joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d580
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x48100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
mov dword [ebp - 0x10], ebx
test esi, esi
jne 0x40d5b5
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004310db
mov esp, ebp
pop ebp
ret 8
push edi
test eax, eax
mov edi, 0x46ec74
mov ecx, esi
cmovne edi, eax
call fcn.0040aae0
mov eax, dword [ebx]
test eax, eax
je 0x40d65e
lea ecx, [ebp - 8]
mov dword [ebp - 0xc], 0
push ecx
push 0
lea ecx, [ebp - 0xc]
mov dword [ebp - 8], 0
push ecx
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d65e
mov eax, dword [ebp - 0xc]
cmp eax, 1
je 0x40d609
cmp eax, 2
je 0x40d609
cmp eax, 7
jne 0x40d65e
mov ebx, dword [ebp - 8]
mov ecx, esi
add ebx, 4
mov dword [ebp - 8], ebx
push 0
shr ebx, 1
push ebx
call fcn.0040ae60
lea eax, [ebx - 1]
mov ecx, esi
push eax
call fcn.0040ac10
xor ecx, ecx
mov word [eax], cx
lea eax, [ebx - 2]
push eax
mov ecx, esi
call fcn.0040ac10
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 8]
push eax
mov ecx, esi
call fcn.0040abf0
push eax
mov eax, dword [ebp - 0x10]
push 0
push 0
push edi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40d673
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004310db
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp - 0xc], 7
jne 0x40d6a9
cmp ebx, 3
jbe 0x40d6a9
mov ecx, esi
call fcn.0040abf0
lea edx, [ebx - 1]
xor ecx, ecx
test edx, edx
je 0x40d6a9
lea edi, [ecx + 0xa]
xor esi, esi
cmp si, word [eax + ecx*2]
jne 0x40d6a4
cmp word [eax + ecx*2 + 2], si
je 0x40d6a4
mov word [eax + ecx*2], di
inc ecx
cmp ecx, edx
jb 0x40d691
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004310db
mov esp, ebp
pop ebp
ret 8

Function at 0x40d750
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x48100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, esi
call fcn.0040d290
cmp dword [edi], 0
je 0x40d7c3
push 0x1fe
mov dword [ebp - 8], 0x1fe
call fcn.00431132
add esp, 4
mov dword [esi], eax
lea ecx, [ebp - 8]
push 0
push 0
push 0
push 0
push ecx
push eax
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x40d7b5
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 4], 0xffffffff
jmp 0x40d7bc
mov dword [esi + 4], 0xfffffffe
mov dword [esi + 8], 0
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004310db
mov esp, ebp
pop ebp
ret 8
Function at 0x40d7e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x48100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
mov ecx, esi
call fcn.0040d290
cmp dword [edi], 0
je 0x40d84b
push ebx
push 0x7ffe
mov dword [ebp - 8], 0x7ffe
call fcn.00431132
add esp, 4
mov dword [esi], eax
lea ebx, [esi + 8]
lea ecx, [esi + 4]
push ebx
push 0
push ecx
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x40d84a
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 4], 0xffffffff
mov dword [ebx], ecx
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004310db
mov esp, ebp
pop ebp
ret 8

Function at 0x40d920
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, ecx
push ebx
mov dword [ebp - 4], eax
cmp dword [eax], 0
je 0x40d99c
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x40d99c
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0xc]
test ecx, ecx
je 0x40d952
cmp edx, 1
jae 0x40d952
mov edx, edi
call fcn.0040dce0
mov edx, eax
cmp edi, 7
jne 0x40d97e
cmp edx, 2
jbe 0x40d97e
push esi
mov esi, edx
xor eax, eax
shr esi, 1
sub esi, 1
je 0x40d97d
cmp word [ecx + eax*2], 0xa
jne 0x40d975
xor ebx, ebx
mov word [ecx + eax*2], bx
inc eax
cmp eax, esi
jb 0x40d968
mov ebx, dword [ebp + 8]
pop esi
mov eax, dword [ebp - 4]
push edx
push ecx
push edi
push 0
push ebx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
pop edi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40db10
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44f9a0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x48100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x20]
xorps xmm0, xmm0
movq qword [ebp - 0x20], xmm0
call fcn.0040a9a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x38]
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
movq qword [ebp - 0x38], xmm0
call fcn.0040d300
push 0x20019
push ebx
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.0040d410
mov ecx, edi
call fcn.0040d860
test eax, eax
je 0x40dbf5
lea esi, [eax - 1]
test esi, esi
js 0x40dbf5
push esi
lea eax, [ebp - 0x2c]
mov ecx, edi
push eax
call fcn.0040d750
sub esp, 0xc
mov ecx, esp
movq xmm0, qword [eax]
mov eax, dword [eax + 8]
movq qword [ecx], xmm0
mov dword [ecx + 8], eax
lea ecx, [ebp - 0x38]
call fcn.0040d380
cmp dword [ebp - 0x34], 0xffffffff
je 0x40dbf0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x20]
push 0x46fd20
push ebx
call fcn.0040ab90
lea ecx, [ebp - 0x20]
call fcn.0040abf0
push eax
mov ecx, edi
call fcn.0040db10
sub esi, 1
jns 0x40db91
push ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x18]
push ebx
movq qword [ebp - 0x18], xmm0
call fcn.0040a9e0
push ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.0040acc0
test al, al
jne 0x40dc1c
xor bl, bl
jmp 0x40dc7f
push ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x28]
push ebx
movq qword [ebp - 0x28], xmm0
call fcn.0040a9e0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.0040ab30
inc eax
lea ecx, [ebp - 0x28]
push eax
call fcn.0040b4e0
push 0x20019
lea ecx, [ebp - 0x28]
call fcn.0040abf0
push eax
mov ecx, edi
call fcn.0040d410
test al, al
jne 0x40dc61
xor bl, bl
jmp 0x40dc77
lea ecx, [ebp - 0x18]
call fcn.0040abf0
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
sete bl
lea ecx, [ebp - 0x28]
call fcn.0040aad0
lea ecx, [ebp - 0x18]
call fcn.0040aad0
lea ecx, [ebp - 0x38]
call fcn.0040aad0
lea ecx, [ebp - 0x20]
call fcn.0040aad0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004310db
mov esp, ebp
pop ebp
ret 4
Function at 0x40df50
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fa18
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x48100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push ecx
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x18]
movq qword [ebp - 0x18], xmm0
call fcn.0040a9e0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x1c]
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], 2
call fcn.0040dd20
mov esi, eax
test esi, esi
jne 0x40dfaf
xor bl, bl
jmp 0x40dfc4
lea ecx, [ebp - 0x18]
call fcn.0040abf0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
sete bl
lea ecx, [ebp - 0x18]
call fcn.0040aad0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004310db
mov esp, ebp
pop ebp
ret
Function at 0x40e5a0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x48100c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
mov esi, ecx
xor edi, edi
push 0xf01ff
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40e709
push ebx
push 0x452818
push 0x94
mov dword [esi], 0x94
call fcn.004314b0
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40e708
push 0x452818
push dword [esi]
call fcn.004314b0
mov edi, eax
add esp, 8
test edi, edi
je 0x40e6ff
mov esi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea ecx, [ebx + 4]
push ecx
push str.SeRestorePrivilege
push 0
mov dword [ebx], 0xc
call esi
lea eax, [ebx + 0x10]
push eax
push str.SeTakeOwnershipPrivilege
push 0
call esi
lea eax, [ebx + 0x1c]
push eax
push str.SeDebugPrivilege
push 0
call esi
lea eax, [ebx + 0x28]
push eax
push str.SeSecurityPrivilege
push 0
call esi
lea eax, [ebx + 0x34]
push eax
push str.SeBackupPrivilege
push 0
call esi
lea eax, [ebx + 0x40]
push eax
push str.SeImpersonatePrivilege
push 0
call esi
lea eax, [ebx + 0x4c]
push eax
push str.SeSystemProfilePrivilege
push 0
call esi
lea eax, [ebx + 0x58]
push eax
push str.SeAssignPrimaryTokenPrivilege
push 0
call esi
lea eax, [ebx + 0x64]
push eax
push str.SeTrustedCredManAccessPrivilege
push 0
call esi
lea eax, [ebx + 0x70]
push eax
push str.SeTcbPrivilege
push 0
call esi
lea eax, [ebx + 0x7c]
push eax
push str.SeIncreaseQuotaPrivilege
push 0
call esi
lea eax, [ebx + 0x88]
push eax
push str.SeShutdownPrivilege
push 0
call esi
lea eax, [ebx + 0xc]
mov ecx, 0xc
nop dword [eax]
mov dword [eax], 2
lea eax, [eax + 0xc]
sub ecx, 1
jne 0x40e6d0
mov eax, dword [ebp - 0xc]
push eax
push edi
push dword [eax]
push ebx
push ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x40e6ff
push edi
call fcn.0043112d
add esp, 4
xor edi, edi
push ebx
call fcn.0043112d
add esp, 4
pop ebx
mov eax, dword [ebp - 8]
test eax, eax
je 0x40e717
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004310db
mov esp, ebp
pop ebp
ret
Function at 0x410200
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x48100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push ebx
push 0xfa0
push 0
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
jne 0x41023c
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004310db
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push str.VarFileInfoTranslation
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x410229
push esi
push edi
sub esp, 8
lea ecx, [ebx + 0xfa4]
push dword [ebp - 0xc]
call fcn.0040c1b0
mov eax, dword [ebp - 0xc]
lea ecx, [ebx + 0xfac]
sub esp, 8
add eax, 2
push eax
call fcn.0040c1b0
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x46fd20
lea ecx, [ebx + 0xfac]
call fcn.0040abf0
push eax
lea ecx, [ebx + 0xfa4]
call fcn.0040abf0
push eax
push str.StringFileInfo_
lea ecx, [ebx + 0xfb4]
call fcn.0040ab90
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004310db
mov esp, ebp
pop ebp
ret 4

Function at 0x410490
Capabilities:
Check if file exists

Disassembly:
push ebx
mov ebx, ecx
cmp byte [ebx + 0x34], 0
lea ecx, [ebx + 8]
jne 0x4104a2
pop ebx
jmp fcn.0040abf0
mov eax, dword [ebx]
push esi
push edi
push 1
mov esi, dword [eax]
push 0
push 0x104
push 0
push 0x800
call fcn.0040ae60
push eax
push dword [ebx]
call dword [esi + 0xc]
lea ecx, [ebx + 8]
test eax, eax
jns 0x4104d2
pop edi
pop esi
pop ebx
jmp fcn.0040abf0
call fcn.0040abf0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4104ff
push 0x800
lea ecx, [ebx + 8]
call fcn.0040abf0
push eax
lea ecx, [ebx + 8]
call fcn.0040abf0
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
pop edi
pop esi
lea ecx, [ebx + 8]
pop ebx
jmp fcn.0040abf0

Function at 0x410780
Capabilities:
Create new key via cryptacquirecontext
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebx
push esi
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
mov esi, ecx
mov ebx, edx
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4107b7
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4107dc
push ebx
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x4107e3
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], 0
pop esi
xor al, al
pop ebx
ret 4
pop esi
mov al, 1
pop ebx
ret 4
Function at 0x4107f0
Capabilities:
Hash data via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fc40
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x48100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0
push 0
push 3
push 0
push 1
push SysReAllocString
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
push ecx
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
or eax, 0xffffffff
test edi, edi
cmove edi, eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 4], 0
lea edx, [ebp - 0x14]
push ecx
xor bl, bl
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x29], bl
call fcn.00410780
test al, al
je 0x410991
push 0x452818
push reloc.WININET.dll_InternetGetConnectedState
mov dword [ebp - 0x18], reloc.WININET.dll_InternetGetConnectedState
call fcn.004314b0
mov esi, eax
add esp, 8
mov dword [ebp - 0x28], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x410966
push 0
lea eax, [ebp - 0x18]
push eax
push reloc.WININET.dll_InternetGetConnectedState
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4108f8
nop dword [eax]
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4108f8
push 0
push eax
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x410966
call fcn.0040c6b0
push 0
lea eax, [ebp - 0x18]
push eax
push reloc.WININET.dll_InternetGetConnectedState
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4108c0
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 4
push eax
push dword [ebp - 0x30]
push 4
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x410966
mov eax, dword [ebp - 0x30]
push esi
mov ebx, dword [eax]
call fcn.0043112d
push 0x452818
push ebx
call fcn.004314b0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x410963
mov ebx, dword [ebp - 0x30]
push 0
push ebx
push esi
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x410963
mov edx, dword [ebx]
mov ecx, esi
push 0
push 0xffff
push dword [ebp - 0x34]
call fcn.0040cb00
mov bl, al
jmp 0x410966
mov bl, byte [ebp - 0x29]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x410976
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x410984
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test esi, esi
je 0x410991
push esi
call fcn.0043112d
add esp, 4
cmp edi, 0xffffffff
je 0x4109a1
test edi, edi
je 0x4109a1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004310db
mov esp, ebp
pop ebp
ret 8
Function at 0x4109d0
Capabilities:
Contain obfuscated stackstrings
Encrypt data using aes via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [0x48100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov esi, edx
mov edi, ecx
cmp dword [eax], 0xa070
je 0x410a05
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004310db
mov esp, ebp
pop ebp
ret 4
push 0x20
push str.9F15E8B42592E073F0A14AFF69039F7D
mov edx, 0x20
mov dword [ebp - 0x40], 0x208
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x3c], 0x6610
mov dword [ebp - 0x38], 0x20
call fcn.00431000
add esp, 8
lea eax, [ebp - 0x40]
push esi
push 0
push 0
push 0x2c
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x4109f1
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x34333231
push eax
push 1
push dword [esi]
mov dword [ebp - 0x10], 0x38373635
mov dword [ebp - 0xc], 0x32313039
mov dword [ebp - 8], 0x36353433
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004310db
mov esp, ebp
pop ebp
ret 4

Function at 0x410a90
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x48100c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push 0
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x410ada
push 0xf0000000
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
xor ecx, ebp
call fcn.004310db
mov esp, ebp
pop ebp
ret
Function at 0x410c20
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x48100c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0xa070
mov eax, ecx
push edi
mov edi, edx
mov dword [ebp - 0x10], eax
jne 0x410d30
test eax, eax
je 0x410d30
test edi, edi
je 0x410d30
cmp dword [edi], 0
je 0x410d30
push ebx
call fcn.00410a90
mov ebx, eax
test ebx, ebx
jne 0x410c7c
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004310db
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
lea edx, [ebp - 8]
push esi
mov dword [ebp - 0xc], eax
mov ecx, ebx
lea eax, [ebp + 8]
mov dword [ebp - 8], 0
push eax
xor esi, esi
call fcn.004109d0
test al, al
je 0x410d04
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 1
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
je 0x410d04
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x410d04
push 0x452818
push eax
call fcn.004314b0
mov esi, eax
add esp, 8
test esi, esi
je 0x410d04
push dword [edi]
mov edx, dword [ebp - 0xc]
mov ecx, esi
push dword [ebp - 0x10]
call fcn.00431000
add esp, 8
push dword [ebp - 0xc]
push edi
push esi
push 0
push 1
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x410d04
push esi
call fcn.0043112d
add esp, 4
xor esi, esi
mov eax, dword [ebp - 8]
test eax, eax
je 0x410d12
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004310db
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.004310db
mov esp, ebp
pop ebp
ret 4

Function at 0x410d50
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x48100c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0xa070
push ebx
push edi
mov ebx, edx
mov edi, ecx
jne 0x410e09
test edi, edi
je 0x410e09
cmp dword [ebx], 0
je 0x410e09
push esi
call fcn.00410a90
mov esi, eax
test esi, esi
jne 0x410da5
pop esi
pop edi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004310db
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp + 8]
mov dword [ebp - 8], 0
push eax
lea edx, [ebp - 8]
mov byte [ebp - 9], 0
mov ecx, esi
call fcn.004109d0
test al, al
je 0x410dda
push ebx
push edi
push 0
push 1
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
setne bl
jmp 0x410ddd
mov bl, byte [ebp - 9]
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x410deb
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
pop edi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004310db
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
xor al, al
pop edi
xor ecx, ebp
pop ebx
call fcn.004310db
mov esp, ebp
pop ebp
ret 4
Function at 0x410ee0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fcb3
mov eax, dword fs:[0]
push eax
sub esp, 0x264
mov eax, dword [0x48100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov ebx, ecx
sub esp, 0x1c
lea ecx, [ebp - 0x18]
xorps xmm0, xmm0
movq qword [ebp - 0x18], xmm0
push 0
push 0
push 0
push 0x4701ec
push ebx
call fcn.0040aa10
push 0x258
lea eax, [ebp - 0x270]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00435d50
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.0040abf0
push 0x250
mov esi, eax
lea eax, [ebp - 0x270]
push 0
push eax
call fcn.00435d50
add esp, 0xc
lea eax, [ebp - 0x270]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edx, eax
mov dword [ebp - 0x20], edx
cmp edx, 0xffffffff
je 0x410f9b
lea ecx, [ebp - 0x270]
mov dword [ebp - 0x1c], 1
call fcn.004018b0
mov edx, dword [ebp - 0x20]
mov byte [ebp - 4], 1
cmp edx, 0xffffffff
je 0x41105b
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
nop
test byte [ebp - 0x270], 0x10
je 0x410ffa
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x244]
push eax
push 0x46fd20
push ebx
lea ecx, [ebp - 0x18]
call fcn.0040ab90
lea ecx, [ebp - 0x18]
call fcn.0040abf0
mov edx, edi
mov ecx, eax
call fcn.00410ee0
call fcn.0040c6b0
mov edx, dword [ebp - 0x20]
jmp 0x411010
mov ecx, dword [ebp - 0x254]
xor eax, eax
add eax, dword [ebp - 0x250]
adc ecx, 0
add dword [edi], eax
adc dword [edi + 4], ecx
cmp edx, 0xffffffff
je 0x41105b
lea eax, [ebp - 0x270]
push eax
push edx
call esi
test eax, eax
je 0x41104b
lea ecx, [ebp - 0x270]
call fcn.004018b0
test al, al
je 0x41103a
mov edx, dword [ebp - 0x20]
jmp 0x410fb0
mov eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x41105b
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x41105b
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x20], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040aad0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004310db
mov esp, ebp
pop ebp
ret