joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000beb2
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1014a7b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, 0xffff
mov esi, ecx
cmp di, bx
jne 0x1000bedb
xor eax, eax
jmp 0x1000bfa3
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x1000bf03
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x1000bf03
mov ecx, esi
call dword [sym.imp.MSVCP140.dll_protected:_wchar_t____thiscall_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::_Pninc_void_]
mov word [eax], bx
mov ax, bx
jmp 0x1000bfa3
cmp dword [esi + 0x4c], 0
je 0x1000bfa0
mov ecx, esi
call fcn.1000cac5
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1000bf31
push dword [esi + 0x4c]
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
pop ecx
pop ecx
cmp ax, di
je 0x1000bfa0
movzx edi, bx
jmp 0x1000bfa0
lea eax, [ebp - 0x2c]
mov word [ebp - 0x28], bx
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x26]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet___wchar_t_const___wchar_t_const___wchar_t_const____char___char___char___const]
test eax, eax
js 0x1000bfa0
cmp eax, 1
jle 0x1000bf6d
cmp eax, 3
jne 0x1000bfa0
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x1000bf1f
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x34], eax
je 0x1000bf91
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp dword [ebp - 0x34], eax
jne 0x1000bfa0
lea eax, [ebp - 0x28]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x30], eax
mov ax, bx
jne 0x1000bfa3
mov ax, di
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ee6a0
leave
ret 4
Function at 0x1001825a
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push 0x10
mov eax, 0x100f2b39
call fcn.100eef7f
mov ebx, ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebx + 0x10]
xor esi, esi
mov dword [ebx], vtable.LogObfuscator.0
push 0x102
push eax
mov dword [ebx + 4], 0x30d40
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], esi
call dword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
pop ecx
pop ecx
lea ecx, [ebx + 0x40]
mov dword [ebp - 4], esi
call fcn.10004a19
push 0xf0000000
push 0x18
push esi
push esi
mov byte [ebp - 4], 1
or dword [ebx + 0x54], 0xffffffff
push 0x101512b8
mov byte [ebx + 0x50], 1
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0x20
call fcn.100ee6bf
mov ebx, eax
pop ecx
mov dword [ebp - 0x14], ebx
push 8
mov byte [ebp - 4], 2
lea esi, [ebx + 4]
pop ecx
xor eax, eax
mov dword [ebp - 0x18], esi
mov edi, ebx
rep stosd dword es:[edi], eax
and dword [ebx], eax
xor edi, edi
push edi
push edi
mov dword [esi], edi
mov dword [esi + 4], edi
call fcn.100078f6
mov dword [esi], eax
mov dword [ebx + 0xc], edi
mov dword [ebx + 0x10], edi
mov dword [ebx + 0x14], edi
mov byte [ebp - 4], 4
mov ecx, ebx
push 8
mov dword [ebx], 0x3f800000
call fcn.1000c7c7
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x10]
push 8
mov dword [esi + 0xc], ebx
call fcn.100ee6bf
mov dword [ebp - 0x18], eax
pop ecx
mov dword [eax], vtable.LoggingSha256Hasher.0
mov dword [eax + 4], edi
mov dword [esi + 8], eax
mov eax, esi
call fcn.100eef48
ret
Function at 0x10018506
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push 0x6c
mov eax, 0x100f2b89
call fcn.100eefb3
mov edx, ecx
mov dword [ebp - 0x64], edx
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0x30]
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x78], ebx
and dword [ebp - 0x74], 0
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x14]
