
mov eax, dword [0x45a42c]
cmp eax, ebx
je 0x42e274
cmp dword [0x45a430], ebx
je 0x42e274
push eax
call fcn.00426033
push dword [0x45a430]
mov esi, eax
call fcn.00426033
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42e274
test edi, edi
je 0x42e274
call esi
test eax, eax
je 0x42e26b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42e26b
test byte [ebp - 0xc], 1
jne 0x42e274
or dword [ebp + 0x10], 0x200000
jmp 0x42e2ad
mov eax, dword [0x45a424]
cmp eax, ebx
je 0x42e2ad
push eax
call fcn.00426033
pop ecx
test eax, eax
je 0x42e2ad
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42e2ad
mov eax, dword [0x45a428]
cmp eax, ebx
je 0x42e2ad
push eax
call fcn.00426033
pop ecx
test eax, eax
je 0x42e2ad
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45a420]
call fcn.00426033
pop ecx
test eax, eax
je 0x42e2cd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42e2cf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43b770
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
call fcn.0040e2e0
add esp, 4
mov dword [ebp - 4], eax
push 0x26
push str.Localcom.adobe.csi.CS5ServiceManager_
call fcn.0040c960
add esp, 8
push eax
mov ecx, dword [ebp - 4]
call fcn.0040ddd0
call fcn.0040d380
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
mov eax, dword [edx + 0x44]
call eax
push eax
mov ecx, dword [ebp - 4]
call fcn.0040ddd0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [edx + 0x24]
call eax
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
je 0x43b7e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x43b7e6
mov al, 1
jmp 0x43b7e8
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x101592d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1015949
test al, 0x10
jne 0x1015949
xor eax, eax
inc eax
jmp 0x101594b
xor eax, eax
pop ebp
ret 4

Function at 0x1019aea
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, eax
mov dword [ebp - 0x14], eax
push esi
mov esi, eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
push edi
lea eax, [ebp - 0x20]
mov dword [ebp - 0xc], eax
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
shr esi, 1
xor ecx, ecx
and ebx, 1
and esi, 1
cmp dword [ebp + 8], ecx
stosd dword es:[edi], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ebx
mov eax, 0x1019996
jne 0x1019b32
mov eax, 0x101995d
lea edx, [ebp + 0x10]
push edx
push ecx
lea edx, [ebp - 0x14]
push edx
push eax
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x1019b63
call fcn.0106d6ff
push eax
push 0x190012f
mov dword [ebp - 4], eax
call fcn.01053610
jmp 0x1019beb
push 0
push esi
push ebx
push dword [ebp + 8]
call fcn.010199d5
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, 0x1f4
jmp 0x1019b85
cmp dword [ebp - 4], 0x102
jne 0x1019bd5
push ebx
push dword [ebp + 0xc]
call edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20]
push eax
push esi
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.010199d5
cmp dword [ebp - 4], 0
jne 0x1019b7c
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x1019bc5
call fcn.0106d6ff
push eax
mov dword [ebp - 4], eax
push 0x1a6012f
jmp 0x1019bdd
cmp dword [ebp - 4], 0
je 0x1019be2
push dword [ebp - 4]
push 0x1a9012f
jmp 0x1019bdd
push dword [ebp - 4]
push 0x1b2012f
call fcn.01053610
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x1019d75
