joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d30c
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0xc], edx
push esi
push esi
push 3
push esi
push 7
mov edi, ecx
mov dword [ebp - 4], esi
push SysReAllocString
push edi
mov dword [ebp - 8], esi
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x49d355
call fcn.004c73cc
mov esi, eax
push esi
push 0x8130144
jmp 0x49d41d
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
test esi, esi
jne 0x49d37a
mov esi, 0x803d0000
push esi
push 0x81a0144
push edi
call dword [sym.imp.certcli.dll_Ordinal_359]
jmp 0x49d428
push esi
call fcn.004fee60
mov dword [ebp - 4], eax
test eax, eax
jne 0x49d39f
call fcn.004c73cc
mov esi, eax
push esi
push 0x8210144
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x49d424
push 0
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x49d3c1
call fcn.004c73cc
mov esi, eax
push esi
push 0x82c0144
jmp 0x49d41d
cmp esi, dword [ebp - 8]
jb 0x49d3c9
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, esi
call fcn.0049d288
push dword [ebp + 0x10]
xor eax, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
push dword [ebp - 4]
push eax
push eax
push eax
push dword [ebp - 0xc]
call dword [sym.imp.webservices.dll_WsReadXmlBufferFromBytes]
mov esi, eax
test esi, esi
je 0x49d3fc
push esi
push 0x83f0144
jmp 0x49d41d
push dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push 0
push 0
push dword [eax]
push dword [ebp - 0xc]
call dword [sym.imp.webservices.dll_WsSetInputToBuffer]
mov esi, eax
test esi, esi
je 0x49d426
push esi
push 0x8470144
push edi
call dword [sym.imp.certcli.dll_Ordinal_359]
test esi, esi
jns 0x49d433
push edi
push esi
xor edx, edx
xor ecx, ecx
call fcn.004cfab1
cmp ebx, 0xffffffff
je 0x49d43f
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call fcn.004feed0
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
Function at 0x49f74a
Capabilities:
Hash data via bcrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x1c]
push ebx
push ebx
push 0x40ac38
push eax
mov edi, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ncrypt.dll_BCryptOpenAlgorithmProvider]
mov esi, eax
test esi, esi
je 0x49f797
or esi, 0x10000000
push esi
push 0x107f0144
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x49f8bb
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ncrypt.dll_BCryptCreateHash]
mov esi, eax
test esi, esi
je 0x49f7bd
or esi, 0x10000000
push esi
push 0x108d0144
jmp 0x49f78c
push ebx
push 4
lea eax, [edi + 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ncrypt.dll_BCryptHashData]
mov esi, eax
test esi, esi
je 0x49f7e1
or esi, 0x10000000
push esi
push 0x10980144
jmp 0x49f78c
push ebx
push 4
lea eax, [edi + 8]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ncrypt.dll_BCryptHashData]
mov esi, eax
test esi, esi
je 0x49f805
or esi, 0x10000000
push esi
push 0x10a30144
jmp 0x49f78c
cmp dword [edi + 0xc], ebx
jbe 0x49f864
mov eax, dword [edi + 0x10]
lea edx, [ebp - 0x14]
mov eax, dword [eax + ebx*4]
mov ecx, eax
mov dword [ebp - 0x20], eax
call fcn.0049b8eb
mov esi, eax
test esi, esi
jne 0x49f8a9
mov ecx, dword [ebp - 0x20]
lea edx, [ebp - 0x28]
call fcn.0049b84c
push esi
push 0x10
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ncrypt.dll_BCryptHashData]
mov esi, eax
test esi, esi
jne 0x49f89b
push eax
push 8
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ncrypt.dll_BCryptHashData]
mov esi, eax
test esi, esi
jne 0x49f88d
inc ebx
cmp ebx, dword [edi + 0xc]
jb 0x49f80a
xor ebx, ebx
lea eax, [edi + 0x14]
push ebx
push 0x20
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ncrypt.dll_BCryptFinishHash]
mov esi, eax
test esi, esi
je 0x49f8b9
or esi, 0x10000000
push esi
push 0x10d00144
jmp 0x49f78c
or esi, 0x10000000
push esi
push 0x10c40144
jmp 0x49f8af
or esi, 0x10000000
push esi
push 0x10b90144
jmp 0x49f8af
push esi
push 0x10ad0144
call dword [sym.imp.certcli.dll_Ordinal_357]
xor ebx, ebx
jmp 0x49f8bb
mov esi, ebx
cmp dword [ebp - 0x18], 0
je 0x49f8ca
push dword [ebp - 0x18]
call dword [sym.imp.ncrypt.dll_BCryptDestroyHash]
cmp dword [ebp - 0x1c], 0
je 0x49f8da
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ncrypt.dll_BCryptCloseAlgorithmProvider]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005036b0
leave
ret

Function at 0x4a0f6e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4a0f93
call fcn.004c73cc
mov esi, eax
test esi, esi
je 0x4a0fa7
jmp 0x4a0f9c
test al, 0x10
jne 0x4a0fa7
mov esi, 0x8007010b
push edi
push esi
xor edx, edx
xor ecx, ecx
call fcn.004cfab1
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x4a0fb3
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push ebx
push esi
mov edx, eax
mov dword [ebp - 0x25c], eax
push edi
xor edi, edi
or esi, 0xffffffff
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, di
jne 0x4a0fdd
sub edx, ecx
sar edx, 1
lea eax, [edx + 3]
mov dword [ebp - 0x260], eax
add eax, eax
push eax
call fcn.004fee60
mov ebx, eax
test ebx, ebx
jne 0x4a1010
call fcn.004c73cc
push eax
push 0x1ce0146
jmp 0x4a108c
push dword [ebp - 0x25c]
mov edx, dword [ebp - 0x260]
mov ecx, ebx
call fcn.0043eb7d
mov edx, dword [ebp - 0x260]
mov ecx, ebx
push 0x41fbd4
call fcn.0043eadb
lea eax, [ebp - 0x258]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a1057
call fcn.004c73cc
push eax
push 0x1da0146
jmp 0x4a108c
test dword [ebp - 0x258], 0x10
jne 0x4a1064
inc edi
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4a1057
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x4a1092
call fcn.004c73cc
push eax
push 0x1ec0146
call dword [sym.imp.certcli.dll_Ordinal_357]
push ebx
call fcn.004feed0
cmp esi, 0xffffffff
je 0x4a10a4
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005036b0
leave
ret

Function at 0x4a182d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push 0x20119
push edi
push 0x41fed0
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a189a
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a189a
cmp dword [ebp - 0xc], 4
je 0x4a189d
push 0x8007000d
push 0x4aa0146
call dword [sym.imp.certcli.dll_Ordinal_357]
mov dword [ebp - 8], edi
cmp dword [ebp - 4], 0
pop edi
pop esi
je 0x4a18ae
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret
Function at 0x4a2726
Capabilities:
Hash data via bcrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x519928]
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
xor ecx, ecx
mov dword [ebp - 4], ecx
test eax, eax
jne 0x4a2777
push ecx
push ecx
push 0x40ac38
push 0x519928
call dword [sym.imp.ncrypt.dll_BCryptOpenAlgorithmProvider]
mov esi, eax
test esi, esi
je 0x4a2770
or esi, 0x10000000
push esi
push 0x9110146
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4a284c
mov eax, dword [0x519928]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.ncrypt.dll_BCryptCreateHash]
mov esi, eax
test esi, esi
je 0x4a279b
or esi, 0x10000000
push esi
push 0x9200146
jmp 0x4a2765
push 0
push 8
lea eax, [edi + 0x14]
push eax
push dword [ebp - 4]
call dword [sym.imp.ncrypt.dll_BCryptHashData]
mov esi, eax
test esi, esi
je 0x4a27c0
or esi, 0x10000000
push esi
push 0x92b0146
jmp 0x4a2765
push 0
push 4
lea eax, [edi + 0x20]
push eax
push dword [ebp - 4]
call dword [sym.imp.ncrypt.dll_BCryptHashData]
mov esi, eax
test esi, esi
je 0x4a27e5
or esi, 0x10000000
push esi
push 0x9360146
jmp 0x4a2765
add edi, 0x2c
xor esi, esi
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4a27ef
sub ecx, edx
sar ecx, 1
push esi
lea eax, [ecx + ecx]
push eax
push edi
push dword [ebp - 4]
call dword [sym.imp.ncrypt.dll_BCryptHashData]
mov esi, eax
test esi, esi
je 0x4a2824
or esi, 0x10000000
push esi
push 0x9410146
jmp 0x4a2765
xor edi, edi
push edi
push 0x20
push ebx
push dword [ebp - 4]
call dword [sym.imp.ncrypt.dll_BCryptFinishHash]
mov esi, eax
test esi, esi
je 0x4a284a
or esi, 0x10000000
push esi
push 0x94c0146
jmp 0x4a2765
mov esi, edi
cmp dword [ebp - 4], 0
je 0x4a285b
push dword [ebp - 4]
