joyce8/EMBER2024-capa huggingface dataset:
Function at 0xe5f686
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0e50a54
jmp 0xe5f79c
pushfd
lea esp, [esp + 2]
call 0xe5f686
mov cs, word [eax]
sahf
stc
or byte [edi + 0x5c35a520], bh
scasd eax, dword es:[edi]
outsd dx, dword [esi]
push esp
invalid
mov dword [esp + 4], esi
pushfd
lea esp, [esp + 2]
call fcn.00e5f6a6
xchg dword [esp], esi
pushfd
mov dword [esp], esp
jmp 0xe5f6bc
push dword [esp + 2]
jmp 0xe5f703
lea esi, [esi + 0x19]
call fcn.00e5f68f
bnd jne 0xe5f6ac
invalid
push dword [esp + 1]
jl 0xe5f678
mov dword [esp + 4], esi
jmp 0xe5f65e
je 0xe5f719
lea esp, [esp + 2]
mov dword [esp + 0xc], edi
jmp 0xe5f8c7
lea esp, [esp + 2]
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
pushfd
jmp 0xe5f53f
rdtsc
lea esp, [esp + 1]
jmp 0xe5f771
add edi, esi
aas
mov gs, ebx
call 0x1d0a63ec
jmp 0xe5f743
lea ebp, [esp + 0x1c]
inc si
jae 0xe5f853
jb 0xe5f7e0
or dword [ecx + reloc.gdiplus.dll_GdipAlloc], ebx
js 0xe5f7cc
mov edi, dword [esp + 0x48]
lea ebp, [eax*4]
lea esi, [edi*4]
rdtsc
lea ebx, [edi*4]
jmp 0xe5f75b
push ax
sub esp, 0x1b
jo 0xe5f759
rdtsc
lea esp, [esp + 1]
jmp 0xe5f771
pop dword [esp]
dec dx
cmc
lea esp, [esp + 3]
mov edx, edi
jmp 0xe5f7e9
mov esi, esp
sub esp, 0x1f
jge 0xe5f7ab
pop dword [esp]
jmp 0xe5f7ff
xor dl, byte [edi]
xchg dword [edi], edx
jb 0xe5f753
scasd eax, dword es:[edi]
cmp byte [esi - 0x7c73c737], ch
adc eax, 0xd91fec85
add al, 0xb9
dec esi
push ebx
leave
iretd
mov ecx, 0xcfc9534e
neg ebx
jmp 0xe5f85a
lea ebx, [edx + esi]
mov ah, byte [esp]
not ebx
mov bx, 0x9f8b
not ch
jmp 0xe5f81e
dec dx
cmc
lea esp, [esp + 3]
jmp 0xe5f7b5
mov ax, bp
call fcn.00e5f808
xchg cx, ax
jmp 0xe5f87b
mov ecx, 0xcfc9534e
neg ebx
sub esp, 0xa4
jmp 0xe5f7c1
xchg bx, ax
jmp 0xe5f8b0
xor edi, 0x7b0eff7f
mov bx, 0x1e81
lea eax, reloc.gdiplus.dll_GdipAlloc
pushfd
jmp 0xe5f865
lea esp, [esp + 4]
not edi
mov bx, bp
bswap ecx
call fcn.00e5fb0e
invalid
lea esp, [esp + 0xc]
jmp 0xe5f725

Function at 0xe5f68f
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp + 1]
push dword [esp + 3]
xchg dword [esp + 0x10], esi
call fcn.00e5f6fc
pop eax
mov ebx, 0xef9c0d92
Function at 0xe5f6d2
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0e50a54
jmp 0xe5f79c
pushfd
lea esp, [esp + 2]
call 0xe5f686
mov cs, word [eax]
sahf
stc
or byte [edi + 0x5c35a520], bh
scasd eax, dword es:[edi]
outsd dx, dword [esi]
push esp
invalid
mov dword [esp + 4], esi
pushfd
lea esp, [esp + 2]
call fcn.00e5f6a6
xchg dword [esp], esi
pushfd
mov dword [esp], esp
jmp 0xe5f6bc
push dword [esp + 2]
jmp 0xe5f703
lea esi, [esi + 0x19]
call fcn.00e5f68f
bnd jne 0xe5f6ac
invalid
push dword [esp + 1]
jl 0xe5f678
mov dword [esp + 4], esi
jmp 0xe5f65e
je 0xe5f719
lea esp, [esp + 2]
mov dword [esp + 0xc], edi
jmp 0xe5f8c7
lea esp, [esp + 2]
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
pushfd
jmp 0xe5f53f
rdtsc
lea esp, [esp + 1]
jmp 0xe5f771
add edi, esi
aas
mov gs, ebx
call 0x1d0a63ec
jmp 0xe5f743
lea ebp, [esp + 0x1c]
inc si
jae 0xe5f853
jb 0xe5f7e0
or dword [ecx + reloc.gdiplus.dll_GdipAlloc], ebx
js 0xe5f7cc
mov edi, dword [esp + 0x48]
lea ebp, [eax*4]
lea esi, [edi*4]
rdtsc
lea ebx, [edi*4]
jmp 0xe5f75b
push ax
sub esp, 0x1b
jo 0xe5f759
rdtsc
lea esp, [esp + 1]
jmp 0xe5f771
pop dword [esp]
dec dx
cmc
lea esp, [esp + 3]
mov edx, edi
jmp 0xe5f7e9
mov esi, esp
sub esp, 0x1f
jge 0xe5f7ab
pop dword [esp]
jmp 0xe5f7ff
