joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011d4e5
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x90]
push 2
pop edi
cmp eax, edi
je 0x1011d66f
cmp eax, 3
je 0x1011d66f
mov ecx, dword [0x10a0066c]
push ebx
push dword [esi + 4]
call fcn.10013bb1
mov ecx, dword [esi + 0x18]
xor ebx, ebx
inc ebx
cmp ecx, 0x14
je 0x1011d522
cmp ecx, 0x18
jne 0x1011d53f
cmp eax, edi
jne 0x1011d53f
cmp byte [esi + 0x2dc], bl
jne 0x1011d53f
pop ebx
pop edi
mov byte [esi + 0x2d0], 0
mov ecx, esi
pop esi
jmp fcn.1011b244
xor edx, edx
cmp ecx, 0x15
jne 0x1011d5c1
cmp eax, edx
jne 0x1011d5c1
push dword [esi + 0xa4]
fldz
mov dword [esi + 0x18], 0x16
push ecx
fstp dword [esp]
push 0xffffffffffffffff
mov ecx, esi
call fcn.1011a815
lea edi, [esi + 0xac]
mov eax, dword [edi]
cmp eax, 0xffffffff
je 0x1011d57f
mov ecx, dword [0x10a0066c]
push eax
call fcn.100185ce
mov ecx, dword [0x10a0066c]
push ebx
push ebx
push dword [esi + 4]
push ebx
push dword [esi + 0xa4]
push edi
call fcn.1001ee88
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xb4], eax
mov ecx, dword [0x10a0c360]
lea eax, [esi + 0xb8]
push eax
push ebx
push dword [esi + 0xa4]
call fcn.10004cd7
jmp 0x1011d66e
cmp ecx, 6
jne 0x1011d5e1
cmp eax, edx
jne 0x1011d5e1
mov dword [esi + 0x90], edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x94], eax
jmp 0x1011d66e
cmp ecx, 4
jne 0x1011d607
cmp eax, edx
jne 0x1011d66e
push edx
fldz
push ecx
fstp dword [esp]
push 0xffffffffffffffff
mov ecx, esi
mov dword [esi + 0x18], 9
call fcn.1011a815
jmp 0x1011d66e
cmp eax, edx
jne 0x1011d66e
cmp ecx, ebx
je 0x1011d63b
cmp ecx, edi
je 0x1011d63b
cmp ecx, 3
je 0x1011d63b
cmp ecx, 5
je 0x1011d63b
cmp ecx, 7
je 0x1011d63b
cmp ecx, 8
je 0x1011d63b
cmp ecx, 0xa
je 0x1011d63b
cmp ecx, 0x14
je 0x1011d63b
cmp ecx, 0x17
je 0x1011d63b
cmp ecx, 0x18
jne 0x1011d66e
mov eax, dword [esi]
cmp byte [eax + 0x81], dl
je 0x1011d64f
mov eax, dword [0x10a0c400]
cmp byte [eax + 0x43], dl
jne 0x1011d66e
push edx
fldz
push ecx
fstp dword [esp]
push 0xffffffffffffffff
mov ecx, esi
mov dword [esi + 0x18], edx
call fcn.1011a815
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x98], eax
pop ebx
pop edi
pop esi
ret
Function at 0x10126cbb
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
push 0x1017c3f8
push dword [ebp + 8]
mov dword [ebp - 8], ecx
call fcn.1015963b
mov esi, eax
xor edi, edi
cmp esi, edi
pop ecx
pop ecx
jne 0x10126ce0
xor eax, eax
jmp 0x10126d49
push ebx
push 2
push edi
push esi
call fcn.10159965
push esi
call fcn.1015e3bb
push eax
mov dword [ebp + 8], eax
call fcn.10158ce7
mov ebx, eax
add esp, 0x14
cmp ebx, edi
jne 0x10126d06
xor eax, eax
jmp 0x10126d48
push edi
push edi
push esi
call fcn.10159965
push esi
push dword [ebp + 8]
push 1
push ebx
call fcn.1015988a
add esp, 0x1c
mov dword [ebp - 4], eax
test byte [esi + 0xc], 0x20
jne 0x10126d02
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push ebx
push edi
push 1
push edi
push dword [eax + 0x34]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x10126d02
push esi
call fcn.101594d4
pop ecx
mov eax, ebx
pop ebx
pop edi
pop esi
leave
ret 4
Function at 0x10129a1d
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
mov eax, dword [0x101b7f10]
push ebx
push esi
mov dword [ebp + 0x74], eax
push edi
lea eax, [ebp - 0x1c]
push eax
mov edi, ecx
call fcn.1015beb2
lea eax, [ebp - 0x1c]
push eax
call fcn.1015bca4
pop ecx
pop ecx
mov esi, eax
add dword [esi + 0x14], 0x76c
inc dword [esi + 0x10]
xor ebx, ebx
push ebx
push str.ScreenShot
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x40
