joyce8/EMBER2024-capa huggingface dataset:
Function at 0x110d6ed
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [esi], eax
cmp ebx, eax
je 0x110d741
lea eax, [ebp - 8]
push eax
push ebx
call fcn.01040a41
mov edi, eax
test edi, edi
jl 0x110d852
push 0x100d39c
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
call fcn.0110d5ee
mov edi, eax
add esp, 0xc
test edi, edi
jl 0x110d852
mov edi, dword [ebp - 4]
jmp 0x110d747
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
cmp dword [ebp + 0xc], 0
je 0x110d75d
push ebx
mov ecx, esi
call fcn.01108d4a
push edi
mov ecx, esi
call fcn.01108d4a
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x110d781
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x110d79f
push eax
call fcn.0103e996
mov edi, eax
jmp 0x110d84e
push ebx
mov ecx, esi
call fcn.01108d4a
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x110d79f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x110d774
push ebx
mov ecx, esi
call fcn.0110c8ea
cmp eax, 0x80070002
jne 0x110d81d
cmp dword [ebp + 0xc], 0
jne 0x110d7ee
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x110d7e0
mov edx, dword [eax + 0x3c]
mov ecx, 0x8000004
and edx, ecx
cmp edx, ecx
jne 0x110d7e0
push 0x100d230
push 0xd
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.011086cc
push 0x4000200e
push 4
mov ecx, esi
call fcn.0110ce4b
push edi
mov ecx, esi
call fcn.0110bf5a
mov edi, eax
test edi, edi
jl 0x110d852
push ebx
mov ecx, esi
call fcn.0110c931
mov edi, eax
test edi, edi
jl 0x110d852
push 0x2000
push ebx
mov ecx, esi
call fcn.0110b655
and dword [esi + 0x10], 0
jmp 0x110d82a
mov edi, eax
test eax, eax
jl 0x110d852
mov dword [esi + 0x10], 1
mov eax, dword [ebp - 8]
test eax, eax
je 0x110d84e
and dword [ebp - 8], 0
push eax
lea ecx, [esi + 8]
call fcn.01047b9f
mov eax, dword [ebp - 4]
and dword [ebp - 4], 0
push eax
lea ecx, [esi + 0xc]
call fcn.01047b9f
test edi, edi
jge 0x110d877
mov eax, dword [0x136ec90]
cmp eax, 0x136ec90
je 0x110d877
test byte [eax + 0x3c], 2
je 0x110d877
push edi
push 0x100d230
push 0xe
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.0103e52d
lea ecx, [ebp - 4]
call fcn.0103f6a1
lea ecx, [ebp - 8]
call fcn.0103f6a1
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x128614c
Capabilities:
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x1391094], 0
push ebx
jne 0x12861c9
push eax
push ebx
push ecx
push edx
xor eax, eax
cpuid
xor eax, eax
xor ebx, 0x756e6547
sete al
xor ebx, ebx
xor ecx, 0x6c65746e
sete bl
and eax, ebx
xor ecx, ecx
xor edx, 0x49656e69
sete cl
and eax, ecx
mov dword [ebp - 4], eax
mov eax, 1
cpuid
xor ecx, ecx
xor edx, edx
mov ebx, 0xff0
and ebx, eax
mov dword [ebp - 8], ebx
pop edx
pop ecx
pop ebx
pop eax
cmp dword [ebp - 4], 0
mov eax, 1
je 0x12861bd
cmp dword [ebp - 8], 0x660
jae 0x12861bd
xor eax, eax
mov eax, dword [eax*4 + 0x136f0b4]
mov dword [0x1391094], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x40], 0x67452301
mov dword [eax + 0x44], 0xefcdab89
mov dword [eax + 0x48], 0x98badcfe
mov dword [eax + 0x4c], 0x10325476
mov dword [eax + 0x50], 0xc3d2e1f0
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1286d2c
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
mov dword [eax + 0x20], ecx
mov dword [eax + 0x24], ecx
pop ebp
ret 4
Function at 0x1287947
Capabilities:
Hash data using sha256

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x13912f4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 0x24]
push edi
mov ecx, ebx
and ecx, 0x3f
mov edi, 0x40
sub edi, ecx
mov dword [ebp - 0x50], eax
cmp edi, 8
ja 0x128797c
add edi, 0x40
lea edx, [edi - 8]
push edx
lea eax, [ebp - 0x4c]
push 0
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [esi + 0x20]
add ecx, ecx
add ecx, ecx
add ecx, ecx
mov edx, ebx
shr edx, 0x1d
or ecx, edx
add esp, 0xc
mov dword [ebp - 0x58], ecx
push 2
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp + edi - 0x54]
lea eax, [ebx*8]
push edx
mov byte [ebp - 0x4c], 0x80
