joyce8/EMBER2024-capa huggingface dataset:
Function at 0x102b43f
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
mov eax, dword [0x1079e94]
mov edx, dword [ebp + 0x10]
and dword [ebp - 0x88], 0
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
and dword [edi], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebx], edx
mov ecx, dword [eax]
cmp ecx, 0x10
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x8c], edi
je 0x102b49d
cmp ecx, 0x20
je 0x102b4a6
mov esi, 0x8000ffff
push esi
push 0x2ee013e
call fcn.01053610
jmp 0x102b600
cmp ecx, 0x20
jne 0x102b55f
lea ecx, [ebp - 0x88]
push ecx
push 0
push 0
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
jne 0x102b4cd
call fcn.0106d6ff
mov esi, eax
push esi
push 0x2f5013e
jmp 0x102b493
xor eax, eax
push eax
push ebx
push eax
push eax
push 1
push eax
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x102b4f5
call fcn.0106d6ff
mov esi, eax
push esi
push 0x305013e
jmp 0x102b493
push dword [ebx]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [edi], eax
jne 0x102b512
mov esi, 0x8007000e
push esi
push 0x30c013e
jmp 0x102b493
mov ecx, dword [ebp + 0x10]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebx]
lea eax, [ebp + 0x10]
push eax
mov eax, dword [ebp - 0x8c]
push dword [eax]
push 0
push 1
push 0
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x102b5fe
call fcn.0106d6ff
mov esi, eax
push esi
push 0x31d013e
jmp 0x102b493
push 0x20
pop ecx
add edx, 8
push edx
lea esi, [eax + 8]
lea edi, [ebp - 0x84]
push 0
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov edi, dword [ebp - 0x8c]
mov dword [edi], eax
jne 0x102b595
mov esi, 0x8007000e
push esi
push 0x331013e
jmp 0x102b493
push ebx
push eax
push dword [ebp - 0x94]
lea eax, [ebp - 0x84]
push eax
call fcn.0106e890
mov esi, eax
test esi, esi
je 0x102b5ba
push esi
push 0x33b013e
jmp 0x102b493
mov eax, dword [ebx]
add eax, dword [edi]
and dword [ebp - 0x90], 0
lea ecx, [ebp - 0x90]
push ecx
push eax
lea eax, [ebp - 0x84]
push eax
call fcn.0106f320
mov esi, eax
test esi, esi
je 0x102b5ea
push esi
push 0x346013e
jmp 0x102b493
mov eax, dword [ebp - 0x90]
add dword [ebx], eax
lea eax, [ebp - 0x84]
push eax
call fcn.010704a0
xor esi, esi
cmp dword [ebp - 0x88], 0
je 0x102b615
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test esi, esi
je 0x102b62f
mov edi, dword [ebp - 0x8c]
mov eax, dword [edi]
test eax, eax
je 0x102b62f
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [edi], 0
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.0104b509
leave
ret 0x14
Function at 0x102c574
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov edx, dword [ebp + 0x14]
mov eax, dword [0x1079e94]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov dword [ebp - 0x28], edx
lea edx, [ebp - 0x1c]
push edx
push 3
push dword [ebp + 0x10]
xor esi, esi
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
inc esi
push esi
push eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], ebx
call dword [sym.imp.CRYPT32.dll_CertAddEncodedCertificateToStore]
test eax, eax
jne 0x102c5d1
call fcn.0106d6ff
mov edi, eax
push edi
push 0x7c2013e
call fcn.01053610
jmp 0x102c6a3
lea eax, [ebp - 0x14]
push eax
call fcn.01053060
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov edi, eax
cmp edi, ebx
je 0x102c5f6
push edi
push 0x7c9013e
jmp 0x102c5c7
mov edx, dword [ebp - 0x18]
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x44]
rep stosd dword es:[edi], eax
mov eax, dword [0x107b23c]
mov edi, dword [ebp + 0x1c]
neg eax
sbb eax, eax
and eax, 0xffffffe0
add eax, 0x20
mov dword [ebp - 0x38], eax
or eax, 8
push eax
push esi
mov ecx, 0x10080b0
push ecx
push edx
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x102c650
call fcn.0106d6ff
mov edi, eax
push edi
push 0x7da013e
jmp 0x102c5c7
lea eax, [ebp - 0x24]
push eax
push esi
push ebx
push dword [ebp + 0x18]
push dword [ebp - 0x28]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x102c67b
call fcn.0106d6ff
mov edi, eax
push edi
push 0x7df013e
jmp 0x102c5c7
lea eax, [ebp - 0x44]
push eax
push ebx
push 2
push dword [ebp - 0x1c]
call dword [sym.imp.CRYPT32.dll_CertSetCertificateContextProperty]
test eax, eax
jne 0x102c6a1
call fcn.0106d6ff
mov edi, eax
push edi
push 0x7e8013e
jmp 0x102c5c7
xor edi, edi
cmp dword [ebp - 0x24], ebx
je 0x102c6b1
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [ebp - 0x20], ebx
je 0x102c6c0
push ebx
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [ebp - 0x18], ebx
je 0x102c6ce
push dword [ebp - 0x18]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 0x1c], ebx
je 0x102c6dc
push dword [ebp - 0x1c]
call dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.0104b509
leave
ret 0x18
Function at 0x103218a
Capabilities:
Get domain controller name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x1079e94]
or dword [ebp - 0x234], 0xffffffff
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x22c], edi
mov dword [esi], edi
jne 0x103223d
lea eax, [ebp - 0x230]
push eax
push ecx
call fcn.0103202f
mov edi, eax
test edi, edi
je 0x10321e5
push edi
push 0x1f90135
jmp 0x10322bf
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x230]
mov dword [ebp - 0x23c], 0x101
push 0
mov dword [ebp - 0x238], 0x10
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
jne 0x103224c
call fcn.0106d6ff
mov edi, eax
push edi
push 0x2090135
jmp 0x10322bf
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
jmp 0x103224e
xor edi, edi
lea eax, [ebp - 0x22c]
push eax
push 0x40000000
push edi
push edi
lea eax, [ebp - 0x24]
push eax
push edi
call dword [sym.imp.NETAPI32.dll_DsGetDcNameW]
mov edi, eax
test edi, edi
je 0x1032275
push edi
push 0x2180135
jmp 0x10322bf
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 0x22c]
push 0
push dword [eax]
call dword [sym.imp.NTDSAPI.dll_DsBindW]
mov edi, eax
test edi, edi
je 0x103229a
push edi
push 0x21d0135
jmp 0x10322bf
mov eax, dword [ebp - 0x22c]
push esi
push ebx
push 1
push dword [eax + 0x1c]
push dword [ebp - 0x234]
call dword [sym.imp.NTDSAPI.dll_DsGetDomainControllerInfoW]
mov edi, eax
test edi, edi
je 0x10322c4
push edi
push 0x2270135
call fcn.01053610
cmp dword [ebp - 0x234], 0xffffffff
je 0x10322da
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.NTDSAPI.dll_DsUnBindW]
cmp dword [ebp - 0x22c], 0
je 0x10322ee
push dword [ebp - 0x22c]
call sub.NETAPI32.dll_NetApiBufferFree
cmp dword [ebp - 0x230], 0
je 0x1032303
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.0104b509
leave
ret 0x10
Function at 0x103580a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
xor edi, edi
lea eax, [ebp + 0x18]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebx], edi
push edi
push dword [ebp + 0xc]
mov dword [ebp + 0x18], edi
push dword [ebp + 8]
call esi
cmp eax, edi
mov dword [ebp - 4], eax
je 0x1035850
push 2
push eax
push 0x6210138
push dword [ebp + 0xc]
call fcn.01053590
jmp 0x10358f3
mov eax, dword [ebp + 0x18]
add eax, 6
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, edi
mov dword [ebx], eax
jne 0x1035879
mov eax, 0x8007000e
push eax
push 0x62a0138
mov dword [ebp - 4], eax
call fcn.01053610
jmp 0x10358f8
lea ecx, [ebp + 0x18]
push ecx
push eax
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
cmp eax, edi
mov dword [ebp - 4], eax
je 0x10358a1
push eax
push 0x6340138
push dword [ebp + 0xc]
call fcn.0105364b
jmp 0x10358f3
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, 1
je 0x10358b0
cmp eax, 7
jne 0x10358eb
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebx]
xor eax, eax
shr edx, 1
lea edi, [ecx + edx*2]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, ecx
cmp word [eax], 0
jne 0x10358ce
cmp word [eax + 2], 0
je 0x10358d2
inc eax
inc eax
jmp 0x10358c1
mov edx, dword [ebp + 0x10]
sub eax, ecx
shr eax, 1
xor ecx, ecx
cmp dword [edx], 1
setne cl
inc ecx
add eax, ecx
shl eax, 1
mov dword [ebp + 0x18], eax
xor edi, edi
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
mov dword [eax], ecx
cmp dword [ebp - 4], edi
je 0x1035907
mov eax, dword [ebx]
cmp eax, edi
je 0x1035907
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebx], edi
push dword [ebp - 4]
call fcn.0106d6ca
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x103cdff
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor esi, esi
push esi
push 0x8000000
push 3
xor eax, eax
push esi
inc eax
push eax
push 0x80000000
push dword [ebp + 8]
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov dword [edi], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [ebp + 0x10], ebx
jne 0x103ce54
call fcn.0106d6ff
mov ebx, eax
push ebx
push 0x1c940139
jmp 0x103ceed
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x103ce73
call fcn.0106d6ff
mov ebx, eax
push ebx
push 0x1c9b0139
jmp 0x103ceed
lea ecx, [ebp - 0x10]
push ecx
push eax
push ebx
call fcn.0103b998
mov ebx, eax
cmp ebx, esi
je 0x103ce8c
push ebx
push 0x1ca10139
jmp 0x103ceed
push esi
push esi
push esi
push dword [ebp + 0x10]
mov dword [edi], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x103ceae
call fcn.0106d6ff
mov ebx, eax
push ebx
push 0x1ca70139
jmp 0x103ceed
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
call fcn.0103c913
mov ebx, eax
cmp ebx, esi
je 0x103ced0
push ebx
push 0x1cad0139
jmp 0x103ceed
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
push dword [ebp + 0x10]
call fcn.0103c64f
mov ebx, eax
cmp ebx, esi
je 0x103cef2
push ebx
push 0x1cb20139
call fcn.01053610
cmp dword [ebp - 0xc], esi
mov edi, dword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
je 0x103cf02
push dword [ebp - 0xc]
call edi
cmp dword [ebp - 0x10], esi
je 0x103cf0c
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 4], esi
je 0x103cf1a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [ebp - 8], esi
je 0x103cf29
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [ebp + 0x10], 0xffffffff
je 0x103cf38
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x1040d1e
Capabilities:
Get hostname
Get session user name

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x1079e94]
push esi
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push 4
mov dword [ebp - 0x208], 0x100
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
mov esi, 0x1003410
jne 0x1040d7b
call fcn.0106d6ff
mov edi, eax
push edi
push 0x63b013a
call fcn.01053610
push edi
push 0x100d080
call fcn.0101c17b
jmp 0x1040d9d
lea eax, [ebp - 0x204]
push eax
push 0x893
call fcn.01052a94
push eax
call fcn.0105b329
push esi
call fcn.0105b329
add esp, 0xc
xor edi, edi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push 2
mov dword [ebp - 0x208], 0x100
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x1040de5
call fcn.0106d6ff
push edi
push 0x64a013a
mov esi, eax
call fcn.01053610
push esi
push 0x100cf8c
call fcn.0101c17b
test edi, edi
jne 0x1040e0b
mov edi, esi
jmp 0x1040e0b
lea eax, [ebp - 0x204]
push eax
push 0x894
call fcn.01052a94
push eax
call fcn.0105b329
push esi
call fcn.0105b329
push esi
call fcn.0105b329
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
call fcn.0104b509
leave
ret
Function at 0x1043b47
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push 0xc
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
test esi, esi
pop ecx
jne 0x1043b70
push 0x8007000e
push 0x9a5013f
call fcn.01053610
jmp 0x1043bf5
push edi
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
push 8
mov dword [esi + 4], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
pop edi
je 0x1043b9e
mov ecx, dword [ebp + 0x10]
mov dword [eax], 0x100d2c8
mov dword [eax + 4], ecx
jmp 0x1043ba0
xor eax, eax
test eax, eax
mov dword [esi + 8], eax
jne 0x1043bb3
push 0x8007000e
push 0x9ae013f
jmp 0x1043bd8
lea eax, [ebp - 4]
push eax
push 0
push esi
push fcn.010438d9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x1043bdf
call fcn.0106d6ff
push eax
push 0x9bb013f
call fcn.01053610
jmp 0x1043be8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
test esi, esi
je 0x1043bf5
push 1
mov ecx, esi
call fcn.010433d8
pop esi
leave
ret 0xc

Function at 0x1043bff
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push 0xc
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
test esi, esi
pop ecx
jne 0x1043c25
push 0x8007000e
push 0x9d6013f
call fcn.01053610
jmp 0x1043ca4
push edi
xor eax, eax
mov edi, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push 8
mov dword [esi], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
test eax, eax
pop ecx
pop edi
je 0x1043c4d
mov ecx, dword [ebp + 0xc]
mov dword [eax], 0x100d2c8
mov dword [eax + 4], ecx
jmp 0x1043c4f
xor eax, eax
test eax, eax
mov dword [esi + 8], eax
jne 0x1043c62
push 0x8007000e
push 0x9de013f
jmp 0x1043c87
lea eax, [ebp - 4]
push eax
push 0
push esi
push fcn.01043406
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
jne 0x1043c8e
call fcn.0106d6ff
push eax
push 0x9eb013f
call fcn.01053610
jmp 0x1043c97
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
test esi, esi
je 0x1043ca4
push 1
mov ecx, esi
call fcn.010433d8
pop esi
leave
ret 8
Function at 0x104b509
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1079e94]
jne 0x104b51a
test ecx, 0xffff0000
jne 0x104b51a
ret
jmp fcn.0104b524

Function at 0x104b609
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x100d918
call fcn.0104b8c0
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
cmp word [0x1000000], 0x5a4d
jne 0x104b652
mov eax, dword [0x100003c]
cmp dword [eax + 0x1000000], 0x4550
jne 0x104b652
movzx ecx, word [eax + 0x1000018]
cmp ecx, 0x10b
je 0x104b66b
cmp ecx, 0x20b
je 0x104b658
and dword [ebp - 0x1c], 0
jmp 0x104b682
cmp dword [eax + 0x1000084], 0xe
jbe 0x104b652
xor ecx, ecx
cmp dword [eax + 0x10000f8], ecx
jmp 0x104b67c
cmp dword [eax + 0x1000074], 0xe
jbe 0x104b652
xor ecx, ecx
cmp dword [eax + 0x10000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
and dword [ebp - 4], 0
push 2
pop esi
push esi
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or edi, 0xffffffff
mov dword [0x107cd60], edi
mov dword [0x107cd64], edi
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x107c668]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x107c664]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x107cd68], eax
call fcn.0104b97c
cmp dword [0x1079ea0], 0
jne 0x104b6e2
push fcn.0104b97c
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0104b965
push 0x10018b0
push 0x10018ac
call sub.msvcrt.dll__initterm
mov eax, dword [0x107c660]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x107c65c]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.msvcrt.dll___wgetmainargs]
mov dword [ebp - 0x38], eax
push 0x10018a8
push 0x10018a0
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
mov eax, dword [eax]
test eax, eax
jne 0x104b747
mov dword [ebp - 4], edi
mov eax, 0xff
jmp 0x104b7f6
mov dword [ebp - 0x20], eax
cmp word [eax], 0x22
jne 0x104b788
add eax, esi
mov dword [ebp - 0x20], eax
mov cx, word [eax]
test cx, cx
je 0x104b763
cmp cx, 0x22
jne 0x104b750
cmp word [eax], 0x22
jne 0x104b76e
add eax, esi
mov dword [ebp - 0x20], eax
mov cx, word [eax]
test cx, cx
je 0x104b77c
cmp cx, 0x20
jbe 0x104b769
test byte [ebp - 0x54], 1
je 0x104b795
movzx ecx, word [ebp - 0x50]
jmp 0x104b798
cmp word [eax], 0x20
jbe 0x104b76e
add eax, esi
mov dword [ebp - 0x20], eax
jmp 0x104b788
push 0xa
pop ecx
push ecx
push eax
push 0
push 0x1000000
call fcn.0101d5e5
mov esi, eax
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x1c], 0
jne 0x104b7b8
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], edi
jmp 0x104b7f4
mov eax, esi
call fcn.0104b8fb
ret
Function at 0x104b9b3
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor esi, esi
push esi
push esi
push 2
push esi
push esi
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 4], esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x104ba0a
call fcn.0106d6ff
push dword [ebp + 8]
mov edi, eax
push edi
push 0x103
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01051e27
push edi
push 0xc900ca
call fcn.01053610
jmp 0x104ba5e
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x104ba4b
call fcn.0106d6ff
push dword [ebp + 8]
mov edi, eax
push edi
push 0x11e
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01051e27
push edi
push 0xd600ca
call fcn.01053610
jmp 0x104ba52
mov dword [ebp - 4], 1
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 4], esi
jne 0x104ba65
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x104dc46
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0x2c]
push ebx
xor eax, eax
push esi
mov esi, dword [ebp + 0x28]
xor ebx, ebx
cmp dword [ebp + 0x14], eax
mov dword [esi], eax
push edi
mov dword [ebp - 4], eax
mov dword [ecx], eax
je 0x104dc68
push 0x20
pop ebx
cmp dword [ebp + 0x1c], eax
je 0x104dc70
or ebx, 0x40
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov eax, ebx
or eax, 0x40
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call edi
mov dword [ebp + 0x28], eax
mov eax, dword [esi]
test eax, eax
je 0x104dc9d
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
and dword [esi], 0
cmp dword [ebp + 0x28], 0
je 0x104dcf5
cmp dword [ebp + 0x24], 0
je 0x104dcdf
mov eax, ebx
or eax, 0x10
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call edi
test eax, eax
jne 0x104dcf5
call fcn.0106d6ff
mov edi, eax
mov eax, dword [ebp + 0x2c]
push edi
mov dword [eax], 0x104
push 0x10fa00ca
call fcn.01053610
jmp 0x104dde6
xor edi, edi
inc edi
push edi
push 0x110000ca
push dword [ebp + 8]
call fcn.0105364b
jmp 0x104dde6
or ebx, 8
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call edi
test eax, eax
jne 0x104dd69
call fcn.0106d6ff
mov edi, eax
mov eax, 0x80090023
cmp edi, eax
jne 0x104dd2a
mov ecx, dword [ebp + 0x2c]
push eax
mov dword [ecx], 0x108
push 0x111500ca
jmp 0x104dcd5
mov eax, 0x800704c7
cmp edi, eax
jne 0x104dd3b
push eax
push 0x111c00ca
jmp 0x104dcd5
mov eax, 0x8009000f
cmp edi, eax
jne 0x104dd55
mov ecx, dword [ebp + 0x2c]
push eax
mov dword [ecx], 0x12b
push 0x112300ca
jmp 0x104dcd5
mov eax, dword [ebp + 0x2c]
push edi
mov dword [eax], 0xfb
push 0x112900ca
jmp 0x104dcd5
cmp dword [ebp + 0x20], 0
je 0x104dd89
push 1
push dword [esi]
call fcn.0105824e
mov edi, eax
test edi, edi
je 0x104dd89
push edi
push 0x113200ca
jmp 0x104dcd5
mov edi, dword [ebp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptGenKey]
lea eax, [ebp - 4]
push eax
shl edi, 0x10
or edi, 1
push edi
push 2
push dword [esi]
call ebx
test eax, eax
jne 0x104dde4
call fcn.0106d6ff
push eax
push 0x113e00ca
call fcn.01053610
lea eax, [ebp - 4]
push eax
and edi, 0xfffffffe
push edi
push 2
push dword [esi]
call ebx
test eax, eax
jne 0x104dde4
call fcn.0106d6ff
mov edi, eax
mov eax, dword [ebp + 0x2c]
push edi
mov dword [eax], 0x109
push 0x114500ca
jmp 0x104dcd5
xor edi, edi
cmp dword [ebp - 4], 0
je 0x104ddf5
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x10f
push edi
push 0x114f
push 0xca
call fcn.01064378
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x28