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.101590d0
push dword [esi + 0xc]
lea eax, [ebp - 0xc]
push dword [esi + 0x10]
push dword [esi + 0x14]
push str.ScreenShotChatLog__d__d__d
push eax
call fcn.10159219
push 0x40
lea eax, [ebp + 0x34]
push ebx
push eax
call fcn.101590d0
add esp, 0x2c
xor esi, esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0x34]
push str._s__d.txt
push eax
call fcn.10159219
lea eax, [ebp + 0x34]
push 0x101846e8
push eax
call fcn.1015963b
add esp, 0x18
cmp eax, ebx
je 0x10129ac9
push eax
call fcn.101594d4
pop ecx
inc esi
jmp 0x10129a97
lea eax, [ebp + 0x34]
push 0x1018e994
push eax
call fcn.1015963b
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x10129baf
push str._ChatLog__n
push esi
call fcn.1015aa74
pop ecx
lea eax, [edi + 0x24188]
mov dword [ebp - 0x14], ebx
pop ecx
mov dword [ebp - 0x10], eax
mov ebx, 0x1017c514
mov eax, dword [ebp - 0x10]
add eax, 0xffffff70
push eax
push esi
call fcn.1015aa74
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
call fcn.10151f50
push eax
push esi
call fcn.1015aa74
push ebx
push esi
call fcn.1015aa74
mov eax, dword [ebp - 0x14]
add esp, 0x10
cmp eax, dword [edi + 0x86b14]
jge 0x10129b49
inc dword [ebp - 0x14]
add dword [ebp - 0x10], 0x194
cmp dword [ebp - 0x14], 0x3e8
jl 0x10129b01
push 0x1018e97c
push esi
call fcn.1015aa74
and dword [ebp - 0x14], 0
pop ecx
lea eax, [edi + 0x24188]
pop ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0x6299c
push eax
push esi
call fcn.1015aa74
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
call fcn.10151f50
push eax
push esi
call fcn.1015aa74
push ebx
push esi
call fcn.1015aa74
mov eax, dword [ebp - 0x14]
add esp, 0x10
cmp eax, dword [edi + 0x908f0]
jge 0x10129ba8
inc dword [ebp - 0x14]
add dword [ebp - 0x10], 0x194
cmp dword [ebp - 0x14], 0x64
jl 0x10129b63
push esi
call fcn.101594d4
pop ecx
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
pop ebx
call fcn.1015901e
add ebp, 0x78
leave
ret
Function at 0x101355cc
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x10179d36
call fcn.10159f04
sub esp, 0x304
cmp byte [0x10a0c34c], 0
mov eax, dword [0x101b7f10]
mov dword [ebp - 0x10], eax
jne 0x101357c7
mov eax, dword [0x10a0c378]
cmp byte [eax + 1], 0
jne 0x101357c7
push 0x10180c16
lea ecx, [ebp - 0x310]
call fcn.10152140
and dword [ebp - 4], 0
mov ecx, eax
call fcn.10151f50
push eax
lea ecx, [ebp - 0x110]
call fcn.10152140
lea ecx, [ebp - 0x310]
mov byte [ebp - 4], 2
call fcn.10152110
cmp dword [0x10a0c470], 1
mov ecx, dword [0x10a0c364]
je 0x10135657
test ecx, ecx
je 0x1013566c
lea eax, [ebp - 0x110]
push eax
push 0x3f0
jmp 0x10135667
test ecx, ecx
je 0x1013566c
lea eax, [ebp - 0x110]
push eax
push 0x3ef
call fcn.100431ba
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
mov eax, dword [0x10a0c228]
sub edi, eax
cmp edi, 0x7a120
jbe 0x101357b7
test eax, eax
push ebx
mov ebx, 0x3e8
je 0x10135785
push esi
lea ecx, [ebp - 0x110]
call fcn.10151f70
lea ecx, [ebp - 0x210]
call fcn.10152120
mov ecx, dword [0x10a0c364]
test ecx, ecx
mov byte [ebp - 4], 3
mov esi, 0x3f1
je 0x101356fa
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.100431ba
cmp al, 1
jne 0x101356fa
mov eax, 0x7c830
sub eax, edi
xor edx, edx
mov ecx, ebx
div ecx
lea ecx, [ebp - 0x210]
push eax
call fcn.10151f50
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.10151f80
add esp, 0xc
cmp dword [0x10a0c470], 5
jge 0x10135731
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x10a0c364]
test ecx, ecx
mov dword [0x10a0c228], eax
je 0x10135729
lea eax, [ebp - 0x110]
push eax
push 0x3f0
call fcn.100431ba
inc dword [0x10a0c470]
jmp 0x10135775
mov ecx, dword [0x10a0c364]
test ecx, ecx
je 0x10135775
lea eax, [ebp - 0x210]
push eax
push esi
call fcn.100431ba
cmp al, 1
jne 0x10135775
mov eax, 0x7c830
sub eax, edi
xor edx, edx
mov ecx, ebx
div ecx
lea ecx, [ebp - 0x210]
push eax
call fcn.10151f50
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.10151f80
add esp, 0xc
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 2
call fcn.10152110
pop esi
mov eax, 0x7c830
sub eax, edi
xor edx, edx
div ebx
pop ebx
test eax, eax
ja 0x101357b7
cmp dword [0x10a0c228], 0
je 0x101357b7
mov ecx, dword [0x10a0c230]
and dword [0x10a0c228], 0
mov byte [0x10a069e0], 0x50
call fcn.1014260c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x110]
call fcn.10152110
pop edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.1015901e
leave
ret
Function at 0x10135e15
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x101b7f10]
push esi
mov esi, ecx
cmp byte [esi + 0x7c], 0
mov dword [ebp - 4], eax
je 0x10135e4a
cmp byte [0x10a069e0], 0xa
jne 0x10135e94
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x6c], eax
mov byte [0x10a069e1], 3
jmp 0x10135e94
mov ecx, dword [0x10a0c230]
call fcn.101425d3
cmp ax, 2
jne 0x10135e94
mov al, byte [0x10a069e0]
cmp al, 0x50
je 0x10135e38
cmp al, 0x51
jne 0x10135e7a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x6c], eax
mov byte [0x10a069e1], 2
jmp 0x10135e94
lea ecx, [ebp - 0x104]
mov byte [esi + 0x7c], 1
call fcn.10152120
lea ecx, [ebp - 0x104]
call fcn.10152110
mov ecx, dword [ebp - 4]
pop esi
call fcn.1015901e
leave
ret
Function at 0x1013de8d
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x194
mov eax, dword [0x101b7f10]
mov dword [esp + 0x190], eax
lea eax, [esp]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov ecx, dword [esp + 0x190]
neg eax
sbb eax, eax
inc eax
call fcn.1015901e
add esp, 0x194
ret

Function at 0x1013dec6
Capabilities:
Connect socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x101b7f10]
push ebx
push esi
xor esi, esi
push esi
push 1
push 2
mov dword [ebp - 4], eax
mov ebx, ecx
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [ebp - 0x28], eax
jne 0x1013df06
push esi
push str.ERROR
push str.Initialize_socket_fail
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x1013e079
cmp dword [ebx + 4], esi
mov dword [ebx + 0x2000c], esi
mov dword [ebx + 0x20008], esi
mov dword [ebx + 0x20010], esi
mov byte [ebx + 0x2013c], 0
mov byte [ebx + 0x2013d], 0
mov byte [ebx + 0x2013f], 0
mov byte [ebx + 0x2013e], 0
je 0x1013df40
mov ecx, ebx
call fcn.1013de2b
push edi
push 0x10
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.101590d0
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x28]
mov word [ebp - 0x12], si
mov esi, dword [sym.imp.WS2_32.dll_bind]
mov word [ebp - 0x14], 2
call esi
cmp eax, 0xffffffff
mov edi, dword [sym.imp.WS2_32.dll_htons]
jne 0x1013dff0
add dword [0x10a4f178], 0xa
mov eax, dword [0x10a4f178]
add eax, 0x1388
push eax
call edi
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x28]
call esi
cmp eax, 0xffffffff
jne 0x1013dff0
add dword [0x10a4f178], 0xa
mov eax, dword [0x10a4f178]
add eax, 0x1388
push eax
call edi
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x28]
call esi
cmp eax, 0xffffffff
jne 0x1013dff0
push 0
push str.ERROR
push str.Binding_fail
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [ebp - 0x28]
call dword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
jmp 0x1013e078
push 0x10
xor esi, esi