mov dword [ebp - 0x54], eax
call fcn.0128982f
push edi
lea eax, [ebp - 0x4c]
push eax
push esi
call fcn.01287849
mov ecx, dword [ebp - 0x50]
push 8
push esi
push ecx
call fcn.0128982f
xor eax, eax
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi], 0x6a09e667
mov dword [esi + 4], 0xbb67ae85
mov dword [esi + 8], 0x3c6ef372
mov dword [esi + 0xc], 0xa54ff53a
mov dword [esi + 0x10], 0x510e527f
mov dword [esi + 0x14], 0x9b05688c
mov dword [esi + 0x18], 0x1f83d9ab
mov dword [esi + 0x1c], 0x5be0cd19
mov eax, 0x40
add esi, 0x28
mov byte [esi], 0
inc esi
sub eax, 1
jne 0x1287a1d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0103e3fb
mov esp, ebp
pop ebp
ret 8
Function at 0x13178bf
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp edi, ebx
jne 0x13178e7
mov dword [ebp + 8], 0x80070057
jmp 0x1317a39
push esi
call fcn.0131777c
mov dword [ebp + 8], eax
cmp eax, ebx
jne 0x1317a1b
push 0xf0000000
push 0x18
push ebx
push ebx
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x131792b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x1317923
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp + 8], eax
jmp 0x1317a1b
push 4
mov ecx, 0x1032230
mov eax, edi
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1317959
cmp dx, bx
je 0x1317955
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1317959
add eax, esi
add ecx, esi
cmp dx, bx
jne 0x1317935
xor eax, eax
jmp 0x131795e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x1317972
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x8004
jmp 0x13179f2
mov ecx, 0x10321e0
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x131799d
cmp dx, bx
je 0x1317999
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x131799d
add eax, esi
add ecx, esi
cmp dx, bx
jne 0x1317979
xor eax, eax
jmp 0x13179a2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x13179b3
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x800c
jmp 0x13179f2
mov ecx, 0x1032190
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x13179de
cmp dx, bx
je 0x13179da
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x13179de
add eax, esi
add ecx, esi
cmp dx, bx
jne 0x13179ba
xor eax, eax
jmp 0x13179e3
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x1317a14
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x800e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x131790f
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 0xc], ecx
jmp 0x1317a38
mov dword [ebp + 8], 0x80049e5b
cmp dword [ebp - 8], ebx
je 0x1317a29
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 4], ebx
je 0x1317a38
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
mov eax, dword [ebp + 8]
pop edi
pop ebx
leave
ret 4
Function at 0x1317fc9
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
cmp eax, esi
je 0x1318183
cmp dword [ebp + 0x10], esi
je 0x1318183
mov ebx, dword [ebp + 0x14]
cmp ebx, esi
je 0x1318183
cmp dword [ecx + 0x20], esi
jne 0x131800c
mov esi, 0x80049e51
jmp 0x13180d8
mov ecx, dword [ebx]
push edi
push 4
mov dword [ebp + 0x14], ecx
mov dword [ebx], esi
mov ecx, 0x10320b8
pop edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1318040
cmp dx, si
je 0x131803c
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1318040
add eax, edi
add ecx, edi
iretd
cmp dx, si
jne 0x131801c
xor eax, eax
jmp 0x1318045
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
jne 0x1318052
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 1
jmp 0x13180d0
mov eax, dword [ebp + 8]
mov ecx, 0x1032060
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x131807e
cmp dx, si
je 0x131807a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x131807e
add eax, edi
add ecx, edi
cmp dx, si
jne 0x131805a
xor eax, eax
jmp 0x1318083
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
jne 0x1318090
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 2
jmp 0x13180d0
mov eax, dword [ebp + 8]
mov ecx, 0x1032008
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x13180bc
cmp dx, si
