joyce8/EMBER2024-capa huggingface dataset:
Function at 0x27596480
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x275abecb
mov eax, dword fs:[0]
push eax
mov eax, 0x2010
call fcn.27580a90
mov eax, dword [0x275ba2ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
xor esi, esi
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x27596613
cmp word [eax], bx
je 0x27596613
cmp edi, ebx
je 0x27596613
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x2018], eax
jne 0x2759651d
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x2759650c
call esi
jmp 0x275965d1
call esi
and eax, 0xffff
or eax, 0x80070000
jmp 0x275965d1
mov eax, dword [edi]
mov ecx, dword [eax + 0x14]
push 0
push 0
push ebx
push esi
push edi
call ecx
mov esi, eax
test esi, esi
jne 0x275965c2
mov edx, dword [edi]
mov edx, dword [edx + 0xc]
lea eax, [ebp - 0x2014]
push eax
push 0x2000
lea ecx, [ebp - 0x2010]
push ecx
push edi
call edx
mov esi, eax
test esi, esi
jl 0x275965b0
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [esp]
mov eax, dword [ebp - 0x2014]
test eax, eax
je 0x275965b6
cmp eax, 0x2000
ja 0x275965bd
push 0
lea ecx, [ebp - 0x201c]
push ecx
push eax
mov eax, dword [ebp - 0x2018]
lea edx, [ebp - 0x2010]
push edx
push eax
call ebx
test eax, eax
je 0x275965ef
mov ecx, dword [edi]
mov ecx, dword [ecx + 0xc]
lea edx, [ebp - 0x2014]
push edx
push 0x2000
lea eax, [ebp - 0x2010]
push eax
push edi
call ecx
mov esi, eax
test esi, esi
jge 0x27596560
mov eax, dword [ebp - 0x2014]
cmp eax, 0x2000
jbe 0x275965c2
mov esi, 0x8000ffff
mov edx, dword [ebp - 0x2018]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.2757f388
mov esp, ebp
pop ebp
ret 8
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x27596601
call esi
mov esi, eax
jmp 0x275965c2
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x275965c2
mov eax, 0x80070057
jmp 0x275965d1
Function at 0x27596950
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x275abf10
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x275ba2ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x14], ebx
cmp dword [ecx + 0x6c], ebx
mov dword [ebp - 4], ebx
jne 0x275969a0
mov eax, 0x80048008
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ecx + 0x6c]
mov eax, dword [ecx]
mov edx, dword [eax + 0x30]
call edx
lea ecx, [ebp - 0x10]
push ecx
push 1
push ebx
push eax
push SysReAllocString
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
je 0x27596a13
mov edx, dword [0x275bc8c4]
mov eax, dword [edx + 0xc]
mov ecx, 0x275bc8c4
mov edi, 0x80048251
call eax
add eax, 0x10
mov dword [ebp + 8], eax
lea ecx, [ebp + 8]
push ecx
push esi
mov byte [ebp - 4], 1
call fcn.2759ea40
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov byte [ebp - 4], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x27596a63
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x27596a63
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 0x10]
lea ecx, [ebp + 8]
push ecx
push eax
lea edx, [ebp - 0x10]
push edx
mov dword [eax], ebx
mov eax, dword [0x275b91d8]
push ebx
push eax
push esi
mov dword [ebp + 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x27596a4a
cmp dword [ebp - 0x10], 4
je 0x27596a58
mov eax, 0xd
jmp 0x27596a4c
jle 0x27596a56
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp esi, ebx
je 0x27596a63
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x275973d0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x58], 0
je 0x27597443
mov eax, dword [esi + 0x54]
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x275973ea
call fcn.27596620
jmp 0x275973ec
mov eax, dword [eax]
push 0x3e3
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x27597402
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov edi, dword [esi + 0x54]
test edi, edi
je 0x2759741a
mov ecx, edi
call fcn.275713a0
push edi
call fcn.2757e8ec
add esp, 4
mov dword [esi + 0x54], 0
mov eax, dword [esi + 0x5c]
test eax, eax
pop edi
je 0x2759743c
cmp eax, 0xffffffff
je 0x2759743c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x5c], 0xffffffff
mov dword [esi + 0x58], 0
pop esi
ret
Function at 0x27597e50
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x275ac758
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x275ba2ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x275bc8c4]
mov edx, dword [eax + 0xc]
xor ebx, ebx
mov ecx, 0x275bc8c4
xor esi, esi
mov dword [ebp - 0x20], ebx
call edx
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ebx