push 8
mov dword [ebp - 0x6c], eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
xor edi, edi
mov dword [ebx + 0x14], 7
mov dword [ebx + 0x10], edi
mov word [ebx], ax
lea esi, [edx + 0x10]
mov dword [ebp - 4], edi
mov ecx, esi
mov dword [ebp - 0x74], 1
call fcn.10007db4
mov eax, dword [ebp - 0x64]
mov eax, dword [eax + 8]
test eax, eax
je 0x10018608
add eax, 4
push eax
push edi
push edi
push 0x800c
mov dword [eax], edi
push dword [0x101512b8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1001859f
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x1001860d
mov ecx, dword [ebp - 0x70]
mov eax, ecx
cmp dword [ecx + 0x14], 8
jb 0x100185b0
mov eax, dword [ecx]
mov edi, dword [ebp - 0x68]
lea ecx, [eax + edi*2]
mov eax, dword [ebp - 0x64]
mov edx, dword [eax + 8]
test ecx, ecx
je 0x100185f7
mov eax, dword [ebp - 0x6c]
push 0
sub eax, edi
add eax, eax
push eax
push ecx
push dword [edx + 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x100185ee
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
jmp 0x100185f0
xor edi, edi
test edi, edi
js 0x1001860d
mov eax, dword [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [eax + 8]
call 0x10011a34
mov edi, eax
jmp 0x1001860d
mov edi, 0x80004004
mov ecx, esi
mov dword [ebp - 4], 1
call fcn.10007dd1
xor eax, eax
mov byte [ebp - 4], al
test edi, edi
js 0x10018696
push dword [ebp - 0x30]
lea eax, [ebp - 0x28]
push eax
call fcn.10018481
push eax
mov ecx, ebx
call fcn.1000808c
lea ecx, [ebp - 0x28]
call fcn.1000815b
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x6c]
sub ecx, eax
push ecx
mov ecx, dword [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.1000b708
mov dword [ebp - 4], 2
mov eax, ebx
cmp dword [ebx + 0x14], 8
jb 0x10018667
mov eax, dword [ebx]
push eax
lea ecx, [ebp - 0x48]
call fcn.10007efe
mov ecx, dword [ebp - 0x64]
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x60]
mov byte [ebp - 4], 3
push eax
call fcn.100186d8
lea ecx, [ebp - 0x48]
call fcn.1000815b
lea ecx, [ebp - 0x60]
call fcn.1000815b
jmp 0x100186a0
cmp edi, 0x80004004
je 0x100186a0
mov byte [eax], al
mov eax, ebx
call fcn.100eef5d
ret 0x10
Function at 0x10018779
Capabilities:
Write file on windows

Disassembly:
push 0xec
mov eax, 0x100f2c0e
call fcn.100eefb3
mov ebx, dword [0x101512ac]
mov edx, dword [ebp + 8]
cmp byte [ebx + 0x50], 0
je 0x10018964
push str.ObfuscationStringMap.txt
lea ecx, [ebp - 0x2c]
call fcn.1001baee
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
cmp dword [ebp - 0x18], 8
mov ecx, ebx
cmovae eax, dword [ebp - 0x2c]
push eax
call 0x10018c0f
test eax, eax
js 0x1001895c
lea edi, [ebx + 0x10]
mov ecx, edi
mov dword [ebp - 0xe0], edi
call fcn.10007db4
mov byte [ebp - 4], 1
mov eax, dword [ebx + 0xc]
test eax, eax
je 0x1001893e
mov byte [ebx + 0x50], 0
mov eax, dword [eax + 4]
mov esi, dword [eax]
cmp esi, eax
je 0x1001893e
mov eax, dword [esi + 0x18]
lea edx, [ebx + 0x40]
add eax, dword [esi + 0x30]
mov ecx, edx
and dword [ebx + 0x48], 0
lea eax, [eax*2 + 6]
push eax
call fcn.10004a8e
push 0xb0
lea eax, [ebp - 0xdc]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
pop ecx
lea ecx, [ebp - 0xdc]
call fcn.10011466
lea eax, [esi + 8]
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
mov dword [ebp - 0x14], eax
jb 0x10018847
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea edx, [esi + 0x20]
cmp dword [edx + 0x14], 8
jb 0x10018852
mov edx, dword [edx]
lea ecx, [ebp - 0xcc]
call fcn.1000d9a0
mov edx, 0x1012a04c
