joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10edce0
Capabilities:
Initialize winhttp library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1140feb
mov eax, dword fs:[0]
push eax
sub esp, 0x29c
push ebx
push esi
push edi
mov eax, dword [0x115f604]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
lea ecx, [ebp - 0x2a8]
mov dword [ebp - 0x10], ebx
call fcn.010ae800
mov eax, dword [ebp + 8]
mov esi, dword [eax]
lea ecx, [ebp - 0x110]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x114], ecx
call dword [0x115f5dc]
push eax
push esi
lea ecx, [ebp - 0x114]
call fcn.01097ab0
mov edx, dword [ebp - 0x114]
push ebx
push ebx
push ebx
push ebx
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov esi, eax
mov eax, dword [ebp - 0x114]
cmp eax, ebx
je 0x10edd72
lea ecx, [ebp - 0x110]
cmp eax, ecx
je 0x10edd72
push eax
call fcn.01083cad
add esp, 4
cmp esi, ebx
jne 0x10edda3
call fcn.01071a70
mov esi, eax
call fcn.01127f00
test al, al
je 0x10ede54
push esi
push 0x1040768
push 0x10406f0
push ebx
call fcn.01128b70
add esp, 0x10
jmp 0x10ede54
push 0xc
call fcn.01084a6d
add esp, 4
cmp eax, ebx
je 0x10eddc3
mov dword [eax + 4], 1
mov dword [eax], 0x103ee94
mov dword [eax + 8], esi
mov ebx, eax
mov edi, dword [ebp + 0xc]
mov esi, dword [edi]
test esi, esi
je 0x10eddee
lea edx, [esi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x10edde8
test esi, esi
je 0x10edde8
mov eax, dword [esi]
mov edx, dword [eax]
push 1
mov ecx, esi
call edx
mov dword [edi], 0
test ebx, ebx
mov dword [edi], ebx
je 0x10ede51
lea eax, [ebp - 0x2a8]
push eax
call fcn.010f91e0
mov ecx, eax
call fcn.0109f1a0
mov ecx, dword [ebp - 0x29c]
mov edx, dword [ebp - 0x2a0]
mov eax, dword [ebp - 0x2a4]
mov edi, dword [edi]
push ecx
mov ecx, dword [edi + 8]
push edx
push eax
push 0
push ecx
call dword [sym.imp.WINHTTP.dll_WinHttpSetTimeouts]
test eax, eax
jne 0x10ede51
call fcn.01127f00
test al, al
je 0x10ede51
call fcn.01071a70
push eax
push 0x10406a8
push 0x1040630
push 0
call fcn.01128b70
add esp, 0x10
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x2a8]
mov dword [ebp - 4], 0xffffffff
call fcn.010aeb80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10ef350
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x114116b
mov eax, dword fs:[0]
push eax
mov eax, 0x2010
call fcn.010840f0
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
xor esi, esi
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x10ef4e3
cmp word [eax], bx
je 0x10ef4e3
cmp edi, ebx
je 0x10ef4e3
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x2018], eax
jne 0x10ef3ed
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10ef3dc
call esi
jmp 0x10ef4a1
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x10ef4a1
mov eax, dword [edi]
mov ecx, dword [eax + 0x14]
push 0
push 0
push ebx
push esi
push edi
call ecx
mov esi, eax
test esi, esi
jne 0x10ef492
mov edx, dword [edi]
mov edx, dword [edx + 0xc]
lea eax, [ebp - 0x2014]
push eax
push 0x2000
lea ecx, [ebp - 0x2010]
push ecx
push edi
call edx
mov esi, eax
test esi, esi
jl 0x10ef480
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [esp]
mov eax, dword [ebp - 0x2014]
test eax, eax
je 0x10ef486
cmp eax, 0x2000
ja 0x10ef48d
push 0
lea ecx, [ebp - 0x201c]
push ecx
push eax
mov eax, dword [ebp - 0x2018]
lea edx, [ebp - 0x2010]
push edx
push eax
call ebx
test eax, eax
je 0x10ef4bf
mov ecx, dword [edi]
mov ecx, dword [ecx + 0xc]
lea edx, [ebp - 0x2014]
push edx
push 0x2000
lea eax, [ebp - 0x2010]
push eax
push edi
call ecx
mov esi, eax
test esi, esi
jge 0x10ef430
mov eax, dword [ebp - 0x2014]
cmp eax, 0x2000
jbe 0x10ef492
mov esi, 0x8000ffff
mov edx, dword [ebp - 0x2018]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10ef4d1
call esi
mov esi, eax
jmp 0x10ef492
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x10ef492
mov eax, 0x80070057
jmp 0x10ef4a1
Function at 0x10effe0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11411a8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x115f604]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
call fcn.0112deb0
mov eax, dword [eax]
lea ecx, [ebp - 0x14]
push ecx
push 0x20019
push ebx
push 0x1006df0
push eax
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x10f004d
mov edi, dword [ebp - 0x14]
xor esi, esi
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x10f005b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
jne 0x10f00b0
lea edx, [ebp - 0x20]
push edx
call fcn.0112deb0
mov eax, dword [eax]
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x14]
push edx
push ebx
push 0x20019
push ebx
push ebx
push ebx
push 0x1006df0
push eax
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10f00a0
cmp edi, ebx
je 0x10f009a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x10f0109
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10f0109
cmp esi, ebx
je 0x10f00e9
jle 0x10f00c5
and esi, 0xffff
or esi, 0x80070000
mov dword [ebp - 0x10], esi
call fcn.01127f00
test al, al
je 0x10f014c
push esi
push 0x1006df0
push 0x10421f8
push 0x1042178
push ebx
call fcn.01128b70
add esp, 0x14
jmp 0x10f014c
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x28]
push edx
push ebx
push 0x1042160
push edi
mov dword [ebp - 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x1c]
cdq
mov ecx, eax
or ecx, edx
mov esi, eax
jne 0x10f011a
mov esi, 1
call fcn.01127f00
test al, al
je 0x10f0138
push esi
push 0x1042120
push 0x10420a0
push 3
call fcn.01128b70
add esp, 0x10
mov edx, dword [ebp - 0x24]
push esi
add edx, 0x118
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov esi, dword [ebp - 0x10]
cmp edi, ebx
je 0x10f0157
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10f0170
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11411d8
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x115f604]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1c], ecx
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 4], edi
call fcn.0112deb0
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push ecx
push 0x20006
push edi
push 0x1006df0
push eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x10f01d5
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10f01e3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
jne 0x10f0240
lea edx, [ebp - 0x18]
push edx
call fcn.0112deb0
mov eax, dword [eax]
lea ecx, [ebp - 0x20]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push 0x1006df0
push eax
mov dword [ebp - 0x10], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10f0230
test edi, edi
je 0x10f022a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x10]
mov dword [ebp - 0x14], edi
mov esi, eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x10f0240
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x10f027d
jle 0x10f0252
and esi, 0xffff
or esi, 0x80070000
mov ebx, esi
call fcn.01127f00
test al, al
je 0x10f02ee
push ebx
push 0x1006df0
push 0x10421f8
push 0x1042330
push 0
call fcn.01128b70
add esp, 0x14
jmp 0x10f02ee
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x118]
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
cmp eax, 0x14
jl 0x10f02e2
push 4
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x1c]
push ecx
push 4
push 0
push 0x1042160
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10f02ee
jle 0x10f02bb
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
call fcn.01127f00
test al, al
je 0x10f02ee
push ebx
push 0x1042160
push 0x10422d8
push 0x1042258
push 0
call fcn.01128b70
add esp, 0x14
jmp 0x10f02ee
push 0x1042160
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test edi, edi
je 0x10f02f9
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10f0410
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1141256
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x124], edi
push esi
push 0x104263c
push 0x10425e0
lea eax, [ebp - 0x120]
push eax
push 0x1042560
lea ecx, [ebp - 0x11c]
push 2
push ecx
mov dword [ebp - 4], edi
call fcn.01075110
add esp, 0x1c
cmp esi, edi
mov byte [ebp - 4], 1
jne 0x10f04a8
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x120], 0x80070057
mov byte [ebp - 4], 0
call fcn.01075230
mov eax, 0x80070057
jmp 0x10f0530
push 3
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
mov dword [ebp - 0x124], edi
jne 0x10f04dc
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10f04ce
call esi
jmp 0x10f050c
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x10f050c
push 0x3e8
push 0x64
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x10f04be
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10f04be
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x10f04be
push ebx
push eax
call fcn.01130360
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x120], eax
mov esi, eax
mov byte [ebp - 4], 0
call fcn.01075230
test edi, edi
je 0x10f052e
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 8
Function at 0x10f06c0
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1140988
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x115f604]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
cmp dword [ebp + 8], edi
lea eax, [ecx + 0x38]
jne 0x10f06f1
lea eax, [ecx + 0x3c]
mov eax, dword [eax]
sub eax, 0x10
push eax
call fcn.01081e90
lea esi, [eax + 0x10]
add esp, 4
mov dword [ebp + 8], esi
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10f074b
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x10f07c7
call fcn.01127f00
test al, al
je 0x10f0744
push esi
push 0x1042a38
push 0x10429b8
push 0
call fcn.01128b70
add esp, 0x10
mov edi, 0x8004827d
jmp 0x10f07c7
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x10f07a9
cmp eax, 0x50
je 0x10f07a9
cmp eax, 0xb7
je 0x10f07a9
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x10f0778
call edi
mov edi, eax
jmp 0x10f0788
call edi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
call fcn.01127f00
test al, al
je 0x10f07c7
push edi
push esi
push 0x1042958
push 0x10428d8
push 0
call fcn.01128b70
add esp, 0x14
jmp 0x10f07c7
call fcn.01127f00
test al, al
je 0x10f07c7
push esi
push 0x1042890
push 0x1042810
push 3
call fcn.01128b70
add esp, 0x10
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10f07ea
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10f2430
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1141449
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x115f604]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov eax, dword [0x1161d94]
mov edx, dword [eax + 0xc]
mov ecx, 0x1161d94
call edx
add eax, 0x10
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov eax, dword [0x1161d94]
mov edx, dword [eax + 0xc]
mov ecx, 0x1161d94
mov dword [ebp - 4], edi
call edx
add eax, 0x10
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], edi
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov eax, dword [0x1161d94]
mov edx, dword [eax + 0xc]
mov ecx, 0x1161d94
mov byte [ebp - 4], 1
call edx
add eax, 0x10
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov eax, dword [0x1161d94]
mov edx, dword [eax + 0xc]
mov ecx, 0x1161d94
mov byte [ebp - 4], 2
call edx
add eax, 0x10
mov dword [esi + 0x4c], eax
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 3
mov dword [esi + 0x50], edi
call fcn.010efd00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10f2bd0
Capabilities:
Receive http response

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x114157b
mov eax, dword fs:[0]
push eax
mov eax, 0x20c8
call fcn.010840f0
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0x100356c
push 0x1044e28
mov esi, ecx
lea ecx, [ebp - 0x20c4]
push ecx
push 0x1044da8
lea edx, [ebp - 0x20c0]
push 2
xor ebx, ebx
push edx
mov dword [ebp - 0x20d4], eax
mov dword [ebp - 0x20c4], ebx
call fcn.01075110
add esp, 0x18
cmp dword [esi + 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20cc], ebx
mov dword [ebp - 0x20c8], 0x3e8
jne 0x10f2c66
mov dword [ebp - 0x20c4], 0x8000ffff
jmp 0x10f2d93
mov eax, dword [esi + 8]
sub dword [ebp - 0x20c8], 1
lea ecx, [ebp - 0x20d0]
push ecx
push eax
mov dword [ebp - 0x20d0], ebx
call dword [sym.imp.WINHTTP.dll_WinHttpQueryDataAvailable]
test eax, eax
je 0x10f2d10
mov eax, dword [esi + 8]
lea edx, [ebp - 0x20cc]
push edx
push 0x1fa1
lea ecx, [ebp - 0x1fb4]
push ecx
push eax
call dword [sym.imp.WINHTTP.dll_WinHttpReadData]
test eax, eax
je 0x10f2d4e
mov eax, dword [ebp - 0x20cc]
cmp eax, ebx
je 0x10f2d93
cmp edi, ebx
je 0x10f2ce8
mov edx, dword [edi]
mov ecx, dword [edx + 0x10]
push ebx
push eax
lea eax, [ebp - 0x1fb4]
push eax
push edi
call ecx
cmp eax, ebx
mov dword [ebp - 0x20c4], eax
jne 0x10f2d93
mov eax, dword [ebp - 0x20cc]
mov ecx, dword [ebp - 0x20d4]
cmp ecx, ebx
je 0x10f2cff
push eax
lea edx, [ebp - 0x1fb4]
push edx
call fcn.010d56b0
cmp dword [ebp - 0x20c8], ebx
jg 0x10f2c66
jmp 0x10f2d93
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10f2d20
call esi
jmp 0x10f2d2c
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x20c4], eax
call fcn.01127f00
test al, al
je 0x10f2d93
mov eax, dword [ebp - 0x20c4]
push eax
push 0x103fc10
push 0x1044d28
jmp 0x10f2d8a
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x10f2d5e
call esi
jmp 0x10f2d6a
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x20c4], eax
call fcn.01127f00
test al, al
je 0x10f2d93
mov ecx, dword [ebp - 0x20c4]
push ecx
push 0x1044ce8
push 0x1044c68
push ebx
call fcn.01128b70
add esp, 0x10
mov esi, dword [ebp - 0x20c4]
lea ecx, [ebp - 0x20c0]
mov dword [ebp - 4], 0xffffffff
call fcn.01075230
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 8
Function at 0x1104aa0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 0xc]
cmp dword [eax], esi
mov ebx, ecx
jae 0x1104abc
pop esi
mov eax, 0xea
pop ebx
pop ebp
ret 0x14
mov ecx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push esi
push ecx
push esi
push edi
call fcn.01083b20
add esp, 0x10
push eax
call fcn.01071730
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
mov edx, dword [ebx]
lea ecx, [ebp + 0xc]
push ecx
push edi
push 0
push 1
push eax
push edx
