joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403c83
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xd8
mov eax, 0x4555ba
call fcn.00436a25
mov ebx, ecx
mov dword [ebp - 0xc4], ebx
lea eax, [ebp - 0xc8]
mov dword [ebp - 0xc4], ebx
push eax
xor edi, edi
lea eax, [ebp - 0xc4]
push edi
push eax
push 0x10002
push str.version
push str.SoftwareNVIDIA_CorporationGlobalGFExperience
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc4], edi
mov dword [ebp - 0xc8], edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x403dfc
mov esi, dword [ebp - 0xc8]
mov eax, SysReAllocString
shr esi, 1
inc esi
mov dword [ebp - 0xd4], edi
mov dword [ebp - 0xd0], edi
mov dword [ebp - 0xcc], edi
cmp esi, eax
ja 0x403e39
push esi
lea ecx, [ebp - 0xd4]
lfence
call fcn.004080e3
mov edi, eax
lea eax, [esi + esi]
push eax
push 0
push edi
lea esi, [eax + edi]
mov dword [ebp - 0xd4], edi
mov dword [ebp - 0xcc], esi
call fcn.004383b0
add esp, 0xc
mov dword [ebp - 0xd0], esi
lea eax, [ebp - 0xc8]
mov dword [ebp - 4], 2
push eax
push edi
lea eax, [ebp - 0xc4]
push eax
push 0x10002
push str.version
push str.SoftwareNVIDIA_CorporationGlobalGFExperience
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x403dad
mov edx, eax
lea ecx, [ebp - 0x58]
call fcn.00401261
push eax
mov edx, str.RegGetValue_failed_with
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x70]
call fcn.004093ec
pop ecx
push eax
lea ecx, [ebp - 0xe4]
mov byte [ebp - 4], 4
call fcn.004012c8
push 0x474330
lea eax, [ebp - 0xe4]
jmp 0x403e33
lea ecx, [ebp - 0xc0]
call fcn.0040543a
xor ecx, ecx
mov byte [ebp - 4], 5
mov eax, edi
cmp word [edi], cx
je 0x403dcd
add eax, 2
cmp word [eax], cx
jne 0x403dc5
push eax
push edi
push ebx
lea ecx, [ebp - 0xc0]
call fcn.004072b8
lea ecx, [ebp - 0xc0]
call fcn.00405418
sub esi, edi
and esi, 0xfffffffe
push esi
push edi
call fcn.00409d69
pop ecx
pop ecx
mov eax, ebx
call fcn.004369cf
ret
mov edx, eax
lea ecx, [ebp - 0x28]
call fcn.00401261
push eax
mov edx, str.RegGetValue_failed_with
mov dword [ebp - 4], edi
lea ecx, [ebp - 0x40]
call fcn.004093ec
pop ecx
push eax
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 1
call fcn.004012c8
push 0x474330
lea eax, [ebp - 0xd4]
push eax
call fcn.00437835
call fcn.0040a0f2
int3
Function at 0x40be83
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0x2f0
mov eax, 0x455eb4
call fcn.00436a25
mov esi, ecx
mov dword [ebp - 0x238], esi
xor edi, edi
lea eax, [ebp - 0x21c]
push 0x20a
mov dword [ebp - 4], edi
push edi
mov dword [ebp - 0x240], esi
push eax
mov dword [ebp - 0x23c], edi
call fcn.004383b0
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push edi
push edi
push 0x26
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x40bf1d
