joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40143f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4014a8
cmp dword [ebp + 0x10], 1
je 0x401480
cmp dword [ebp + 0x10], 2
je 0x401480
push 0xd
pop eax
jmp 0x4014a8
mov eax, dword [ebp - 4]
test edi, edi
je 0x4014a2
test eax, eax
je 0x40149d
test al, 1
jne 0x40147b
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x4014a2
jmp 0x40147b
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc

Function at 0x4014ae
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 8
Function at 0x404d84
Capabilities:
Create process on windows

Disassembly:
push 0xc
mov eax, 0x46378e
call fcn.0043e9a8
mov edi, ecx
cmp byte [ebp + 8], 0
mov eax, str.true
jne 0x404da2
mov eax, str.false
push eax
push str.in_ForceConfig__s_
call fcn.00408586
push str.Checking_if_Norton_OOBE_is_already_running...
call fcn.00408586
add esp, 0xc
mov ecx, edi
call fcn.0040109a
test al, al
je 0x404ddb
push str.Quit_because_Norton_OOBE_is_running.
call fcn.00408586
pop ecx
push 3
pop eax
call fcn.0043ea80
ret 8
cmp byte [edi + 8], 0
mov ebx, str.Waiting_InstStub_...
jne 0x404e07
push ebx
call fcn.00408586
pop ecx
mov ecx, edi
call fcn.0040179f
test al, al
jne 0x404e07
push str.Quit_because_the_messaging_window_of_InstStub_cannot_be_found_
call fcn.004085ae
pop ecx
push 4
jmp 0x404dd2
push 0x46b5a0
add edi, 0xc
lea eax, [ebp - 0x18]
push edi
push eax
call fcn.00403107
and dword [ebp - 4], 0
mov esi, str.InstStub.exe
push esi
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00403107
add esp, 0x18
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.004014ff
push 0x46bf48
lea ecx, [ebp - 0x10]
call fcn.004042a2
cmp byte [ebp + 8], 0
mov byte [ebp - 4], 3
jne 0x404e6f
push str.SymSilent_is_launched_in_silent_mode._Launching_InstallStub_with__silentcfgwiz
call fcn.00408586
lea ecx, [ebp - 0x10]
mov dword [esp], str.__silentcfgwiz
call fcn.004033ee
push str.__FORCECONFIG
lea ecx, [ebp - 0x10]
call fcn.004033ee
push dword [ebp - 0x10]
push str.Launching_InstStub_with_switches:__s_...
call fcn.00408586
mov edi, dword [edi]
pop ecx
pop ecx
push 5
push edi
push dword [ebp - 0x10]
xor edi, edi
push dword [ebp - 0x14]
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x404ed4
push str.Fail_to_launch_InstStub.exe_
call fcn.004085ae
xor esi, esi
pop ecx
inc esi
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004014ff
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004014ff
mov eax, esi
jmp 0x404dd3
cmp byte [ebp + 0xc], 0
je 0x404f32
push ebx
call fcn.00408586
pop ecx
push esi
lea ecx, [ebp + 8]
call fcn.004042a2
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 4
call fcn.00409667
mov bl, al
pop ecx
mov ecx, dword [ebp + 8]
neg bl
sbb bl, bl
add ecx, 0xfffffff0
inc bl
mov byte [ebp - 4], 3
call fcn.004014ff
test bl, bl
jne 0x404f27
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x12c
jl 0x404ee1
push str.InstStub_exits.
call fcn.00408586
pop ecx
xor esi, esi
jmp 0x404eb7
Function at 0x4054fd
Capabilities:
Accept command line arguments
Find taskbar

Disassembly:
push 8
mov eax, 0x4638aa
call fcn.0043e9a8
push str.Check_if_we_need_to_re_launch_...
call fcn.00408586
pop ecx
xor ebx, ebx
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
test eax, eax
je 0x405534
call dword [sym.imp.USER32.dll_GetDesktopWindow]
test eax, eax
jne 0x4055c5
mov ecx, dword [ebp + 8]
mov esi, str._nospawn
push esi
call fcn.0041b8b2
test al, al
jne 0x4055c5
push str.Relaunching_SymSilent_for_not_holding_on_at_RunOnce...
call fcn.00408586
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp + 8]
call fcn.004042a2
push 0x46c790
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], ebx
call fcn.004042e3
push esi
push eax
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 4], 1
call fcn.00403107
add esp, 0xc
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.004038af
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004014ff
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.004014ff
push ebx
lea eax, [ebp + 8]
push ebx
push eax
call fcn.004096ed
mov ecx, dword [ebp + 8]
add esp, 0xc
add ecx, 0xfffffff0
call fcn.004014ff
mov al, 1
jmp 0x4055c7
xor al, al
call fcn.0043ea80
ret 4
Function at 0x405ce3
Capabilities:
Get common file path

Disassembly:
push 0x1c
mov eax, 0x463a17
call fcn.0043e9a8
mov esi, ecx
push str.Creating_desktop_icon_...
call fcn.00408586
pop ecx
mov edi, 0x4872a4
push edi
lea ecx, [ebp - 0x18]
call fcn.00401c03
xor ebx, ebx
push 0x104
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00402209
push eax
push ebx
push ebx
push 0x19
push ebx
call dword [sym.imp.SHFOLDER.dll_SHGetFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x28], eax
call fcn.00401bd9
cmp dword [ebp - 0x28], ebx
jge 0x405d4a
push str.Cannot_find_all_users_desktop_folder_
call fcn.004085ae
pop ecx
jmp 0x405ebf
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x24]
call fcn.004021eb
push str..lnk
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.004042e3
lea eax, [ebp - 0x20]
push eax
add esi, 0x20
lea eax, [ebp - 0x28]
push esi
push eax
mov byte [ebp - 4], 2
call fcn.004030b0
push dword [eax]
lea eax, [ebp - 0x24]
push eax
call fcn.00417145
mov ecx, dword [ebp - 0x28]
add esp, 0x14
add ecx, 0xfffffff0
call fcn.004014ff
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.004014ff
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
push 0x46a81c
push 0x17
push ebx
push 0x470b1c
mov byte [ebp - 4], 3
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x405ea3
push edi
lea ecx, [ebp - 0x14]
call fcn.00401c03
lea eax, [ebp - 0x14]
push eax
push str._INSTALLDIR_
mov byte [ebp - 4], 4
call fcn.0041959b
pop ecx
pop ecx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x20]
call fcn.004021eb
lea eax, [ebp - 0x20]
push str.uiStub.exe
push eax
mov byte [ebp - 4], 5
call fcn.00417145
pop ecx
pop ecx
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004021eb
lea eax, [ebp - 0x1c]
push str.Settings.dll
push eax
mov byte [ebp - 4], 6
call fcn.00417145
mov eax, dword [ebp - 0x10]
pop ecx
pop ecx
push dword [ebp - 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov esi, dword [esi]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ebx
push dword [ebp - 0x1c]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x28]
call fcn.0040211b
mov eax, dword [ebp - 0x28]
mov ecx, dword [eax]
push 1
push dword [ebp - 0x24]
mov byte [ebp - 4], 7
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 6
cmp eax, ebx
je 0x405e82
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004014ff
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.004014ff
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004014ff
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x405eb4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
call fcn.004014ff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004014ff
call fcn.0043ea80
ret
Function at 0x406e38
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0x14
mov eax, 0x463c3b
call fcn.0043e9a8
mov esi, 0x4872a4
push esi
lea ecx, [ebp - 0x14]
call fcn.00401c03
xor ebx, ebx
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00401c03
push esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00401c03
mov edi, 0x104
push edi
push edi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.00402209
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.00401bd9
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.0040182a
push eax
push ebx
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call fcn.004029e6
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.00402be3
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.004014ff
push 0x5c
lea ecx, [ebp - 0x14]
call fcn.0040182a
inc eax
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x14]
call fcn.0040308d
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.00402be3
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov byte [ebp - 4], 2
call fcn.004014ff
push esi
lea ecx, [ebp - 0x10]
call fcn.00401c03
push edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 5
call fcn.00402209
mov esi, dword [sym.imp.SHFOLDER.dll_SHGetFolderPathW]
push eax
push ebx
push ebx
push 0x2a
push ebx
call esi
test eax, eax
jge 0x406f33
push edi
lea ecx, [ebp - 0x10]
call fcn.00402209
push eax
push ebx
push ebx
push 0x26
push ebx
call esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00401bd9
lea eax, [ebp - 0x10]
push 0x46bc6a
push eax
call fcn.00405ed0
pop ecx
pop ecx
test al, al
je 0x406f90
push str.Cannot_find_destination_folder_
call fcn.004085ae
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004014ff
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004014ff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004014ff
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004014ff
xor al, al
call fcn.0043ea80
ret
lea eax, [ebp - 0x10]
push str.SymSilent
push eax
call fcn.00417145
pop ecx
pop ecx
push dword [ebp - 0x10]
lea ecx, [ebp - 0x18]
call fcn.004018b3
test eax, eax
je 0x406fea
push str.SymSilent_is_NOT_launched_from_install_destination.
call fcn.00408586
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004014ff
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004014ff
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004014ff
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.004014ff
mov al, bl
jmp 0x406f8a
push str.SymSilent_is_launched_from_install_destination.
call fcn.00408586
mov bl, 1
jmp 0x406fb9
Function at 0x40779e
Capabilities:
Move file

Disassembly:
push 0x14
mov eax, 0x463d77
call fcn.0043e9a8
push str.Removing_RunOnce_key_...
call fcn.00408586
pop ecx
call fcn.00407740
call fcn.00406e38
test al, al
jne 0x4077d5
push str.No_need_to_remove_files_and_Uninstall_key.
call fcn.00408586
pop ecx
mov al, 1
jmp 0x4078f8
push str.Removing_Uninstall_key...
call fcn.00408586
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [esp], 0x2001f
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], edi
call fcn.004013c6
test eax, eax
jne 0x4078e3
push str.SymSilent
lea ecx, [ebp - 0x20]
call fcn.004012f6
test eax, eax
jne 0x4078dc
push str.Uninstall_key_has_been_deleted.
call fcn.00408586
mov dword [esp], str.Delay_removing_EXE_and_its_folder...
call fcn.00408586
pop ecx
mov esi, 0x4872a4
push esi
lea ecx, [ebp - 0x10]
call fcn.00401c03
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00401c03
mov eax, 0x104
push eax
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00402209
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00401bd9
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.0040182a
push eax
push edi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x10]
call fcn.004029e6
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00402be3
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004014ff
mov ebx, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
push edi
push ebx
call esi
push 4
push edi
mov edi, dword [ebp - 0x14]
push edi
call esi
lea ecx, [edi - 0x10]
call fcn.004014ff
lea ecx, [ebx - 0x10]
call fcn.004014ff
lea ecx, [ebp - 0x20]
call fcn.00401351
jmp 0x4077ce
push str.Cannot_delete_uninstall_key_
jmp 0x4078e8
push str.Failed_to_open_Uninstall_key_
call fcn.004085ae
pop ecx
lea ecx, [ebp - 0x20]
call fcn.00401351
xor al, al
call fcn.0043ea80
ret
Function at 0x408ecc
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push 0x1c
push 0x47d360
call fcn.0043f178
mov edi, dword [ebp + 0x1c]
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
mov dword [edi], ebx
cmp dword [ebp + 0x14], 1
je 0x408efd
cmp dword [ebp + 0x14], 2
jne 0x409081
push 8
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x10]
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
call esi
cmp eax, ebx
jne 0x408f3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x8009000f
jne 0x409081
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call esi
cmp eax, ebx
je 0x409081
push edi
push 1
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
cmp eax, ebx
je 0x409081
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push 7
push ebx
push dword [edi]
mov esi, dword [sym.imp.ADVAPI32.dll_CryptExportKey]
call esi
cmp eax, ebx
je 0x409081
push dword [ebp - 0x28]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x20], eax
cmp eax, ebx
je 0x409081
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x20]
push ebx
push 7
push ebx
push dword [edi]
call esi
cmp eax, ebx
je 0x409081
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov dword [edi], ebx
push 4
mov esi, dword [ebp - 0x20]
lea eax, [esi + 0xc]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.0043ee10
add esp, 0xc
lea eax, [esi + 0x10]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 4
jge 0x408fd9
cmp ecx, ebx
jne 0x408fd3
mov byte [eax], 1
jmp 0x408fd6
mov byte [ecx + eax], bl
inc ecx
jmp 0x408fc2
mov ecx, dword [ebp - 0x24]
mov edx, ecx
shr edx, 4
mov esi, ecx
shr esi, 3
add esi, eax
lea eax, [esi + edx*2 + 4]
xor edx, edx
mov dword [ebp - 0x1c], edx
mov esi, ecx
shr esi, 4
cmp edx, esi
jae 0x40900f
cmp edx, ebx
jne 0x409003
mov byte [eax], 1
jmp 0x409006
mov byte [edx + eax], bl
inc edx
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x24]
jmp 0x408ff1
mov edx, ecx
shr edx, 4
add eax, edx
xor edx, edx
mov dword [ebp - 0x1c], edx
mov esi, ecx
shr esi, 4
cmp edx, esi
jae 0x409039
cmp edx, ebx
jne 0x40902d
mov byte [eax], 1
jmp 0x409030
mov byte [edx + eax], bl
inc edx
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x24]
jmp 0x40901b
mov edx, ecx
shr edx, 4
lea eax, [eax + edx*2]
xor edx, edx
mov dword [ebp - 0x1c], edx
shr ecx, 3
cmp edx, ecx
jae 0x409062
cmp edx, ebx
jne 0x409056
mov byte [eax], 1
jmp 0x409059
mov byte [edx + eax], bl
inc edx
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x24]
jmp 0x409046
push edi
push ebx
push ebx
push dword [ebp - 0x28]
push dword [ebp - 0x20]
mov eax, dword [ebp + 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x409081
mov dword [ebp - 0x2c], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.0040909b
mov eax, dword [ebp - 0x2c]
call fcn.0043f1bd
ret
Function at 0x4090cd
Capabilities:
Generate random numbers via winapi

Disassembly:
push 0x8c
push 0x47d380
call fcn.0043f36c
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x90], eax
xor esi, esi
mov dword [ebp - 0x84], esi
xor edi, edi
mov dword [ebp - 0x88], esi
xor eax, eax
inc eax
mov dword [ebp - 0x7c], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x78], 0x58
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
push 0x16
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetProvParam]
cmp eax, esi
je 0x409134
xor eax, eax
mov ecx, dword [ebp + 0x10]
cmp dword [ebp - 0x74], ecx
jne 0x409130
xor edi, edi
inc edi
mov dword [ebp - 0x9c], edi
cmp edi, esi
je 0x4090fe
cmp edi, esi
je 0x409295
lea eax, [ebp - 0x7c]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
cmp eax, esi
je 0x409295
push 4
pop ebx
mov dword [ebp - 0x78], ebx
push 0
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x8c]
push eax
push 9
push dword [ebp - 0x7c]
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
call edi
test eax, eax
je 0x409295
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
and dword [ebp - 0x7c], 0
mov eax, dword [ebp + 0x18]
shl eax, 3
cmp eax, dword [ebp - 0x8c]
ja 0x409295
mov dword [ebp - 0x78], ebx
push 0
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x98]
push eax
push 7
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x409295
mov dword [ebp - 0x78], ebx
push 0
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x94]
push eax
push 9
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x409295
mov edi, dword [ebp - 0x94]
shr edi, 3
add edi, 0xc
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
mov dword [ebp - 0x88], esi
test esi, esi
je 0x409295
mov byte [esi], 1
mov byte [esi + 1], 2
xor eax, eax
mov word [esi + 2], ax
mov eax, dword [ebp + 0x10]
mov dword [esi + 4], eax
lea eax, [esi + 8]
mov ecx, dword [ebp - 0x98]
mov dword [eax], ecx
add eax, ebx
xor ecx, ecx
mov dword [ebp - 0x80], ecx
mov edx, dword [ebp + 0x18]
cmp ecx, edx
jae 0x40923a
mov ebx, dword [ebp + 0x14]
sub ebx, ecx
mov dl, byte [ebx + edx - 1]
mov byte [ecx + eax], dl
inc ecx
jmp 0x409221
mov ecx, edi
sub ecx, edx
sub ecx, 0xf
mov dword [ebp - 0x78], ecx
lea ebx, [eax + edx + 1]
push ebx
push ecx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x409295
xor eax, eax
mov dword [ebp - 0x80], eax
cmp eax, dword [ebp - 0x78]
jae 0x40926e
cmp byte [eax + ebx], 0
jne 0x40926b
mov byte [eax + ebx], 1
inc eax
jmp 0x409259
mov byte [edi + esi - 2], 2
push dword [ebp - 0x90]
xor ebx, ebx
inc ebx
push ebx
push dword [ebp + 0xc]
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x409295
mov dword [ebp - 0x84], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.004092b3
mov eax, dword [ebp - 0x84]
call fcn.0043f3b4
ret
Function at 0x4092ce
Capabilities:
Decode data using base64 via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
push str.TestContainer
xor esi, esi
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
call fcn.00408ecc
add esp, 0x18
test eax, eax
jne 0x409314
push str.Cannot_create_private_exponent_one_key_
call fcn.004085ae
pop ecx
xor al, al
jmp 0x409425
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x6603
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.004090cd
add esp, 0x18
test eax, eax
jne 0x40933c
push str.Cannot_import_3DES_key_
jmp 0x409307
push esi
push dword [ebp + 0x14]
push 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
jne 0x409356
push str.Cannot_set_3DES_IV_
jmp 0x409307
mov ecx, dword [ebp + 8]
push edi
call fcn.0043a5b6
mov ecx, dword [ebp + 8]
mov edi, eax
call fcn.00422e84
mov dword [ebp - 4], eax
cmp byte [edi], 0xef
jne 0x409384
cmp byte [edi + 1], 0xbb
jne 0x409384
cmp byte [edi + 2], 0xbf
jne 0x409384
add edi, 3
sub dword [ebp - 4], 3
push ebx
mov ebx, dword [ebp + 0x18]
push dword [ebp - 4]
mov ecx, ebx
call fcn.00417bb8
push esi
push esi
lea eax, [ebp - 4]
push eax
mov ecx, ebx
call fcn.0043a5b6
push eax
push 1
push esi
push edi
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
lea eax, [ebp - 4]
push eax
mov ecx, ebx
call fcn.0043a5b6
push eax
push esi
push 1
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x4093d6
push str.Cannot_decrypt_3DES_data_
call fcn.004085ae
pop ecx
xor al, al
jmp 0x409423
push dword [ebp - 4]
mov ecx, ebx
call fcn.00417fec
mov edi, dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
cmp dword [ebp - 8], esi
je 0x4093f0
push dword [ebp - 8]
call edi
cmp dword [ebp - 0x10], esi
je 0x4093fa
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 0xc], esi
je 0x409421
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 0x10
push 1
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
push str.TestContainer
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov al, 1
pop ebx
pop edi
pop esi
leave
ret
Function at 0x409667
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x485df0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x4096a2
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e999
leave
ret
lea eax, [ebp - 0x230]
push eax
push edi
mov dword [ebp - 0x230], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x4096c8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
jmp 0x409693
lea eax, [ebp - 0x20c]
push eax
mov ecx, esi
call fcn.004018b3
test eax, eax
je 0x4096e9
lea eax, [ebp - 0x230]
push eax
push edi
call sub.KERNEL32.dll_Process32NextW
jmp 0x4096b9
mov bl, 1
jmp 0x4096bd

Function at 0x4096ed
Capabilities:
Create process on windows

Disassembly:
push 0x58
mov eax, 0x4640ef
call fcn.0043e9a8
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.0043f490
add esp, 0xc
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x64], edi
call fcn.004021eb
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push esi
push 0x8000000
push esi
push esi
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.004094a6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x409756
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004014ff
mov eax, esi
call fcn.0043ea80
ret
push dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
cmp dword [ebp + 0xc], esi
je 0x409771
push 0xffffffffffffffff
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp + 0x10], esi
je 0x409782
push dword [ebp + 0x10]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x20]
call edi
xor esi, esi
inc esi
jmp 0x409743