lea eax, [ebp - 0x24]
push esi
push eax
call fcn.101590d0
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_inet_addr]
push dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov word [ebp - 0x24], 2
call edi
mov edi, dword [ebp - 0x28]
mov word [ebp - 0x22], ax
push 0x10
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jl 0x1013e043
push 0x21
push dword [ebp + 0x14]
push dword [ebp + 0x18]
push edi
call dword [sym.imp.WS2_32.dll_WSAAsyncSelect]
test eax, eax
jle 0x1013e04f
push edi
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebx + 4], esi
jmp 0x1013dfe9
cmp dword [ebp + 0x1c], esi
mov dword [ebx + 4], edi
je 0x1013e06c
push esi
push 4
lea eax, [ebp + 0x10]
push eax
push edi
mov dword [ebp + 0x10], 0x1f44f321
call dword [sym.imp.WS2_32.dll_send]
mov dword [ebx + 0x20018], 1
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.1015901e
leave
ret 0x18
Function at 0x1013e540
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 4], ebx
ja 0x1013e552
xor eax, eax
jmp 0x1013e5f2
cmp dword [esi + 0x20014], ebx
jle 0x1013e561
mov ecx, esi
call fcn.1013e0c5
mov eax, dword [esi + 0x20008]
mov edx, 0x10000
cmp eax, edx
push edi
jg 0x1013e5e3
cmp eax, ebx
jl 0x1013e5e3
mov ecx, dword [esi + 0x20014]
cmp ecx, eax
jg 0x1013e587
cmp ecx, edx
jge 0x1013e587
cmp ecx, ebx
jge 0x1013e593
mov dword [esi + 0x20008], ebx
mov dword [esi + 0x20014], ebx
mov ecx, dword [esi + 0x20014]
mov eax, dword [esi + 0x20008]
push ebx
sub eax, ecx
push eax
lea eax, [ecx + esi + 8]
push eax
push dword [esi + 4]
call dword [sym.imp.WS2_32.dll_send]
mov edi, eax
cmp edi, 0xffffffff
je 0x1013e5c0
add dword [esi + 0x20014], edi
jmp 0x1013e5c6
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov eax, dword [esi + 0x20014]
cmp eax, dword [esi + 0x20008]
jl 0x1013e5de
cmp edi, 0xffffffff
je 0x1013e5de
xor eax, eax
inc eax
jmp 0x1013e5e5
xor eax, eax
inc eax
jmp 0x1013e5f1
xor eax, eax
mov dword [esi + 0x20008], ebx
mov dword [esi + 0x20014], ebx
pop edi
pop esi
pop ebx
ret

Function at 0x10144dec
Capabilities:
Delete file

Disassembly:
mov eax, 0x1017a46a
call fcn.10159f04
sub esp, 0x494
mov eax, dword [0x101b7f10]
mov ecx, dword [0x10a0c444]
push 3
mov dword [ebp - 0x10], eax
push 0x66
lea eax, [ebp - 0x4a0]
push eax
call fcn.10096c2b
and dword [ebp - 4], 0
mov ecx, eax
call fcn.10151f50
push eax
lea ecx, [ebp - 0x180]
call fcn.10152140
lea ecx, [ebp - 0x4a0]
mov byte [ebp - 4], 2
call fcn.10152110
lea ecx, [ebp - 0x180]
call fcn.10151f60
test al, al
je 0x10144e63
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x180]
call fcn.10152110
jmp 0x10144f17
push esi
mov esi, str.._system_SaveID.bin
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x3a0]
call fcn.101536c0
push 0x16
push esi
lea ecx, [ebp - 0x3a0]
mov byte [ebp - 4], 3
call fcn.10153be0
test al, al
je 0x10144ef8
lea ecx, [ebp - 0x180]
call fcn.10151f40
mov esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x180]
call fcn.10151f50
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.1015a1f0
push 0x35
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.101590d0
add esp, 0x18
xor eax, eax
test esi, esi
jle 0x10144edc
mov cl, byte [ebp + eax - 0x80]
not cl
mov byte [ebp + eax - 0x48], cl
inc eax
cmp eax, esi
jl 0x10144ecd
push 0x35
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x3a0]
call fcn.101538d0
lea ecx, [ebp - 0x3a0]
call fcn.10153700
lea ecx, [ebp - 0x3a0]
mov byte [ebp - 4], 2
call fcn.10153b90
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x180]
call fcn.10152110
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.1015901e
leave
ret
Function at 0x10146d49
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x1017a593
call fcn.10159f04
sub esp, 0x30c
cmp byte [ecx], 1
mov eax, dword [0x101b7f10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x314], ecx
je 0x10146f9a
cmp dword [0x10a069f4], 5
jne 0x10146f9a
lea ecx, [ebp - 0x210]
call fcn.10152120
and dword [ebp - 4], 0
lea ecx, [ebp - 0x310]
call fcn.10152120
lea ecx, [ebp - 0x110]
mov byte [ebp - 4], 1
call fcn.10152120
mov eax, dword [0x10a0c35c]
mov eax, dword [eax + 0x1144]
sub eax, 0
mov byte [ebp - 4], 2
je 0x10146e71
dec eax
je 0x10146e4a
dec eax
je 0x10146e23
dec eax
je 0x10146dfc
dec eax
jne 0x10146ea1
push str.systemTantraParam_5.tpa
lea ecx, [ebp - 0x210]
call fcn.10152010
push str.systemHTQuest_5.sys
lea ecx, [ebp - 0x310]
call fcn.10152010
push str.systemHTScript_5.sys
jmp 0x10146e96
push str.systemTantraParam_4.tpa
lea ecx, [ebp - 0x210]
call fcn.10152010
push str.systemHTQuest_4.sys
lea ecx, [ebp - 0x310]
call fcn.10152010
push str.systemHTScript_4.sys
jmp 0x10146e96
push str.systemTantraParam_3.tpa
lea ecx, [ebp - 0x210]
call fcn.10152010
push str.systemHTQuest_3.sys
lea ecx, [ebp - 0x310]
call fcn.10152010
push str.systemHTScript_3.sys
jmp 0x10146e96
push str.systemTantraParam_2.tpa
lea ecx, [ebp - 0x210]
call fcn.10152010
push str.systemHTQuest_2.sys
lea ecx, [ebp - 0x310]
call fcn.10152010
push str.systemHTScript_2.sys
jmp 0x10146e96
push str.systemTantraParam_1.tpa
lea ecx, [ebp - 0x210]
call fcn.10152010
push str.systemHTQuest_1.sys
lea ecx, [ebp - 0x310]
call fcn.10152010
push str.systemHTScript_1.sys
lea ecx, [ebp - 0x110]
call fcn.10152010
push ebx
push esi
lea ecx, [ebp - 0x210]
mov bl, 1
call fcn.10151f50
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
call esi
cmp eax, 0xffffffff
jne 0x10146ec0
xor bl, bl
lea ecx, [ebp - 0x310]
call fcn.10151f50
push eax
call esi
cmp eax, 0xffffffff
jne 0x10146ed5
xor bl, bl
lea ecx, [ebp - 0x110]
call fcn.10151f50
push eax
call esi
cmp eax, 0xffffffff
jne 0x10146eea
xor bl, bl
cmp bl, 1
jne 0x10146f62
mov ecx, dword [0x10a0c360]
test ecx, ecx
je 0x10146f07
mov esi, ecx
call fcn.1000e222
push esi
call fcn.1015a314
pop ecx
and dword [0x10a0c360], 0
push 0x1e4
call fcn.101589ff
pop ecx
mov dword [ebp - 0x318], eax
test eax, eax
mov byte [ebp - 4], 3
je 0x10146f30
mov ecx, eax
call fcn.1000e96c
jmp 0x10146f32
xor eax, eax
lea ecx, [ebp - 0x210]
push ecx
mov ecx, eax
mov byte [ebp - 4], 2
mov dword [0x10a0c360], eax
call fcn.1000efe8
mov ecx, dword [0x10a0c360]
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x310]
push eax
call fcn.1000f305
mov eax, dword [ebp - 0x314]
lea ecx, [ebp - 0x110]
mov byte [eax], 1
mov byte [ebp - 4], 1
call fcn.10152110
lea ecx, [ebp - 0x310]
mov byte [ebp - 4], 0
call fcn.10152110
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x210]
call fcn.10152110
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
call fcn.1015901e
leave
ret
Function at 0x10153a20
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x204
push ebp
push esi
push edi
mov edx, ecx
xor eax, eax
mov word [esp + 0x10], 0x5c
mov ecx, 0x3f
lea edi, [esp + 0x12]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x214]
stosw word es:[edi], ax
lea eax, [esp + 0x110]
push eax
lea esi, [edx + 8]
lea ebp, [edx + 0x108]
push str.PATH
push ecx
mov dword [esp + 0x18], esi
mov byte [esi], 0
mov byte [ebp], 0
call fcn.1015f783
add esp, 0xc
lea edx, [esp + 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0x10
jne 0x10153aad