mov ecx, eax
call fcn.1000d9a0
mov edx, dword [ebp - 0x14]
mov ecx, eax
call fcn.1000d9a0
mov edx, 0x1012a044
mov ecx, eax
call fcn.1000d9a0
push dword [ebx + 0x48]
push 0
push dword [ebx + 0x44]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0xf8]
lea ecx, [ebp - 0xc4]
push eax
call fcn.100114e7
cmp dword [ebp - 0xe4], 8
lea eax, [ebp - 0xf8]
push dword [ebx + 0x48]
cmovae eax, dword [ebp - 0xf8]
push eax
push dword [ebx + 0x44]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea ecx, [ebp - 0xf8]
call fcn.1000815b
cmp dword [ebx + 0x54], 0xffffffff
je 0x1001890b
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0
push eax
push dword [ebx + 0x48]
push dword [ebx + 0x44]
push dword [ebx + 0x54]
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
je 0x1001890b
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
js 0x1001892d
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 1
call fcn.1000c04c
lea ecx, [ebp - 0x74]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
mov eax, dword [ebx + 0xc]
mov esi, dword [esi]
cmp esi, dword [eax + 4]
jmp 0x100187f1
lea ecx, [ebp - 0x74]
call fcn.1000c04c
lea ecx, [ebp - 0x74]
call dword [sym.imp.MSVCP140.dll_public_virtual:_void___thiscall_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void_]
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.10007dd1
cmp dword [ebx + 0x54], 0xffffffff
je 0x1001895c
push dword [ebx + 0x54]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebx + 0x54], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.1000815b
call fcn.100eef5d
ret 4
Function at 0x100199ee
Capabilities:
Move file

Disassembly:
push 0x50
mov eax, 0x100f2e88
call fcn.100eefb3
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x2c], edi
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
and dword [ebp - 4], eax
push ecx
push 0x5c
mov ecx, esi
call fcn.1001bfd0
push ecx
push 0x2e
mov ecx, esi
mov ebx, eax
call fcn.1001bfd0
cmp eax, 0xffffffff
jne 0x10019a3e
push esi
lea ecx, [ebp - 0x44]
call fcn.100080e4
jmp 0x10019a5f
cmp ebx, 0xffffffff
je 0x10019a47
cmp ebx, eax
ja 0x10019a33
push eax
push 0
push esi
lea ecx, [ebp - 0x28]
call fcn.1000cfab
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x44]
call fcn.10007d1a
lea ecx, [ebp - 0x28]
call fcn.1000815b
push 0x1012a074
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 1
call fcn.1000b7be
push eax
lea ecx, [ebp - 0x5c]
call fcn.10007d1a
push 0x10127b34
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.1000b7be
push eax
mov ecx, edi
call fcn.10007d1a
lea ecx, [ebp - 0x5c]
call fcn.1000815b
lea ecx, [ebp - 0x44]
call fcn.1000815b
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x10019ab7
mov eax, dword [edi]
cmp dword [esi + 0x14], 8
jb 0x10019abf
mov esi, dword [esi]
push eax
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrename]
pop ecx
pop ecx
mov eax, edi
call fcn.100eef5d
ret

Function at 0x1001b892
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x198
mov eax, dword [0x1014a7b4]
xor eax, esp
mov dword [esp + 0x194], eax
push 0x190
lea eax, [esp + 4]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push eax
call fcn.1001bac7
mov ecx, dword [esp + 0x194]
xor ecx, esp
call fcn.100ee6a0
mov esp, ebp
pop ebp
ret
Function at 0x1001b8f2
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1014a7b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x1c], ecx
push esi
push 1
push 2
pop eax
push eax
call dword [sym.imp.WS2_32.dll_socket]
