joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025b7d
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x10043c30]
mov dword [ebp - 0xc], ecx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10025bbd
cmp byte [ebx], 0xa
jne 0x10025bbd
or byte [edi + eax + 0x28], 4
jmp 0x10025bc2
and byte [edi + eax + 0x28], 0xfb
add ecx, ebx
mov eax, ebx
mov dword [ebp - 0x10], ecx
mov esi, ebx
mov dword [ebp - 8], eax
cmp ebx, ecx
jae 0x10025cc1
mov dl, byte [eax]
cmp dl, 0x1a
je 0x10025ca4
inc eax
cmp dl, 0xd
je 0x10025bee
mov dword [ebp - 8], eax
mov byte [esi], dl
jmp 0x10025c14
cmp eax, ecx
jae 0x10025c22
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add dword [ebp - 8], eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor edx, edx
inc edx
add esi, edx
cmp eax, ecx
jb 0x10025bd6
jmp 0x10025cc1
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10025c9f
cmp dword [ebp - 0x10], 0
je 0x10025c9f
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx*4 + 0x10043c30]
test byte [eax + edi + 0x28], 0x48
je 0x10025c79
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x10025c64
mov byte [esi], dl
jmp 0x10025c75
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x10043c30]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x10025cc1
cmp byte [ebp - 1], 0xa
jne 0x10025c88
cmp esi, ebx
jne 0x10025c88
mov byte [esi], 0xa
jmp 0x10025cc0
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.10026703
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x10025cc1
mov byte [esi], 0xd
jmp 0x10025cc0
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx*4 + 0x10043c30]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10025cbe
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x10025cc1
mov byte [esi], dl
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10025cca
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x10043c30]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10025d10
cmp word [ebx], dx
jne 0x10025d10
or byte [eax + edi + 0x28], 4
jmp 0x10025d15
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x10025e78
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x10025e58
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x10025d56
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10025d8c
cmp eax, edx
jae 0x10025d9a
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x10025d31
jmp 0x10025e78
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10025e53
cmp dword [ebp - 0x18], 0
je 0x10025e53
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x10043c30]
test byte [eax + edi + 0x28], 0x48
je 0x10025e29
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x10025ded
mov word [esi], cx
jmp 0x10025e24
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x10043c30]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x10043c30]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x10043c30]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x10025e78
pop eax
cmp word [ebp - 4], ax
jne 0x10025e39
cmp esi, ebx
jne 0x10025e39
mov word [esi], ax
jmp 0x10025e75
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10026703
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x10025e78
push 0xd
pop eax
jmp 0x10025e34
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x10043c30]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x10025e72
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x10025e78
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10029323
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x100293c0
push ebx
push esi
call fcn.100292ec
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10028108
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1002936d
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100293bf
push edi
push eax
call fcn.10020aae
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1002938d
call fcn.1001fe4f
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x100293be
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10028108
add esp, 0x20
test eax, eax
jne 0x100293ac
push edi
call fcn.1001fe4f
jmp 0x100293b4
push ebx
call fcn.1001fe4f
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1002d266
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.10021fe7