lea eax, [esp + 0x110]
mov edx, ebp
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10153a92
pop edi
mov word [esi], 0x5c
pop esi
pop ebp
add esp, 0x204
ret 4
cmp eax, 0xffffffff
je 0x10153b82
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x114]
push eax
call fcn.1015d369
add esp, 8
mov edx, esi
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x10153ad0
lea ecx, [esp + 0x10]
push ecx
push 0
call fcn.1015d369
add esp, 8
test eax, eax
je 0x10153b82
push ebx
jmp 0x10153af8
mov esi, dword [esp + 0x10]
mov ecx, esi
lea ebx, [ebx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x10153b00
sub ecx, esi
mov edi, ebp
mov edx, ecx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10153b10
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
mov edx, ecx
lea esp, [esp]
mov bl, byte [ecx]
inc ecx
test bl, bl
jne 0x10153b30
sub ecx, edx
mov edi, ebp
mov esi, edx
mov edx, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x10153b40
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x10]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10153b60
lea edx, [esp + 0x14]
push edx
push 0
call fcn.1015d369
add esp, 8
test eax, eax
jne 0x10153af4
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x204
ret 4
Function at 0x10158520
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x864
mov eax, dword [0x101b7f10]
push ebx
mov dword [esp + 0x864], eax
mov eax, dword [ecx + 4]
xor ebx, ebx
cmp eax, ebx
push esi
push edi
jne 0x1015855b
xor eax, eax
mov ecx, dword [esp + 0x86c]
call fcn.1015901e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax*4 + 0x101b7e20]
push ecx
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov al, byte [0x10180c16]
mov byte [esp + 0x68], al
xor eax, eax
mov ecx, 0x1ff
lea edi, [esp + 0x69]
rep stosd dword es:[edi], eax
push 0xf0000000
push 1
push ebx
stosw word es:[edi], ax
push ebx
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x20], 1
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], ebx
stosb byte es:[edi], al
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x101586b8
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push ebx
push ebx
push 0x8003
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x101586a8
lea eax, [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x101585e0
sub eax, edx
mov edx, dword [esp + 0x10]
push ebx
push eax
lea ecx, [esp + 0x28]
push ecx
push edx
mov dword [esp + 0x2c], eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x10158697
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push eax
push 1
push ecx
push 0x6801
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x10158697
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
mov dword [esp + 0x1c], ecx
mov eax, ecx
shr ecx, 2
lea edi, [esp + 0x68]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 0x18]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x6c]
push edx
push ebx
push 1
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x10158664
mov dword [esp + 0xc], ebx
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0x68]
mov ecx, eax
sub edx, ecx
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10158680
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x101586ac
mov edx, dword [esp + 0x10]
push edx
mov dword [esp + 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
jmp 0x101586ac
mov dword [esp + 0xc], ebx
mov eax, dword [esp + 0x14]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [esp + 0x86c]
mov eax, dword [esp + 0xc]
call fcn.1015901e
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10