lea eax, [ebp - 0x21c]
mov ecx, esi
push eax
call fcn.004059e5
mov dword [ebp - 4], edi
mov ecx, esi
push str.NVIDIA_CorporationNvTelemetryNvTelemetryAPI
mov dword [ebp - 0x23c], 1
call fcn.00407d34
push 0x468b94
mov ecx, esi
call fcn.00407d34
push str..dll
mov ecx, esi
call fcn.00407d34
mov eax, esi
call fcn.004369cf
ret
push 0xb0
lea eax, [ebp - 0x2fc]
mov dword [ebp - 0x238], 0xc4
push edi
push eax
call fcn.004383b0
add esp, 0xc
lea ecx, [ebp - 0x2fc]
call fcn.0040be68
lea ecx, [ebp - 0x234]
mov dword [ebp - 4], 1
push ecx
push 0x468c30
lea ecx, [ebp - 0x238]
push ecx
push 0x468c2c
push str..._common_NvTelemetryClient.cpp
sub esp, 0xc
mov ecx, eax
call fcn.0041c6ad
mov ecx, eax
call fcn.0041c6c3
mov ecx, eax
call fcn.0041c6d9
mov ecx, eax
call fcn.0041c67b
mov ecx, eax
call fcn.0041c67b
mov ecx, eax
call fcn.0041c6ef
mov ecx, eax
call fcn.0041c67b
mov ecx, eax
call fcn.0040bbff
lea eax, [ebp - 0x234]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x24c]
call fcn.004012c8
push 0x474330
lea eax, [ebp - 0x24c]
push eax
call fcn.00437835
int3
Function at 0x442c5b
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
xor edi, edi
lea ecx, [ebp - 0x28]
push edi
call fcn.0043acf9
mov eax, dword [ebp - 0x24]
mov esi, 0x164
mov dword [ebp - 0x10], edi
mov edx, edi
mov dword [ebp - 8], edi
mov ecx, dword [eax + 0x9c]
mov eax, edi
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], eax
cmp edx, 1
jne 0x442cbf
push esi
call fcn.00446e5e
mov dword [ebp - 0xc], eax
pop ecx
test eax, eax
je 0x443335
push esi
push edi
push eax
call fcn.004383b0
mov eax, dword [ebp - 0xc]
add esp, 0xc
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], esi
mov esi, 0x164
mov edx, edi
mov dword [ebp - 0x14], eax
sub dword [ebp - 0x14], ecx
mov ebx, ecx
mov dword [ebp - 0x18], edx
cmp dword [ebp - 8], 1
jne 0x442cf7
lea ecx, [eax + esi]
mov eax, dword [ebp - 0x14]
mov dword [eax + ebx], ecx
push dword [ebx]
mov eax, dword [ebp - 0x10]
sub eax, esi
push eax
push ecx
call fcn.00445dc6
add esp, 0xc
invalid
Function at 0x443c08
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub edi, dword [edi]
dec ebx
and byte [ebp - 0x544], 0
push 0
call dword [ebp - 0x340]
mov dword [ebp + 8], eax
push 0x104
lea eax, [ebp - 0x334]
push eax
push 0
call dword [ebp - 0x538]
call fcn.00442d7c
or esi, dword [edx + ecx*4]
stosd dword es:[edi], eax
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00442d5a
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00442d8c
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00442d41
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00442d7c
pop edx
in eax, 0x64
or ch, byte [eax + 4]
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid

Function at 0x444d28
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
je 0x444d5f
lea eax, [ebp - 0x714]
push eax
call fcn.00442d8c
pop ecx
push eax
push dword [ebp - 0x3a4]
push dword [ebp + 0x14]
call fcn.00442d41
add esp, 0xc
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
jne 0x444d5f
jmp 0x44471e
cmp dword [ebp - 0x37c], 0
je 0x444d6d
jmp 0x444e22

Function at 0xdffff8
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe00002
pushal
call 0xe00008
pop ebp
sub ebp, 0x10
sub ebp, 0x9ffff8
jmp 0xe0001e
mov eax, 0x9ffff8
add eax, ebp
add eax, 0x4c
mov ecx, 0x5ad
mov edx, 0xe1427712
xor byte [eax], dl
inc eax
dec ecx
jne 0xe00035
jmp 0xe00048
cdq
fistp word [ecx + 0x12122e9b]
adc dl, byte [ebx + 0x1212ead3]
adc dl, byte [ecx]
fild qword [edx + 0x1212121a]
test al, 0x3a
adc dl, byte [edx]
adc ah, ch
invalid
Function at 0x4066f4
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x25c
push ebx
mov ebx, dword [esp + 0x268]
push esi
mov esi, dword [esp + 0x268]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.00406613
mov dword [esp + 0x14], eax
test bl, 8
je 0x406736
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x429dc8], eax
jmp 0x4068b5
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x14], ebp
je 0x406753
test eax, eax
je 0x4068a4
test bl, 2
je 0x40686d
push esi
push 0x425248
call fcn.00406af5
test ebp, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x406776
push 0x408960
push 0x425248
call ebp
jmp 0x40677c
push esi
call fcn.00406ceb
xor eax, eax
cmp word [esi], ax
jne 0x40678d
cmp word [0x425248], 0x5c
jne 0x406795
push 0x4082b0
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push 0x425248
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x406856
push 0x2e
pop eax
cmp word [esp + 0x48], ax
jne 0x4067df
cmp word [esp + 0x4a], 0
je 0x406838
cmp word [esp + 0x4a], ax
jne 0x4067df
cmp word [esp + 0x4c], 0
je 0x406838
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x14]
call fcn.00406af5
test byte [esp + 0x1c], 0x10
je 0x406806
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x406838
push ebx
push esi
call fcn.004066f4
jmp 0x406838
push edi
push esi
call fcn.00406560
test eax, eax
jne 0x406830
test edi, edi
je 0x406828
push esi
push 0xfffffffffffffff1
call fcn.00405d15
xor eax, eax
push eax
push esi
call fcn.00406218
jmp 0x406838
inc dword [0x429dc8]
jmp 0x406838
push esi
push 0xfffffffffffffff2
call fcn.00405d15
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x4067c1
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x14], 0
je 0x4068b4
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax - 2], cx
cmp dword [esp + 0x18], ecx
je 0x4068a4
push esi
call fcn.004065aa
test eax, eax
je 0x4068b4
push esi
call fcn.00406531
mov eax, edi
or eax, 1
push eax
push esi
call fcn.00406560
test eax, eax
jne 0x4068ac
test edi, edi
je 0x4068a4
push esi
push 0xfffffffffffffff1
call fcn.00405d15
xor eax, eax
push eax
push esi
call fcn.00406218
jmp 0x4068b4
inc dword [0x429dc8]
jmp 0x4068b4
push esi
push 0xffffffffffffffe5
call fcn.00405d15
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x25c
ret 8

Function at 0x4068f6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc
Function at 0x4029a4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x405008], 0x8088405
inc edx
mov dword [ebx + 0x405008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40348c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x405010]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403524
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403504
xor eax, eax
push ebp
push 0x4034fd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403540
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403504
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x405010]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x405010], ax
mov esp, ebp
pop ebp
ret

Function at 0x403b6c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x406034], 0
je 0x403bcd
cmp word [0x406208], 0xd7b2
jne 0x403b95
cmp dword [0x406210], 0
jbe 0x403b95
mov eax, 0x406204
call dword [0x406220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x405088
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403bf4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x40501c], 0
jne 0x403be9
push 0
push 0x405080
push 0x405088
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x403f84
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403fea
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403db8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402bf0
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403fd4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403ff1
lea eax, [ebp - 0x10]
call fcn.00403ce8
ret
Function at 0x100443d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x100443df
pop dword [ebp - 0x4c]
mov eax, 0xd5cab8cc
sub eax, 0xc5c674ed
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x33d32637
sub dword [ebp - 0x5c], 0xe580e0ec
mov dword [ebp - 0x58], 0xa7828934
sub dword [ebp - 0x58], 0x754f3cef
mov dword [ebp - 0x54], 0xb16b3df0
sub dword [ebp - 0x54], 0x651ef9c2
mov dword [ebp - 0x50], 0xb9233d1f
sub dword [ebp - 0x50], 0xb9233d1f
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x90e4ae25
add eax, 0x7f21f213
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xe8465f10
add dword [ebp - 0x5c], 0x8c2c0a46
mov dword [ebp - 0x58], 0x9c2eb3fb
sub dword [ebp - 0x58], 0x5ac25286
mov dword [ebp - 0x54], 0xc3ddaee1
add dword [ebp - 0x54], 0x9f91bd8b
mov dword [ebp - 0x50], 0x20e9e54f
add dword [ebp - 0x50], 0xdf161ab1
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x45047
push 0
call eax
mov ecx, 0x470f
mov esi, eax
mov edi, 0x22c50783
add edi, 0xed452c7d
add edi, dword [ebp - 0x4c]
mov edx, 0x8e8bc248
sub dword [ebp - 0x34], 0x76bba01
mov ebx, dword [edi]
add dword [ebp - 0x40], eax
add ebx, edx
xor dword [ebp - 0x30], 0x50b6a973
mov dword [esi], ebx
sub dword [ebp - 0x24], edx
add esi, 0xd877e011
sub esi, 0xd877e00d
add edi, 4
loop 0x100444f0
add eax, 0x57406b98
sub eax, 0x573f5c89
mov ebx, eax
add eax, 0xf76f2ef4
sub eax, 0xf76f2eef
mov ecx, 0x106d55db
add ecx, 0xff92aa25
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x1005c13a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10094144]
jne 0x1005c144
repz ret
jmp fcn.1005c74e
Function at 0x40e26b
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x40e2a6
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x40e28d
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x40e29e
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x40e2a8
inc edi
add eax, 0x28
cmp edi, esi
jb 0x40e283
xor eax, eax
pop edi
pop esi
ret

Function at 0x40e502
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40e519
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec

Function at 0x40e618
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov al, byte [0xa145c633]
mov byte cs:[ebp - 0x5e], 0x35

Function at 0x40ea2b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7ec
push ebx
push esi
push edi
call fcn.0040e209
idiv edi
inc ebx

Function at 0x40ea39
Capabilities:
Contain obfuscated stackstrings

Disassembly:
idiv edi
inc ebx
clc
and byte [ebp - 0x354], 0
and byte [ebp - 0x353], 0
mov byte [ebp - 0x352], 0xda
and byte [ebp - 0x351], 0
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
invalid
invalid

Function at 0x411e30
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42631d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x42a050]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, ecx
lea esi, [edi + 0x1e8]
push dword [esi + 8]
mov eax, dword [esi]
xor ebx, ebx
push ebx
mov ecx, esi
call dword [eax + 4]
lea eax, [esp + 0x10]
add edi, 0x168
push eax
call fcn.00411c76
push 0xe
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], ebx
call fcn.00411d9a
push 0xf
lea ecx, [esp + 0x14]
call fcn.00411d9a
push 0x11
push esi
lea edi, [esp + 0x18]
call fcn.00411d4e
push 0x10
push esi
call fcn.00411d4e
push 9
push esi
call fcn.00411d4e
push 6
push esi
call fcn.00411d4e
push 0x12
push esi
call fcn.00411d4e
push 0x14
push esi
call fcn.00411d4e
push 0x13
push esi
call fcn.00411d4e
push 0x15
push esi
call fcn.00411d4e
push 0xa
push esi
call fcn.00411d4e
push 0x16
push esi
call fcn.00411d4e
mov eax, esi
call fcn.00411d0d
push ebx
push 0x61
call fcn.0041192f
push ebx
push 0x62
call fcn.0041192f
push ebx
push 0x63
call fcn.0041192f
push 0x14
pop edi
mov eax, esi
call fcn.00411dda
push 6
pop edi
mov eax, esi
call fcn.00411dda
push 9
pop edi
mov eax, esi
call fcn.00411dda
push 0x11
pop edi
mov eax, esi
call fcn.00411dda
or dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00412bd6
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401440
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
je 0x40144f
mov eax, 1
pop esi
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push edi
push 8
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push str.MyContainer
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x4014d2
push eax
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x4014d2
push 0x20
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x4014d2
push 0x28
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push eax
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x4014d2
push eax
push 1
push str.Microsoft_Base_Cryptographic_Provider_v1.0
push str.MyContainer
push esi
call ebx
mov edi, eax
test edi, edi
jne 0x4014d2
mov eax, dword [esi]
test eax, eax
je 0x4014dc
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov dword [esi], edi
mov eax, edi
pop edi
pop ebx
pop esi
ret
lea eax, [esi + 4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, edi
pop edi
pop ebx
pop esi
ret
Function at 0x4014f0
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428430
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x4371bc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x6c], eax
test edi, edi
jle 0x40164a
call fcn.00401440
test eax, eax
je 0x40164a
lea eax, [esi + 4]
mov dword [ebp - 0x70], 0
push eax
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x80], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push 0x8003
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x40158c
push str.CryptCreateHash_error
lea ecx, [ebp - 0x7c]
call fcn.00401340
push 0x435ef4
lea eax, [ebp - 0x7c]
push eax
call fcn.00412d98
push 0
push dword [ebp + 0x14]
push str.lykjLdy173
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x4015aa
push str.CryptHashData_error
jmp 0x401576
lea eax, [ebp - 0x70]
push eax
push 0
push dword [ebp - 0x64]
push 0x6801
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x4015cb
push str.CryptDeriveKey_error
jmp 0x401576
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
jne 0x4015df
push str.CryptDestroyHash_error
jmp 0x401576
mov dword [ebp - 0x64], 0
xor esi, esi
nop dword [eax + eax]
mov eax, edi
sub eax, esi
cmp eax, 0x3e8
jbe 0x40160c
add esi, 0x3e8
mov dword [ebp - 0x68], 0x3e8
xor edi, edi
jmp 0x401616
mov dword [ebp - 0x68], eax
add esi, eax
mov edi, 1
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x6c]
push 0
push edi
push 0
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x401667
test edi, edi
jne 0x401641
mov edi, dword [ebp - 0x6c]
add edi, dword [ebp - 0x68]
mov dword [ebp - 0x6c], edi
mov edi, dword [ebp + 0xc]
jmp 0x4015f0
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004107d4
mov esp, ebp
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
xorps xmm0, xmm0
lea ecx, [ebp - 0x48]
push str.Error_Code:
mov edi, eax
movups xmmword [ebp - 0x30], xmm0
movups xmmword [ebp - 0x20], xmm0
call fcn.00401890
mov esi, eax
push 0xa
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
push eax
push edi
call fcn.00417e6b
push eax
mov edx, esi
lea ecx, [ebp - 0x60]
call fcn.00402000
add esp, 0x10
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 0x10
jb 0x4016b6
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x8c]
call fcn.00401340
push 0x435ef4
lea eax, [ebp - 0x8c]
jmp 0x401586
Function at 0x402680
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x4371bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x4026e0
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4026a0
sub ecx, edx
lea ebx, [ecx + 1]
cmp ebx, 0x3fffffff
jg 0x4026e0
lea eax, [ebx + ebx]
call fcn.00411200
mov edi, esp
test edi, edi
je 0x4026e0
push ebx
push edi
push 0xffffffffffffffff
xor eax, eax
push esi
push eax
push 0x3a8
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, edi
jmp 0x4026e2
xor eax, eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x402712
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x402712
xor eax, eax
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004107d4
mov esp, ebp
pop ebp
ret
mov eax, 1
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004107d4
mov esp, ebp
pop ebp
ret