joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x46a124]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
test edi, edi
je 0x401098
mov edx, dword [ebp + 0xc]
lea eax, [edx - 1]
test eax, eax
jne 0x401098
cmp edx, 1
jne 0x401087
push esi
push 0x110
xor esi, esi
lea eax, [ebp - 0x114]
push esi
push eax
call fcn.0040a3a0
add esp, 0xc
mov dword [ebp - 0x118], 0x114
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x401077
cmp dword [ebp - 0x114], 6
ja 0x401072
jne 0x401077
cmp dword [ebp - 0x110], esi
jbe 0x401077
mov esi, 1
shl esi, 0xb
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ecx, eax
pop esi
mov eax, ecx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004093c1
mov esp, ebp
pop ebp
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.004093c1
mov esp, ebp
pop ebp
ret

Function at 0x401430
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x101
push 0
push dword [ebp + 0xc]
mov dword [ebp - 8], 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4014a0
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x45b4ec
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x4014a0
cmp dword [ebp - 8], 0
je 0x4014a0
mov eax, 1
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x401950
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
test ebx, ebx
je 0x401a0c
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x401a0c
xor esi, esi
cmp dword [ebx], esi
jle 0x4019ea
nop dword [eax]
nop dword [eax + eax]
push 0x45b534
push dword [eax + esi*4]
call fcn.00413875
add esp, 8
test eax, eax
je 0x4019af
mov eax, dword [ebp + 0x10]
push 0x45b54c
push dword [eax + esi*4]
call fcn.00413875
add esp, 8
test eax, eax
je 0x4019af
xor edi, edi
jmp 0x4019b4
mov edi, 1
mov ecx, dword [ebx]
mov dword [ebp + 0xc], edi
test edi, edi
jne 0x4019c7
mov eax, dword [ebp + 0x10]
inc esi
cmp esi, ecx
jl 0x401980
jmp 0x4019ea
lea eax, [ecx - 1]
cmp esi, eax
jge 0x4019e5
mov edi, dword [ebp + 0x10]
mov eax, dword [edi + esi*4 + 4]
mov dword [edi + esi*4], eax
inc esi
mov ecx, dword [ebx]
lea eax, [ecx - 1]
cmp esi, eax
jl 0x4019d1
mov edi, dword [ebp + 0xc]
lea eax, [ecx - 1]
mov dword [ebx], eax
push edi
push dword [ebp + 8]
call fcn.00401b60
add esp, 8
mov ecx, 1
test eax, eax
cmovne edi, ecx
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
pop ebp
ret
push 0x45b508
push 1
push 0x45b51c
xor edi, edi
call section..text
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x401ab3
push 0x46ab60
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call esi
xor esi, esi
mov ebx, eax
cmp dword [0x46ab60], esi
jle 0x401ab3
nop dword [eax]
push 0x45b534
push dword [ebx + esi*4]
call fcn.00413875
add esp, 8
test eax, eax
je 0x401a85
push 0x45b54c
push dword [ebx + esi*4]
call fcn.00413875
add esp, 8
test eax, eax
je 0x401a85
inc esi
xor edi, edi
cmp esi, dword [0x46ab60]
jl 0x401a50
jmp 0x401ab3
mov ecx, dword [0x46ab60]
mov edi, 1
lea eax, [ecx - 1]
cmp esi, eax
jge 0x401aac
mov eax, dword [ebx + esi*4 + 4]
mov dword [ebx + esi*4], eax
inc esi
mov ecx, dword [0x46ab60]
lea eax, [ecx - 1]
cmp esi, eax
jl 0x401a97
dec ecx
mov dword [0x46ab60], ecx
push edi
push dword [ebp + 8]
call fcn.00401b60
add esp, 8
mov ecx, 1
test eax, eax
cmovne edi, ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x401b30
Capabilities:
Terminate process

Disassembly:
push dword [0x4690c4]
push 0x45b6a4
call fcn.00402160
push 0x45b6b0
call fcn.00402160
push 0x45b748
call fcn.00402160
add esp, 0x10
push 1
call fcn.00413d84
int3
Function at 0x4021e0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x46a124]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
mov dword [ebp - 0x210], edx
xor ebx, ebx
mov edx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
cmp dword [edx], 1
mov dword [ebp - 0x214], edx
jle 0x402286
mov esi, 1
nop word [eax + eax]
push 0x45b7c4
push dword [edi + esi*4]
call fcn.00413875
add esp, 8
test eax, eax
je 0x40224c
push 0x45b7d8
push dword [edi + esi*4]
call fcn.00413875
add esp, 8
test eax, eax
je 0x40224c
xor ebx, ebx
jmp 0x402251
mov ebx, 1
mov edx, dword [ebp - 0x214]
mov ecx, dword [edx]
test ebx, ebx
jne 0x402264
inc esi
cmp esi, ecx
jl 0x402220
jmp 0x402286
lea eax, [ecx - 1]
cmp esi, eax
jge 0x402281
nop dword [eax + eax]
mov eax, dword [edi + esi*4 + 4]
mov dword [edi + esi*4], eax
inc esi
mov ecx, dword [edx]
lea eax, [ecx - 1]
cmp esi, eax
jl 0x402270
lea eax, [ecx - 1]
mov dword [edx], eax
push edi
push edx
push dword [ebp - 0x210]
call fcn.004013c0
add esp, 0xc
test eax, eax
jne 0x402411
push 1
call fcn.00413ed7
push eax
call fcn.00425ca5
push eax
call fcn.004260ee
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x402411
push 1
call fcn.00413ed7
mov esi, eax
lea eax, [ebp - 0x220]
push eax
push esi
call fcn.00425c44
add esp, 0xc
test eax, eax
jne 0x402311
mov ecx, dword [ebp - 0x220]
or ecx, dword [ebp - 0x21c]
jne 0x402311
push 0x20000
push esi
call fcn.00425ca5
add esp, 4
push eax
call fcn.004262db
push 0x45b8a4
push esi
call fcn.00402680
add esp, 0x10
test ebx, ebx
jne 0x40241a
push 0x208
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
push esi
call fcn.004139ef
add esp, 4
mov edi, eax
lea eax, [ebp - 0x20c]
push edi
push esi
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
push 0x45b7ec
push edi
call fcn.00402890
push 0x45b808
push edi
mov esi, eax
call fcn.00402890
push 0x45b820
push edi
mov dword [ebp - 0x214], eax
call fcn.00402890
push 0x45b840
push edi
mov dword [ebp - 0x210], eax
call fcn.00402890
push 0x45b860
push edi
mov dword [ebp - 0x218], eax
call fcn.00402890
add esp, 0x28
mov edi, eax
call fcn.00401700
push edi
push dword [ebp - 0x218]
push dword [ebp - 0x210]
push dword [ebp - 0x214]
push esi
push 0x45b878
test eax, eax
je 0x4023ef
push 1
call fcn.00413ed7
add esp, 4
push eax
call fcn.004026b0
push 1
call fcn.00413ed7
push eax
call fcn.00425beb
add esp, 0x24
jmp 0x40241a
push 2
call fcn.00413ed7
add esp, 4
push eax
call fcn.004026b0
push 2
call fcn.00413ed7
push eax
call fcn.00425beb
add esp, 0x24
jmp 0x40241a
push ebx
call fcn.00402440
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
test ebx, ebx
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.004093c1
mov esp, ebp
pop ebp
ret
Function at 0x402440
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x46a124]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x402544
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
push esi
call fcn.004139ef
add esp, 4
mov edi, eax
lea eax, [ebp - 0x20c]
push edi
push esi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoW
push 0x45b7ec
push edi
call fcn.004027e0
push 0x45b808
push edi
mov esi, eax
call fcn.004027e0
push 0x45b820
push edi
mov ebx, eax
call fcn.004027e0
push 0x45b840
push edi
mov dword [ebp - 0x214], eax
call fcn.004027e0
push 0x45b860
push edi
mov dword [ebp - 0x210], eax
call fcn.004027e0
add esp, 0x28
mov edi, eax
call fcn.00401700
push edi
push dword [ebp - 0x210]
push dword [ebp - 0x214]
push ebx
push esi
push 0x45b878
test eax, eax
je 0x402521
push 1
call fcn.00413ed7
add esp, 4
push eax
call fcn.004026b0
push 1
jmp 0x402533
push 2
call fcn.00413ed7
add esp, 4
push eax
call fcn.004026b0
push 2
call fcn.00413ed7
push eax
call fcn.00425beb
add esp, 0x24
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004093c1
mov esp, ebp
pop ebp
ret
Function at 0x4037d0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x45ba9c
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x40383b
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push edi
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x45baac
push dword [ebp + 0xc]
mov ebx, eax
call fcn.004268e7
mov esi, eax
add esp, 8
test esi, esi
je 0x40383b
push esi
push edi
push 1
push ebx
call fcn.00426d45
push esi
call fcn.00426a24
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
pop ebp
ret

Function at 0x4040a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
lea eax, [ebx - 0x834]
mov edi, 0x1300
cmp eax, 0x383
ja 0x4040d8
push 2
push esi
push 0x45ba7c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
mov eax, 0x1b00
test esi, esi
cmovne edi, eax
push 0
push 0
lea eax, [ebp + 8]
push eax
push 0x400
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x404114
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 8]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x40411f
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404750
Capabilities:
Delete file
Delete service
Get common file path
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x46a124]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
mov dword [ebp - 0x830], eax
cmp byte [ebp + 8], 0
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x834], ebx
je 0x404898
push 0xf003f
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
push edi
push eax
mov dword [ebp - 0x828], eax
call fcn.00404ee0
add esp, 8
push 0xf01ff
push edi
push dword [ebp - 0x828]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x4047ca
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 0x828]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
lea eax, [ebp - 0x82c]
mov dword [ebp - 0x82c], 0x104
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.00413875
add esp, 8
test eax, eax
jne 0x40483d
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0040ab3b
add esp, 8
lea ebx, [ebp - 0x20c]
xor ecx, ecx
mov word [eax], cx
mov eax, 0x45b7b8
jmp 0x404842
mov eax, 0x45bac8
push dword [ebp - 0x830]
push ebx
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.004020d0
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x10
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop word [eax + eax]
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x404892
call ebx
cmp eax, 5
jne 0x404892
push 0x64
call edi
inc esi
cmp esi, 0xa
jb 0x404870
mov ebx, dword [ebp - 0x834]
cmp byte [0x46ab74], 0
je 0x4048c6
push ebx
lea eax, [ebp - 0x824]
push 0x45bab4
push eax
call fcn.004020d0
add esp, 0xc
lea eax, [ebp - 0x824]
push 1
push 0
push eax
call sub.MPR.dll_WNetCancelConnection2W
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004093c1
mov esp, ebp
pop ebp
ret
Function at 0x404dc0
Capabilities:
Check for time delay via gettickcount
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46a124]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
call ebx
mov ecx, dword [0x46ab78]
mov dword [ebp - 0x24], eax
test ecx, ecx
je 0x404df5
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0xf01ff
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [0x46ab78], eax
test eax, eax
jne 0x404e1c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004093c1
mov esp, ebp
pop ebp
ret
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x404e38
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x404e84
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push dword [0x46ab78]
mov edi, 1
call esi
test eax, eax
je 0x404e84
mov eax, dword [ebp - 0x1c]
cmp eax, 4
je 0x404e86
cmp eax, 1
je 0x404e84
call ebx
sub eax, dword [ebp - 0x24]
cmp eax, 0xea60
ja 0x404ec0
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x20]
push eax
push dword [0x46ab78]
call esi
test eax, eax
jne 0x404e53
xor edi, edi
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x46ab78]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
mov dword [0x46ab78], 0
call ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004093c1
mov esp, ebp
pop ebp
ret
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x41d
call ebx
xor edi, edi
jmp 0x404e8c

Function at 0x404ee0
Capabilities:
Check for time delay via gettickcount
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46a124]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0xf01ff
push esi
push edi
mov dword [ebp - 0x24], eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x404f24
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004093c1
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, eax
test edi, edi
je 0x404f81
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push esi
call ebx
test eax, eax
je 0x404f7e
nop dword [eax]
cmp dword [ebp - 0x1c], 1
je 0x404f80
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x24]
cmp eax, 0xea60
ja 0x404f73
lea eax, [ebp - 0x20]
push eax
push esi
call ebx
test eax, eax
jne 0x404f50
jmp 0x404f7e
push 0x41d
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
pop ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004093c1
mov esp, ebp
pop ebp
ret
Function at 0x4050b0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x45c204
call fcn.00403f60
mov edi, dword [ebp + 0xc]
add esp, 4
cmp dword [edi], 0
jne 0x405163
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0
push 0x18
push 0
push 0
push edi
call esi
test eax, eax
jne 0x405163
push 0x45bfd8
push 0x45c064
call fcn.00403f60
add esp, 8
push 8
push 0x18
push 0
push 0
push edi
call esi
test eax, eax
jne 0x405163
push 0x45c070
push 0x45c064
call fcn.00403f60
add esp, 8
push 0x20
push 0x18
push 0
push 0
push edi
call esi
test eax, eax
jne 0x405163
push 0x45c0e8
push 0x45c064
call fcn.00403f60
add esp, 8
push 0x28
push 0x18
push 0
push 0
push edi
call esi
test eax, eax
jne 0x405163
push 0x45c178
push 0x45c064
call fcn.00403f60
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
add ebx, 0x13
push ebx
call fcn.004139ef
push dword [esi]
mov dword [ebp + 0xc], eax
push dword [esi + 8]
push eax
call fcn.0040a500
mov ecx, dword [esi]
add esp, 0x10
mov esi, dword [ebp + 0xc]
movups xmm0, xmmword [0x45c22c]
movups xmmword [ecx + esi], xmm0
mov ax, word [0x45c23c]
mov word [ecx + esi + 0x10], ax
mov al, byte [0x45c23e]
mov byte [ecx + esi + 0x12], al
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x8004
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40515a
push 0
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x40515a
push dword [ebp + 0x10]
push 0
push dword [ebp - 4]
push 0x6610
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x40515a
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405390
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
cmp dword [esi], 0
jne 0x405431
mov edi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
push 0
push 0x18
push 0
push 0
push esi
call edi
test eax, eax
jne 0x405431
push 0x45bfd8
push 0x45c064
call fcn.00403f60
add esp, 8
push 8
push 0x18
push 0
push 0
push esi
call edi
test eax, eax
jne 0x405431
push 0x45c070
push 0x45c064
call fcn.00403f60
add esp, 8
push 0x20
push 0x18
push 0
push 0
push esi
call edi
test eax, eax
jne 0x405431
push 0x45c0e8
push 0x45c064
call fcn.00403f60
add esp, 8
push 0x28
push 0x18
push 0
push 0
push esi
call edi
test eax, eax
jne 0x405431
push 0x45c178
push 0x45c064
call fcn.00403f60
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret
Function at 0x405440
Capabilities:
Encrypt or decrypt via wincrypt
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
test ebx, ebx
jne 0x405468
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
pop edi
mov ebx, eax
pop esi
pop ebx
pop ebp
ret
mov edi, dword [ebp + 0x18]
lea eax, [ebp + 8]
push edi
push 4
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40549a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x45c1c8
call fcn.00403f60
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push dword [ebp + 8]
call fcn.004139ef
add esp, 4
mov esi, eax
push 0
push edi
push dword [ebp + 8]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4054dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x45c1dc
call fcn.00403f60
push esi
call fcn.004139ea
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
push edi
push esi
push 0
push 1
push 0
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov ebx, eax
test ebx, ebx
je 0x405510
push dword [edi]
push esi
push dword [ebp + 0x10]
call fcn.0040a500
add esp, 0xc
push esi
call fcn.004139ea
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x45c1f0
call fcn.00403f60
add esp, 8
push esi
call fcn.004139ea
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x405540
Capabilities:
Encrypt or decrypt via wincrypt
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 8
push ebx
push esi
push edi
push 0
test eax, eax
jne 0x40556e
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
mov esi, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x14]
lea ecx, [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
push ecx
push 0
push 0
push 1
push 0
push dword [eax]
mov dword [ebp - 4], esi
call edi
push dword [ebp - 4]
call fcn.004139ef
push dword [ebp - 4]
mov ebx, eax
push dword [ebp + 0x10]
push ebx
call fcn.0040a500
add esp, 0x10
mov dword [ebp - 8], esi
lea eax, [ebp - 8]
push dword [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push ebx
push 0
push 1
push 0
push dword [eax]
call edi
test eax, eax
je 0x4055fc
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push eax
push 4
lea eax, [ebp - 4]
push eax
push esi
call edi
test eax, eax
je 0x4055fc
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push ebx
push esi
call edi
push ebx
mov esi, eax
call fcn.004139ea
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
call fcn.004139ea
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405610
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x89c
mov eax, dword [0x46a124]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x804]
mov dword [ebp - 0x874], ecx
push 0x45c2e8
push eax
call fcn.004020d0
mov eax, dword [0x46ab98]
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x405670
push 0x45c26c
push 0x45c258
call edi
push eax
call esi
mov dword [0x46ab98], eax
lea ecx, [ebp - 0x804]
push ecx
lea ecx, [ebp - 0x89c]
push ecx
call eax
lea eax, [ebp - 0x89c]
mov dword [ebp - 0x894], 0x18
mov dword [ebp - 0x88c], eax
mov eax, dword [0x46ab9c]
mov dword [ebp - 0x890], 0
mov dword [ebp - 0x888], 0x40
mov dword [ebp - 0x884], 0
mov dword [ebp - 0x880], 0
test eax, eax
jne 0x4056db
push 0x45c284
push 0x45c258
call edi
push eax
call esi
mov dword [0x46ab9c], eax
push 0x90
push 1
lea ecx, [ebp - 0x87c]
push ecx
lea ecx, [ebp - 0x894]
push ecx
push 0x100001
lea ecx, [ebp - 0x870]
push ecx
call eax
mov ebx, eax
test ebx, ebx
jne 0x4057f5
mov eax, dword [0x46aba0]
mov ebx, dword [ebp - 0x870]
mov dword [ebp - 0x824], 6
mov dword [ebp - 0x820], 2
test eax, eax
jne 0x40573f
push 0x45c290
push 0x45c258
call edi
push eax
call esi
mov dword [0x46aba0], eax
push 0x44
lea ecx, [ebp - 0x86c]
push ecx
push 0x24
lea ecx, [ebp - 0x828]
push ecx
push 0x1401a3
lea ecx, [ebp - 0x87c]
push ecx
push 0
push 0
push 0
push ebx
call eax
mov ebx, eax
test ebx, ebx
jne 0x40577c
mov eax, dword [ebp - 0x874]
movups xmm0, xmmword [ebp - 0x840]
movups xmmword [eax], xmm0
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x874], eax
mov eax, dword [0x46aba0]
mov dword [ebp - 0x824], 6
mov dword [ebp - 0x820], 1
test eax, eax
jne 0x4057b9
push 0x45c290
push 0x45c258
call edi
push eax
call esi
mov dword [0x46aba0], eax
push 0
push 0
push 0x24
lea ecx, [ebp - 0x828]
push ecx
push 0x1401ac
lea ecx, [ebp - 0x87c]
push ecx
push 0
push 0
push 0
push dword [ebp - 0x874]
call eax
cmp eax, 0x103
jne 0x4057f5
push 0xffffffffffffffff
push dword [ebp - 0x870]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x870]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x46ab94]
test eax, eax
jne 0x40581e
push 0x45c240
push 0x45c258
call edi
push eax
call esi
mov dword [0x46ab94], eax
push ebx
call eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004093c1
mov esp, ebp
pop ebp
ret