joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004b473
Capabilities:
Get number of processors

Disassembly:
jmp 0x1003f794
call fcn.1003f77f
salc
arpl word [ebp - 0x79], cx
loop 0x1003f78a
adc eax, 0x24748b56
add al, 0x8d
mov dh, 0xd4
adc byte [edx], al
add byte [ecx + 0x5e042474], cl
push edx
mov dword [esp], ebp
push esp
pop ebp
push ebp
mov ebp, esp
add ebp, 4
sub ebp, 0x80
xchg dword [esp], ebp
pop esp
sub esp, 4
mov dword [esp], ebx
push edi
mov dword [esp], esi
push 0x188b
mov dword [esp], edi
jmp 0x100653b3
push ebx
mov ebx, 8
add ebx, ebp
mov eax, dword [ebx]
pop ebx
sub esp, 4
mov dword [esp], eax
jmp 0x1005e1dd
jmp 0x1004a476
push 0
push 0x41797261
push 0x7262694c
push 0x64616f4c
lea ecx, [ebp - 0x2c]
sub esp, 4
mov dword [esp], ecx
jmp 0x10059856
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x1983f]
mov dword [esp + 4], ecx
pop ecx
jmp 0x10061e32
jmp 0x1005986d
call fcn.10059858
adc byte [eax - 0x77], dl
loopne 0x1005987c
add al, 0
add byte [eax], al
add eax, 4
xchg dword [esp], eax
pop esp
rol byte [edi + eax*4], 4
and al, 0x5c
push eax
pop dword [ebp - 4]
push ecx
mov ecx, 0xc
add ecx, ebp
mov eax, dword [ecx]
pop ecx
push esi
mov dword [esp], eax
push dword [ebp - 4]
sub dword [esp], 0x3f8325ed
pop ecx
add ecx, 0x3f8325ed
push esi
mov dword [esp], ecx
push eax
mov eax, 8
add eax, ebp
mov edx, dword [eax]
pop eax
push eax
mov eax, 0x64
add edx, eax
pop eax
push ebx
mov dword [esp], edx
jmp 0x1003f77d
jmp 0x1005e1f4
call fcn.1005e1df
or eax, dword [ebp + 0x68]
mov byte [eax], 0
jmp 0x1003fbce
push esi
mov esi, 0x6114390f
xor esi, 0x61143917
mov eax, esi
pop esi
mov eax, dword fs:[eax]
push eax
pop dword [ebp - 4]
push dword [ebp - 4]
pop eax
push dword [eax + 0x30]
sub dword [esp], 0x63f80c4b
pop ecx
add ecx, 0x63f80c4b
push eax
mov eax, 0xfffffff8
add eax, ebp
mov dword [eax], ecx
pop eax
push dword [ebp - 8]
pop edx
push ecx
mov ecx, 8
add ecx, edx
mov eax, dword [ecx]
pop ecx
push edx
mov edx, 0xffffffec
add edx, ebp
mov dword [edx], eax
pop edx
push ebx
mov ebx, 0
mov dword [ebp - 0x10], ebx
pop ebx
cmp dword [ebp - 0x10], 0
je 0x10040698
jmp 0x10041265

Function at 0x1006a6f2
Capabilities:
Access peb ldr_data

Disassembly:
push eax
mov eax, dword [esp + 4]
lea eax, [eax - 0x4e23]
mov dword [esp + 4], eax
pop eax
jmp 0x10059a70

Function at 0x10246438
Capabilities:
Encode data using xor

Disassembly:
sub esp, 4
mov dword [esp], ecx
cmp eax, 0x1000
lea ecx, [esp + 8]
jb 0x10246496
jmp 0x10246455
push ebx
mov ebx, 0x1000
sub ecx, ebx
pop ebx
push esi
mov esi, 0x42603735
add esi, 0x62b848ad
not esi
xor esi, 0xa3b2af6
xor esi, 0x5731f4a
shr esi, 4
xor esi, 0x55aeb5a
sub eax, esi
pop esi
test dword [ecx], eax
cmp eax, 0x1000
jae 0x10246455
jmp 0x10246496
sub ecx, 0x42861a21
sub ecx, eax
add ecx, 0x42861a21
push esp
pop eax
test dword [ecx], eax
mov esp, ecx
push dword [eax]
pop ecx
push dword [eax + 4]
xor dword [esp], 0x1d9f7243
pop eax
xor eax, 0x1d9f7243
push ecx
mov dword [esp], eax
ret
Function at 0x484cf1
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x484a08
mov ebx, ebx
call fcn.00484d21
or ebx, edx
dec edx
sub edx, 1
xor dword [edi], eax
or ebx, ebx
sub ebx, edx
add edi, 2
add edx, edx
cmp edi, esi
jl fcn.00484cf1
sub edx, 0xb2a7a224
ret
Function at 0x1003f0e
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x1013750
call fcn.01013630
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x2c], ebx
je 0x1003f33
xor eax, eax
cmp dword [esi + 0x30], ebx
sete al
jmp 0x1004045
push edi
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x18]
call fcn.01003bec
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
inc dword [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.01012eac
cmp dword [esi + 0x2c], ebx
jne 0x100401c
push 0x1001638
mov dword [esi + 0x30], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esi + 0x30], eax
je 0x1003fe8
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001654
push eax
call edi
push 0x1001668
push dword [esi + 0x30]
mov dword [esi + 0x34], eax
call edi
push 0x100167c
push dword [esi + 0x30]
mov dword [esi + 0x38], eax
call edi
push 0x100168c
push dword [esi + 0x30]
mov dword [esi + 0x3c], eax
call edi
push 0x100169c
push dword [esi + 0x30]
mov dword [esi + 0x40], eax
call edi
push 0x10016b4
push dword [esi + 0x30]
mov dword [esi + 0x44], eax
call edi
push 0x10016c8
push dword [esi + 0x30]
mov dword [esi + 0x48], eax
call edi
push 0x10016dc
push dword [esi + 0x30]
mov dword [esi + 0x4c], eax
call edi
push 0x10016f4
push dword [esi + 0x30]
mov dword [esi + 0x50], eax
call edi
mov dword [esi + 0x54], eax
mov eax, dword [esi + 0x30]
cmp eax, ebx
je 0x1004010
cmp dword [esi + 0x38], ebx
je 0x1004002
cmp dword [esi + 0x4c], ebx
je 0x1004002
cmp dword [esi + 0x3c], ebx
je 0x1004002
xor edi, edi
jmp 0x1004013
cmp eax, ebx
je 0x1004010
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x30], ebx
xor edi, edi
inc edi
mov dword [esi + 0x2c], 1
jmp 0x1004026
xor eax, eax
cmp dword [esi + 0x30], ebx
sete al
mov edi, eax
cmp dword [ebp - 0x18], ebx
jbe 0x1004036
mov ecx, dword [ebp - 0x14]
dec dword [ebp - 0x18]
call fcn.01012ec1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.01003c08
mov eax, edi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x1004053
Capabilities:
Link many functions at runtime

Disassembly:
mov eax, 0x1013750
call fcn.01013630
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x58], ebx
je 0x1004078
xor eax, eax
cmp dword [esi + 0x5c], ebx
sete al
jmp 0x100417c
push edi
lea eax, [esi + 4]
push eax
lea ecx, [ebp - 0x18]
call fcn.01003bec
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
inc dword [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.01012eac
cmp dword [esi + 0x58], ebx
jne 0x1004153
push 0x100170c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esi + 0x5c], eax
je 0x1004110
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1001724
push eax
call edi
push 0x1001734
push dword [esi + 0x5c]
mov dword [esi + 0x60], eax
call edi
push 0x1001744
push dword [esi + 0x5c]
mov dword [esi + 0x64], eax
call edi
push 0x1001754
push dword [esi + 0x5c]
mov dword [esi + 0x68], eax
call edi
push 0x1001768
push dword [esi + 0x5c]
mov dword [esi + 0x6c], eax
call edi
push 0x1001780
push dword [esi + 0x5c]
mov dword [esi + 0x70], eax
call edi
push 0x1001798
push dword [esi + 0x5c]
mov dword [esi + 0x74], eax
call edi
mov dword [esi + 0x78], eax
mov eax, dword [esi + 0x5c]
cmp eax, ebx
je 0x1004147
cmp dword [esi + 0x60], ebx
je 0x1004139
cmp dword [esi + 0x68], ebx
je 0x1004139
cmp dword [esi + 0x6c], ebx
je 0x1004139
cmp dword [esi + 0x70], ebx
je 0x1004139
cmp dword [esi + 0x74], ebx
je 0x1004139
cmp dword [esi + 0x78], ebx
je 0x1004139
xor edi, edi
jmp 0x100414a
cmp eax, ebx
je 0x1004147
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi + 0x5c], ebx
xor edi, edi
inc edi
mov dword [esi + 0x58], 1
jmp 0x100415d
xor eax, eax
cmp dword [esi + 0x5c], ebx
sete al
mov edi, eax
cmp dword [ebp - 0x18], ebx
jbe 0x100416d
mov ecx, dword [ebp - 0x14]
dec dword [ebp - 0x18]
call fcn.01012ec1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.01003c08
mov eax, edi
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x10042a7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push 0x1001888
push SysReAllocString
mov dword [ebp - 4], 0x80004005
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x100435f
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push 0x1001864
push dword [ebp - 0x10]
mov dword [ebp - 8], ebx
call edi
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x1004340
cmp dword [ebp - 0xc], eax
je 0x1004340
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
push 0x1001848
push dword [ebp - 0x10]
mov dword [ebp - 8], ebx
call edi
mov esi, eax
test esi, esi
jne 0x1004331
cmp dword [ebp - 0xc], eax
jne 0x100434c
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
mov dword [eax], 2
jmp 0x100434c
mov ecx, dword [ebp + 8]
mov dword [ecx], 1
mov dword [ebp - 4], eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
pop edi
pop ebx
je 0x1004370
test esi, esi
jle 0x100436d
and esi, 0xffff
or esi, 0x80070000
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop esi
leave
ret 4

Function at 0x10043a3
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x2001f
xor edi, edi
push edi
push 0x1001888
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x100442b
mov eax, dword [ebp + 8]
dec eax
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
je 0x10043ee
dec eax
push 1
pop ecx
je 0x10043eb
dec eax
dec eax
je 0x10043e8
push 0x57
pop esi
jmp 0x1004422
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
push 4
lea eax, [ebp - 8]
push eax
push 4
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x1001864
push dword [ebp - 4]
call edi
mov esi, eax
test esi, esi
jne 0x1004422
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push esi
push 0x1001848
push dword [ebp - 4]
call edi
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jle 0x100443b
and esi, 0xffff
or esi, 0x80070000
pop edi
mov eax, esi
pop esi
leave
ret 4
Function at 0x1004cd8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x10171b0]
push ebx
push esi
push edi
push 0x10013e0
xor edi, edi
push edi
push edi
lea ecx, [ebp - 0x80]
mov dword [ebp + 0x194], eax
call fcn.01004750
push 0xffffffffffffffff
lea ecx, [ebp - 0x80]
call fcn.0100479a
mov ebx, dword [ebp + 0x1a4]
cmp ebx, edi
je 0x1004d9e
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1004d9e
lea eax, [ebp - 0x70]
push eax
push 0x10008
push edi
push ebx
push dword [ebp + 0x1a0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x1004da3
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push edi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, 0x103
je 0x1004d84
cmp esi, edi
jne 0x1004d93
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x70]
call fcn.01004cd8
mov esi, eax
cmp esi, edi
je 0x1004d45
jmp 0x1004d93
push ebx
push dword [ebp + 0x1a0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov esi, eax
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1004da3
mov esi, 0x3f2
lea ecx, [ebp - 0x80]
call fcn.010047c3
lea ecx, [ebp - 0x80]
call fcn.01004775
mov ecx, dword [ebp + 0x194]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.0101204b
add ebp, 0x198
leave
ret 8
Function at 0x1004dcd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x10171b0]
push ebx
push esi
push edi
push 0x10013e0
xor esi, esi
push esi
push esi
lea ecx, [ebp - 0x80]
mov dword [ebp + 0x2a4], eax
call fcn.01004750
push 0xffffffffffffffff
lea ecx, [ebp - 0x80]
call fcn.0100479a
lea eax, [ebp - 0x6c]
push eax
mov edi, 0x20019
push edi
push esi
push dword [ebp + 0x2d4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push dword [ebp + 0x2b0]
call esi
test eax, eax
jne 0x1004ebc
mov ebx, dword [sym.imp.ole32.dll_StringFromGUID2]
push 0x102
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp + 0x2b4]
push eax
call ebx
push 0x81
lea eax, [ebp + 0x1a0]
push eax
lea eax, [ebp + 0x2c4]
push eax
call ebx
lea eax, [ebp - 0x68]
push eax
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x6c]
call esi
test eax, eax
jne 0x1004eb3
lea eax, [ebp - 0x70]
push eax
push edi
push ebx
lea eax, [ebp + 0x1a0]
push eax
push dword [ebp - 0x68]
call esi
test eax, eax
jne 0x1004eaa
lea eax, [ebp - 0x74]
push eax
push dword [ebp + 0x2d8]
mov dword [ebp - 0x74], 4
push ebx
push 0x10
push 0x1001a14
push ebx
push dword [ebp - 0x70]
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
je 0x1004ec0
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
jmp 0x1004ed8
push dword [ebp - 0x6c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x70]
call esi
push dword [ebp - 0x68]
call esi
xor esi, esi
inc esi
lea ecx, [ebp - 0x80]
call fcn.010047c3
lea ecx, [ebp - 0x80]
call fcn.01004775
mov ecx, dword [ebp + 0x2a4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.0101204b
add ebp, 0x2a8
leave
ret 0x2c
Function at 0x1004f02
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2a4]
sub esp, 0x324
mov eax, dword [0x10171b0]
push esi
push edi
push 0x10013e0
push 0
push 0
lea ecx, [ebp - 0x80]
mov dword [ebp + 0x2a0], eax
call fcn.01004750
push 0xffffffffffffffff
lea ecx, [ebp - 0x80]
call fcn.0100479a
lea eax, [ebp - 0x70]
push eax
mov edi, 0x2001f
push edi
push dword [ebp + 0x2d0]
push dword [ebp + 0x2ac]
call fcn.010049f0
test eax, eax
jne 0x1004fe4
mov esi, dword [sym.imp.ole32.dll_StringFromGUID2]
push 0x102
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x2b0]
push eax
call esi
push 0x81
lea eax, [ebp + 0x19c]
push eax
lea eax, [ebp + 0x2c0]
push eax
call esi
lea eax, [ebp - 0x6c]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x70]
call fcn.010049f0
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x1004fdf
lea eax, [ebp - 0x74]
push eax
push edi
lea eax, [ebp + 0x19c]
push eax
push dword [ebp - 0x6c]
call fcn.010049f0
test eax, eax
jne 0x1004fda
push 4
lea eax, [ebp + 0x2d4]
push eax
push 4
push 0
push 0x1001a14
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1004fe8
push dword [ebp - 0x6c]
call esi
push dword [ebp - 0x70]
call esi
xor esi, esi
jmp 0x1005000
push dword [ebp - 0x70]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x74]
call esi
push dword [ebp - 0x6c]
call esi
xor esi, esi
inc esi
lea ecx, [ebp - 0x80]
call fcn.010047c3
lea ecx, [ebp - 0x80]
call fcn.01004775
mov ecx, dword [ebp + 0x2a0]
pop edi
mov eax, esi
pop esi
call fcn.0101204b
add ebp, 0x2a4
leave
ret 0x2c
Function at 0x1005029
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x10171b0]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 8
pop ecx
push 0xf0000000
push 0x18
push 0x1001a30
xor ebx, ebx
mov dword [ebp - 4], eax
push ebx
lea eax, [ebp - 0x3c]
mov byte [ebp - 0x30], cl
mov byte [ebp - 0x2f], 2
mov word [ebp - 0x2e], bx
mov dword [ebp - 0x2c], 0x6610
mov dword [ebp - 0x28], 0x20
lea edi, [ebp - 0x24]
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1005115
lea eax, [ebp + 0xc]
push eax
push ebx
push ebx
push 0x2c
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
xor edi, edi
test eax, eax
je 0x1005109
mov esi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push ebx
lea eax, [ebp - 0x34]
push eax
push 4
push dword [ebp + 0xc]
inc edi
mov dword [ebp - 0x34], edi
call esi
test eax, eax
jne 0x10050b8
xor edi, edi
jmp 0x1005100
push ebx
lea eax, [ebp - 0x34]
push eax
push 3
push dword [ebp + 0xc]
mov dword [ebp - 0x34], edi
call esi
test eax, eax
je 0x10050b4
mov esi, dword [ebp + 8]
mov eax, dword [esi + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [esi + 4]
cmp eax, ebx
jne 0x10050e0
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
lea ecx, [ebp - 0x38]
push ecx
push eax
push ebx
push edi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x10050b4
push dword [ebp - 0x38]
mov ecx, esi
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::resize_unsigned_int_]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push ebx
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101204b
leave
ret 8
Function at 0x1005124
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x10171b0]
push esi
push 0xf0000000
xor esi, esi
push 0x18
push esi
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x41c]
push eax
mov dword [ebp - 0x424], 0x20
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x418], esi
mov byte [ebp - 0x14], 0x84
mov byte [ebp - 0x13], 0xb8
mov byte [ebp - 0x12], 0x2f
mov byte [ebp - 0x11], 0xd0
mov byte [ebp - 0x10], 0x24
mov byte [ebp - 0xf], 0xb5
mov byte [ebp - 0xe], 0x1b
mov byte [ebp - 0xd], 0x8c
mov byte [ebp - 0xc], 0xed
mov byte [ebp - 0xb], 0x84
mov byte [ebp - 0xa], 0x8a
mov byte [ebp - 9], 0x1f
mov byte [ebp - 8], 0x57
mov byte [ebp - 7], 0xb0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x100528f
push ebx
push edi
lea eax, [ebp - 0x418]
push eax
push esi
push esi
push 0x800c
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x10051cb
xor edi, edi
jmp 0x100527e
mov edi, dword [sym.imp.ADVAPI32.dll_CryptHashData]
push esi
push 0xe
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x418]
call edi
test eax, eax
jne 0x10051eb
xor edi, edi
jmp 0x1005272
push 0x1001a9c
push dword [ebp + 8]
mov dword [ebp - 0x420], esi
call dword [sym.imp.msvcrt.dll__wfopen]
mov ebx, eax
cmp ebx, esi
pop ecx
pop ecx
je 0x1005252
push ebx
push 0x400
lea eax, [ebp - 0x414]
push 1
push eax
call dword [sym.imp.msvcrt.dll_fread]
add esp, 0x10
cmp eax, esi
jbe 0x100524a
add dword [ebp - 0x420], eax
push esi
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
call edi
test eax, eax
je 0x100529c
cmp dword [ebp - 0x420], 0x1000
jb 0x1005207
push ebx
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
push esi
lea eax, [ebp - 0x424]
push eax
push dword [ebp + 0xc]
push 2
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
xor edi, edi
test eax, eax
je 0x1005272
inc edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.0101204b
leave
ret 8
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push ebx
call dword [sym.imp.msvcrt.dll_fclose]
pop ecx
xor eax, eax
jmp 0x100528d
Function at 0x10054bd
Capabilities:
Delete file
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x10171b0]
mov dword [ebp + 0x3a0], eax
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push 0
push 0x1001ae0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x80], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1005559
push edi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push 0x10000002
push 0x1001ac4
push 0
push dword [ebp - 0x7c]
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
push dword [ebp - 0x7c]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x1005559
push 0x104
lea eax, [ebp + 0x194]
push eax
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp + 0x3ac]
lea eax, [ebp + 0x194]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x100555d
xor eax, eax
jmp 0x100556d
lea eax, [ebp + 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x3a0]
call fcn.0101204b
add ebp, 0x3a4
leave
ret 4
Function at 0x1005853
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 4
pop ebx
xor esi, esi
push 0x10013e0
push esi
push esi
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.01004750
push 0xffffffffffffffff
lea ecx, [ebp - 0x20]
call fcn.0100479a
push 1
mov edi, 0x2001f
push edi
push 2
call fcn.01004a79
cmp eax, esi
mov dword [ebp - 0xc], eax
je 0x1005964
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push esi
mov esi, 0x1001b28
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
neg ecx
sbb ecx, ecx
mov edx, eax
and ecx, 0x40
neg edx
sbb edx, edx
and edx, 8
or ecx, edx
neg eax
sbb eax, eax
and eax, 2
or ecx, eax
mov eax, dword [ebp - 4]
and eax, 0xffffffb0
push ebx
or ecx, eax
lea eax, [ebp - 4]
push eax
push ebx
push 0
push esi
push dword [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], ecx
call esi
push dword [ebp - 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
lea eax, [ebp - 8]
push eax
push edi
push 0
push 0x1001960
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1005959
cmp dword [ebp + 8], eax
je 0x1005944
mov edi, 0x10019c0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push edi
push 2
push 0
push 0x1002238
push dword [ebp - 8]
call esi
jmp 0x1005952
push 0x1002238
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 8]
call ebx
jmp 0x1005961
push dword [ebp + 8]
call fcn.01013382
xor esi, esi
inc esi
lea ecx, [ebp - 0x20]
call fcn.010047c3
lea ecx, [ebp - 0x20]
call fcn.01004775
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x100597d
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x10171b0]
mov dword [ebp + 0x190], eax
lea eax, [ebp - 0x7c]
push eax
push 0x2001f
push 0
push 0x1001960
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1005a20
push edi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push 0x10000002
mov edi, 0x1002238
push edi
push 0
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], 0x208
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x1005a16
push 0x1001b44
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1005a16
push esi
mov esi, 0x10019c0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push esi
push 2
push 0
push edi
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp + 0x190]
xor eax, eax
inc eax
call fcn.0101204b
add ebp, 0x194
leave
ret