je 0x13180b8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x13180bc
add eax, edi
add ecx, edi
cmp dx, si
jne 0x1318098
xor eax, eax
jmp 0x13180c1
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
jne 0x1318179
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 3
je 0x13180e9
mov esi, 0x80049e2e
pop edi
push dword [ebp - 0xc]
call fcn.0103e4a5
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
mov eax, dword [ebp + 0xc]
push eax
mov dword [ebp - 8], eax
call fcn.0103e496
mov edi, eax
pop ecx
mov dword [ebp - 0xc], edi
cmp edi, esi
jne 0x1318106
mov esi, 0x8007000e
jmp 0x13180d7
push dword [ebp - 8]
push dword [ebp + 0x10]
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push edi
push esi
push 1
push esi
push dword [eax + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x1318146
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x1318142
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x13180d7
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
mov dword [ebx], eax
cmp dword [ebp + 0x18], esi
je 0x13180d7
cmp dword [ebp + 0x14], eax
jae 0x1318162
mov esi, 0x80049e19
jmp 0x13180d7
push eax
mov eax, edi
add eax, 0x10
push eax
push dword [ebp + 0x18]
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x13180d7
mov esi, 0x80049e5b
jmp 0x13180d7
mov esi, 0x80070057
jmp 0x13180d8
Function at 0x13186c2
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, ecx
cmp edi, ebx
je 0x13187ec
cmp dword [ebp + 8], 0x14
jbe 0x13187ec
push dword [esi + 0x14]
call fcn.0103e4a5
push dword [esi + 0xc]
mov dword [esi + 0x14], ebx
call fcn.0103e4a5
mov eax, dword [esi + 0x20]
pop ecx
pop ecx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
cmp eax, ebx
je 0x131870f
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [esi + 0x20], ebx
mov eax, dword [edi + 0xc]
shr eax, 3
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x10]
lea ebx, [esi + 0x1c]
mov dword [ebx], eax
mov eax, dword [esi + 0x18]
mov ecx, eax
shr ecx, 1
add ecx, 4
imul ecx, ecx, 5
lea eax, [ecx + eax*2]
cmp dword [ebp + 8], eax
jne 0x13187ec
push dword [esi + 0x14]
call fcn.0103e4a5
push dword [esi + 0x18]
and dword [esi + 0x14], 0
call fcn.0103e496
pop ecx
pop ecx
mov dword [esi + 0x14], eax
test eax, eax
jne 0x1318762
mov dword [ebp + 0xc], 0x8007000e
jmp 0x13187f3
push dword [esi + 0x18]
lea ecx, [edi + 0x14]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push 4
push ebx
mov ecx, esi
call fcn.01317bcc
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x13187f3
push dword [esi + 0x18]
mov ecx, esi
push dword [esi + 0x14]
call fcn.01317bcc
mov dword [ebp + 0xc], eax
test eax, eax
jne 0x13187f3
lea ebx, [esi + 0x24]
cmp dword [ebx], eax
jne 0x13187cb
push 0xf0000000
push 0x18
push eax
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x13187cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x13187c6
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp + 0xc], eax
jmp 0x13187f3
lea eax, [esi + 0x20]
push eax
push 0x40
push 0
push dword [ebp + 8]
push edi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x13187b2
mov dword [esi + 8], 4
jmp 0x13187f3
mov dword [ebp + 0xc], 0x80070057
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x131963d
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
cmp dword [ebp + 8], ebx
je 0x1319812
cmp dword [ebp + 0xc], ebx
je 0x1319812
push dword [esi + 0x14]
call fcn.0103e4a5
push dword [esi + 0xc]
mov dword [esi + 0x14], ebx
call fcn.0103e4a5
mov eax, dword [esi + 0x20]
pop ecx
pop ecx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
cmp eax, ebx
je 0x1319687
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [esi + 0x20], ebx
lea eax, [esi + 0x24]
cmp dword [eax], ebx
jne 0x13196be
push 0xf0000000
push 0x18
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x13196be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x13196b6
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp + 0xc], eax
jmp 0x1319819
push dword [esi + 0xc]
call fcn.0103e4a5
mov eax, dword [ebp + 0xc]
pop ecx
mov dword [esi + 0xc], ebx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x13196d0
sub eax, ecx
sar eax, 1
mov dword [esi + 0x10], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0103e496
pop ecx
mov dword [esi + 0xc], eax
cmp eax, ebx
jne 0x131970a
mov dword [ebp + 0xc], 0x8007000e
jmp 0x131981e
push dword [ebp + 0xc]
mov ecx, dword [esi + 0x10]
inc ecx
push ecx
push eax
call fcn.0104574b
mov dword [ebp + 0xc], eax
cmp eax, ebx
jne 0x1319819
mov eax, dword [ebp + 8]
push 4
mov ecx, 0x10320b8
pop edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1319752
cmp dx, bx
je 0x131974e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1319752
add eax, edi
add ecx, edi
cmp dx, bx
jne 0x131972e
xor eax, eax
jmp 0x1319757
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x131976c
mov eax, 0x660e
mov dword [esi + 8], 1
jmp 0x13197f0
mov eax, dword [ebp + 8]
mov ecx, 0x1032060
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1319798
cmp dx, bx
je 0x1319794
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1319798
add eax, edi
add ecx, edi
cmp dx, bx
jne 0x1319774
xor eax, eax
jmp 0x131979d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x13197af
mov eax, 0x660f
mov dword [esi + 8], 2
jmp 0x13197f0
mov eax, dword [ebp + 8]
mov ecx, 0x1032008
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x13197db
cmp dx, bx
je 0x13197d7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x13197db
add eax, edi
add ecx, edi
cmp dx, bx
jne 0x13197b7
xor eax, eax
jmp 0x13197e0
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x1319809
mov eax, 0x6610
mov dword [esi + 8], 3
lea ecx, [esi + 0x20]
push ecx
push 1
push eax
push dword [esi + 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
jne 0x1319819
jmp 0x13196a2
mov dword [ebp + 0xc], 0x80049e2e
jmp 0x131981e
mov dword [ebp + 0xc], 0x80070057
cmp dword [ebp + 0xc], ebx
jge 0x1319839
push dword [esi + 0x14]
call fcn.0103e4a5
push dword [esi + 0xc]
mov dword [esi + 0x14], ebx
call fcn.0103e4a5
pop ecx
pop ecx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x131dc68
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp eax, edi
jne 0x131dc8a
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
leave
ret 0xc
push esi
cmp dword [ebp + 0xc], edi
je 0x131dcbb
lea ecx, [ebp - 4]
push ecx
push 0x20019
push edi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x131dcad
cmp dword [ebp - 4], edi
jne 0x131dcbe
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, esi
pop esi
jmp 0x131dc85
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], edi
je 0x131dcdc
push edi
push edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
neg esi
sbb esi, esi
inc esi
jmp 0x131dcdf
xor esi, esi
inc esi
cmp dword [ebp + 0xc], edi
je 0x131dcaf
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x131dcaf

Function at 0x131dcef
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 4
mov dword [ebp - 0x10], esi
cmp eax, esi
jne 0x131dd1d
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x131dd8a
cmp dword [ebp + 0xc], esi
je 0x131dd42
lea ecx, [ebp - 4]
push ecx
push 0x20019
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x131dd3f
cmp dword [ebp - 4], esi
jne 0x131dd45
push eax
jmp 0x131dd13
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, esi
jne 0x131dd6e
cmp dword [ebp - 0xc], 4
je 0x131dd71
push 0xd
pop edi
mov dword [ebp - 8], esi
cmp dword [ebp + 0xc], esi
je 0x131dd7f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 8]
pop edi
pop esi
leave
ret 0xc
Function at 0x131e0b2
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push esi
xor esi, esi
xor eax, eax
cmp dword [ebp + 0x1c], esi
push edi
setne al
mov edi, 0x80
inc eax
mov dword [ebp + 0x1c], eax
add edi, edi
test esi, esi
je 0x131e0e5
push esi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [edi + edi]
push eax
push 8
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x131e130
cmp dword [ebp + 0x18], 0
