joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1119e80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1145c8b
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0
push 0x1063528
lea eax, [ebp - 0x120]
push eax
push 0x10634a8
lea ecx, [ebp - 0x11c]
push 2
push ecx
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x120], 0
call fcn.01075110
push 0x44
lea edx, [ebp - 0x178]
push 0
push edx
mov dword [ebp - 4], 0
call fcn.01084910
xor eax, eax
add esp, 0x24
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov eax, dword [esi + 4]
push 0
push eax
lea eax, [ebp - 0x124]
push eax
mov dword [ebp - 0x170], 0x1063484
mov dword [ebp - 0x178], 0x44
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
test eax, eax
je 0x1119ff9
mov eax, dword [ebp - 0x124]
mov esi, dword [esi + 4]
lea ecx, [ebp - 0x134]
push ecx
lea edx, [ebp - 0x178]
push edx
push 0
push eax
push 0x430
push 0
push 0
push 0
push edi
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x1119fc6
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1119f8e
call esi
jmp 0x1119f9a
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x120], eax
call fcn.01127f00
test al, al
je 0x1119fe6
mov ecx, dword [ebp - 0x120]
push ecx
push 0x1063420
push 0x10633a0
push 0
call fcn.01128b70
add esp, 0x10
jmp 0x1119fe6
mov eax, dword [ebp - 0x134]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x1119fd9
push eax
call esi
mov eax, dword [ebp - 0x130]
test eax, eax
je 0x1119fe6
push eax
call esi
mov eax, dword [ebp - 0x124]
test eax, eax
je 0x111a03f
push eax
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
jmp 0x111a03f
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x111a009
call esi
jmp 0x111a015
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x120], eax
call fcn.01127f00
test al, al
je 0x111a03f
mov edx, dword [ebp - 0x120]
push edx
push 0x1063338
push 0x10632b8
push 0
call fcn.01128b70
add esp, 0x10
mov esi, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], 0xffffffff
call fcn.01075230
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 8
Function at 0x111cb40
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11460e0
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor edi, edi
xor ebx, ebx
cmp dword [esi + 0x44], edi
je 0x111cd0a
mov dword [ebp - 4], edi
cmp edi, dword [esi + 0x38]
jae 0x111cbba
mov eax, dword [esi + 0x34]
lea ecx, [edi*4]
add eax, ecx
cmp dword [eax], 0
je 0x111cbb5
cmp edi, dword [esi + 0x38]
jb 0x111cba8
push 0x80070057
call fcn.01071710
mov eax, dword [esi + 0x34]
mov ecx, dword [eax + ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add edi, 1
jmp 0x111cb83
cmp dword [esi + 0x34], 0
je 0x111cbdf
xor eax, eax
cmp eax, dword [esi + 0x38]
jae 0x111cbcc
add eax, 1
jmp 0x111cbc2
mov edx, dword [esi + 0x34]
push edx
call fcn.01083cad
add esp, 4
mov dword [esi + 0x34], 0
xor eax, eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov edi, dword [esi + 0x30]
cmp dword [edi - 0xc], eax
je 0x111cca1
push 0x20c
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.01084910
mov eax, dword [edi - 0xc]
lea ecx, [eax + eax]
add esp, 0xc
cmp ecx, 0x104
jae 0x111cc1a
add eax, eax
jmp 0x111cc1f
mov eax, 0x104
push eax
lea edx, [ebp - 0x220]
push edi
push edx
call fcn.01086710
xor eax, eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x234], eax
add esp, 0xc
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov word [ebp - 0x228], ax
lea ecx, [ebp - 0x244]
lea eax, [ebp - 0x220]
push ecx
mov dword [ebp - 0x240], 3
mov dword [ebp - 0x23c], eax
mov word [ebp - 0x234], 0x14
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x111cca1
jle 0x111cc9f
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
mov eax, dword [0x1163640]
test eax, eax
je 0x111cd03
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test eax, eax
jne 0x111ccf9
test ebx, ebx
jl 0x111ccf9
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x111cccb
call edi
mov ebx, eax
jmp 0x111ccdb
call edi
mov ebx, eax
and ebx, 0xffff
or ebx, 0x80070000
call fcn.01127f00
test al, al
je 0x111ccf9
push ebx
push 0x1064474
push 0x10643f8
push 0
call fcn.01128b70
add esp, 0x10
mov dword [0x1163640], 0
mov dword [esi + 0x44], 0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret
Function at 0x111e490
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1138cb6
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
push ebx
push 0x1065828
lea eax, [ebp - 0x120]
push eax
push 0x10657a8
lea ecx, [ebp - 0x11c]
push 2
push ecx
mov dword [ebp - 0x120], ebx
call fcn.01075110
add esp, 0x18
mov eax, dword [esi]
sub eax, 0x10
mov ecx, 1
sub ecx, dword [eax + 0xc]
mov eax, dword [eax + 8]
or eax, ecx
mov dword [ebp - 4], ebx
jge 0x111e50a
push ebx
mov ecx, esi
call fcn.010745e0
mov eax, dword [esi]
cmp dword [eax - 8], ebx
jge 0x111e51b
push 0x80070057
call fcn.01071710
mov dword [eax - 0xc], ebx
mov edx, dword [esi]
mov word [edx], bx
mov eax, dword [0x1162a90]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
je 0x111e555
push eax
mov ecx, esi
call fcn.0109c210
mov ecx, dword [esi]
cmp dword [ecx - 0xc], ebx
jne 0x111e5d7
mov dword [ebp - 0x120], 0x80070057
jmp 0x111e5f7
mov edx, dword [0x1161d94]
mov eax, dword [edx + 0xc]
mov ecx, 0x1161d94
call eax
add eax, 0x10
mov dword [ebp - 0x124], eax
lea ecx, [ebp - 0x124]
push ecx
push esi
push 1
push 0x1c
mov byte [ebp - 4], 1
call fcn.010f91e0
mov ecx, eax
call fcn.010f4b20
mov dword [ebp - 0x120], eax
cmp eax, ebx
mov eax, dword [ebp - 0x124]
mov byte [ebp - 4], bl
jge 0x111e5bb
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x111e5f7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x111e5f7
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x111e5d7
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.01127f00
test al, al
je 0x111e5f7
mov ecx, dword [esi]
push ecx
push 0x1065760
push 0x10656e0
push 3
call fcn.01128b70
add esp, 0x10
mov esi, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], 0xffffffff
call fcn.01075230
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 4
Function at 0x111efc0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11464a6
mov eax, dword fs:[0]
push eax
sub esp, 0x118
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x1161d94]
mov edx, dword [eax + 0xc]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ecx, 0x1161d94
mov dword [ebp - 0x120], 0
call edx
add eax, 0x10
mov dword [ebp - 0x124], eax
push 0
push 0x1065e28
lea eax, [ebp - 0x120]
push eax
push 0x1065da8
lea ecx, [ebp - 0x11c]
push 2
push ecx
mov dword [ebp - 4], 0
call fcn.01075110
add esp, 0x18
push esi
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 1
call fcn.0109c210
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [ebp - 0x124]
call fcn.0109dbe0
mov esi, dword [ebp - 0x124]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x111f0ba
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x111f083
call edi
jmp 0x111f08f
call edi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x120], eax
call fcn.01127f00
test al, al
je 0x111f0ba
mov edx, dword [ebp - 0x120]
push esi
push edx
push 0x10261c0
push 0x1065d28
push 0
call fcn.01128b70
add esp, 0x14
mov edi, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 0
call fcn.01075230
lea eax, [esi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x111f0f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 8
Function at 0x1125be0
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1147050
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x115f604]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov esi, dword [ebp + 8]
cmp byte [esi + 0x1d], bl
mov byte [ebp - 4], 1
jne 0x1125c47
lea eax, [esi + 0xc]
lea edi, [esi + 8]
push eax
mov ecx, edi
call fcn.0109c0b0
mov edi, dword [edi]
mov dword [esi], edi
mov ecx, dword [edi - 0xc]
mov dword [esi + 4], ecx
mov byte [esi + 0x1d], 1
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x30]
lea ecx, [ebp - 0x10]
push ecx
push ebx
push ebx
push 0x8004
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1125c74
call fcn.01071a70
mov ebx, eax
test ebx, ebx
jl 0x1125d6e
xor ebx, ebx
mov eax, dword [esi + 4]
mov esi, dword [esi]
mov edx, dword [ebp - 0x10]
push ebx
push eax
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x1125c9b
call fcn.01071a70
mov ebx, eax
test ebx, ebx
jl 0x1125d6e
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push ebx
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 4
push edx
mov dword [ebp + 8], 4
call edi
test eax, eax
jne 0x1125cc4
call fcn.01071a70
mov ebx, eax
test ebx, ebx
jl 0x1125d6e
mov esi, dword [ebp - 0x14]
test esi, esi
jbe 0x1125cfb
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
jne 0x1125cf5
push 0x114de9c
lea eax, [ebp + 8]
push eax
mov dword [ebp + 8], 0x8007000e
call fcn.01083d3b
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 0x14]
push ecx
push edx
push 2
push eax
mov dword [ebp - 0x24], esi
call edi
test eax, eax
jne 0x1125d1b
call fcn.01071a70
jmp 0x1125d1d
xor eax, eax
test eax, eax
mov ebx, eax
jl 0x1125d60
push 0
push esi
call fcn.0109ff70
mov edi, dword [ebp + 0xc]
push 0
lea ecx, [ebp + 8]
push ecx
push eax
mov ecx, edi
mov dword [ebp + 8], eax
call fcn.010a0610
mov edx, dword [ebp - 0x20]
push eax
push esi
push edx
call fcn.010a0010
mov esi, eax
mov eax, dword [ebp + 8]
push eax
mov ecx, edi
call fcn.010976b0
test esi, esi
jne 0x1125d60
mov ebx, 0x80045c0e
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x1125d6e
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1125d7c
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1126b70
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1147188
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
push ebx
push esi
push edi
mov eax, dword [0x115f604]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp edi, ebx
je 0x1126d40
mov esi, dword [ebp + 8]
cmp esi, ebx
jne 0x1126bf5
mov dword [ebp - 0x6c], 0x1069c10
mov dword [ebp - 0x68], 0x1069c40
mov dword [ebp - 0x64], 0x33
mov dword [ebp - 0x60], 0x80070057
push 0x115b270
lea eax, [ebp - 0x6c]
mov byte [ebp - 0x5c], bl
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x44], bl
mov dword [ebp - 0x14], 1
push eax
call fcn.01083d3b
cmp dword [0x11636ac], ebx
jne 0x1126ce0
push 0x11636b0
lea ecx, [ebp - 0x10]
call fcn.010bae20
cmp dword [0x11636ac], ebx
mov dword [ebp - 4], ebx
jne 0x1126c71
push 0xf0000000
push 1
push 0x1069c14
push ebx
push 0x11636ac
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x1126c71
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1126c45
call esi
jmp 0x1126c51
call esi
and eax, 0xffff
or eax, 0x80070000
push 1
push eax
push 0x49
push 0x1069c40
lea ecx, [ebp - 0x6c]
call fcn.01126af0
push 0x115b270
lea ecx, [ebp - 0x6c]
push ecx
call fcn.01083d3b
mov edi, dword [ebp - 0x10]
lea esi, [edi + 4]
push esi
mov dword [ebp - 4], 0xffffffff
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov edx, dword [esi + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_SetEvent]
add edi, 0x14
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [0x11636ac], ebx
jne 0x1126cda
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1126cb1
call esi
jmp 0x1126cbd
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x6c], 0x1069c10
mov dword [ebp - 0x68], 0x1069c40
mov dword [ebp - 0x64], 0x52
mov dword [ebp - 0x60], eax
jmp 0x1126bcb
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push edi
push ebx
push esi
call fcn.01084910
mov ecx, dword [0x11636ac]
add esp, 0xc
push esi
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x1126d40
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1126d0e
call esi
jmp 0x1126d1a
call esi
and eax, 0xffff
or eax, 0x80070000
push 1
push eax
push 0x58
push 0x1069c40
lea ecx, [ebp - 0xc8]
call fcn.01126af0
push 0x115b270
lea edx, [ebp - 0xc8]
push edx
jmp 0x1126bf0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x11273d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x114723b
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x1c]
xor esi, esi
push 0x110
lea ecx, [ebp - 0x120]
push esi
push ecx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], esi
mov dword [ebp - 0x124], esi
call fcn.01084910
add esp, 0xc
mov dword [ebp - 0x134], esi
cmp edi, esi
mov ebx, dword [ebp + 0x10]
lea edx, [ebx + 0xc]
mov dword [ebp - 4], esi
mov dword [ebp - 0x130], edx
mov byte [ebp - 0x13c], 8
mov byte [ebp - 0x13b], 2
mov word [ebp - 0x13a], si
je 0x112745d
mov dword [edi], esi
cmp dword [ebp + 8], esi
je 0x112756f
cmp dword [ebp - 0x12c], esi
je 0x112756f
cmp ebx, esi
je 0x112756f
cmp edi, esi
je 0x112756f
lea eax, [ebp - 0x124]
push eax
mov dword [ebp - 0x124], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x11274cd
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x11274b6
call esi
mov dword [ebp - 0x128], eax
jmp 0x1127579
call esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x128], eax
jmp 0x1127579
mov eax, dword [ebp - 0x120]
cmp eax, 5
ja 0x1127501
jne 0x11274e3
cmp dword [ebp - 0x11c], 1
jae 0x1127501
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x12c]
mov eax, dword [ebp + 8]
push edi
push ecx
push ebx
push edx
push eax
call fcn.011272f0
mov dword [ebp - 0x128], eax
jmp 0x1127579
mov ecx, dword [ebp - 0x130]
push ecx
call fcn.01083687
mov esi, eax
add esp, 4
test esi, esi
jne 0x1127522
mov dword [ebp - 0x128], 0x8007000e
jmp 0x1127579
mov edx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x12c]
mov eax, dword [ebp + 0x14]
mov dword [esi], edx
push ebx
push ecx
lea edx, [esi + 0xc]
mov dword [esi + 4], eax
push edx
mov dword [ebp - 0x134], esi
mov dword [esi + 8], ebx
call fcn.01086710
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x130]
mov edx, dword [ebp + 8]
add esp, 0xc
push edi
push eax
push 0
push ecx
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x1127579
jmp 0x112749d
mov dword [ebp - 0x128], 0x80070057
mov eax, dword [ebp - 0x134]
push eax
call fcn.010838da
mov eax, dword [ebp - 0x128]
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1128080
Capabilities:
Check if file exists
Create directory
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x114732b
mov eax, dword fs:[0]
push eax
sub esp, 0x230
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push 0x116371c
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x23c], 0x116371c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x238], 1
xor esi, esi
push 0x208
lea ecx, [ebp - 0x21a]
push esi
push ecx
mov dword [ebp - 4], esi
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], esi
mov word [ebp - 0x21c], si
call fcn.01084910
add esp, 0xc
cmp edi, esi
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x228], esi
jne 0x1128138
lea edx, [ebp - 0x228]
push edx
push 0x20019
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
jne 0x1128273
mov edi, dword [ebp - 0x228]
lea eax, [ebp - 0x224]
push eax
push 0x20019
push esi
push 0x1069d20
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1128273
mov eax, dword [ebp - 0x224]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x230]
push edx
push esi
push esi
push 0x1069d10
push eax
mov dword [ebp - 0x220], 4
call edi
test eax, eax
jne 0x1128273
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x22c]
push edx
push esi
push esi
push 0x1069d04
push eax
mov dword [ebp - 0x220], 4
call edi
mov eax, dword [ebp - 0x224]
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x21c]
push edx
push esi
push esi
push 0x1069cf4
push eax
mov dword [ebp - 0x220], 0x104
call edi
test eax, eax
je 0x11281f9
push 1
push 5
lea ecx, [ebp - 0x21c]
push ecx
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1128273
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1128229
push esi
lea eax, [ebp - 0x21c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
cmp eax, esi
je 0x1128229
cmp eax, 0x50
je 0x1128229
cmp eax, 0xb7
jne 0x1128273
mov eax, dword [ebp - 0x234]
cmp eax, esi
lea ecx, [ebp - 0x21c]
jne 0x1128244
push 0x1069cd0
push ecx
mov edx, ecx
push edx
jmp 0x112824d
push eax
lea eax, [ebp - 0x21c]
push eax
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
test eax, eax
je 0x1128273
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x230]
lea edx, [ebp - 0x21c]
push edx
push eax
push ecx
push 1
call fcn.01128000
mov eax, dword [ebp - 0x224]
cmp eax, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x1128286
push eax
call edi
mov eax, dword [ebp - 0x228]
cmp eax, esi
je 0x1128293
push eax
call edi
push 0x116371c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 8
Function at 0x1128780
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11473ab
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
push 0x116371c
mov dword [ebp - 0x98], 0x116371c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x94], 1
cmp byte [0x116370c], 0
mov dword [ebp - 4], 0
je 0x11287e8
cmp byte [ebp + 8], 0
jne 0x11287e8
push edi
call fcn.01128730
test edi, edi
jne 0x11287f1
mov edi, 0x100356c
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
cmp byte [0x116370c], 0
je 0x1128810
cmp dword [0x1163710], 0
jne 0x112881d
cmp byte [0x116370d], 0
je 0x1128920
push 0x5000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x11289c1
mov ecx, dword [0x1163718]
movzx edx, word [ebp - 0x9a]
movzx eax, word [ebp - 0x9c]
push edi
push 0x20
push ecx
movzx ecx, word [ebp - 0x9e]
push edx
movzx edx, word [ebp - 0xa0]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov eax, dword [0x1163734]
push eax
push 0x1069da4
push 0x2800
push esi
call fcn.01127fa0
add esp, 0x30
cmp byte [ebp + 0x10], 0
je 0x11288c1
mov ecx, 0x2800
mov eax, esi
jmp 0x1128890
cmp word [eax], 0
je 0x11288a0
add eax, 2
sub ecx, 1
jne 0x1128890
jmp 0x11288c1
test ecx, ecx
je 0x11288c1
mov eax, 0x2800
sub eax, ecx
push 0x1059698
mov ecx, 0x2800
sub ecx, eax
push ecx
lea edx, [esi + eax*2]
push edx
call fcn.010733a0
cmp byte [0x116370c], 0
je 0x11288e2
mov eax, dword [0x1163710]
test eax, eax
je 0x11288e2
push esi
push 0x1069d9c
push eax
call fcn.0112b25a
add esp, 0xc
cmp byte [0x116370d], 0
je 0x1128919
lea eax, [ebp - 0x94]
push eax
push 0x2800
push esi
mov dword [ebp - 0x94], 0
call fcn.010eff40
mov ecx, dword [ebp - 0x94]
push ecx
push esi
mov ecx, 0x1163738
call fcn.01127e80
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp byte [0x116370c], 0
je 0x11289c1
test byte [0x1163714], 1
je 0x11289c1
push 0x7e
lea edx, [ebp - 0x8e]
push 0
push edx
mov word [ebp - 0x90], 0
call fcn.01084910
mov eax, dword [0x1163718]
movzx ecx, word [ebp - 0x9a]
movzx edx, word [ebp - 0x9c]
add esp, 0xc
push 0x20
push eax
movzx eax, word [ebp - 0x9e]
push ecx
movzx ecx, word [ebp - 0xa0]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, dword [0x1163734]
push eax
push edx
push 0x1069d6c
lea eax, [ebp - 0x90]
push 0x40
push eax
call fcn.01127fa0
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add esp, 0x2c
lea ecx, [ebp - 0x90]
push ecx
call esi
push edi
call esi
cmp byte [ebp + 0x10], 0
je 0x11289c1
push 0x1059698
call esi
push 0x116371c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 0xc