joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10f224b
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x1426ed0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov edi, ecx
lea ecx, [ebp - 0x80]
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], esi
call fcn.010ed27c
mov eax, dword [edi]
lea ecx, [ebp - 0x98]
push ecx
push 8
push esi
push eax
push 0x80000002
mov dword [ebp - 0x98], esi
mov dword [ebp - 0xac], esi
mov dword [ebp - 0x94], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x10f22be
mov dword [ebp - 0x94], esi
jmp 0x10f23bd
lea ecx, [ebp - 0x94]
push ecx
push eax
call fcn.01044c5f
test eax, eax
je 0x10f238b
mov dword [ebp - 0x9c], esi
mov eax, dword [ebp - 0x98]
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0xb0]
push ecx
lea ecx, [ebp - 0x50]
push ecx
push dword [ebp - 0x9c]
mov dword [ebp - 0xb0], 0x25
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x9c]
cmp eax, 0x103
je 0x10f2371
lea ecx, [ebp - 0x94]
push ecx
push eax
call fcn.01044c5f
test eax, eax
je 0x10f238b
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.01051d8d
test eax, eax
jl 0x10f2381
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.010effec
cmp eax, esi
mov dword [ebp - 0x94], eax
jl 0x10f2393
push esi
push esi
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0xa8]
call fcn.010f0fc8
cmp eax, esi
mov dword [ebp - 0x94], eax
jge 0x10f22d9
jmp 0x10f2393
lea eax, [ebp - 0xa8]
push eax
mov ecx, ebx
call fcn.010f104d
jmp 0x10f238b
mov dword [ebp - 0x94], 0x8004f807
cmp dword [ebp - 0x94], esi
jge 0x10f23bd
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10f23bd
test byte [eax + 0x3c], 2
je 0x10f23bd
push dword [ebp - 0x94]
push 0x1010e44
push 0xd
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
lea ecx, [ebp - 0xac]
call fcn.010454cc
lea ecx, [ebp - 0x98]
call fcn.01045411
lea ecx, [ebp - 0x80]
call fcn.010ed29e
push esi
lea ecx, [ebp - 0xa8]
call fcn.010f013b
lea ecx, [ebp - 0xa0]
call fcn.010ec37b
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01043035
leave
ret 4
Function at 0x10f4905
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
or dword [ebp - 4], 0xffffffff
push ebx
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
call fcn.01060191
mov esi, eax
cmp esi, edi
jl 0x10f4a2c
mov eax, dword [ebp - 0xc]
push edi
push edi
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 4]
call fcn.01081f68
push dword [ebp - 4]
call fcn.01081f1c
test al, al
jne 0x10f4968
cmp dword [ebp - 4], edi
jne 0x10f4979
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0104499a
jmp 0x10f4a26
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
je 0x10f4968
cmp dword [ebp - 0x14], edi
je 0x10f499c
mov esi, 0x80070057
jmp 0x10f4a2c
cmp esi, 0x100000
ja 0x10f4992
push esi
call fcn.0104309c
lea ecx, [ebp - 8]
mov ebx, eax
call fcn.01050f44
cmp ebx, edi
jne 0x10f49c2
mov dword [ebp - 8], edi
mov esi, 0x8007000e
jmp 0x10f4a2c
push edi
lea eax, [ebp - 0x18]
push eax
push esi
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10f4968
cmp dword [ebp - 0x18], esi
je 0x10f49e5
mov esi, 0x8000ffff
jmp 0x10f4a2c
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x74]
mov ecx, dword [eax]
lea edx, [ebp - 0x20]
push edx
lea edx, [ebp - 0x10]
push edx
push esi
push ebx
push eax
call dword [ecx + 0xc]
mov esi, eax
cmp esi, edi
jl 0x10f4a2c
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x20]
push eax
call fcn.010f42a0
mov esi, eax
cmp esi, edi
jl 0x10f4a2c
add ebx, 0x2c
push ebx
push dword [ebp + 8]
call fcn.010467e1
mov esi, eax
cmp esi, edi
jge 0x10f4a51
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10f4a51
test byte [eax + 0x3c], 2
je 0x10f4a51
push esi
push 0x1010e54
push 0x21
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
lea ecx, [ebp - 0xc]
call fcn.010454cc
lea ecx, [ebp - 0x10]
call fcn.0105121e
lea ecx, [ebp - 8]
call fcn.01050f44
lea ecx, [ebp - 4]
call fcn.01081f49
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10f65eb
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 4]
push edi
xor ebx, ebx
call fcn.01081f1c
test al, al
jne 0x10f6608
test edi, edi
jne 0x10f660f
mov ebx, 0x80004005
jmp 0x10f6646
mov esi, edi
push esi
call fcn.01081f1c
neg al