mov dword [ebp + 0xc], esi
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
pop edi
jne 0x1104b00
call fcn.01071a70
pop esi
pop ebx
pop ebp
ret 0x14
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x14]
pop esi
mov dword [ecx], eax
xor eax, eax
pop ebx
pop ebp
ret 0x14

Function at 0x110ef70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1144a08
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x115f604]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1161d94]
mov edx, dword [eax + 0xc]
mov ecx, 0x1161d94
call edx
add eax, 0x10
mov dword [ebp - 0x10], eax
push 0
lea eax, [ebp - 0x10]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0x100f6f8
mov dword [ebp - 4], 0
call fcn.0107f6b0
mov edi, dword [ebp + 8]
lea ecx, [edi + 0x30]
call fcn.011183a0
mov esi, eax
test esi, esi
mov dword [ebp - 0x14], esi
jl 0x110f08e
push 0x105b47c
lea ecx, [ebp + 8]
call fcn.01081d40
mov esi, dword [ebp + 0xc]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.01098c30
lea ecx, [ebp + 8]
push ecx
mov ecx, esi
call fcn.0109c0b0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x110f02a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp + 8]
push ecx
mov ecx, edi
call fcn.0109b7e0
mov eax, dword [eax]
push eax
push esi
mov byte [ebp - 4], 2
call fcn.01108990
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x110f065
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push 0x1f
push 0x10311ec
mov ecx, esi
call fcn.010d56b0
mov ecx, dword [ebp - 0x10]
push ecx
push esi
call fcn.01108990
push 0x25
push 0x10311c4
mov ecx, esi
call fcn.010d56b0
mov esi, dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.0109c040
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1117960
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1145750
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x115f604]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [0x1161d94]
mov edx, dword [eax + 0xc]
mov ecx, 0x1161d94
xor ebx, ebx
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
mov ecx, dword [edi + 0x30]
cmp ecx, ebx
mov dword [ebp - 4], ebx
je 0x11179e6
lea eax, [ebp - 0x14]
push eax
call fcn.0109b7e0
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0109c210
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x11179e3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [ebp - 0x10]
cmp dword [esi - 0xc], ebx
mov edi, dword [ebp + 8]
jne 0x11179f5
mov ebx, 0x8004886c
jmp 0x11179fc
push edi
push esi
call fcn.010dce50
call fcn.01127f00
test al, al
je 0x1117a1c
mov ecx, dword [edi]
push ecx
push 0x1033d74
push 0x10612e8
push 3
call fcn.01128b70
add esp, 0x10
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1117a3f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1118020
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1145889
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x12c], edi
mov eax, dword [0x1161d94]
mov edx, dword [eax + 0xc]
mov ecx, 0x1161d94
mov byte [ebp - 4], 1
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x128], esi
mov ebx, 2
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
mov dword [ebp - 0x124], edi
call fcn.0109c120
mov ecx, eax
call fcn.0109c170
lea ecx, [ebp + 8]
call fcn.010b6420
mov eax, dword [ebp + 8]
push eax
push 0x1061970
push 0x1061920
lea ecx, [ebp - 0x120]
push ecx
push 0x10618a0
lea edx, [ebp - 0x11c]
push ebx
push edx
call fcn.01075110
add esp, 0x1c
mov eax, dword [ebp + 8]
cmp dword [eax - 0xc], edi
mov byte [ebp - 4], 3
je 0x111818b
lea ecx, [ebp - 0x124]
push ecx
push 0x20006
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
cmp eax, edi
je 0x111812b
jle 0x11180fc
and eax, 0xffff
or eax, 0x80070000
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x120], eax
mov edi, eax
mov byte [ebp - 4], bl
call fcn.01075230
lea eax, [esi - 0x10]
mov byte [ebp - 4], 1
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x11181b3
push 0x1034be8
lea ecx, [ebp - 0x128]
call fcn.0107f660
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x128]
call fcn.0109dbe0
mov esi, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x124]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp eax, edi
je 0x111817e
cmp eax, ebx
je 0x111817e
cmp eax, edi
jle 0x1118178
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x120], eax
mov edx, dword [ebp - 0x124]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], bl
call fcn.01075230
lea eax, [esi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [ebp - 4], 1
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x11181bf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x11181e5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 4