mov ebx, eax
lea edi, [ebp - 0x18]
cmp ebx, 0xffffffff
setne cl
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
cmp ebx, 0xffffffff
je 0x1001b972
push 2
pop eax
push dword [ebp + 8]
mov word [ebp - 0x18], ax
call dword [sym.imp.WS2_32.dll_htons]
mov edi, dword [ebp - 0x1c]
mov word [ebp - 0x16], ax
cmp byte [edi + 8], 0
jne 0x1001b94d
push esi
jmp 0x1001b952
push 0x7f000001
call dword [sym.imp.WS2_32.dll_htonl]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push 0x10
push eax
push ebx
call dword [sym.imp.WS2_32.dll_bind]
mov esi, eax
cmp esi, 0xffffffff
setne cl
jmp 0x1001b975
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 8], 1
test cl, cl
je 0x1001b9ab
push 4
lea eax, [ebp - 8]
push eax
push 8
push 0xffff
push ebx
call dword [sym.imp.WS2_32.dll_setsockopt]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001b9ab
push 0xa
push ebx
call dword [sym.imp.WS2_32.dll_listen]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1001b9ba
cmp ebx, 0xffffffff
je 0x1001b9ba
push ebx
call dword [sym.imp.WS2_32.dll_closesocket]
or ebx, 0xffffffff
push esi
mov dword [edi + 4], ebx
call fcn.1001bac7
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ee6a0
leave
ret 4
Function at 0x10023e00
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x100f3f18
call fcn.100eefb3
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x38], ebx
je 0x10023f09
cmp byte [esi + 0x3d], bl
je 0x10023f09
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
sete al
test al, al
je 0x10023e3a
xor al, al
jmp 0x10023f0b
push ebx
push 8
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x28], bl
call fcn.100181da
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 0x28]
mov edi, dword [ebp - 0x14]
cmp edi, 0x10
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x28]
cmovae edx, ebx
lea ecx, [ebp - 0x28]
cmovae ecx, ebx
add eax, edx
push eax
push ecx
mov ecx, dword [esi + 0x38]
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10023e96
sub eax, 1
je 0x10023e9a
dec eax
sub eax, 1
je 0x10023ef7
xor bl, bl
jmp 0x10023ef9
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ebx, dword [ebp - 0x28]
cmp edi, 0x10
mov ecx, dword [ebp - 0x2c]
cmovae eax, ebx
sub ecx, eax
mov dword [ebp - 0x30], ecx
je 0x10023ed9
push dword [esi + 0x4c]
cmp edi, 0x10
lea eax, [ebp - 0x28]
push ecx
cmovae eax, ebx
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ecx, dword [ebp - 0x30]
add esp, 0x10
cmp ecx, eax
jne 0x10023e92
mov edi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x28]
cmp byte [esi + 0x3d], 0
je 0x10023ef7
test ecx, ecx
jne 0x10023e5b
push ecx
push 8
lea ecx, [ebp - 0x28]
call fcn.10005731
jmp 0x10023e55
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.100202d3
mov al, bl
jmp 0x10023f0b
mov al, 1
call fcn.100eef5d
ret
Function at 0x1002495c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1014a7b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
xor edx, edx
push ebx
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x14], eax
mov dword [esi], edx
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi + 0xc], edx
cmp dword [ebx + 0x10], ecx
je 0x10024ace
cmp dword [ebx + 0x10], 0x20
jne 0x10024ace
mov byte [ebp - 0xc], dl
lea edi, [ebp - 0xb]
xor eax, eax
mov dword [ebp - 0x18], edx
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edx
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, edx
cmp dword [ebx + 0x14], 0x10
jb 0x100249be
mov eax, dword [ebx]
jmp 0x100249c0
mov eax, ebx