push 0
sbb eax, eax
not eax
and eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x10f663d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0104499a
mov ebx, eax
jmp 0x10f6642
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
test ebx, ebx
jge 0x10f666b
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10f666b
test byte [eax + 0x3c], 2
je 0x10f666b
push ebx
push 0x10119f0
push 0x13
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4

Function at 0x10f6674
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov esi, ecx
stosd dword es:[edi], eax
mov edi, dword [esi + 4]
push edi
call fcn.01081f1c
test al, al
jne 0x10f66a0
test edi, edi
jne 0x10f66a7
mov ebx, 0x80004005
jmp 0x10f66fe
mov eax, dword [ebp + 0x14]
mov esi, edi
push esi
mov dword [ebp - 0xc], eax
call fcn.01081f1c
mov ecx, dword [ebp + 0x10]
neg al
lea edx, [ebp - 0x14]
sbb eax, eax
not eax
and eax, esi
mov esi, dword [ebp + 0xc]
neg ecx
sbb ecx, ecx
and ecx, edx
push ecx
lea ecx, [ebp + 0x14]
push ecx
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10f66f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0104499a
mov ebx, eax
jmp 0x10f66fa
cmp dword [ebp + 0x14], esi
je 0x10f6723
mov ebx, 0x8004e109
test ebx, ebx
jge 0x10f6723
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10f6723
test byte [eax + 0x3c], 2
je 0x10f6723
push ebx
push 0x10119f0
push 0x16
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x10
Function at 0x10f67b9
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov edi, dword [esi + 4]
push edi
xor ebx, ebx
call fcn.01081f1c
test al, al
jne 0x10f67d6
test edi, edi
jne 0x10f67dd
mov ebx, 0x80004005
jmp 0x10f6823
mov esi, edi
push esi
call fcn.01081f1c
neg al
push 0
lea ecx, [ebp + 0xc]
push ecx
sbb eax, eax
not eax
and eax, esi
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10f6815
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0104499a
mov ebx, eax
jmp 0x10f681f
cmp dword [ebp + 0xc], esi
je 0x10f6848
mov ebx, 0x8004e10a
test ebx, ebx
jge 0x10f6848
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10f6848
test byte [eax + 0x3c], 2
je 0x10f6848
push ebx
push 0x10119f0
push 0x17
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 8

Function at 0x10f6aab
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
push dword [ebp + 8]
mov ebx, ecx
xor edi, edi
call esi
test eax, eax
jne 0x10f6b16
push dword [ebp + 8]
mov ecx, ebx
call fcn.010f6851
mov edi, eax
test edi, edi
jl 0x10f6af1
push dword [ebp + 8]
call esi
test eax, eax
jne 0x10f6aed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0104499a
mov edi, eax
test edi, edi
jge 0x10f6b16
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10f6b16
test byte [eax + 0x3c], 2
je 0x10f6b16
push edi
push 0x10119f0
push 0x1f
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x10f6e5d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
xor ebx, ebx
cmp dword [ebp + 8], ebx
push edi
mov esi, ecx
je 0x10f6f0d
cmp dword [esi + 0x10], ebx
jne 0x10f6f0d
mov eax, dword [0x1426c54]
mov ebx, 0x1426c54
cmp eax, ebx
mov edi, 0x10119f0
je 0x10f6ead
mov edx, dword [eax + 0x3c]
mov ecx, 0x8000004
and edx, ecx
cmp edx, ecx
jne 0x10f6ead
push dword [esi + 8]
push edi
push 0xf
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.010ea0e3
lea ecx, [esi + 4]
call fcn.01081f49
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10f6ecb
push dword [esi + 8]
jmp 0x10f6fc9
mov eax, dword [0x1426c54]
cmp eax, ebx
je 0x10f6fd0
mov eax, dword [eax + 0x3c]
mov ecx, 0x1000004
and eax, ecx
cmp eax, ecx
jne 0x10f6fd0
mov ebx, dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [0x1426c54]
push ebx
push edi
push 0x10
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.010b387f
jmp 0x10f6fd0
mov edi, dword [esi + 4]
push edi
call fcn.01081f1c
test al, al
jne 0x10f6fd0
cmp edi, ebx
je 0x10f6fd0
cmp dword [esi], ebx
mov edi, 0x10119f0
jne 0x10f6f7d
cmp dword [esi + 0x10], ebx
jne 0x10f6f7d
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10f6f5c
mov edx, dword [eax + 0x3c]
mov ecx, 0x8000004
and edx, ecx
cmp edx, ecx
jne 0x10f6f5c
push edi
push 0x11
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.010f6443
mov ebx, dword [esi + 4]
push ebx
call fcn.01081f1c
neg al
sbb eax, eax
not eax
and eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
neg eax
sbb eax, eax
inc eax
mov dword [esi], eax
xor ebx, ebx
lea ecx, [esi + 4]
call fcn.01081f49
cmp dword [esi + 0x10], ebx
jne 0x10f6fd0
cmp dword [esi], ebx
je 0x10f6fc6
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10f6ec3
mov edx, dword [eax + 0x3c]
mov ecx, 0x1000004
and edx, ecx
cmp edx, ecx
jne 0x10f6ec3
push dword [esi + 8]
push edi
push 0x12
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.010ea0e3
jmp 0x10f6ec3
push dword [esi + 0xc]
mov ecx, esi
call fcn.010f6aab
pop edi
mov dword [esi + 0x10], 1
pop esi
pop ebx
pop ebp
ret 4

Function at 0x10f9eeb
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10f9f0b
or eax, dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
pop ebp
ret 8
Function at 0x10fb155
Capabilities:
Copy file
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x10], ebx
push edi
jne 0x10fb16e
xor edi, edi
jmp 0x10fb21c
lea eax, [ebp - 4]
push eax
call fcn.010f672c
mov edi, eax
cmp edi, ebx
jl 0x10fb1f7
push ebx
mov ecx, esi
call fcn.010f6e5d
push dword [esi + 0xc]
mov ecx, esi
call fcn.010f6aab
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 8]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x10fb1b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0104499a
jmp 0x10fb1f1
mov eax, dword [esi + 8]
mov ecx, dword [esi + 0xc]
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x10fb1a2
mov eax, dword [esi + 8]
push 0x2000
push eax
mov ecx, esi
call fcn.010f9eeb
push dword [esi + 8]
mov ecx, esi
call fcn.010fae4e
mov edi, eax
cmp edi, ebx
jl 0x10fb1f7
push ebx
push dword [ebp - 4]
mov ecx, esi
mov dword [esi + 0x10], ebx
call fcn.010f69cd
mov edi, eax
cmp edi, ebx
jge 0x10fb21c
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10fb21c
test byte [eax + 0x3c], 2
je 0x10fb21c
push edi
push 0x10119f0
push 0x18
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10fb249
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
push 0x1011af8
push esi
mov dword [ebp - 4], esi
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
lea ecx, [ebp - 4]
mov edi, eax
call fcn.010fa2d5
cmp edi, esi
jne 0x10fb278
mov dword [ebp - 4], esi
jmp 0x10fb292
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push esi
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x10fb2c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0104499a
mov ebx, eax
cmp ebx, esi
jge 0x10fb2c9
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10fb2c9
test byte [eax + 0x3c], 2
je 0x10fb2c9
push ebx
push 0x10119f0
push 0x19
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
lea ecx, [ebp - 4]
call fcn.010fa2d5
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x10fbaeb
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
cmp ebx, eax
push esi
mov esi, ecx
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [esi], eax
je 0x10fbb3f
lea eax, [ebp - 8]
push eax
push ebx
call fcn.010467e1
mov edi, eax
test edi, edi
jl 0x10fbc50
push 0x1011b68
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
call fcn.010fb9ec
mov edi, eax
add esp, 0xc
test edi, edi
jl 0x10fbc50
mov edi, dword [ebp - 4]
jmp 0x10fbb45
mov ebx, dword [esi + 8]
mov edi, dword [esi + 0xc]
cmp dword [ebp + 0xc], 0
je 0x10fbb5b
push ebx
mov ecx, esi
call fcn.010f6aab
push edi
mov ecx, esi
call fcn.010f6aab
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10fbb7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x10fbb9d
push eax
call fcn.0104499a
mov edi, eax
jmp 0x10fbc4c
push ebx
mov ecx, esi
call fcn.010f6aab
push 0
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x10fbb9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10fbb72
push ebx
mov ecx, esi
call fcn.010fae07
cmp eax, 0x80070002
jne 0x10fbc1b
cmp dword [ebp + 0xc], 0
jne 0x10fbbec
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10fbbde
mov edx, dword [eax + 0x3c]
mov ecx, 0x8000004
and edx, ecx
cmp edx, ecx
jne 0x10fbbde
push 0x10119f0
push 0xd
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.010f6443
push 0x4000200e
push 4
mov ecx, esi
call fcn.010fb249
push edi
mov ecx, esi
call fcn.010fa7e9
mov edi, eax
test edi, edi
jl 0x10fbc50
push ebx
mov ecx, esi
call fcn.010fae4e
mov edi, eax
test edi, edi
jl 0x10fbc50
push 0x2000
push ebx
mov ecx, esi
call fcn.010f9eeb
and dword [esi + 0x10], 0
jmp 0x10fbc28
test eax, eax
mov edi, eax
jl 0x10fbc50
mov dword [esi + 0x10], 1
mov eax, dword [ebp - 8]
test eax, eax
je 0x10fbc4c
and dword [ebp - 8], 0
push eax
lea ecx, [esi + 8]
call fcn.010531ae
mov eax, dword [ebp - 4]
and dword [ebp - 4], 0
push eax
lea ecx, [esi + 0xc]
call fcn.010531ae
test edi, edi
jge 0x10fbc75
mov eax, dword [0x1426c54]
cmp eax, 0x1426c54
je 0x10fbc75
test byte [eax + 0x3c], 2
je 0x10fbc75
push edi
push 0x10119f0
push 0xe
push dword [eax + 0x34]
push dword [eax + 0x30]
call fcn.01043c41
lea ecx, [ebp - 4]
call fcn.010454cc
lea ecx, [ebp - 8]
call fcn.010454cc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x11deb64
Capabilities:
Hash data using sha1

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x14466fc], 0
push ebx
jne 0x11debe1
push eax
push ebx
push ecx
push edx
xor eax, eax
cpuid
xor eax, eax
xor ebx, 0x756e6547
sete al
xor ebx, ebx
xor ecx, 0x6c65746e
sete bl
and eax, ebx
xor ecx, ecx
xor edx, 0x49656e69
sete cl
and eax, ecx
mov dword [ebp - 4], eax
mov eax, 1
cpuid
xor ecx, ecx
xor edx, edx
mov ebx, 0xff0
and ebx, eax
mov dword [ebp - 8], ebx
pop edx
pop ecx
pop ebx
pop eax
cmp dword [ebp - 4], 0
mov eax, 1
je 0x11debd5
cmp dword [ebp - 8], 0x660
jae 0x11debd5
xor eax, eax
mov eax, dword [eax*4 + 0x1427078]
mov dword [0x14466fc], eax
mov eax, dword [ebp + 8]
mov dword [eax + 0x54], 0
mov dword [eax + 0x58], 0
mov dword [eax + 0x40], 0x67452301
mov dword [eax + 0x44], 0xefcdab89
mov dword [eax + 0x48], 0x98badcfe
mov dword [eax + 0x4c], 0x10325476
mov dword [eax + 0x50], 0xc3d2e1f0
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x12a94a8
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
cmp edi, ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
jne 0x12a94d0
mov dword [ebp + 8], 0x80070057
jmp 0x12a9622
push esi
call fcn.012a9365
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x12a9604
push 0xf0000000
push 0x18
push ebx
push ebx
lea eax, [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x12a9514
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x12a950c
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp + 8], eax
jmp 0x12a9604
push 4
mov ecx, 0x1021208
mov eax, edi
pop esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x12a9542
cmp dx, bx
je 0x12a953e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x12a9542
add eax, esi
add ecx, esi
cmp dx, bx
jne 0x12a951e
xor eax, eax
jmp 0x12a9547
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x12a955b
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x8004
jmp 0x12a95db
mov ecx, 0x10211b8
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x12a9586
cmp dx, bx
je 0x12a9582
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x12a9586
add eax, esi
add ecx, esi
cmp dx, bx
jne 0x12a9562
xor eax, eax
jmp 0x12a958b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x12a959c
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x800c
jmp 0x12a95db
mov ecx, 0x1021168
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x12a95c7
cmp dx, bx
je 0x12a95c3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x12a95c7
add eax, esi
add ecx, esi
cmp dx, bx
jne 0x12a95a3
xor eax, eax
jmp 0x12a95cc
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x12a95fd
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push 0x800e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x12a94f8
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 8]
mov dword [eax + 0xc], ecx
jmp 0x12a9621
mov dword [ebp + 8], 0x80049e5b
cmp dword [ebp - 8], ebx
je 0x12a9612
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
cmp dword [ebp - 4], ebx
je 0x12a9621
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop esi
mov eax, dword [ebp + 8]
pop edi
pop ebx
leave
ret 4
Function at 0x12a9bb2
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
je 0x12a9d6c
cmp dword [ebp + 0x10], esi
je 0x12a9d6c
mov ebx, dword [ebp + 0x14]
cmp ebx, esi
je 0x12a9d6c
cmp dword [ecx + 0x20], esi
jne 0x12a9bf5
mov esi, 0x80049e51
jmp 0x12a9cc1
mov ecx, dword [ebx]
push edi
push 4
mov dword [ebp + 0x14], ecx
mov dword [ebx], esi
mov ecx, 0x1021090
pop edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x12a9c29
cmp dx, si
je 0x12a9c25
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x12a9c29
add eax, edi
add ecx, edi
cmp dx, si
jne 0x12a9c05
xor eax, eax
jmp 0x12a9c2e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
jne 0x12a9c3b
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 1
jmp 0x12a9cb9
mov eax, dword [ebp + 8]
mov ecx, 0x1021038
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x12a9c67
cmp dx, si
je 0x12a9c63
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x12a9c67
add eax, edi
add ecx, edi
cmp dx, si
jne 0x12a9c43
xor eax, eax
jmp 0x12a9c6c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
jne 0x12a9c79
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 2
jmp 0x12a9cb9
mov eax, dword [ebp + 8]
mov ecx, 0x1020fe0
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x12a9ca5
cmp dx, si
je 0x12a9ca1
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x12a9ca5
add eax, edi
add ecx, edi
cmp dx, si
jne 0x12a9c81
xor eax, eax
jmp 0x12a9caa
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
jne 0x12a9d62
mov eax, dword [ebp - 4]
cmp dword [eax + 8], 3
je 0x12a9cd2
mov esi, 0x80049e2e
pop edi
push dword [ebp - 0xc]
call fcn.01043bb7
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret 0x14
mov eax, dword [ebp + 0xc]
push eax
mov dword [ebp - 8], eax
call fcn.01043ba8
mov edi, eax
cmp edi, esi
pop ecx
mov dword [ebp - 0xc], edi
jne 0x12a9cef
mov esi, 0x8007000e
jmp 0x12a9cc0
push dword [ebp - 8]
push dword [ebp + 0x10]
push edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push edi
push esi
push 1
push esi
push dword [eax + 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x12a9d2f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x12a9d2b
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
jmp 0x12a9cc0
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
cmp dword [ebp + 0x18], esi
mov dword [ebx], eax
je 0x12a9cc0
cmp dword [ebp + 0x14], eax
jae 0x12a9d4b
mov esi, 0x80049e19
jmp 0x12a9cc0
push eax
mov eax, edi
add eax, 0x10
push eax
push dword [ebp + 0x18]
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x12a9cc0
mov esi, 0x80049e5b
jmp 0x12a9cc0
mov esi, 0x80070057
jmp 0x12a9cc1
Function at 0x12aa2aa
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp edi, ebx
mov esi, ecx
je 0x12aa3d4
cmp dword [ebp + 8], 0x14
jbe 0x12aa3d4
push dword [esi + 0x14]
call fcn.01043bb7
push dword [esi + 0xc]
mov dword [esi + 0x14], ebx
call fcn.01043bb7
mov eax, dword [esi + 0x20]
cmp eax, ebx
pop ecx
pop ecx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
je 0x12aa2f7
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [esi + 0x20], ebx
mov eax, dword [edi + 0xc]
shr eax, 3
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x10]
lea ebx, [esi + 0x1c]
mov dword [ebx], eax
mov eax, dword [esi + 0x18]
mov ecx, eax
shr ecx, 1
add ecx, 4
imul ecx, ecx, 5
lea eax, [ecx + eax*2]
cmp dword [ebp + 8], eax
jne 0x12aa3d4
push dword [esi + 0x14]
call fcn.01043bb7
push dword [esi + 0x18]
and dword [esi + 0x14], 0
call fcn.01043ba8
test eax, eax
pop ecx
pop ecx
mov dword [esi + 0x14], eax
jne 0x12aa34a
mov dword [ebp + 0xc], 0x8007000e
jmp 0x12aa3db
push dword [esi + 0x18]
lea ecx, [edi + 0x14]
push ecx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push 4
push ebx
mov ecx, esi
call fcn.012a97b5
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x12aa3db
push dword [esi + 0x18]
mov ecx, esi
push dword [esi + 0x14]
call fcn.012a97b5
test eax, eax
mov dword [ebp + 0xc], eax
jne 0x12aa3db
lea ebx, [esi + 0x24]
cmp dword [ebx], eax
jne 0x12aa3b3
push 0xf0000000
push 0x18
push eax
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x12aa3b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x12aa3ae
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp + 0xc], eax
jmp 0x12aa3db
lea eax, [esi + 0x20]
push eax
push 0x40
push 0
push dword [ebp + 8]
push edi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x12aa39a
mov dword [esi + 8], 4
jmp 0x12aa3db
mov dword [ebp + 0xc], 0x80070057
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 8