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1002d2d5
cmp esi, dword [ebp - 4]
je 0x1002d2d0
cmp dword [ebp + 0xc], 0
je 0x1002d2d0
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x1002d2ad
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.1002cdb8
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x1002d2d7
xor eax, eax
inc eax
jmp 0x1002d2d7
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x1002d33c
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10042040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.10021fe7
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.10021fe7
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x1002d3b3
cmp word [ecx], dx
je 0x1002d3b3
mov eax, dword [0x1003b61c]
push edi
dec eax
push eax
push 0x1003b508
call fcn.1002d2db
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1002d426
cmp word [eax], dx
je 0x1002d426
mov eax, dword [edi]
test eax, eax
je 0x1002d3d7
cmp word [eax], dx
je 0x1002d3d7
lea eax, [ebp - 0x10]
push eax
call fcn.1002ccbe
jmp 0x1002d3e0
lea eax, [ebp - 0x10]
push eax
call fcn.1002cd59
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x1002d450
mov eax, dword [0x1003b504]
push dword [ebp - 0x14]
dec eax
push eax
push 0x1003b1f8
call fcn.1002d2db
add esp, 0xc
test al, al
je 0x1002d450
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x1002d41b
cmp word [eax], di
je 0x1002d41b
lea eax, [ebp - 0x10]
push eax
call fcn.1002ccbe
pop ecx
jmp 0x1002d452
lea eax, [ebp - 0x10]
push eax
call fcn.1002cd59
jmp 0x1002d418
mov eax, dword [edi]
test eax, eax
je 0x1002d43d
cmp word [eax], dx
je 0x1002d43d
lea eax, [ebp - 0x10]
push eax
call fcn.1002cc73
pop ecx
jmp 0x1002d450
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x1002d51b
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.1002d160
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1002d51b
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1002d51b
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x1002d51b
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1002d4a8
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.10020517
test ebx, ebx
je 0x1002d516
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.10020517
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1002d51b
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x1002d51b
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10023acb
add esp, 0x10
xor eax, eax
inc eax
jmp 0x1002d51d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011882
leave
ret
Function at 0x10030180
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100301ad
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100301ad
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1005d353
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1005d362
pop dword [ebp - 0x4c]
mov eax, 0x46c3319c
sub eax, 0x36bd5e3a
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xbca3744b
sub dword [ebp - 0x5c], 0x6e512f00
mov dword [ebp - 0x58], 0xfd9122c9
sub dword [ebp - 0x58], 0xcb5dd684
mov dword [ebp - 0x54], 0x5dac35a9
add dword [ebp - 0x54], 0xeea00e85
mov dword [ebp - 0x50], 0x73ca08a4
add dword [ebp - 0x50], 0x8c35f75c
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xff2bed92
add dword [ebp - 0x5c], 0x75467bc4
mov dword [ebp - 0x58], 0x35850b9f
add dword [ebp - 0x58], 0xbe755d6
mov dword [ebp - 0x54], 0x657636e9
sub dword [ebp - 0x54], 0x206ca7d
mov dword [ebp - 0x50], 0xc8a3ab93
add dword [ebp - 0x50], 0x375c546d
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xbb7e8048
add eax, 0x5496d254
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x741b7
push 0
call eax
mov ecx, 0xdae319e1
sub ecx, 0xdae2d15a
mov edx, eax
mov esi, 0x107ec400
add esi, dword [ebp - 0x4c]
mov ebx, 0x19270e1f
add ebx, 0xdcec5def
xor dword [ebp - 0x10], 0xe9f44ea2
mov edi, dword [esi]
sub dword [ebp - 0x48], 0xe622eb08
sub edi, ebx
mov dword [ebp - 0x3c], 0x1f713795
mov dword [edx], edi
add dword [ebp - 4], ebx
add edx, 4
add esi, 4
loop 0x1005d479
add eax, 0x114ef
xor ebx, ebx
add ebx, eax
add eax, 0x9d0e78af
add eax, 0x62f18756
mov ecx, 0x8e290575
sub ecx, 0x7e290575
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x1009b454
Capabilities:
Create thread