movzx eax, byte [eax + edi]
push eax
call fcn.1002641b
pop ecx
cmp eax, 0xffffffff
je 0x10024a15
mov ecx, dword [ebp - 0x18]
shl ecx, 4
add ecx, eax
inc edi
mov dword [ebp - 0x18], ecx
cmp edi, 8
jl 0x100249b4
jmp 0x10024a0e
cmp dword [ebx + 0x14], 0x10
jb 0x100249ed
mov eax, dword [ebx]
jmp 0x100249ef
mov eax, ebx
movzx eax, byte [eax + edi]
push eax
call fcn.1002641b
pop ecx
cmp eax, 0xffffffff
je 0x10024a15
mov ecx, dword [ebp - 0x1c]
shl ecx, 4
add ecx, eax
inc edi
movzx ecx, cx
mov dword [ebp - 0x1c], ecx
cmp edi, 0xc
jl 0x100249e3
jmp 0x10024a4b
mov ecx, dword [ebp - 0x14]
mov byte [ecx], 1
jmp 0x10024ad1
cmp dword [ebx + 0x14], 0x10
jb 0x10024a2a
mov eax, dword [ebx]
jmp 0x10024a2c
mov eax, ebx
movzx eax, byte [eax + edi]
push eax
call fcn.1002641b
pop ecx
cmp eax, 0xffffffff
je 0x10024a15
mov ecx, dword [ebp - 0x20]
shl ecx, 4
add ecx, eax
inc edi
movzx ecx, cx
mov dword [ebp - 0x20], ecx
cmp edi, 0x10
jl 0x10024a20
xor al, al
mov byte [ebp - 0xd], al
inc al
cmp edi, 0x20
jge 0x10024aad
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x24], ecx
xor al, 1
cmp dword [ebx + 0x14], 0x10
mov byte [ebp - 0xe], al
jb 0x10024a71
mov eax, dword [ebx]
jmp 0x10024a73
mov eax, ebx
movzx eax, byte [eax + edi]
push eax
call fcn.1002641b
pop ecx
mov ecx, eax
cmp ecx, 0xffffffff
je 0x10024a15
mov al, byte [ebp - 0xd]
shl al, 4
add al, cl
cmp byte [ebp - 0xe], 0
mov byte [ebp - 0xd], al
je 0x10024aa4
mov ecx, dword [ebp - 0x24]
mov byte [ecx], al
xor al, al
inc ecx
mov byte [ebp - 0xd], al
mov dword [ebp - 0x24], ecx
mov al, byte [ebp - 0xe]
inc edi
cmp edi, 0x20
jl 0x10024a62
mov eax, dword [ebp - 0x18]
mov dword [esi], eax
mov eax, dword [ebp - 0x1c]
mov word [esi + 4], ax
mov eax, dword [ebp - 0x20]
mov word [esi + 6], ax
mov eax, dword [ebp - 0xc]
mov dword [esi + 8], eax
mov eax, dword [ebp - 8]
mov dword [esi + 0xc], eax
jmp 0x10024ad1
mov byte [eax], 1
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ee6a0
mov esp, ebp
pop ebp
ret
Function at 0x10024fca
Capabilities:
Get common file path

Disassembly:
push 0x248
mov eax, 0x100f414d
call fcn.100eefb3
mov esi, dword [ebp + 8]
xor edi, edi
push 0x1010203d
mov ecx, esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x254], esi
mov dword [ebp - 0x250], edi
call fcn.1001df91
push 0x20a
xor ebx, ebx
mov dword [ebp - 4], edi
lea eax, [ebp - 0x21c]
inc ebx
push edi
push eax
mov dword [ebp - 0x250], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x100250b5
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], edi
mov word [ebp - 0x234], ax
cmp word [ebp - 0x21c], ax
jne 0x1002505a
mov eax, edi
jmp 0x10025068
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
pop ecx
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.10025a31
lea eax, [ebp - 0x234]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.10026c10
pop ecx
pop ecx
push eax
mov ecx, esi
call fcn.100057e5
push edi
push ebx
lea ecx, [ebp - 0x24c]
call fcn.100202d3
push edi
push ebx
lea ecx, [ebp - 0x234]
call fcn.100257f5
mov eax, esi
call fcn.100eef5d
ret

Function at 0x10025152
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
dec eax
neg eax
sbb eax, eax
inc eax
mov esp, ebp
pop ebp
ret
Function at 0x10026515
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x1014a7b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x28]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x424], eax
xor eax, eax
push 0x14
push eax
mov bl, al
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x438]