Capabilities:
Generate random numbers via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x1079e94]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push 0xf0000000
mov dword [ebp - 4], eax
xor eax, eax
push 1
push eax
push eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1019dbd
call fcn.0106d6ff
mov esi, eax
push esi
push 0x238012f
call fcn.01053610
jmp 0x1019e9b
mov esi, dword [ebp + 8]
cmp esi, 1
je 0x1019dca
cmp esi, 0x10
jbe 0x1019dcd
push 0x10
pop esi
cmp esi, dword [ebp + 0x10]
jbe 0x1019dd5
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x28]
call edi
test eax, eax
jne 0x1019e01
call fcn.0106d6ff
mov esi, eax
push esi
push 0x246012f
call fcn.01053610
jmp 0x1019e9a
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp - 0x28]
call edi
test eax, eax
jne 0x1019e1e
call fcn.0106d6ff
mov esi, eax
push esi
push 0x24b012f
jmp 0x1019df7
mov eax, esi
shr eax, 3
lea ecx, [esi + esi + 2]
mov edx, ecx
shr ecx, 2
mov dword [ebp - 0x2c], eax
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor ecx, ecx
test esi, esi
mov dword [ebp - 0x30], 0x59
jbe 0x1019e98
movzx eax, byte [ebp + ecx - 0x14]
xor edx, edx
div dword [ebp - 0x30]
movzx eax, byte [ebp + ecx - 0x24]
mov edi, edx
xor edx, edx
div esi
jmp 0x1019e67
inc edx
cmp edx, esi
jne 0x1019e67
xor edx, edx
cmp word [ebx + edx*2], 0
jne 0x1019e60
mov ax, word [edi*2 + 0x1002178]
push 0x3e
mov word [ebx + edx*2], ax
pop eax
cmp edi, eax
jb 0x1019e93
cmp dword [ebp - 0x2c], 0
jbe 0x1019e8e
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0
jne 0x1019e93
mov dword [ebp - 0x30], eax
inc ecx
cmp ecx, esi
jb 0x1019e49
xor esi, esi
pop edi
push 0x10
lea eax, [ebp - 0x14]
pop ecx
mov byte [eax], 0
inc eax
dec ecx
jne 0x1019ea1
cmp dword [ebp - 0x28], 0
je 0x1019eb9
push 0
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.0104b509
leave
ret 0xc
Function at 0x101b59a
Capabilities:
Create http request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x107b254]
neg eax
sbb eax, eax
push edi
add eax, 0x8b9
push eax
call fcn.01052a94
push eax
push 0x10026f0
call fcn.0105b329
mov eax, dword [0x107b254]
neg eax
pop ecx
sbb eax, eax
pop ecx
and eax, 0xff000000
add eax, 0x1000000
push eax
xor edi, edi
push edi
push edi
push edi
push 0x10026c8
call dword [sym.imp.WININET.dll_InternetOpenW]
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x101b604
call fcn.0106d6ff
mov edi, eax
push edi
push 0x31b0140
call fcn.01053610
jmp 0x101b710
mov ecx, dword [0x107b254]
push ebx
push esi
mov esi, dword [ebp + 8]
neg ecx
sbb ecx, ecx
push edi
and ecx, 0x80000000
or ecx, 0x1000
push ecx
push 0xffffffffffffffff
push 0x10026ac
push esi
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov ebx, eax
cmp ebx, edi
jne 0x101b64c
call fcn.0106d6ff
push 0x80072ee6
push eax
push 0x32d0140
push esi
call fcn.01053590
cmp dword [0x107b254], edi
je 0x101b66e
cmp dword [0x107b258], edi
je 0x101b68f
push esi
call fcn.0101ac46
cmp eax, edi
je 0x101b68f
push eax
push 0x3350140
jmp 0x101b68a
cmp dword [0x107b258], edi
je 0x101b68f
cmp ebx, edi
je 0x101b68f
push ebx
call fcn.0101aa1b
cmp eax, edi
je 0x101b68f
push eax
push 0x33d0140
call fcn.01053610
push esi
push ebx
call fcn.0101aea4
cmp eax, edi
je 0x101b6a5
push eax
push 0x3410140
call fcn.01053610
cmp dword [0x107b254], edi
jne 0x101b6ca
cmp dword [0x107b258], edi
je 0x101b6ca
push esi
call fcn.0101ac46
cmp eax, edi
je 0x101b6ca
push eax
push 0x3460140
call fcn.01053610
cmp ebx, edi
mov esi, dword [sym.imp.WININET.dll_InternetCloseHandle]
je 0x101b6ed
push ebx
call esi
test eax, eax
jne 0x101b6ed
call fcn.0106d6ff
mov edi, eax
push edi
push 0x3500140
call fcn.01053610
push dword [ebp - 4]
call esi
test eax, eax
jne 0x101b70e
call fcn.0106d6ff
mov esi, eax
push esi
push 0x35c0140
call fcn.01053610
test edi, edi
jne 0x101b70e
mov edi, esi
pop esi
pop ebx
mov eax, edi
pop edi
leave
ret 4

Function at 0x101d75c
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push ebx
xor edx, edx
mov dx, word [eax]
and dword [ebp + 0xc], 0
push esi
mov bl, 1
mov al, byte [ebp + 0xc]
and al, bl
neg al
mov esi, dword [ebp + 0xc]
sbb eax, eax
xor ecx, ecx
mov cx, word [ebp + 0xc]
shr cx, 1
and eax, edx
xor eax, ecx
mov cl, al
and cl, bl
neg cl
sbb ecx, ecx
shr ax, 1
and ecx, edx
xor ecx, eax
mov al, cl
and al, bl
neg al
sbb eax, eax
shr cx, 1
and eax, edx
xor eax, ecx
mov cl, al
and cl, bl
neg cl
sbb ecx, ecx
shr ax, 1
and ecx, edx
xor ecx, eax
mov al, cl
and al, bl
neg al
sbb eax, eax
shr cx, 1
and eax, edx
xor eax, ecx
mov cl, al
and cl, bl
neg cl
sbb ecx, ecx
shr ax, 1
and ecx, edx
xor ecx, eax
mov al, cl
and al, bl
neg al
sbb eax, eax
shr cx, 1
and eax, edx
xor eax, ecx
mov cl, al
and cl, bl
neg cl
sbb ecx, ecx
shr ax, 1
and ecx, edx
xor ecx, eax
inc dword [ebp + 0xc]
cmp dword [ebp + 0xc], 0x100
mov eax, dword [ebp + 8]
mov word [eax + esi*2], cx
jl 0x101d771
pop esi
pop ebx
pop ebp
ret 8
Function at 0x101d815
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
test esi, esi
mov ax, word [edx]
je 0x101d84d
push ebx
push edi
movzx ebx, byte [ecx]
mov edi, eax
and edi, 0xff
xor edi, ebx
mov ebx, dword [ebp + 8]
movzx ax, ah
xor ax, word [ebx + edi*2]
inc ecx
dec esi
jne 0x101d82f
pop edi
pop ebx
mov word [edx], ax
pop esi
pop ebp
ret 0x10
Function at 0x1021cfd
Capabilities:
Get domain controller name
List groups for user account

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
call fcn.01061242
mov edi, eax
cmp edi, ebx
je 0x1021d37
push edi
push 0x15f30133
jmp 0x1021e15
cmp dword [ebp - 4], ebx
je 0x1021deb
push 0x24
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
pop ecx
pop ecx
je 0x1021deb
lea eax, [ebp - 0x10]
push eax
push 0x80000000
push ebx
push ebx
push dword [ebp - 8]
push ebx
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
cmp eax, ebx
je 0x1021d81
push eax
call fcn.0106d6ca
mov edi, eax
push edi
push 0x16060133
jmp 0x1021e15
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push ebx
push dword [ebp - 4]
push dword [eax]
call sub.NETAPI32.dll_NetUserGetGroups
cmp eax, ebx
je 0x1021db1
push eax
call fcn.0106d6ca
mov edi, eax
push edi
push 0x16140133
jmp 0x1021e15
push 0x81b
call fcn.01052a94
push eax
push 0x1003640
call fcn.0105b329
pop ecx
xor esi, esi
cmp dword [ebp + 8], ebx
pop ecx
jbe 0x1021de7
mov eax, dword [ebp - 0xc]
push dword [eax + esi*4]
push 0x1001b48
call fcn.0105b329
inc esi
cmp esi, dword [ebp + 8]
pop ecx
pop ecx
jb 0x1021dcf
xor edi, edi
jmp 0x1021e1a
push 0x85c
call fcn.01052a94
push eax
call fcn.0105b329
mov dword [esp], 0x1003410
call fcn.0105b329
pop ecx
mov eax, 0x80070057
push eax
mov edi, eax
push 0x15fa0133
call fcn.01053610
cmp dword [ebp - 8], ebx
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x1021e2a
push dword [ebp - 8]
call esi
cmp dword [ebp - 4], ebx
je 0x1021e34
push dword [ebp - 4]
call esi
cmp dword [ebp - 0xc], ebx
je 0x1021e41
push dword [ebp - 0xc]
call sub.NETAPI32.dll_NetApiBufferFree
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x102ae7a
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0x18]
xor ebx, ebx
cmp dword [ebp + 0x1c], edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], edi
jbe 0x102aec4
mov eax, dword [ebp + 0x1c]
sub eax, edi
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x102aec4
mov eax, 0x8007000e
push eax
mov esi, eax
push 0x6b013e
call fcn.01053610
jmp 0x102af97
xor eax, eax
inc eax
cmp dword [ebp + 0x10], eax
mov dword [ebp - 0x10], eax
jle 0x102af95
mov esi, dword [sym.imp.ADVAPI32.dll_CryptHashData]
xor eax, eax
cmp dword [ebp + 8], 0x10
setne al
add eax, 0x8003
mov dword [ebp + 8], eax
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x102afbc
push ebx
push dword [ebp - 8]
push dword [ebp + 0x14]
push dword [ebp - 4]
call esi
test eax, eax
je 0x102afce
mov ecx, dword [ebp + 0x1c]
cmp ecx, dword [ebp - 8]
jbe 0x102af60
mov al, byte [ebp - 0x10]
sub ecx, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov bl, al
mov bh, bl
mov edx, ecx
shr ecx, 2
mov eax, ebx
shl eax, 0x10
mov ax, bx
xor ebx, ebx
push ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp + 0x1c]
sub eax, dword [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
call esi
test eax, eax
je 0x102afe0
mov edi, dword [ebp + 0x18]
push ebx
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
mov dword [ebp - 8], edi
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x102aff2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0x10]
mov dword [ebp - 4], ebx
jl 0x102aeea
xor esi, esi
cmp dword [ebp - 0xc], ebx
je 0x102afa5
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 4], ebx
je 0x102afb3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
call fcn.0106d6ff
mov esi, eax
push esi
push 0x7c013e
jmp 0x102aeba
call fcn.0106d6ff
mov esi, eax
push esi
push 0x84013e
jmp 0x102aeba
call fcn.0106d6ff
mov esi, eax
push esi
push 0x96013e
jmp 0x102aeba
call fcn.0106d6ff
mov esi, eax
push esi
push 0xa5013e
jmp 0x102aeba
Function at 0x102b009
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x1079e94]
push ebx
mov ebx, dword [ebp + 0xc]
xor edx, edx
cmp dword [ebp + 0x10], 8
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x88], edx
je 0x102b047
mov esi, 0x80070057
push esi
push 0x1f2013e
call fcn.01053610
jmp 0x102b150
push edi
push 0x20
pop ecx
cmp dword [eax], ecx
jne 0x102b0e8
lea ecx, [ebp - 0x88]
push ecx
push edx
push edx
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
jne 0x102b080
call fcn.0106d6ff
mov esi, eax
push esi
push 0x1fa013e
call fcn.01053610
jmp 0x102b14f
mov esi, dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
push 8
stosd dword es:[edi], eax
lea eax, [ebp + 0x10]
push eax
push ebx
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x88]
call esi
test eax, eax
jne 0x102b0b3
call fcn.0106d6ff
mov esi, eax
push esi
push 0x204013e
jmp 0x102b076
push 8
mov eax, 0x8080808
mov edi, ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
pop eax
push eax
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push ebx
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x88]
call esi
test eax, eax
jne 0x102b14d
call fcn.0106d6ff
mov esi, eax
push esi
push 0x20e013e
jmp 0x102b076
lea esi, [eax + 8]
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov edi, ebx
stosd dword es:[edi], eax
push 8
stosd dword es:[edi], eax
push ebx
lea eax, [ebp - 0x84]
push eax
call fcn.0106f9e0
mov esi, eax
test esi, esi
je 0x102b119
push esi
push 0x220013e
jmp 0x102b076
lea eax, [ebp - 0x84]
push eax
call fcn.01070450
mov esi, eax
test esi, esi
je 0x102b136
push esi
push 0x223013e
jmp 0x102b076
mov eax, dword [ebp - 0xc]
mov dword [ebx], eax
mov eax, dword [ebp - 8]
mov dword [ebx + 4], eax
lea eax, [ebp - 0x84]
push eax
call fcn.010704a0
xor esi, esi
pop edi
cmp dword [ebp - 0x88], 0
je 0x102b165
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.0104b509
leave
ret 0xc
Function at 0x102b27c
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x1079e94]
mov ecx, dword [ebp + 0xc]
and dword [ebp - 0x8c], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x94], eax
mov eax, dword [eax]
cmp eax, 0x10
push edi
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x90], esi
je 0x102b2f6
cmp eax, 0x20
je 0x102b2f6
cmp eax, 0x40
jne 0x102b2e1
push dword [ebp + 0x10]
push ecx
push 0x804
call fcn.01052b92
push 0x1003410
call fcn.0105b329
pop ecx
mov edi, 0x8000ffff
push edi
push 0x27a013e
call fcn.01053610
jmp 0x102b400
mov edi, dword [ebp + 0x10]
lea eax, [edi + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebx], eax
jne 0x102b318
mov edi, 0x8007000e
push edi
push 0x283013e
jmp 0x102b2ec
mov ecx, edi
mov eax, ecx
mov dword [esi], edi
mov edi, dword [ebx]
mov esi, dword [ebp - 0x88]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x94]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x20
pop ecx
cmp dword [eax], ecx
jne 0x102b394
lea ecx, [ebp - 0x8c]
push ecx
xor esi, esi
push esi
push esi
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
jne 0x102b366
call fcn.0106d6ff
mov edi, eax
push edi
push 0x290013e
jmp 0x102b2ec
push dword [ebp - 0x90]
push dword [ebx]
push esi
push 1
push esi
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x102b3fe
call fcn.0106d6ff
mov edi, eax
push edi
push 0x29e013e
jmp 0x102b2ec
lea esi, [eax + 8]
lea edi, [ebp - 0x84]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x90]
push esi
push dword [ebx]
lea eax, [ebp - 0x84]
push dword [ebp - 0x88]
push eax
call fcn.0106f390
mov eax, dword [esi]
add eax, dword [ebx]
and dword [ebp - 0x88], 0
lea ecx, [ebp - 0x88]
push ecx
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0106f980
mov edi, eax
test edi, edi
je 0x102b3ea
push edi
push 0x2c0013e
jmp 0x102b2ec
mov eax, dword [ebp - 0x88]
add dword [esi], eax
lea eax, [ebp - 0x84]
push eax
call fcn.010704a0
xor edi, edi
cmp dword [ebp - 0x8c], 0
je 0x102b415
push dword [ebp - 0x8c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test edi, edi
je 0x102b429
mov eax, dword [ebx]
test eax, eax
je 0x102b429
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebx], 0
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.0104b509
leave
ret 0x14