mov eax, dword [ebp + 0xc]
cmp eax, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
je 0x27597f00
push 0xffffffffffffffff
push eax
push ebx
lea ecx, [ebp - 0x20]
call fcn.2757d950
test eax, eax
jne 0x27597f00
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x27597ec9
call esi
mov esi, eax
jmp 0x27597ed9
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
call fcn.27595010
test al, al
je 0x27597ef6
push esi
push 0x2752e380
push 0x2752e318
push ebx
call fcn.27595fd0
add esp, 0x10
mov esi, 0x80048006
jmp 0x27597f86
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, ebx
je 0x27597f64
cmp edi, 0x1000
jbe 0x27597f22
mov esi, 0x8000ffff
jmp 0x27597f86
mov ebx, dword [ebp + 0x10]
push edi
mov ecx, ebx
call fcn.2754ea60
mov eax, dword [ebx]
test eax, eax
jne 0x27597f3a
mov esi, 0x8007000e
jmp 0x27597f86
mov edx, dword [ebp + 8]
push eax
push edi
push 0
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x27597f64
mov ecx, dword [ebp + 0x14]
mov ebx, dword [ebx]
lea eax, [ebp - 0x14]
push eax
push ecx
push 0x2750ce98
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x27597f86
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x27597f76
call esi
mov esi, eax
jmp 0x27597f86
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
cmp dword [ebp - 0x20], 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 4], 0xffffffff
je 0x27597fa1
test edi, edi
je 0x27597fac
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test edi, edi
je 0x27597fac
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x27597fcb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x2759edc0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x275acb98
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x275ba2ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x2759ee9a
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x2759ee9a
cmp dword [ebp + 0x14], ebx
je 0x2759ee9a
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.2759dda0
mov esi, eax
cmp esi, ebx
mov ebx, dword [ebp - 0x10]
jl 0x2759ee79
movzx edx, word [ebp + 0x10]
movzx eax, di
push edx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x2759ee56
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x2759ee44
call esi
jmp 0x2759ee77
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x2759ee79
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x2759ee34
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x2759ee34
mov ecx, dword [ebp + 0x14]
push ecx
push eax
call fcn.2759eab0
mov esi, eax
test ebx, ebx
je 0x2759ee84
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x2759f310
Capabilities:
Encrypt data using des via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x275acc30
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x275ba2ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov eax, dword [ecx + 0xc]
lea ecx, [ebp - 0x10]
push ecx
push edi
push edi
push 0x8004
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x2759f36e
call fcn.27539290
mov esi, eax
cmp esi, edi
jl 0x2759f3fb
mov edi, dword [ebp + 8]
cmp dword [edi - 4], 1
mov esi, dword [edi - 0xc]
jle 0x2759f388
mov edx, esi
push edx
lea ecx, [ebp + 8]
call fcn.27539d00
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
push 0
push esi
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x2759f3a5
call fcn.27539290
mov esi, eax
test esi, esi
jl 0x2759f3fe
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x2759f3cb
mov ecx, dword [eax]
test ecx, ecx
je 0x2759f3cb
mov eax, dword [eax + 4]
test eax, eax
je 0x2759f3cb
push 0
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.2754ec80
mov esi, eax
test esi, esi
jl 0x2759f3fe
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x10]
push edx
push 0xc00000
push ecx
push 0x6603
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x2759f3f7
call fcn.27539290
mov esi, eax
jmp 0x2759f3fe
xor esi, esi
jmp 0x2759f3fe
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x2759f413
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [ebp - 0x10], 0
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x2759f436
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x2759f450
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x275acc60
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x275ba2ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov edx, dword [ebp + 0x14]
xor ebx, ebx
test dl, 4
lea eax, [edi + 0x14]
jne 0x2759f48a
lea eax, [edi + 0x10]
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x2759f584
mov ecx, dword [ebp + 0x18]
cmp ecx, ebx
je 0x2759f584
mov eax, dword [eax]
cmp dword [eax - 0xc], 0x40
jne 0x2759f554
mov dword [ebp + 0x14], ebx
mov edx, dword [ebp + 0x10]
lea ecx, [ebp + 0x14]
push ecx
push edx
push ecx
add eax, 0xfffffff0
mov dword [ebp + 0x10], esp
mov esi, esp
push eax
mov dword [ebp - 4], ebx
call fcn.27539d90
add eax, 0x10
add esp, 4
mov ecx, edi
mov dword [esi], eax
call fcn.2759f310
mov esi, eax
cmp esi, ebx
jge 0x2759f502
mov eax, dword [ebp + 0x14]
cmp eax, ebx
je 0x2759f4ec
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebx
push ecx
push edx
lea ecx, [ebp - 0x18]
call fcn.275578b0
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.275485b0
mov esi, eax
cmp esi, ebx
jl 0x2759f542
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + 0x18]
mov edx, dword [ebp - 0x14]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x18]
call fcn.2753a160
lea ecx, [ebp + 0x14]
call fcn.27538c40
jmp 0x2759f4ec
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edx
push ebx
push ebx
push eax
push ecx
push esi
call dword [sym.imp.CRYPT32.dll_CryptProtectData]
test eax, eax
jne 0x2759f59d
call fcn.27539290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x2759f5c0
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x275acc90
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x275ba2ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov edx, dword [ebp + 0x10]
xor ebx, ebx
test dl, 4
lea eax, [edi + 0x14]
jne 0x2759f5fa
lea eax, [edi + 0x10]
mov esi, dword [ebp + 8]
cmp esi, ebx
je 0x2759f6f1
mov ecx, dword [ebp + 0x14]
cmp ecx, ebx
je 0x2759f6f1
mov eax, dword [eax]
cmp dword [eax - 0xc], 0x40
jne 0x2759f6c4
mov dword [ebp + 0x10], ebx
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 0x10]
push ecx
push edx
push ecx
add eax, 0xfffffff0
mov dword [ebp + 0xc], esp
mov esi, esp
push eax
mov dword [ebp - 4], ebx
call fcn.27539d90
add eax, 0x10
add esp, 4
mov ecx, edi
mov dword [esi], eax
call fcn.2759f310
mov esi, eax
cmp esi, ebx
jge 0x2759f672
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x2759f65c
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebx
push ecx
push edx
lea ecx, [ebp - 0x18]
call fcn.275578b0
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.27548680
mov esi, eax
cmp esi, ebx
jl 0x2759f6b2
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x18]
call fcn.2753a160
lea ecx, [ebp + 0x10]
call fcn.27538c40
jmp 0x2759f65c
mov eax, dword [ebp + 0xc]
push ecx
push edx
push ebx
push ebx
push eax
push ebx
push esi
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x2759f70a
call fcn.27539290
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x2759f720
Capabilities:
Generate random numbers via winapi
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x275accc6
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x275ba2ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov ebx, ecx
mov dword [ebp - 0x94], edi
xor eax, eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebx + 0xc]
cmp eax, edi
mov byte [ebp - 4], 1
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xac], edi
jne 0x2759f7b2
call fcn.27595010
test al, al
je 0x2759f7a8
push 0x27535640
push 0x275355e0
push edi
call fcn.27595fd0
add esp, 0xc
mov esi, 0x80070057
jmp 0x2759f8ca
lea ecx, [ebp - 0x50]
push ecx
push 0x40
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x2759f7d2
call fcn.27539290
mov esi, eax
cmp esi, edi
jl 0x2759f8ca
mov ecx, 0x10
mov esi, str._GKP__LL___OTR__GV6_lxzdLL__
lea edi, [ebp - 0x90]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x9c]
push ecx
lea edx, [ebp - 0x50]
push 1
mov dword [ebp - 0xa4], edx
lea edx, [ebp - 0xb0]
lea eax, [ebp - 0x90]
push edx
mov dword [ebp - 0xac], eax
push 0x275355b8
lea eax, [ebp - 0xa8]
push eax
mov ecx, ebx
mov dword [ebp - 0xa8], 0x40
mov dword [ebp - 0xb0], 0x40
call fcn.2759f450
mov esi, eax
test esi, esi
jl 0x2759f8ca
lea ecx, [ebp - 0xb4]
push ecx
lea edx, [ebp - 0xa0]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push 0x27535560
push SysReAllocString
mov dword [ebp - 0xa0], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x2759f8bc
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0x98]
mov eax, dword [ebp - 0xa0]
push ecx
push edx
push 3
push 0
push 0x27535550
push eax
mov dword [ebp - 0x94], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x2759f8bc
mov eax, dword [ebp - 0x9c]
push eax
push 0x27535544
lea ecx, [ebp - 0x94]
call fcn.2759f2c0
test eax, eax
je 0x2759f8ca
jle 0x2759f8c8
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x2759f8db
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x94]
test eax, eax
je 0x2759f8ec
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.2757f388
mov esp, ebp
pop ebp
ret
Function at 0x2759fa20
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x275accf8
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x275ba2ec]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x18], ecx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, dword [ebp + 8]
push ebx
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 0x14]
push edx
mov edx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
xor eax, eax
push edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [edi]
mov edx, dword [eax + 0x44]
push ecx
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], 0x10
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x14], ebx
call edx
mov esi, eax
cmp esi, ebx
jl 0x2759fab7
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0x1c]
jne 0x2759fab7
mov ecx, dword [ebp + 0x20]
push eax
mov eax, dword [ebp - 0x10]
push eax
call fcn.2753d2d0
jmp 0x2759fb5b
mov ecx, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x20]
push ecx
mov ecx, ebx
call fcn.2753d230
mov edx, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xc]
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x2759fafc
call fcn.27539290
mov esi, eax
test esi, esi
jge 0x2759fafc
call fcn.27595010
test al, al
je 0x2759fb5b
push esi
push 0x275357d8
push 0x27535778
jmp 0x2759fb51
mov eax, dword [ebx]
sub eax, 0x10
cmp dword [eax + 0xc], 1
jle 0x2759fb12
mov edx, dword [eax + 4]
push edx
mov ecx, ebx
call fcn.27539d00
mov eax, dword [ebx]
mov ecx, dword [eax - 0xc]
mov edx, dword [edi]
mov edx, dword [edx + 0x48]
push 0
push 1
push 0
push eax
mov eax, dword [ebp + 0x18]
push ecx
mov ecx, dword [ebp + 0x14]
push eax
mov eax, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push eax
push ecx
push edi
call edx
mov esi, eax
test esi, esi
jge 0x2759fb5b
call fcn.27595010
test al, al
je 0x2759fb5b
push esi
push 0x27535718
push 0x275356b8
push 0
call fcn.27595fd0
add esp, 0x10
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x2759fb69
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x275a04f0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 0xc]
cmp dword [ebx], esi
mov dword [ebp - 4], ecx
jae 0x275a0510
pop esi
mov eax, 0xea
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push esi
push eax
push esi
push edi
call fcn.2757e936
add esp, 0x10
push eax
call fcn.27538a90
mov ecx, dword [ebp + 0x18]
mov eax, dword [ecx]
mov edx, dword [ebx]
push edx
mov edx, dword [ebp - 4]
lea ecx, [ebp + 0xc]
push ecx
push edi
push 0
push 1
push eax
mov eax, dword [edx]
push eax
mov dword [ebp + 0xc], esi
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
pop edi
jne 0x275a055c
call fcn.27539290
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [ebp + 0xc]
pop esi
mov dword [ebx], ecx
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x275a06c0
Capabilities:
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x275a06da
mov eax, 0x8004311c
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi + 8]
push edi
mov edi, dword [ebp + 8]
push edi
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
jne 0x275a06f5
mov dword [edi], eax
jmp 0x275a06fb
mov edi, dword [edi]
test edi, edi
jne 0x275a0725
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x275a0711
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
call esi
and eax, 0xffff
pop edi
or eax, 0x80070000
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
lea eax, [ebp + 8]
push eax
push 4
push edi
mov dword [ebp + 8], 1
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x275a0746
call fcn.27539290
jmp 0x275a0748
xor eax, eax
test eax, eax
jl 0x275a0797
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 4]
push edi
push 0
push eax
push 0x8009
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x275a0772
call fcn.27539290
test eax, eax
jl 0x275a0797
mov ecx, dword [esi + 0x14]
xor eax, eax
push eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
push edx
mov dword [ebp - 0x14], ecx
push 5
mov ecx, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call fcn.2754ecb0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8