push eax
call sub.VCRUNTIME140.dll_memset
push 0x40c
lea eax, [ebp - 0x410]
mov dword [ebp - 0x438], 0x800c
push 0
push eax
call sub.VCRUNTIME140.dll_memset
cmp dword [ebp + 0x24], 0x10
lea eax, [ebp + 0x10]
mov ecx, dword [ebp + 0x20]
cmovae eax, dword [ebp + 0x10]
push ecx
push eax
lea eax, [ebp - 0x404]
mov word [ebp - 0x410], 0x208
push eax
mov dword [ebp - 0x40c], 0x6602
mov dword [ebp - 0x408], ecx
call sub.VCRUNTIME140.dll_memcpy
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
add esp, 0x24
xor eax, eax
inc eax
push 0xf0000000
push eax
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push 0
lea eax, [ebp - 0x418]
push eax
call esi
test eax, eax
jne 0x1002660e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090016
jne 0x100266df
push 0xf0000000
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push dword [0x10148248]
lea eax, [ebp - 0x418]
push eax
call esi
test eax, eax
je 0x100266df
lea eax, [ebp - 0x41c]
push eax
push 0x101
push 0
push 0x40c
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x100266df
lea eax, [ebp - 0x414]
push eax
push 0
push dword [ebp - 0x41c]
push 0x8009
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x100266df
push 0
lea eax, [ebp - 0x438]
push eax
push 5
push dword [ebp - 0x414]
call dword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x100266df
push 0
push dword [ebp + 0xc]
push edi
push dword [ebp - 0x414]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x100266df
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
lea eax, [ebp - 0x420]
push 0
push eax
push 0
push 2
push dword [ebp - 0x414]
call esi
test eax, eax
je 0x100266df
cmp dword [ebp - 0x420], 0
je 0x100266df
push 0
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x424]
push 2
push dword [ebp - 0x414]
call esi
push 1
test eax, eax
movzx ebx, bl
pop esi
cmovne ebx, esi
jmp 0x100266e2
xor esi, esi
inc esi
cmp dword [ebp - 0x41c], 0
je 0x100266f7
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [ebp - 0x414], 0
je 0x1002670c
push dword [ebp - 0x414]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 0x418], 0
je 0x10026723
push 0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0
push esi
lea ecx, [ebp + 0x10]
call fcn.100202d3
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100ee6a0
mov esp, ebp
pop ebp
ret
Function at 0x10063ff0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fb9cc
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1014a7b4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ebx, dword [sym.imp.MSVCP140.dll__Mtx_lock]
lea edi, [esi + 0x64]
push edi
mov dword [esi], vtable.common::HttpClientManager.0
call ebx
push eax
call fcn.1001fd88
add esi, 0x30
push esi
call ebx
push eax
call fcn.1001fd88
and dword [ebp - 4], 0
mov ebx, dword [sym.imp.MSVCP140.dll__Mtx_unlock]
push esi
call ebx
push eax
call fcn.1001fd88
push edi
mov dword [ebp - 4], 1
call ebx
push eax
call fcn.1001fd88
mov ebx, dword [ebp - 0x10]
add esp, 0x20
lea ecx, [ebx + 0xb0]
call fcn.100640bf
lea ecx, [ebx + 0xa0]
call fcn.10063f49
lea ecx, [ebx + 0x94]
call fcn.10020328
push edi
mov edi, dword [sym.imp.MSVCP140.dll__Mtx_destroy_in_situ]
call edi
push esi
call edi
pop ecx
pop ecx
lea ecx, [ebx + 0x10]
call fcn.1001e84c
lea ecx, [ebx + 8]
call fcn.10063f99
mov dword [ebx], vtable.Microsoft::Applications::Telemetry::PlatformAbstraction::RefCountedImpl_class_common::IHcmRequestCallback_.0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret