joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b39b
Capabilities:
Encode data using xor
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, str.DecryptFullTiltPassword
push esi
push ebx
push str._s_Decrypting_text__s
call fcn.00449974
mov eax, dword [ebp + 0x10]
xor ecx, ecx
add esp, 0xc
cmp dword [ebp + 0xc], 5
mov byte [eax], cl
jae 0x40b3db
push ebx
push str._s___Empty_password
call fcn.00449974
pop ecx
pop ecx
xor eax, eax
jmp 0x40b490
push ecx
push ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push 0x66ce80
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
movzx eax, word [ebp - 4]
jne 0x40b403
mov eax, 0xff00ff
push edi
push eax
call fcn.0063d41d
mov edi, dword [ebp - 4]
movzx eax, byte [esi]
pop ecx
movzx ecx, byte [esi + 1]
shr edi, 0x10
shl ecx, 8
and edi, 0x1f
or ecx, eax
inc edi
add edi, ecx
call fcn.0063d3fc
dec edi
test edi, edi
jg 0x40b423
movzx edx, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl edx, 8
or edx, ecx
cmp eax, edx
jne 0x40b48c
movzx ebx, byte [esi + 4]
cmp ebx, 0x40
jae 0x40b48c
cmp ebx, dword [ebp + 0xc]
ja 0x40b48c
xor edi, edi
test ebx, ebx
je 0x40b463
call fcn.0063d3fc
xor al, byte [edi + esi + 5]
mov byte [edi + esi], al
inc edi
cmp edi, ebx
jl 0x40b452
mov ebx, dword [ebp + 0x10]
push esi
push dword [ebp + 0x14]
mov byte [edi + esi], 0
push ebx
call fcn.006311ec
push ebx
push str.DecryptFullTiltPassword
push str._s__Final_Clear_Text_Password_is__s
call fcn.00449974
xor eax, eax
add esp, 0x18
inc eax
jmp 0x40b48f
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b494
Capabilities:
Encode data using xor
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
movaps xmm0, xmmword [0x68ac20]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 0x34], eax
xor esi, esi
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x38], eax
mov edi, 0xba0da71d
movups xmmword [ebp - 0x24], xmm0
movsx ecx, byte [ebx + esi]
mov eax, esi
imul ecx, edi
and eax, 3
imul edi, edi, 0xbc8f
push ebx
xor dword [ebp + eax*4 - 0x24], ecx
inc esi
call fcn.00631510
pop ecx
cmp esi, eax
jb 0x40b4ce
xor ebx, ebx
mov edx, dword [ebp - 0x30]
mov eax, esi
and eax, 3
push edx
movsx ecx, byte [edx + ebx]
imul ecx, edi
imul edi, edi, 0xbc8f
xor dword [ebp + eax*4 - 0x24], ecx
inc ebx
inc esi
call fcn.00631510
pop ecx
cmp ebx, eax
jb 0x40b4f2
push str.Entropy_values_after_hashing_are
call fcn.00449974
pop ecx
push 4
xor esi, esi
pop edi
push dword [ebp + esi*4 - 0x24]
push str._n_0x_.8x
call fcn.00449974
inc esi
pop ecx
pop ecx
cmp esi, edi
jl 0x40b528
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.006269d0
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.006269d0
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.006269d0
push edi
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 8]
push eax
call fcn.006269d0
mov ebx, dword [ebp - 0x34]
push ebx
call fcn.00631510
lea edi, [eax + 1]
push edi
push str.passlen_before_operation__d
call fcn.00449974
mov edx, dword [ebp - 0x24]
add esp, 0x3c
or edx, 1
xor esi, esi
mov cl, byte [ebx + esi + 4]
mov al, byte [ebx + esi + 5]
dec cl
sub al, 0x21
shl cl, 4
or cl, al
mov eax, esi
shr eax, 1
sub cl, dl
add esi, 2
imul edx, edx, 0x10ff5
mov byte [ebx + eax], cl
cmp esi, edi
jb 0x40b597
push esi
push str.final_length_is__d
call fcn.00449974
pop ecx
pop ecx
lea eax, [ebp - 0x14]
shr esi, 1
mov dword [ebp - 0x3c], eax
xor ecx, ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x44], ebx
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x10
push eax
sub esi, 3
lea eax, [ebp - 0x48]
push ecx
push eax
mov dword [ebp - 0x48], esi
mov byte [ebx + esi], cl
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
jne 0x40b618
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CryptUnprotectData_failed_with_error_0x_.8x
call fcn.00449974
pop ecx
pop ecx
xor eax, eax
jmp 0x40b642
push dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x38]
push dword [ebp - 0x28]
push ebx
call fcn.006269d0
mov ecx, dword [ebp - 0x2c]
mov byte [ebx + ecx], 0
push dword [ebp - 0x2c]
push ebx
push str.Password_is__s___d_
call fcn.00449974
xor eax, eax
add esp, 0x18
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x40b730
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x10]
push esi
xor esi, esi
mov dword [ebp - 4], 0x31ca3289
mov byte [edx], 0
cmp dword [ebp + 0xc], esi
jbe 0x40b769
push edi
mov edi, dword [ebp + 8]
sub edi, edx
mov eax, esi
lea ecx, [esi + edx]
and eax, 3
mov al, byte [ebp + eax - 4]
xor al, byte [edi + ecx]
xor al, 0x30
inc esi
mov byte [ecx], al
cmp esi, dword [ebp + 0xc]
jb 0x40b74f
pop edi
push edx
push str.Final_Decrypted_Password_is__s
mov byte [esi + edx], 0
call fcn.00449974
pop ecx
pop ecx
xor eax, eax
inc eax
pop esi
leave
ret

Function at 0x40b780
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7f0
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push str.DecryptMSNPassword
push str._s___Decrypting_MSN_password_of_size__d
mov dword [ebp - 0x7e0], eax
call fcn.00449974
mov eax, dword [ebp + 0x14]
add esp, 0xc
mov dword [ebp - 0x7e8], eax
lea eax, [ebp - 0x7dc]
mov dword [ebp - 0x7ec], edi
xor edi, edi
mov dword [ebp - 0x7f0], esi
push eax
push 1
push edi
push edi
lea eax, [ebp - 0x7e8]
mov dword [ebp - 0x7e4], ebx
push eax
push edi
lea eax, [ebp - 0x7f0]
push eax
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
jne 0x40b826
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ebx, str.DecryptMSNPassword
push ebx
push str._s___CryptUnprotectData_failed_with_error__0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
push dword [ebp - 0x7dc]
mov ebx, str.DecryptMSNPassword
push ebx
push str._s___Decrypted_data_of_size__d
call fcn.00449974
push dword [ebp - 0x7dc]
lea eax, [ebp - 0x7d4]
push dword [ebp - 0x7d8]
push eax
call fcn.006269d0
mov eax, dword [ebp - 0x7dc]
add esp, 0x18
and eax, 0xfffffffe
cmp eax, 0x7d0
jae 0x40b8a5
mov esi, dword [ebp - 0x7e0]
xor ecx, ecx
push edi
push edi
push dword [ebp + 0x1c]
mov word [ebp + eax - 0x7d4], cx
lea ecx, [ebp - 0x7d4]
push esi
push 0xffffffffffffffff
push ecx
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push ebx
push str._s___Final_decrypted_password_is__s
call fcn.00449974
xor eax, eax
add esp, 0xc
inc eax
jmp 0x40b817
call fcn.005fe87a
int3
Function at 0x40c131
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x488
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
push 4
pop ebx
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x47c], eax
lea eax, [ebp - 0x470]
push ebx
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x470], 0x6f2825f5
push eax
mov dword [ebp - 0x474], 0x7d
call fcn.006269d0
push ebx
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.006269d0
push ebx
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.006269d0
push ebx
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.006269d0
push esi
lea eax, [ebp - 0x450]
push 0x3e8
push eax
call fcn.006311ec
lea eax, [ebp - 0x450]
push eax
call fcn.00449ed8
add esp, 0x40
mov esi, eax
push esi
push str.DecryptMultiCommanderPassword
push str._s:_Converted_Password_to_Hex_Bytes_of_size__d
call fcn.00449974
push 0x10
pop eax
push eax
mov dword [ebp - 0x464], eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x460]
mov dword [ebp - 0x46c], 0x208
push eax
mov dword [ebp - 0x468], 0x6801
call fcn.006269d0
add esp, 0x18
lea eax, [ebp - 0x484]
xor ebx, ebx
push 0xf0000000
push 1
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x40c256
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DecryptMultiCommanderPassword
push str._s:_CryptAcquireContext_failed__Error0x_.8x
call fcn.00449974
add esp, 0xc
xor eax, eax
jmp 0x40c30f
lea eax, [ebp - 0x488]
push eax
push ebx
push ebx
push 0x1c
lea eax, [ebp - 0x46c]
push eax
push dword [ebp - 0x484]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x40c28b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DecryptMultiCommanderPassword
push str._s:_CryptImportKey_failed__Error0x_.8x
jmp 0x40c247
lea eax, [ebp - 0x480]
mov dword [ebp - 0x480], esi
push eax
lea eax, [ebp - 0x450]
push eax
push ebx
push 1
push ebx
push dword [ebp - 0x488]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x40c2c8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._n_CryptDecrypt_failed_with_error_0x_.8x
call fcn.00449974
pop ecx
pop ecx
jmp 0x40c24f
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0x480]
push str._n_CryptDecrypt_success__password_is___d___S
call fcn.00449974
add esp, 0xc
lea ecx, [ebp - 0x450]
push ebx
push ebx
push dword [ebp + 0x10]
push edi
push 0xffffffffffffffff
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
push str.DecryptMultiCommanderPassword
push str._n_n_s:_Successfully_decrypted_the_password___s__n_n
call fcn.00449974
xor eax, eax
add esp, 0xc
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x40c7de
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, str.12_ASDgemWe2
mov dword [ebp - 0x18], eax
lea edi, [ebp - 0x14]
mov dword [ebp - 0x24], ecx
push eax
push str.DecryptNimbuzzPassword
movsd dword es:[edi], dword [esi]
push str._s_Decrypting_password_of_size__d
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.00449974
mov esi, dword [ebp - 0x24]
add esp, 0xc
xor eax, eax
xor edi, edi
inc edi
push 0xf0000000
push edi
push eax
push eax
mov byte [esi], al
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x40c859
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._n_CryptAcquireContextA_failed_with_error_0x_.8x
call fcn.00449974
pop ecx
pop ecx
xor eax, eax
jmp 0x40c927
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0x8004
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x40c881
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._n_CryptCreateHash_failed_with_error_0x_.8x
jmp 0x40c84b
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00631510
pop ecx
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
jne 0x40c8ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._n_CryptHashData_failed_with_error_0x_.8x
jmp 0x40c84b
lea eax, [ebp - 0x28]
push eax
push edi
push dword [ebp - 0x1c]
push 0x6601
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
jne 0x40c8d8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._n_CryptDeriveKey_failed_with_error_0x_.8x
jmp 0x40c84b
lea eax, [ebp - 0x18]
push eax
push ebx
push 0
push edi
push 0
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x40c900
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._n_CryptDecrypt_failed_with_error_0x_.8x
jmp 0x40c84b
mov eax, dword [ebp - 0x18]
mov byte [eax + ebx], 0
push dword [ebp - 0x18]
push ebx
push dword [ebp + 0x14]
push esi
call fcn.00631360
push esi
push dword [ebp - 0x18]
push str._n_CryptDecrypt_success__password_is___d___s
call fcn.00449974
add esp, 0x1c
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
Function at 0x40c936
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x14]
push edi
push esi
push str.Decrypting_OpenVPn_Password_of_size__d__salt_size_d
call fcn.00449974
mov eax, dword [ebp + 8]
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp edi, 0x11
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push 0x10
pop eax
cmove edi, eax
mov dword [ebp - 0x18], esi
lea eax, [ebp - 8]
mov dword [ebp - 0x10], edi
push eax
xor esi, esi
lea eax, [ebp - 0x10]
push esi
push esi
push esi
push eax
push esi
lea eax, [ebp - 0x18]
push eax
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
jne 0x40c9a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CryptUnprotectData_failed_with_error_0x_.8x
call fcn.00449974
pop ecx
pop ecx
xor eax, eax
jmp 0x40c9e0
push dword [ebp - 4]
push dword [ebp - 8]
push str.Successfully_decrypted_password_of_size___d__n_Password_S
call fcn.00449974
add esp, 0xc
push esi
push esi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push 0xffffffffffffffff
push dword [ebp - 4]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp + 0x18]
push str.DecryptOpenVPNPassword
push str._s_:_Final_ascii_password_is__s
call fcn.00449974
xor eax, eax
add esp, 0xc
inc eax
pop edi
pop esi
leave
ret
Function at 0x40ca69
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4e34
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0x10]
mov ebx, str.DecryptOutlookPassword
push edi
mov edi, dword [ebp + 8]
push ebx
push str._s___entered....
call fcn.00449974
mov eax, dword [ebp + 0xc]
pop ecx
pop ecx
cmp eax, 1
jae 0x40cac1
push ebx
push str._s___empty_password...returning....
call fcn.00449974
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
dec eax
mov dword [ebp - 0x4e34], eax
lea eax, [edi + 1]
mov dword [ebp - 0x4e30], eax
lea eax, [ebp - 0x4e2c]
push eax
push 1
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x4e34]
push eax
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
jne 0x40cb07
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push str._s_:_CryptUnprotectData_failed_with_error_0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x40cab0
push dword [ebp - 0x4e2c]
lea eax, [ebp - 0x4e24]
push dword [ebp - 0x4e28]
push eax
call fcn.006269d0
mov eax, dword [ebp - 0x4e2c]
add esp, 0xc
and eax, 0xfffffffe
cmp eax, 0x4e20
jae 0x40cbb1
xor ecx, ecx
mov word [ebp + eax - 0x4e24], cx
lea eax, [ebp - 0x4e24]
push eax
call fcn.00630ba0
push eax
push dword [ebp - 0x4e2c]
push ebx
push str._s___Success___Decrypted_data_length___d__and_pass_length___d
call fcn.00449974
add esp, 0x14
lea eax, [ebp - 0x4e24]
push 0
push 0
push dword [ebp + 0x14]
push esi
push eax
call fcn.00630ba0
pop ecx
push eax
lea eax, [ebp - 0x4e24]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x4e24]
push eax
call fcn.00630ba0
push esi
mov byte [eax + esi], 0
call fcn.00631510
push eax
push ebx
push str._s_:_Password___d
call fcn.00449974
xor eax, eax
add esp, 0x14
inc eax
jmp 0x40cab2
call fcn.005fe87a
int3
Function at 0x40d04f
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x13c8
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x139c]
push edi
mov edi, dword [ebp + 0xc]
push 0x1388
push eax
push esi
mov dword [ebp - 0x14], 0xb06012c
mov dword [ebp - 0x10], 0x4d29201d
mov dword [ebp - 0xc], 0x2020101
mov dword [ebp - 8], 0x29250909
mov byte [edi], 0
call fcn.00445e29
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x40d0cd
push esi
push str.DecryptRazorSQLPassword
push str._s___Base64_decoding_failed_for__s
call fcn.00449974
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
push ebx
push str._n_Successfully_base64_decoded_pass_of_size__d
call fcn.00449974
push 0x10
pop eax
push eax
mov dword [ebp - 0x13b0], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x13ac]
mov dword [ebp - 0x13b8], 0x208
push eax
mov dword [ebp - 0x13b4], 0x660e
call fcn.006269d0
add esp, 0x14
lea eax, [ebp - 0x13c4]
xor esi, esi
push 0xf0000000
push 0x18
push esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x40d13b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DecryptRazorSQLPassword
push str._s:_CryptAcquireContext_failed__Error0x_.8x
jmp 0x40d0b4
lea eax, [ebp - 0x13c0]
push eax
push esi
push esi
push 0x1c
lea eax, [ebp - 0x13b8]
push eax
push dword [ebp - 0x13c4]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x40d173
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DecryptRazorSQLPassword
push str._s:_CryptImportKey_failed__Error0x_.8x
jmp 0x40d0b4
push esi
lea eax, [ebp - 0x13c8]
mov dword [ebp - 0x13c8], 2
push eax
push 4
push dword [ebp - 0x13c0]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x40d1ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DecryptRazorSQLPassword
push str._s:_CryptSetKeyParam_failed__Error0x_.8x
jmp 0x40d0b4
lea eax, [ebp - 0x13bc]
mov dword [ebp - 0x13bc], ebx
push eax
lea eax, [ebp - 0x139c]
xor ebx, ebx
push eax
push ebx
push 1
push ebx
push dword [ebp - 0x13c0]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x40d1ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DecryptRazorSQLPassword
push str._s:_CryptDecrypt_failed__Error0x_.8x
jmp 0x40d0b4
push dword [ebp - 0x13bc]
mov esi, str.DecryptRazorSQLPassword
push esi
push str._n_s:__decrypted_the_password_of_size__d__password_is_n
call fcn.00449974
mov eax, dword [ebp - 0x13bc]
add esp, 0xc
cmp eax, 0x1388
jae 0x40d247
mov byte [ebp + eax - 0x139c], bl
lea eax, [ebp - 0x139c]
push eax
push dword [ebp + 0x10]
push edi
call fcn.006311ec
push edi
push dword [ebp - 0x13bc]
push esi
push str._n_n_s:_Successfully_decrypted_the_password_of_size__d__password_is___s__n_n
call fcn.00449974
xor eax, eax
add esp, 0x1c
inc eax
jmp 0x40d0be
call fcn.005fe87a
int3
Function at 0x40de0f
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x158]
push 0x100
push eax
push ebx
mov dword [ebp - 0x164], edi
mov dword [ebp - 0x58], 0xc48126f3
mov dword [ebp - 0x54], 0x92db8639
mov dword [ebp - 0x50], 0xe6b9a371
mov dword [ebp - 0x4c], 0x7c957a53
mov dword [ebp - 0x44], 0xff0000
mov dword [ebp - 0x40], 0x8000
mov dword [ebp - 0x3c], 0x808000
mov dword [ebp - 0x38], 0xff
mov dword [ebp - 0x34], 0x800080
mov dword [ebp - 0x30], 0x8080
mov dword [ebp - 0x2c], 0xff8000
mov dword [ebp - 0x28], 0xff0080
mov dword [ebp - 0x24], 0x808080
mov dword [ebp - 0x20], 0x62616e55
mov dword [ebp - 0x1c], 0x7420656c
mov dword [ebp - 0x18], 0x6572206f
mov dword [ebp - 0x14], 0x766c6f73
mov dword [ebp - 0x10], 0x54482065
mov dword [ebp - 0xc], 0x70205054
mov dword [ebp - 8], 0x786f72
call fcn.00445e29
add esp, 0xc
mov esi, str.DecryptTrillianAstraPassword
test eax, eax
jne 0x40df02
push esi
push str._s_:_BASE64_decoding_of_password_has_failed__it_may_not_have_been_encoded_with_base64__so_continuing_now
call fcn.00449974
push ebx
lea eax, [ebp - 0x158]
push 0x100
push eax
call fcn.006311ec
add esp, 0x14
jmp 0x40df17
lea eax, [ebp - 0x158]
push eax
push esi
push str._s___After_based64_decoding_the_password_is__s
call fcn.00449974
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x15c], eax
cmp byte [ebp - 0x158], al
je 0x40df8f
lea ebx, [ebp - 0x58]
xor ecx, ecx
sub ebx, edi
mov dh, byte [ebp + ecx - 0x157]
test dh, dh
je 0x40df89
mov cl, byte [ebp + ecx - 0x158]
mov dl, cl
shl cl, 4
sub dl, 0x30
cmp dl, 9
mov dl, 9
lea eax, [ecx - 0x70]
movzx ecx, cl
movzx eax, al
cmova ecx, eax
mov al, dh
sub al, 0x30
cmp dl, al
sbb al, al
and al, 0xf9
add al, 0xd0
add cl, al
mov eax, dword [ebp - 0x15c]
add cl, dh
xor cl, byte [ebx + edi]
inc eax
mov byte [edi], cl
inc edi
mov dword [ebp - 0x15c], eax
lea ecx, [eax + eax]
cmp byte [ebp + ecx - 0x158], 0
jne 0x40df2e
mov edi, dword [ebp - 0x164]
push edi
push esi
push str._s___Final_decrypted_Trillian_password_is__s
mov byte [edi + eax], 0
call fcn.00449974
mov ecx, dword [ebp - 4]
add esp, 0xc
xor eax, eax
xor ecx, ebp
inc eax
pop edi
pop esi
pop ebx
call fcn.005fe955
leave
ret
Function at 0x40dfb4
Capabilities:
Delete file
Encrypt data using dpapi
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7e8
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x7d8]
push edi
push 0x670244
push esi
xor ebx, ebx
push eax
mov dword [ebp - 0x7d8], ebx
call fcn.00632119
add esp, 0xc
cmp dword [ebp - 0x7d8], ebx
je 0x40e195
test eax, eax
jne 0x40e195
push 2
push ebx
push dword [ebp - 0x7d8]
call fcn.00637e4f
push dword [ebp - 0x7d8]
call fcn.006384ae
mov esi, eax
push esi
call fcn.0063d3c4
add esp, 0x14
mov edi, eax
push dword [ebp - 0x7d8]
test edi, edi
jne 0x40e04b
call fcn.00637603
mov dword [esp], str.DecryptTrillianFile
push str._s___Memory_allocation_failed
call fcn.00449974
pop ecx
pop ecx
jmp 0x40e1a9
call fcn.006388c3
push dword [ebp - 0x7d8]
push 1
push esi
push edi
call fcn.00637a2b
push dword [ebp - 0x7d8]
call fcn.00637603
push esi
push str._nSuccessfully_read_file_of_size__d_n_n
call fcn.00449974
add esp, 0x20
mov dword [ebp - 0x7e4], edi
lea eax, [ebp - 0x7e0]
mov dword [ebp - 0x7e8], esi
push eax
push 1
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x7e8]
push eax
call sub.CRYPT32.dll_CryptUnprotectData
test eax, eax
jne 0x40e0af
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._n_n__CryptUnprotectData_failed_with_error__0x_.8x
jmp 0x40e03f
push dword [ebp - 0x7e0]
push str._n_n__CryptUnprotectData_Succeeded_with_output_size___d
call fcn.00449974
push edi
call fcn.0063d3a9
add esp, 0xc
lea eax, [ebp - 0x7d4]
mov esi, 0x3e8
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount64]
push eax
call fcn.0063d41d
call fcn.0063d3fc
push eax
lea eax, [ebp - 0x7d4]
push eax
push str._strillian__d
lea eax, [ebp - 0x3ec]
push esi
push eax
call fcn.00445d6d
push 0x677954
lea eax, [ebp - 0x3ec]
push eax
lea eax, [ebp - 0x7d8]
push eax
call fcn.00632119
add esp, 0x24
cmp dword [ebp - 0x7d8], ebx
je 0x40e180
test eax, eax
jne 0x40e180
push dword [ebp - 0x7d8]
push dword [ebp - 0x7e0]
push 1
push dword [ebp - 0x7dc]
call fcn.006387a3
push dword [ebp - 0x7d8]
call fcn.00637603
lea eax, [ebp - 0x3ec]
push eax
push str._nSuccessfully_saved_decrypted_data_to_file_s__n_n
call fcn.00449974
lea eax, [ebp - 0x3ec]
push eax
call fcn.0042bec8
add esp, 0x20
lea eax, [ebp - 0x3ec]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40e1a9
push eax
push str.DecryptTrillianFile
push str._s___Failed_to_open_file_for_writing__Error0x_.8x
call fcn.00449974
add esp, 0xc
jmp 0x40e1a9
push eax
push esi
push str.DecryptTrillianFile
push str._s___Failed_to_open_file__s__Error0x_.8x
call fcn.00449974
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret