joyce8/EMBER2024-capa huggingface dataset:
Function at 0xffde972
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 4], 0
push esi
push 0x14
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
lea ecx, [eax + 0x38]
push ecx
lea ecx, [eax + 0x58]
push ecx
add eax, 0x174
push eax
call fcn.0ffdc536
test eax, eax
je 0xffde9a1
mov esi, eax
jmp 0xffdea15
push edi
mov edi, dword [ebp + 0x10]
push 1
lea eax, [ebp - 4]
push eax
push edi
push 0x14
lea eax, [ebp - 0x18]
push eax
call fcn.0ffde89a
test eax, eax
jne 0xffde9ed
test edi, edi
mov esi, dword [ebp + 0xc]
jbe 0xffde9d1
mov ecx, dword [ebp - 4]
mov cl, byte [eax + ecx]
xor byte [esi + eax + 0x15], cl
inc eax
cmp eax, edi
jb 0xffde9c2
lea eax, [ebp - 0x2c]
push 0
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x14
push edi
lea eax, [esi + 0x15]
push eax
call fcn.0ffde89a
test eax, eax
je 0xffde9f1
mov esi, eax
jmp 0xffdea06
xor eax, eax
mov cl, byte [ebp + eax - 0x2c]
xor cl, byte [ebp + eax - 0x18]
inc eax
cmp eax, 0x14
mov byte [esi + eax], cl
jb 0xffde9f3
xor esi, esi
cmp dword [ebp - 4], 0
pop edi
je 0xffdea15
push dword [ebp - 4]
call fcn.0ffe82e0
mov eax, esi
pop esi
leave
ret 0xc

Function at 0xffdea1c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, eax
cmp byte [esi], 0
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
je 0xffdea41
mov edi, 0x80090005
jmp 0xffdeab2
mov edi, dword [ebp + 0xc]
push ebx
lea eax, [ebp - 0x18]
push 0
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
push 0x14
add edi, 0xffffffeb
push edi
lea ebx, [esi + 0x15]
push ebx
call fcn.0ffde89a
test eax, eax
je 0xffdea68
mov edi, eax
jmp 0xffdeab1
xor eax, eax
lea ecx, [esi + 1]
mov dl, byte [ebp + eax - 0x18]
xor byte [ecx + eax], dl
inc eax
cmp eax, 0x14
jb 0xffdea6d
push 1
lea eax, [ebp - 4]
push eax
push edi
push 0x14
push ecx
call fcn.0ffde89a
test eax, eax
mov esi, dword [ebp - 4]
je 0xffdea94
mov edi, eax
jmp 0xffdeaa7
xor eax, eax
test edi, edi
jbe 0xffdeaa5
mov cl, byte [eax + esi]
xor byte [ebx + eax], cl
inc eax
cmp eax, edi
jb 0xffdea9a
xor edi, edi
test esi, esi
je 0xffdeab1
push esi
call fcn.0ffe82e0
pop ebx
mov eax, edi
pop edi
pop esi
leave
ret 8
Function at 0xffdff3f
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x60]
sub esp, 0x14c
mov edx, dword [ebp + 0x6c]
and dword [ebp + 0x5c], 0
cmp edx, 0x40
jbe 0xffdff59
push 0x40
pop edx
push esi
mov esi, dword [ebp + 0x68]
push edi
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x98]
rep stosd dword es:[edi], eax
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea edi, [ebp - 0x98]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x68]
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x58]
rep stosd dword es:[edi], eax
mov ecx, edx
mov eax, ecx
shr ecx, 2
lea edi, [ebp - 0x58]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor eax, eax
xor dword [ebp + eax - 0x98], 0x36363636
xor dword [ebp + eax - 0x58], 0x5c5c5c5c
add eax, 4
cmp eax, 0x40
jb 0xffdffa3
cmp dword [ebp + 0x78], 0x8004
jne 0xffe002d
lea eax, [ebp - 0x18]
push eax
call sub.ADVAPI32.dll_A_SHAInit
push 0x40
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x18]
push eax
call sub.ADVAPI32.dll_A_SHAUpdate
push dword [ebp + 0x74]
lea eax, [ebp - 0x18]
push dword [ebp + 0x70]
push eax
call sub.ADVAPI32.dll_A_SHAUpdate
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
call sub.ADVAPI32.dll_A_SHAFinal
push 0x10
pop ecx
push 5
lea esi, [ebp - 0x58]
lea edi, [ebp - 0xec]
rep movsd dword es:[edi], dword [esi]
pop ecx
push dword [ebp + 0x7c]
lea eax, [ebp - 0xec]
push 0x54
lea esi, [ebp - 0x14]
lea edi, [ebp - 0xac]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0ffdfed2
jmp 0xffe008c
lea eax, [ebp - 0x10]
push eax
call sub.ADVAPI32.dll_MD5Init
push 0x40
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x10]
push eax
call sub.ADVAPI32.dll_MD5Update
push dword [ebp + 0x74]
lea eax, [ebp - 0x10]
push dword [ebp + 0x70]
push eax
call sub.ADVAPI32.dll_MD5Update
lea eax, [ebp - 0x10]
push eax
call sub.ADVAPI32.dll_MD5Final
push 0x10
pop ecx
push dword [ebp + 0x7c]
lea esi, [ebp - 0x58]
lea edi, [ebp - 0xec]
rep movsd dword es:[edi], dword [esi]
lea esi, [ebp + 0x48]
lea edi, [ebp - 0xac]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x50
lea eax, [ebp - 0xec]
push eax
movsd dword es:[edi], dword [esi]
call fcn.0ffdff03
test eax, eax
je 0xffe0097
mov dword [ebp + 0x5c], 1
mov eax, dword [ebp + 0x5c]
pop edi
pop esi
add ebp, 0x60
leave
ret 0x18
Function at 0xffe01a2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, eax
shr eax, 1
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
add eax, esi
push edi
push eax
and ebx, 1
mov dword [ebp - 8], eax
call fcn.0ffe82b0
mov edi, eax
test edi, edi
mov dword [ebp - 4], edi
jne 0xffe01da
push 8
pop esi
jmp 0xffe0295
push dword [ebp + 0x24]
call fcn.0ffe82b0
test eax, eax
mov dword [ebp + 0xc], eax
jne 0xffe01f1
push 8
pop esi
jmp 0xffe027f
mov edx, dword [ebp + 0x14]
mov ecx, esi
mov esi, dword [ebp + 0x10]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push dword [ebp + 0x24]
mov ecx, eax
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x18]
lea edi, [eax + edx]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x8003
push dword [ebp - 8]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp + 8]
push eax
add ebx, esi
push ebx
push edi
call fcn.0ffe00a3
test eax, eax
jne 0xffe0261
push dword [ebp + 0x24]
add esi, edi
push dword [ebp + 0xc]
push 0x8004
push dword [ebp - 8]
push dword [ebp - 4]
push ebx
push esi
call fcn.0ffe00a3
test eax, eax
je 0xffe0265
mov esi, eax
jmp 0xffe027f
mov esi, dword [ebp + 0x24]
test esi, esi
jbe 0xffe027d
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0xc]
sub ecx, eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0xffe0274
xor esi, esi
cmp dword [ebp + 0xc], 0
je 0xffe028d
push dword [ebp + 0xc]
call fcn.0ffe82e0
push dword [ebp - 4]
call fcn.0ffe82e0
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x20
Function at 0xffe2880
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x18]
sub esp, 0x20
cmp eax, 1
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
push edi
jne 0xffe28f5
test ebx, ebx
jbe 0xffe294b
mov esi, dword [esp + 0x3c]
mov ebp, dword [esp + 0x40]
mov edi, dword [esp + 0x4c]
sub ebp, esi
mov dword [esp + 0x38], ebx
mov edi, edi
mov eax, dword [esp + 0x44]
push 1
push eax
push edi
lea ecx, [esp + 0x1c]
push ecx
call dword [esp + 0x44]
mov dl, byte [esi + ebp]
xor dl, byte [esp + 0x10]
lea eax, [ebx - 1]
push eax
lea eax, [edi + 1]
push eax
push edi
mov byte [esi], dl
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
mov al, byte [esi]
mov byte [ebx + edi - 1], al
mov eax, dword [esp + 0x38]
inc esi
dec eax
mov dword [esp + 0x38], eax
jne 0xffe28b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x1c
test ebx, ebx
jbe 0xffe294b
mov esi, dword [esp + 0x40]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0x4c]
sub ebp, esi
mov dword [esp + 0x38], ebx
jmp 0xffe2910
mov ecx, dword [esp + 0x44]
push 1
push ecx
push edi
lea edx, [esp + 0x1c]
push edx
call dword [esp + 0x44]
mov al, byte [esi]
xor al, byte [esp + 0x10]
mov byte [esi + ebp], al
lea eax, [ebx - 1]
push eax
lea eax, [edi + 1]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_RtlMoveMemory]
mov cl, byte [esi]
mov eax, dword [esp + 0x38]
inc esi
dec eax
mov byte [ebx + edi - 1], cl
mov dword [esp + 0x38], eax
jne 0xffe2910
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0x1c
Function at 0xffe4890
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov edx, dword [esp + 0xc]
sub esp, 0x20
push ebx
add edx, 0xfffffffa
push ebp
lea eax, [edx - 1]
test eax, eax
push esi
push edi
jl 0xffe48be
mov ecx, dword [esp + 0x34]
lea esi, [esp + 0x10]
sub ecx, esi
nop
lea esi, [ecx + eax*4]
dec eax
mov esi, dword [esp + esi + 0x10]
mov dword [esp + eax*4 + 0x14], esi
jns 0xffe48b0
mov ebp, dword [esp + 0x38]
xor esi, esi
xor ecx, ecx
xor eax, eax
test edx, edx
jle 0xffe4902
lea esp, [esp]
mov edi, dword [esp + 0x3c]
inc edi
cmp esi, edi
jge 0xffe4902
cmp eax, edx
jge 0xffe48f6
lea ecx, [ecx]
cmp ecx, 4
jge 0xffe48f9
mov ebx, dword [esp + eax*4 + 0x10]
lea edi, [ecx + esi*4]
inc eax
inc ecx
cmp eax, edx
mov dword [ebp + edi*4], ebx
jl 0xffe48e0
cmp ecx, 4
jne 0xffe48fe
inc esi
xor ecx, ecx
cmp eax, edx
jl 0xffe48d0
mov eax, dword [esp + 0x3c]
inc eax
cmp esi, eax
mov dword [esp + 0x34], eax
jge 0xffe4a6c
mov dword [esp + 0x3c], 0xffd48f0
jmp 0xffe4920
movzx edi, byte [esp + edx*4 + 0xd]
mov bl, byte [edi + 0xffd16f0]
mov al, byte [esp + 0x10]
xor al, bl
mov byte [esp + 0x10], al
movzx edi, byte [esp + edx*4 + 0xe]
mov bl, byte [edi + 0xffd16f0]
xor byte [esp + 0x11], bl
movzx edi, byte [esp + edx*4 + 0xf]
mov bl, byte [edi + 0xffd16f0]
xor byte [esp + 0x12], bl
movzx edi, byte [esp + edx*4 + 0xc]
mov bl, byte [edi + 0xffd16f0]
mov edi, dword [esp + 0x3c]
xor byte [esp + 0x13], bl
xor al, byte [edi]
add edi, 4
cmp edx, 8
mov byte [esp + 0x10], al
mov dword [esp + 0x3c], edi
mov eax, 1
je 0xffe49a0
cmp edx, eax
jle 0xffe4a24
mov ebx, dword [esp + eax*4 + 0x10]
mov edi, dword [esp + eax*4 + 0xc]
xor ebx, edi
mov dword [esp + eax*4 + 0x10], ebx
inc eax
cmp eax, edx
jl 0xffe4985
jmp 0xffe4a24
mov ebx, dword [esp + eax*4 + 0x10]
mov edi, dword [esp + eax*4 + 0xc]
xor ebx, edi
mov dword [esp + eax*4 + 0x10], ebx
inc eax
cmp eax, 4
jl 0xffe49a0
movzx eax, byte [esp + 0x1c]
mov al, byte [eax + 0xffd16f0]
mov bl, byte [esp + 0x20]
xor bl, al
movzx eax, byte [esp + 0x1d]
mov al, byte [eax + 0xffd16f0]
mov byte [esp + 0x20], bl
mov bl, byte [esp + 0x21]
xor bl, al
movzx eax, byte [esp + 0x1e]
mov al, byte [eax + 0xffd16f0]
mov byte [esp + 0x21], bl
mov bl, byte [esp + 0x22]
xor bl, al
movzx eax, byte [esp + 0x1f]
mov al, byte [eax + 0xffd16f0]
mov byte [esp + 0x22], bl
xor byte [esp + 0x23], al
mov eax, 5
jmp 0xffe4a10
mov ebx, dword [esp + eax*4 + 0x10]
mov edi, dword [esp + eax*4 + 0xc]
xor ebx, edi
mov dword [esp + eax*4 + 0x10], ebx
inc eax
cmp eax, 8
jl 0xffe4a10
xor eax, eax
test edx, edx
jle 0xffe4a62
lea ebx, [ebx]
cmp esi, dword [esp + 0x34]
jge 0xffe4a6c
cmp eax, edx
jge 0xffe4a56
lea ebx, [ebx]
cmp ecx, 4
jge 0xffe4a59
mov ebx, dword [esp + eax*4 + 0x10]
lea edi, [ecx + esi*4]
inc eax
inc ecx
cmp eax, edx
mov dword [ebp + edi*4], ebx
jl 0xffe4a40
cmp ecx, 4
jne 0xffe4a5e
inc esi
xor ecx, ecx
cmp eax, edx
jl 0xffe4a30
cmp esi, dword [esp + 0x34]
jl 0xffe4920
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 0xc
Function at 0xffe4a80
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
cmp ecx, 1
jle 0xffe4b77
mov eax, dword [esp + 4]
push esi
add eax, 0x16
dec ecx
push edi
jmp 0xffe4aa0
movzx esi, byte [eax - 4]
mov edi, dword [esi*4 + 0xffd40f0]
movzx edx, byte [eax - 3]
mov edx, dword [edx*4 + 0xffd44f0]
movzx esi, byte [eax - 5]
xor edx, edi
mov edi, dword [esi*4 + 0xffd3cf0]
movzx esi, byte [eax - 6]
xor edx, edi
xor edx, dword [esi*4 + 0xffd38f0]
mov dword [eax - 6], edx
movzx esi, byte [eax - 1]
mov edi, dword [esi*4 + 0xffd3cf0]
movzx edx, byte [eax + 1]
mov edx, dword [edx*4 + 0xffd44f0]
movzx esi, byte [eax]
xor edx, edi
mov edi, dword [esi*4 + 0xffd40f0]
movzx esi, byte [eax - 2]
xor edx, edi
xor edx, dword [esi*4 + 0xffd38f0]
mov dword [eax - 2], edx
movzx esi, byte [eax + 4]
mov edi, dword [esi*4 + 0xffd40f0]
movzx edx, byte [eax + 5]
mov edx, dword [edx*4 + 0xffd44f0]
movzx esi, byte [eax + 3]
xor edx, edi
mov edi, dword [esi*4 + 0xffd3cf0]
movzx esi, byte [eax + 2]
xor edx, edi
xor edx, dword [esi*4 + 0xffd38f0]
mov dword [eax + 2], edx
movzx esi, byte [eax + 8]
movzx edx, byte [eax + 9]
mov edi, dword [esi*4 + 0xffd40f0]
movzx esi, byte [eax + 7]
mov edx, dword [edx*4 + 0xffd44f0]
xor edx, edi
mov edi, dword [esi*4 + 0xffd3cf0]
movzx esi, byte [eax + 6]
xor edx, edi
xor edx, dword [esi*4 + 0xffd38f0]
mov dword [eax + 6], edx
add eax, 0x10
dec ecx
jne 0xffe4aa0
pop edi
pop esi
ret 8
Function at 0xffe5320
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor edx, edx
xor ecx, ecx
push esi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0xc]
push edi
mov edi, eax
mov ebx, dword [esp + 0x14]
push ebp
mov cl, byte [esi + 0x100]
mov ebp, ebx
mov dl, byte [esi + 0x101]
test ebx, ebx
je 0xffe545b
shr ebx, 2
and eax, 3
test ebx, ebx
je 0xffe5430
test eax, eax
jne 0xffe5430
mov eax, edi
lea edi, [edi + ebx*4]
mov dword [esp + 0x1c], edi
sub eax, 4
mov ebp, ebx
mov edi, dword [eax + 4]
inc ecx
xor eax, eax
and ecx, 0xff
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 8
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
inc ecx
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x10
xor edi, eax
and ecx, 0xff
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, 0xff
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov al, byte [esi + eax]
shl eax, 0x18
lea ebx, [ebp*4]
xor edi, eax
mov eax, dword [esp + 0x1c]
sub eax, ebx
mov dword [eax], edi
dec ebp
jne 0xffe5370
mov ebp, dword [esp + 0x18]
and ebp, 3
test ebp, ebp
je 0xffe545b
lea edi, [eax + 4]
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0xffe5430
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc

Function at 0xffe5580
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x18], ecx
ret 4
Function at 0xffe56d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
mov esi, dword [esp + 0x40]
mov eax, esi
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0xc], ecx
mov ecx, dword [eax + 8]
mov dword [esp + 0x10], edx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], edx
mov edx, dword [esp + 0x48]
mov eax, edx
mov ecx, dword [eax]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 4]
mov dword [esp + 0x20], ecx
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x24], ecx
push edi
mov ecx, esi
lea edi, [esp + 0x30]
mov dword [esp + 0x2c], eax
sub ecx, edx
mov eax, edx
sub edi, edx
mov ebp, 0x10
lea ebx, [ebx]
mov bl, byte [ecx + eax]
xor bl, byte [eax]
inc eax
dec ebp
mov byte [edi + eax - 1], bl
jne 0xffe5730
xor ecx, ecx
xor edi, edi
xor eax, eax
mov bl, byte [esp + eax + 0x10]
mov cl, byte [ecx + 0xffd4968]
xor bl, cl
mov byte [esp + eax + 0x10], bl
inc eax
cmp eax, 0x30
movzx ecx, bl
jb 0xffe5743
add ecx, edi
and ecx, 0xff
inc edi
cmp edi, 0x12
jb 0xffe5741
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x48]
mov dword [esi + 0xc], ecx
movzx ecx, byte [eax + 0xf]
sub edx, eax
mov esi, 0x10
movzx edi, byte [edx + eax]
mov bl, byte [eax]
xor edi, ecx
mov cl, byte [edi + 0xffd4968]
xor bl, cl
mov byte [eax], bl
inc eax
dec esi
movzx ecx, bl
jne 0xffe5794
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0xc

Function at 0xffe5b70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ebx
push ebp
lea ebp, [eax + 7]
shr ebp, 3
lea ecx, [ebp*8]
sub ecx, eax
mov ebx, 0xff
sar ebx, cl
push esi
mov esi, dword [esp + 0x14]
mov ecx, edx
mov eax, ecx
shr ecx, 2
push edi
mov edi, dword [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
cmp edx, 0x80
rep movsb byte es:[edi], byte [esi]
jge 0xffe5be6
mov ecx, dword [esp + 0x14]
mov edi, 1
mov esi, 0x80
sub edi, edx
lea eax, [ecx + edx - 1]
sub esi, edx
xor edx, edx
mov dl, byte [edi + eax]
xor ecx, ecx
mov cl, byte [eax]
add edx, ecx
and edx, 0xff
mov dl, byte [edx + 0xffd4b40]
mov byte [eax + 1], dl
inc eax
dec esi
jne 0xffe5bc8
mov edx, dword [esp + 0x14]
mov eax, edx
sub eax, ebp
movzx esi, byte [eax + 0x80]
add eax, 0x80
movzx ecx, bl
and ecx, esi
mov cl, byte [ecx + 0xffd4b40]
mov byte [eax], cl
mov ecx, 0x7f
sub ecx, ebp
js 0xffe5c2c
lea eax, [ecx + edx + 1]
inc ecx
movzx edx, byte [eax + ebp - 1]
movzx esi, byte [eax]
xor edx, esi
mov dl, byte [edx + 0xffd4b40]
mov byte [eax - 1], dl
dec eax
dec ecx
jne 0xffe5c15
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x10
Function at 0xffe82fd
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call sub.ADVAPI32.dll_SystemFunction040
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
ret 8

Function at 0xffe8316
Capabilities:
Encrypt data using dpapi

Disassembly:
push 0
push dword [esp + 0xc]
push dword [esp + 0xc]
call sub.ADVAPI32.dll_SystemFunction041
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
ret 8

Function at 0xffe833c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 4]
push eax
xor esi, esi
push 0x20119
push esi
push 0xffd5c74
push 0x80000002
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
mov dword [ebx + 0x110], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
cmp edi, 2
je 0xffe83ba
cmp edi, esi
jne 0xffe83bc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push 0xffd5c60
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
cmp edi, esi
jne 0xffe83b5
cmp dword [ebp - 0xc], 2
jne 0xffe83b5
mov dword [ebx + 0x110], 1
jmp 0xffe83bc
cmp edi, 2
jne 0xffe83bc
xor edi, edi
cmp dword [ebp - 4], esi
je 0xffe83ca
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0xffe8448
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
lea eax, [ebp - 4]
push eax
push 0x20119
xor edi, edi
push edi
push 0xffd5c74
push 0x80000002
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
cmp ebx, 2
jne 0xffe847c
xor ebx, ebx
jmp 0xffe84f9
cmp ebx, edi
jne 0xffe84f9
mov eax, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 8]
push ecx
add eax, 0x114
push eax
push edi
push edi
push 0xffd5cbc
push dword [ebp - 4]
mov dword [ebp - 8], 4
call esi
mov ebx, eax
cmp ebx, 2
jne 0xffe84b2
xor ebx, ebx
jmp 0xffe84f8
cmp ebx, edi
jne 0xffe84f8
mov eax, dword [ebp + 8]
add eax, 0x114
cmp dword [eax], edi
je 0xffe84f8
mov eax, dword [ebp + 8]
lea ecx, [ebp - 8]
push ecx
add eax, 0x118
push eax
push edi
push edi
push 0xffd5ca0
push dword [ebp - 4]
mov dword [ebp - 8], 4
mov dword [ebp + 8], eax
call esi
mov ebx, eax
cmp ebx, edi
jne 0xffe84f8
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
imul ecx, ecx, 0x3e8
mov dword [eax], ecx
pop esi
cmp dword [ebp - 4], edi
je 0xffe8507
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0xffe856c
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [sym.imp.CRYPT32.dll_CryptProtectData]
push edi
push 0xa
xor ebx, ebx
pop edi
jmp 0xffe85a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
sub ecx, 0x6b5
je 0xffe85c9
sub ecx, 6
jne 0xffe85ce
cmp ebx, 5
jae 0xffe85c2
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
add edi, edi
inc ebx
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
je 0xffe857f
xor eax, eax
jmp 0xffe85ce
mov eax, 0x6bb
jmp 0xffe85ce
mov eax, 0x426
pop edi
pop esi
pop ebx
pop ebp
ret 0x1c

Function at 0xffe85d5
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 0x24]
test edi, edi
mov dword [ebp - 4], 0xa
je 0xffe85f6
and dword [edi], 0
or dword [ebp + 0x1c], 0x41
push dword [ebp + 0x20]
mov esi, dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0xffe8669
call ebx
cmp eax, 0x6bb
jne 0xffe8640
cmp dword [ebp - 8], 5
jae 0xffe867f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
add eax, eax
inc dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0xffe8652
cmp eax, 0x52d
jne 0xffe867f
test edi, edi
je 0xffe867f
or dword [edi], 2
and dword [ebp + 0x1c], 0xfffffffe
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
je 0xffe861b
test edi, edi
je 0xffe867d
call ebx
cmp eax, 0x91012
jne 0xffe867d
or dword [edi], 8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x20
Function at 0xffe8845
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov dword [eax], esi
lea eax, [ebp - 4]
push eax
push 0x20119
push esi
push 0xffd5d08
push 0x80000002
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], 0x10
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 2
jne 0xffe8884
xor edi, edi
jmp 0xffe8959
cmp eax, esi
je 0xffe888f
mov edi, eax
jmp 0xffe8959
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push esi
mov ebx, 0xffd5cfc
push ebx
push dword [ebp - 4]
call edi
cmp eax, 2
jne 0xffe88b4
xor edi, edi
jmp 0xffe8958
cmp eax, esi
je 0xffe88bf
mov edi, eax
jmp 0xffe8958
push dword [ebp - 0xc]
call fcn.0ffe82b0
cmp eax, esi
mov dword [ebp - 8], eax
jne 0xffe88d3
push 8
pop edi
jmp 0xffe894b
lea ecx, [ebp - 0xc]
push ecx
push eax
push esi
push esi
push ebx
push dword [ebp - 4]
call edi
cmp eax, esi
jne 0xffe8903
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push esi
push 0xffffffffffffffff
push dword [ebp - 8]
push 2
push esi
call edi
cmp eax, esi
mov dword [ebp - 0x10], eax
jne 0xffe8907
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0xffe894b
lea eax, [eax + eax + 2]
push eax
call fcn.0ffe82b0
mov ebx, eax
cmp ebx, esi
jne 0xffe891c
push 8
pop edi
jmp 0xffe8941
push dword [ebp - 0x10]
push ebx
push 0xffffffffffffffff
push dword [ebp - 8]
push 2
push esi
call edi
test eax, eax
jne 0xffe8938
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0xffe8941
mov eax, dword [ebp + 8]
mov dword [eax], ebx
xor ebx, ebx
xor edi, edi
cmp ebx, esi
je 0xffe894b
push ebx
call fcn.0ffe82e0
cmp dword [ebp - 8], esi
je 0xffe8958
push dword [ebp - 8]
call fcn.0ffe82e0
pop ebx
cmp dword [ebp - 4], esi
je 0xffe8967
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret 4