Disassembly:
push 8
mov eax, 0x1014fef1
call fcn.10147df8
mov esi, ecx
mov dword [ebp - 0x14], esi
call fcn.1008f6dc
xor ebx, ebx
mov dword [esi], vtable.ScObjects::Thread.0
push 0x10
mov dword [ebp - 4], ebx
mov dword [esi + 0x10], ebx
mov byte [esi + 0x14], bl
call fcn.1005d353
mov dword [ebp - 0x14], eax
pop ecx
test eax, eax
je 0x1009b49b
mov dword [eax], vtable.ScObjects::ThreadData.0
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jmp 0x1009b49d
mov eax, ebx
mov dword [esi + 8], eax
lea eax, [ebp - 0x10]
push eax
push 4
push esi
push 0x1009b680
push ebx
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov ecx, eax
add esp, 0x18
cmp ecx, 0xffffffff
jne 0x1009b4d0
mov eax, dword [esi + 8]
mov dword [esi + 0x10], 0x20
mov dword [esi + 0xc], ebx
mov dword [eax + 4], ebx
jmp 0x1009b4dc
mov eax, dword [ebp - 0x10]
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
mov dword [eax + 4], ecx
mov eax, esi
call fcn.10147dc1
ret

Function at 0x1009b790
Capabilities:
Resume thread

Disassembly:
cmp dword [ecx + 0x10], 0
jne 0x1009b7a2
mov eax, dword [ecx + 8]
push dword [eax + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
ret

Function at 0x100a1d60
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0x2c
mov eax, 0x10150bd0
call fcn.10147e2c
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x38], esi
mov ecx, esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], edi
call fcn.1009b955
mov dword [ebp - 4], edi
mov dword [ebp - 0x34], 1
call fcn.100a1e88
test eax, eax
jne 0x100a1da4
push 0xffffffffffffffff
push 0x10159980
mov ecx, esi
call fcn.1005d353
jmp 0x100a1dea
lea ecx, [ebp - 0x20]
push ecx
push 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov ecx, esi
push 0xffffffffffffffff
push 0x10159980
test eax, eax
je 0x100a1d9d
call fcn.1005d353
movzx eax, byte [ebp + edi - 0x20]
push eax
lea eax, [ebp - 0x30]
push 0x10165c80
push eax
call fcn.1005d353
lea eax, [ebp - 0x30]
push eax
push esi
call fcn.1005d353
add esp, 0x14
inc edi
cmp edi, 0x10
jb 0x100a1dc3
mov eax, esi
call fcn.10147dd6
ret

Function at 0x100a1e88
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push esi
mov esi, dword [0x107d4410]
test esi, esi
jne 0x100a1edc
push edi
push esi
push 1
push esi
push esi
mov edi, 0x107d4410
push edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x100a1ed5
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x100a1ed5
push 8
push 1
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x100a1ed5
call dword [sym.imp.kernel32.dll_GetLastError]
mov dword [0x107d4410], esi
jmp 0x100a1edb
mov esi, dword [0x107d4410]
pop edi
mov eax, esi
pop esi
ret
Function at 0x100a2070
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push 0x54
mov eax, 0x10150c7f
call fcn.10147e2c
mov ebx, dword [ebp + 8]
xor eax, eax
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x50], ebx
mov dword [ebp - 4], eax
mov dword [ebp - 0x44], eax
call fcn.100a1e88
and dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x60]
mov dword [ebp - 0x48], eax
call fcn.1009b955
mov ecx, ebx
mov dword [ebp - 4], 1
call fcn.1009b955
push edi
mov eax, 0x10165d08
mov dword [ebp - 0x44], 1
push eax
push esi
push eax
push edi
push ebx
call fcn.1005d353
pop ecx
pop ecx
push eax
call fcn.1005d353
pop ecx
pop ecx
push eax
call fcn.1005d353
pop ecx
pop ecx
push eax
call fcn.1005d353
pop ecx
pop ecx
push eax
call fcn.1005d353
mov eax, dword [ebp - 0x48]
pop ecx
pop ecx
test eax, eax
jne 0x100a2105
push 0xffffffffffffffff
push 0x10159980
mov ecx, ebx
call fcn.1005d353
jmp 0x100a21c1
lea ecx, [ebp - 0x3c]
xor esi, esi
push ecx
push esi
push esi
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x100a20f2
push esi
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x100a20f2
push 4
pop ecx
push esi
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x40], esi
push eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x4c], ecx
push eax
push ecx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x100a20f2
push dword [ebp - 0x40]
call fcn.1005d353
mov edi, eax
pop ecx
test edi, edi
je 0x100a20f2
push esi
lea eax, [ebp - 0x40]
push eax
push edi
push 2
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov ecx, ebx
push 0xffffffffffffffff
push 0x10159980
test eax, eax
jne 0x100a2185
call fcn.1005d353
jmp 0x100a21ba
call fcn.1005d353
cmp dword [ebp - 0x40], esi
jbe 0x100a21ba
cmp esi, 0x28
jae 0x100a21ba
movzx eax, byte [esi + edi]
push eax
lea eax, [ebp - 0x38]
push 0x10165c80
push eax
call fcn.1005d353
lea eax, [ebp - 0x38]
push eax
push ebx
call fcn.1005d353
add esp, 0x14
inc esi
cmp esi, dword [ebp - 0x40]
jb 0x100a218f
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
pop ecx
cmp dword [ebp - 0x3c], 0
je 0x100a21d0
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
lea ecx, [ebp - 0x60]
call fcn.1005d353
mov eax, ebx
call fcn.10147dd6
ret
Function at 0x100afdae
Capabilities:
Create mailslot

Disassembly:
push 0x14
mov eax, 0x10152d8e
call fcn.10147df8
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [0x10191e8c]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.100ab64a
xor ebx, ebx
mov dword [esi], vtable.WinInterAppStream.0
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], ebx
call fcn.1009b955
lea eax, [esi + 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [esi + 0x30]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.1005d353
pop ecx
pop ecx
push eax
call fcn.1005d353
push 0xc
lea edi, [esi + 0x56]
push ebx
push edi
call sub.VCRUNTIME140.dll_memset
push edi
mov ecx, ebx
call fcn.1005d353
add esp, 0x18
test al, al
je 0x100afe21
cmp dword [esi + 0x5a], ebx
cmovne ecx, edi
push ecx
push ebx
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.kernel32.dll_CreateMailslotA]
lea ecx, [ebp - 0x20]
mov dword [esi + 0x52], eax
call fcn.1005d353
mov eax, esi
call fcn.10147dc1
ret 8

Function at 0x100affb0
Capabilities:
Write file on windows

Disassembly:
push 0x20
mov eax, 0x101509dd
call fcn.10147df8
mov esi, ecx
push esi
lea ecx, [ebp - 0x1c]
call fcn.1008f6a9
and dword [ebp - 4], 0
lea eax, [esi + 0x30]
push eax
lea ecx, [ebp - 0x2c]
call fcn.1009b803
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
push dword [eax + 8]
push dword [eax + 4]
call fcn.1005d353
push 0
xor ecx, ecx
lea eax, [esi + 0x56]
cmp dword [esi + 0x5a], ecx
push 0x80
push 3
cmovne ecx, eax
push ecx
push ebx
push 0x40000000
push dword [ebp - 0x28]
call dword [sym.imp.kernel32.dll_CreateFileA]
and dword [ebp - 0x10], 0
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
je 0x100b004b
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
push 0
push ecx
push dword [edi + 8]
push dword [edi + 4]
push eax
call dword [sym.imp.kernel32.dll_WriteFile]
push dword [ebp - 0x14]
mov esi, eax
call dword [sym.imp.kernel32.dll_CloseHandle]
test esi, esi
je 0x100b004b
mov eax, dword [ebp - 0x10]
cmp eax, dword [edi + 8]
je 0x100b004d
xor bl, bl
lea ecx, [ebp - 0x2c]
call fcn.1005d353
lea ecx, [ebp - 0x1c]
call fcn.1005d353
mov al, bl
call fcn.10147dc1
ret 8
Function at 0x10127680
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1012771b
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x101276d2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x101276d2
cmp esi, ebx
jge 0x101276d2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x10127715
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x10127715
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x10155aa8]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x10155aa8]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1012772d
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc

Function at 0x10127950
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x101975e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107d44f4], 0
mov eax, dword [ebp + 8]
je 0x10127978
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x10127992
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1005d353
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10147db0
leave
ret 4

Function at 0x10127b60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x101975e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107d44f4], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x10127b96
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x10127bf5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1005d353
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1005d353
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.1005d353
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10147db0
leave
ret 0x10
Function at 0x10127c10
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x101975e0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x107d44f4], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x10127c3c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x10127c6d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x10127c6b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1005d353
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x10127c6d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10147db0
leave
ret 8