je 0x131e110
push dword [ebp + 8]
push edi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
jmp 0x131e132
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x131e11c
mov eax, 0x1007f84
push dword [ebp + 8]
push edi
push esi
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x131e132
xor eax, eax
mov ecx, edi
sub ecx, dword [ebp + 0x1c]
cmp eax, ecx
jae 0x131e0d3
cmp dword [ebp + 0x14], 0
jne 0x131e15a
test esi, esi
je 0x131e167
test eax, eax
jne 0x131e15a
push esi
push eax
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test eax, eax
je 0x131e15a
xor esi, esi
test esi, esi
je 0x131e167
mov eax, dword [ebp + 0x20]
test eax, eax
je 0x131e167
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x1c

Function at 0x132ecde
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x132ed73
lea eax, [ecx + 0x110]
mov dword [ebp - 0x10], eax
movzx eax, byte [eax]
mov dword [ebp - 4], eax
lea eax, [ecx + 0x111]
mov dword [ebp - 0x14], eax
movzx eax, byte [eax]
add ecx, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov esi, edi
add esi, dword [ebp + 0xc]
push ebp
mov ebp, dword [ebp - 0xc]
add eax, 1
and eax, 0xff
movzx ecx, byte [eax + ebp]
add ebx, ecx
and ebx, 0xff
movzx edx, byte [ebx + ebp]
mov byte [eax + ebp], dl
add edx, ecx
mov byte [ebx + ebp], cl
and edx, 0xff
movzx ecx, byte [edx + ebp]
xor byte [edi], cl
add edi, 1
cmp edi, esi
jb 0x132ed29
pop ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov al, byte [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov byte [ecx], al
mov al, byte [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov byte [ecx], al
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x132eefe
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
mov dword [ebp - 8], ecx
cmp dword [ebp + 0x10], esi
jbe 0x132ef4f
push ebx
push edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edx, [eax + esi]
call fcn.013255a6
mov ecx, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov byte [ebp - 1], al
mov eax, dword [ebp + 0xc]
lea ebx, [eax + esi]
call fcn.0132ed94
xor al, byte [ebp - 1]
mov edx, ebx
mov byte [ebp - 0xc], al
push dword [ebp - 0xc]
mov ecx, edi
call fcn.013255eb
inc esi
cmp esi, dword [ebp + 0x10]
jb 0x132ef13
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x132f422
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
push esi
lea ecx, [ebp - 8]
mov edi, 0x80004005
call fcn.0132efde
mov ecx, dword [esi + 4]
call fcn.01325a9e
push eax
call fcn.01325b32
mov ebx, eax
mov eax, dword [esi + 8]
sub eax, 0
mov dword [ebp - 4], ebx
je 0x132f542
dec eax
jne 0x132f530
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
cmp dword [ecx], ebx
jb 0x132f523
test eax, eax
je 0x132f523
mov edi, dword [esi + 0x30]
jmp 0x132f490
sub bl, byte [esi + 0x30]
lea ecx, [esi + 0xc]
call fcn.0132f073
mov byte [eax + edi], bl
mov ebx, dword [ebp - 4]
inc edi
cmp edi, ebx
jb 0x132f47e
and dword [ebp - 4], 0
test ebx, ebx
jbe 0x132f4c2
lea ecx, [esi + 0xc]
call fcn.0132f073
mov ecx, dword [ebp - 4]
lea edi, [eax + ecx]
lea ecx, [esi + 0x34]
call fcn.0132f0e6
mov ecx, dword [ebp - 4]
mov al, byte [eax + ecx]
xor byte [edi], al
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jb 0x132f49c
lea ecx, [esi + 0xc]
call fcn.0132f073
mov edx, eax
lea ecx, [ebp - 0x14]
call fcn.013256d1
lea ecx, [ebp - 0x14]
call fcn.013256d8
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push ecx
push ecx
mov ecx, esp
and dword [ecx + 4], 0
mov dword [ecx], eax
mov ecx, dword [esi + 4]
push 0x80
call fcn.01228a37
mov ebx, dword [ebx + 0x32]
mov al, byte [0x20000036]
mov edi, eax
test edi, edi
jne 0x132f530
and dword [esi + 0x30], eax
push ebx
push eax
lea ecx, [esi + 0x34]
call fcn.0132f0e6
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x132f530
neg eax
sbb eax, eax
and eax, 0xc004d107
mov dword [ecx], ebx
mov edi, eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc
mov edi, dword [esi + 0x30]
neg edi
sbb edi, edi
and edi, 0x80004005
jmp 0x132f530