call dword [sym.imp.ncrypt.dll_BCryptDestroyHash]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4a2de1
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x274
mov eax, dword [0x5184d0]
xor eax, esp
mov dword [esp + 0x270], eax
or dword [esp + 0xc], 0xffffffff
mov eax, ecx
push ebx
xor ecx, ecx
mov dword [esp + 0x1c], edx
push esi
push edi
mov edi, ecx
mov dword [edx], ecx
mov dword [esp + 0x1c], ecx
mov ebx, ecx
mov dword [esp + 0x14], ecx
mov edx, 0x405e54
lea ecx, [esp + 0x14]
mov dword [esp + 0x20], eax
push ecx
push ecx
mov ecx, eax
mov dword [esp + 0x18], edi
call fcn.004cc4cd
mov esi, eax
test esi, esi
je 0x4a2e46
push esi
push 0x8f0147
jmp 0x4a2fab
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 0x18], esi
cmp esi, 0xffffffff
jne 0x4a2e72
call fcn.004c73cc
mov esi, eax
push esi
push 0x950147
jmp 0x4a2fab
test dword [esp + 0x28], 0x10
jne 0x4a2f1b
cmp dword [esp + 0x44], 0
jne 0x4a2f1b
cmp dword [esp + 0x48], 0
je 0x4a2f1b
xor eax, eax
cmp ax, word [esp + 0x54]
je 0x4a2f1b
lea ecx, [esp + 0x54]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [esp + 0x1c]
jne 0x4a2ea6
sub ecx, edx
sar ecx, 1
cmp ecx, 0x104
ja 0x4a2f1b
mov ecx, dword [esp + 0x20]
lea eax, [esp + 0x10]
push eax
lea edx, [esp + 0x58]
call fcn.004a2d15
test eax, eax
jne 0x4a2f17
xor edi, edi
test ebx, ebx
jne 0x4a2ef1
push edi
push edi
push edi
push 0x10001
push 0xb
call dword [sym.imp.CRYPT32.dll_CertOpenStore]
mov ebx, eax
test ebx, ebx
je 0x4a2f68
push edi
push edi
mov edi, dword [esp + 0x18]
push edi
push ebx
call dword [sym.imp.CRYPT32.dll_CertAddStoreToCollection]
test eax, eax
je 0x4a2f81
xor eax, eax
push eax
push edi
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
xor eax, eax
mov edi, eax
mov dword [esp + 0x10], edi
jmp 0x4a2f1b
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4a2e72
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4a2f9e
test ebx, ebx
jne 0x4a2f90
mov ecx, 0xc2b
call fcn.004cf8b9
push eax
call fcn.004c5942
mov dword [esp], 0x406520
call fcn.004c5942
pop ecx
mov esi, 0x80092004
push esi
push 0xd70147
jmp 0x4a2fab
call fcn.004c73cc
mov esi, eax
push esi
push 0xb20147
call dword [sym.imp.certcli.dll_Ordinal_357]
mov edi, dword [esp + 0x10]
jmp 0x4a2fb1
call fcn.004c73cc
mov esi, eax
push esi
push 0xbd0147
jmp 0x4a2fab
mov eax, dword [esp + 0x24]
mov dword [eax], ebx
xor eax, eax
mov ebx, eax
mov esi, eax
jmp 0x4a2fb1
call fcn.004c73cc
mov esi, eax
push esi
push 0xcd0147
call dword [sym.imp.certcli.dll_Ordinal_357]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test ebx, ebx
je 0x4a2fc9
xor eax, eax
push eax
push ebx
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
test edi, edi
je 0x4a2fd7
xor eax, eax
push eax
push edi
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
mov eax, dword [esp + 0x18]
cmp eax, 0xffffffff
je 0x4a2fe7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x27c]
mov eax, esi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.005036b0
mov esp, ebp
pop ebp
ret
Function at 0x4a37a5
Capabilities:
Encode data using xor

Disassembly:
movzx edx, word [edx]
push ebx
push esi
xor ebx, ebx
xor esi, esi
inc ebx
movzx ecx, si
mov al, cl
and al, bl
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, edx
xor ax, cx
movzx ecx, ax
mov al, cl
and al, bl
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, edx
xor ax, cx
movzx ecx, ax
mov al, cl
and al, bl
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, edx
xor ax, cx
movzx ecx, ax
mov al, cl
and al, bl
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, edx
xor ax, cx
movzx ecx, ax
mov al, cl
and al, bl
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, edx
xor ax, cx
movzx ecx, ax
mov al, cl
and al, bl
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, edx
xor ax, cx
movzx ecx, ax
mov al, cl
and al, bl
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, edx
xor ax, cx
movzx ecx, ax
mov al, cl
and al, bl
movzx eax, al
neg eax
sbb eax, eax
shr cx, 1
and eax, edx
xor ax, cx
mov word [esi*2 + 0x5196c0], ax
inc esi
cmp esi, 0x100
jl 0x4a37af
pop esi
pop ebx
ret

Function at 0x4a387d
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
push edi
mov edi, dword [ebp + 0xc]
movzx edx, word [esi]
test edi, edi
je 0x4a38b1
movzx eax, byte [ebx]
movzx ecx, dl
xor ecx, eax
shr dx, 8
xor dx, word [ecx*2 + 0x5196c0]
inc ebx
movzx edx, dx
sub edi, 1
jne 0x4a3894
pop edi
mov word [esi], dx
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4a38f3
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], edx
xor esi, esi
mov dword [ebp - 8], eax
xor ebx, ebx
mov dword [ebp - 4], esi
inc edi
cmp ecx, 0x10
setne bl
add ebx, 0x8003
lea eax, [ebp - 4]
push eax
push esi
push esi
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x4a3995
push esi
push dword [ebp - 8]
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4a3986
mov eax, dword [ebp + 0x10]
push esi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x4a3977
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov edx, dword [ebp - 0xc]
inc edi
mov dword [ebp - 4], esi
cmp edi, 0x64
jl 0x4a391d
jmp 0x4a39b7
call fcn.004c73cc
mov esi, eax
push esi
push 0xa7013e
jmp 0x4a39a2
call fcn.004c73cc
mov esi, eax
push esi
push 0x86013e
jmp 0x4a39a2
call fcn.004c73cc
mov esi, eax
push esi
push 0x7e013e
call dword [sym.imp.certcli.dll_Ordinal_357]
cmp dword [ebp - 4], 0
je 0x4a39b7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4a3f09
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 8
xor edi, edi
mov ebx, edx
cmp dword [ecx], 0x20
pop esi
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], edi
jne 0x4a3fd6
lea eax, [ebp - 0x90]
push eax
push edi
push edi
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
jne 0x4a3f6b
call fcn.004c73cc
mov esi, eax
push esi
push 0x1ff013e
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4a4041
push esi
lea eax, [ebp - 0x94]
mov dword [ebx], edi
push eax
push ebx
push edi
push edi
push edi
push dword [ebp - 0x90]
mov dword [ebx + 4], edi
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x4a3f9b
call fcn.004c73cc
mov esi, eax
push esi
push 0x209013e
jmp 0x4a3f60
mov eax, 0x8080808
mov dword [ebp - 0x94], esi
push esi
mov dword [ebx], eax
mov dword [ebx + 4], eax
lea eax, [ebp - 0x94]
push eax
push ebx
push edi
push edi
push edi
push dword [ebp - 0x90]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x4a403f
call fcn.004c73cc
mov esi, eax
push esi
push 0x213013e
jmp 0x4a3f60
push 0x20
lea esi, [ecx + 8]
pop ecx
lea edi, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
push 8
xor edi, edi
lea eax, [ebp - 0x8c]
push ebx
mov dword [ebx], edi
push eax
mov dword [ebx + 4], edi
call fcn.00435f20
mov esi, eax
test esi, esi
je 0x4a400b
push esi
push 0x225013e
jmp 0x4a3f60
lea eax, [ebp - 0x8c]
push eax
call fcn.00436750
mov esi, eax
test esi, esi
je 0x4a4028
push esi
push 0x228013e
jmp 0x4a3f60
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov dword [ebx], eax
lea eax, [ebp - 0x8c]
push eax
mov dword [ebx + 4], ecx
call fcn.004367a0
mov esi, edi
cmp dword [ebp - 0x90], 0
je 0x4a4056
push dword [ebp - 0x90]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005036b0
leave
ret 4
Function at 0x4a4165
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 8], eax
and dword [ebp - 0x94], 0
mov eax, edx
cmp dword [ecx], 0x10
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x9c], esi
je 0x4a41dc
cmp dword [ecx], 0x20
je 0x4a41dc
cmp dword [ecx], 0x40
jne 0x4a41c6
push edi
mov ecx, 0x804
call fcn.004ca44f
push 0x406520
call fcn.004c5942
pop ecx
mov esi, 0x8000ffff
push esi
push 0x27f013e
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4a42f2
cmp edi, 0xa0000
jbe 0x4a41f1
mov esi, 0x80070216
push esi
push 0x287013e
jmp 0x4a41d1
lea eax, [edi + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebx], eax
test eax, eax
jne 0x4a4210
mov esi, 0x8007000e
push esi
push 0x28d013e
jmp 0x4a41d1
push edi
push dword [ebp - 0x90]
mov dword [esi], edi
push dword [ebx]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x98]
add esp, 0xc
cmp dword [eax], 0x20
jne 0x4a4283
lea ecx, [ebp - 0x94]
push ecx
push 0
push 0
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
jne 0x4a4258
call fcn.004c73cc
mov esi, eax
push esi
push 0x29a013e
jmp 0x4a41d1
push esi
push dword [ebx]
push 0
push 1
push 0
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x4a42f0
call fcn.004c73cc
mov esi, eax
push esi
push 0x2a8013e
jmp 0x4a41d1
push 0x20
pop ecx
lea esi, [eax + 8]
lea edi, [ebp - 0x8c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x9c]
lea eax, [ebp - 0x8c]
push edi
push dword [ebx]
push dword [ebp - 0x90]
push eax
call fcn.00435a10
mov eax, dword [ebx]
lea ecx, [ebp - 0x90]
add eax, dword [edi]
and dword [ebp - 0x90], 0
push ecx
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.00435ec0
mov esi, eax
test esi, esi
je 0x4a42dc
push esi
push 0x2ca013e
jmp 0x4a41d1
mov eax, dword [ebp - 0x90]
add dword [edi], eax
lea eax, [ebp - 0x8c]
push eax
call fcn.004367a0
xor esi, esi
cmp dword [ebp - 0x94], 0
je 0x4a4307
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test esi, esi
je 0x4a431b
cmp dword [ebx], 0
je 0x4a431b
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebx], 0
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005036b0
leave
ret 0xc
Function at 0x4a4334
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa0
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
xor edx, edx
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x90], edx
mov dword [edi], edx
mov dword [ebx], eax
cmp dword [ecx], 0x10
je 0x4a4440
cmp dword [ecx], 0x20
je 0x4a4393
mov esi, 0x8000ffff
push esi
push 0x2f8013e
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4a44f9
lea eax, [ebp - 0x90]
push eax
push edx
push edx
push dword [ecx + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
jne 0x4a43b8
call fcn.004c73cc
mov esi, eax
push esi
push 0x2ff013e
jmp 0x4a4388
xor eax, eax
push eax
push ebx
push eax
push eax
push 1
push eax
push dword [ebp - 0x90]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x4a43e0
call fcn.004c73cc
mov esi, eax
push esi
push 0x30f013e
jmp 0x4a4388
push dword [ebx]
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [edi], eax
test eax, eax
jne 0x4a43ff
mov eax, 0x8007000e
push eax
mov esi, eax
push 0x316013e
jmp 0x4a4388
push dword [ebp + 8]
push esi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebp + 8]
push dword [ebx]
push eax
push dword [edi]
push 0
push 1
push 0
push dword [ebp - 0x90]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x4a44f7
call fcn.004c73cc
mov esi, eax
push esi
push 0x327013e
jmp 0x4a4388
lea esi, [ecx + 8]
lea edi, [ebp - 0x8c]
push 0x20
pop ecx
rep movsd dword es:[edi], dword [esi]
cmp eax, 0xa0000
jbe 0x4a4465
mov esi, 0x80070216
push esi
push 0x33a013e
jmp 0x4a4388
add eax, 8
push eax
push edx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, dword [ebp - 0x98]
mov dword [edi], eax
test eax, eax
jne 0x4a448e
mov eax, 0x8007000e
push eax
mov esi, eax
push 0x340013e
jmp 0x4a4388
push ebx
push eax
push dword [ebp - 0x9c]
lea eax, [ebp - 0x8c]
push eax
call fcn.00435150
mov esi, eax
test esi, esi
je 0x4a44b3
push esi
push 0x34a013e
jmp 0x4a4388
mov eax, dword [ebx]
lea ecx, [ebp - 0x94]
add eax, dword [edi]
and dword [ebp - 0x94], 0
push ecx
push eax
lea eax, [ebp - 0x8c]
push eax
call fcn.004359b0
mov esi, eax
test esi, esi
je 0x4a44e3
push esi
push 0x355013e
jmp 0x4a4388
mov eax, dword [ebp - 0x94]
add dword [ebx], eax
lea eax, [ebp - 0x8c]
push eax
call fcn.004367a0
xor esi, esi
cmp dword [ebp - 0x90], 0
je 0x4a450e
push dword [ebp - 0x90]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
test esi, esi
je 0x4a4528
mov edi, dword [ebp - 0x98]
cmp dword [edi], 0
je 0x4a4528
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [edi], 0
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005036b0
leave
ret 0xc