xor dl, byte [edi]
xchg dword [edi], edx
jb 0xe5f753
scasd eax, dword es:[edi]
cmp byte [esi - 0x7c73c737], ch
adc eax, 0xd91fec85
add al, 0xb9
dec esi
push ebx
leave
iretd
mov ecx, 0xcfc9534e
neg ebx
jmp 0xe5f85a
lea ebx, [edx + esi]
mov ah, byte [esp]
not ebx
mov bx, 0x9f8b
not ch
jmp 0xe5f81e
dec dx
cmc
lea esp, [esp + 3]
jmp 0xe5f7b5
mov ax, bp
call fcn.00e5f808
xchg cx, ax
jmp 0xe5f87b
mov ecx, 0xcfc9534e
neg ebx
sub esp, 0xa4
jmp 0xe5f7c1
xchg bx, ax
jmp 0xe5f8b0
xor edi, 0x7b0eff7f
mov bx, 0x1e81
lea eax, reloc.gdiplus.dll_GdipAlloc
pushfd
jmp 0xe5f865
lea esp, [esp + 4]
not edi
mov bx, bp
bswap ecx
call fcn.00e5fb0e
invalid
lea esp, [esp + 0xc]
jmp 0xe5f725

Function at 0xe6d896
Capabilities:
Check for vm using instruction vpcext

Disassembly:
pop si
mov si, ax
lea esp, [esp + 2]
push ecx
bswap esi
jmp 0xe6d8c8
xchg si, cx
lea esi, [edx - 0x4e]
pop ecx
mov si, di
jmp 0xe6d9c0
mov ch, 0x93
mov cl, byte [esp]
xchg cx, si
mov cx, word [esp]
xchg si, cx
lea ecx, [eax + edi]
jmp 0xe6d8b2
lea esi, [esi*4]
lea esi, [edx*4]
not esi
mov esi, dword [esp + 2]
lea esp, [esp + 0xc]
pushal
jmp 0xe6d8f3

Function at 0xecdf70
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp + 4]
jmp 0xecdfcd
lea ecx, [eax + ecx]
mov eax, dword [ecx]
pop ecx
call fcn.00ecdffd
sbb eax, 0x98690e98
jne 0xece02e
xchg edi, eax
dec cl
imul esi, esi, 0x14
push ecx
mov ecx, ecx
jmp 0xecdfb7
call 0x33c8d8be
cmp ah, bl
push ebx
xor byte [ebx + 0x23], dl
add edi, dword [ecx + reloc.gdiplus.dll_GdipAlloc]
push eax
clc
dec ecx
inc edx
push edi
scasd eax, dword es:[edi]
je 0xece020
dec ebp
cmpsb byte [esi], byte es:[edi]
dec ebx
int3

Function at 0x52b5b0
Capabilities:
Encode data using xor

Disassembly:
fiadd word [esp + ebx*8 - 0x70]
cmp dl, cl
xor edx, eax
invalid
Function at 0x401da0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x4c], 0x450043
push edi
mov dword [ebp - 0x48], 0x300043
mov dword [ebp - 0x44], 0x310039
mov dword [ebp - 0x40], 0x390030
mov dword [ebp - 0x3c], 0x43002d
mov dword [ebp - 0x38], 0x350035
mov dword [ebp - 0x34], 0x2d0041
mov dword [ebp - 0x30], 0x390034
mov dword [ebp - 0x2c], 0x410038
mov dword [ebp - 0x28], 0x41002d
mov dword [ebp - 0x24], 0x330042
mov dword [ebp - 0x20], 0x2d0036
mov dword [ebp - 0x1c], 0x350043
mov dword [ebp - 0x18], 0x460041
mov dword [ebp - 0x14], 0x310030
mov dword [ebp - 0x10], 0x340045
mov dword [ebp - 0xc], 0x410039
mov dword [ebp - 8], 0x310034
mov word [ebp - 4], ax
call fcn.00402330
mov ecx, eax
test ecx, ecx
je 0x401e88
mov eax, dword [ecx]
push 2
push 0x24
call dword [eax]
test eax, eax
je 0x401e92
mov esi, dword [ebp + 8]
add eax, 0x10
mov dword [esi], eax
cmp dword [eax - 8], 0x24
jl 0x401e7e
mov dword [eax - 0xc], 0x24
xor eax, eax
mov ecx, dword [esi]
push 0x48
mov word [ecx + 0x48], ax
lea eax, [ebp - 0x4c]
push eax
push 0x48
push dword [esi]
call fcn.004044d0
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.004020a0
push 0x80004005
call fcn.004020a0
call fcn.004040d0
int3
Function at 0x403520
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x474ead
mov eax, dword fs:[0]
push eax
mov eax, 0x2010
call fcn.00414820
mov eax, dword [0x498114]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x201c], edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x2018], 0
call fcn.00402330
mov ecx, eax
test ecx, ecx
je 0x4036bf
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x2014]
mov dword [ebp - 4], 0
push 1
push eax
mov dword [ebp - 0x2018], 1
call fcn.00409280
add esp, 8
mov esi, dword [ebp - 0x2014]
mov dword [ebp - 4], 1
cmp dword [esi - 0xc], 0
jne 0x4035de
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4036a0
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4036a0
push 0x2000
lea eax, [ebp - 0x2010]
push 0
push eax
call fcn.00416b00
add esp, 0xc
lea eax, [ebp - 0x2010]
push esi
push 0x1000
push eax
push 0x47a334
push 0x47a384
push str.mechanism
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push dword [ebp - 0x2014]
push 0
push 0x47a384
push str.mechanism
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
test eax, eax
jne 0x403655
mov edx, dword [ebp - 0x2014]
mov byte [ebp - 4], al
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4036a0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4036a0
lea ecx, [ebp - 0x2010]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403660
sub ecx, edx
lea eax, [ebp - 0x2010]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00403fa0
mov esi, dword [ebp - 0x2014]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4036a0
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00414809
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.004020a0
int3
Function at 0x404190
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4041e9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4041e9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4041da
cmp esi, edx
jae 0x4041e9
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4041c8
cmp esi, edx
jae 0x4041e9
cmp word [esi], 0
je 0x4041e9
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x405e00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x475116
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x498114]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], 0
mov dword [ebp - 0x418], 0
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 0x60
push 0
push edi
mov byte [ebp - 4], 1
call ebx
mov esi, eax
mov dword [ebp - 0x424], esi
test esi, esi
jne 0x405eac
push 2
push eax
push edi
call ebx
mov esi, eax
mov dword [ebp - 0x424], eax
test esi, esi
jne 0x405eac
call fcn.004051a0
mov edi, eax
jmp 0x405fcb
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x405ecf
call fcn.004051a0
jmp 0x405fbe
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
test ebx, ebx
jne 0x405eed
call fcn.004051a0
jmp 0x405fbe
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov dword [ebp - 0x41c], edi
lea eax, [edi + 1]
cmp eax, edi
jae 0x405f0e
mov edi, 0x8007000e
jmp 0x405fc0
mov ecx, 2
mov byte [ebp - 4], 2
mul ecx
test edx, edx
ja 0x406004
jb 0x405f2c
cmp eax, 0xffffffff
ja 0x406004
cmp eax, 0x400
jbe 0x405f41
push eax
lea ecx, [ebp - 0x418]
call fcn.004050c0
jmp 0x405f67
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x405f67
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
jne 0x405f7e
mov edi, 0x8007000e
jmp 0x405fc0
push edi
push dword [ebp - 0x418]
push edi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
jne 0x405f9e
call fcn.004051a0
jmp 0x405fbe
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.00405c60
mov edi, eax
test esi, esi
je 0x405fcb
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x405fe4
lea ecx, [ebp - 0x418]
call fcn.004053c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00414809
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.004020a0
int3
Function at 0x40b090
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
mov eax, dword [0x498114]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
js 0x40b224
push 0x208
lea eax, [ebp - 0x228]
push 0
push eax
call fcn.00416b00
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x104
push eax
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x228]
push eax
call edi
test esi, esi
jle 0x40b0ff
lea eax, [ebp - 0x228]
push eax
call edi
sub esi, 1
jne 0x40b0f1
lea eax, [ebp - 0x63c]
mov dword [ebp - 0x63c], 0
push eax
call fcn.00407a70
mov ecx, dword [ebp - 0x63c]
mov edi, eax
add esp, 4
mov esi, edi
lea ecx, [ecx + ecx*4]
shl ecx, 4
add ecx, edi
cmp edi, ecx
je 0x40b224
mov ebx, dword [sym.imp.SHLWAPI.dll_PathCombineW]
nop dword [eax + eax]
push 0x208
lea eax, [ebp - 0x638]
push 0
push eax
call fcn.00416b00
add esp, 0xc
lea eax, [ebp - 0x228]
push dword [esi + 8]
push eax
lea eax, [ebp - 0x638]
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [esi]
test eax, eax
jne 0x40b24a
cmp ecx, 2
jne 0x40b20b
push 0x208
push eax
lea eax, [ebp - 0x430]
push eax
call fcn.00416b00
add esp, 0xc
mov dword [ebp - 0x20], 0x61004d
lea eax, [ebp - 0x430]
mov dword [ebp - 0x1c], 0x740073
mov dword [ebp - 0x18], 0x720065
mov dword [ebp - 0x14], 0x440050
push 0
push 0x1a
push eax
push 0
mov dword [ebp - 0x10], 0x440046
mov dword [ebp - 0xc], 0x740061
mov dword [ebp - 8], 0x61
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x40b237
mov eax, dword [ebp - 0x63c]
add esi, 0x50
lea eax, [eax + eax*4]
shl eax, 4
add eax, edi
cmp esi, eax
jne 0x40b140
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414809
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414809
mov esp, ebp
pop ebp
ret
mov eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414809
mov esp, ebp
pop ebp
ret
Function at 0x40c8e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x498114]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0
push 0
push 0x80
push 2
push 1
push 0x40000000
push eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call fcn.0040b620
mov edi, dword [ebp - 0xc]
test eax, eax
js 0x40c973
cmp dword [esi + 0x14], 0x10
mov eax, dword [esi + 0x10]
jb 0x40c933
mov esi, dword [esi]
push 0
lea ecx, [ebp - 8]
push ecx
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40c951
call fcn.004051a0
mov esi, eax
test esi, esi
js 0x40c96c
push edi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x40c96a
call fcn.004051a0
mov esi, eax
not esi
shr esi, 0x1f
jmp 0x40c975
xor esi, esi
not esi
shr esi, 0x1f
jmp 0x40c975
xor esi, esi
test edi, edi
je 0x40c980
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00414809
mov esp, ebp
pop ebp
ret
Function at 0x410310
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x475eb6
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x498114]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, dword [ecx + 8]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 4], 0
test esi, esi
je 0x4103fd
test edi, edi
je 0x410429
mov edx, dword [ebp + 0x10]
test edx, 0xf
jne 0x410455
lea eax, [edx - 0x10]
cmp dword [ebp + 0xc], eax
jbe 0x410481
cmp byte [ecx + 0x10], 0
je 0x4104ad
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], edx
push eax
push edi
push 0
push 1
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov ecx, eax
test ecx, ecx
je 0x4104d9
jmp 0x4103d5
mov eax, dword [ebp - 0x18]
mov dword [ebx], eax
test ecx, ecx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00414809
mov esp, ebp
pop ebp
ret 0x10
push 0x80090003
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Key_is_not_valid
lea ecx, [ebp - 0xc0]
call fcn.0040ec80
push 0x491ddc
lea eax, [ebp - 0xc0]
push eax
call fcn.00415b12
push 0x6f8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Buffer_is_NULL
lea ecx, [ebp - 0xcc]
call fcn.0040ec80
push 0x491ddc
lea eax, [ebp - 0xcc]
push eax
call fcn.00415b12
push 0x80090005
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Data_size_is_not_a_multple_of_block_size
lea ecx, [ebp - 0xd8]
call fcn.0040ec80
push 0x491ddc
lea eax, [ebp - 0xd8]
push eax
call fcn.00415b12
push 0x80090028
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_Buffer_is_too_small
lea ecx, [ebp - 0xe4]
call fcn.0040ec80
push 0x491ddc
lea eax, [ebp - 0xe4]
push eax
call fcn.00415b12
push 0x80090027
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Decrypt_1_:_IV_has_not_been_set
lea ecx, [ebp - 0xf0]
call fcn.0040ec80
push 0x491ddc
lea eax, [ebp - 0xf0]
push eax
call fcn.00415b12
push 0x98
lea ecx, [ebp - 0xb0]
call fcn.004127f0
push 1
push 2
lea ecx, [ebp - 0xb0]
call fcn.0040e810
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 1
push str.Decrypt_1_:_CryptDecrypt_failed__
push eax
call fcn.0040e230
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 8
call esi
push eax
call fcn.00410f20
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.0040e230
add esp, 0xc
lea eax, [ebp - 0xb0]
push str.__0x
push eax
call fcn.0040e230
add esp, 8
mov ecx, eax
push 0x413500
call fcn.0040fbf0
mov edi, eax
call esi
push eax
mov ecx, edi
call fcn.0040f930
push 0x47fed0
push eax
call fcn.0040e230
add esp, 8
mov dword [ebx], 0
lea eax, [ebp - 0x114]
lea ecx, [ebp - 0xb0]
push eax
call fcn.00413ce0
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00412990
push eax
lea ecx, [ebp - 0xfc]
call fcn.0040ec80
push 0x491ddc
lea eax, [ebp - 0xfc]
push eax
call fcn.00415b12
push 0
push 0
call fcn.00415b12
int3
Function at 0x410930
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x475f36
mov eax, dword fs:[0]
push eax
sub esp, 0xfc
mov eax, dword [0x498114]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edx, dword [ecx + 8]
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 4], 0
test edx, edx
je 0x410a19
test esi, esi
je 0x410a45
mov ebx, dword [ebp + 0x10]
mov eax, ebx
and eax, 0xfffffff0
add eax, 0x10
cmp dword [ebp + 0xc], eax
jb 0x410a71
cmp byte [ecx + 0x10], 0
je 0x410a9d
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
push esi
push 0
push 1
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov ecx, eax
test ecx, ecx
je 0x410ac9
jmp 0x4109f1
mov eax, dword [ebp - 0x18]
mov dword [edi], eax
test ecx, ecx
setne al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00414809
mov esp, ebp
pop ebp
ret 0x10
push 0x80090003
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Encrypt_1_:_Key_is_not_valid
lea ecx, [ebp - 0xc0]
call fcn.0040ec80
push 0x491ddc
lea eax, [ebp - 0xc0]
push eax
call fcn.00415b12
push 0x6f8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Encrypt_1_:_Buffer_is_NULL
lea ecx, [ebp - 0xcc]
call fcn.0040ec80
push 0x491ddc
lea eax, [ebp - 0xcc]
push eax
call fcn.00415b12
push 0x80090028
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Encrypt_1_:_Buffer_is_too_small
lea ecx, [ebp - 0xd8]
call fcn.0040ec80
push 0x491ddc
lea eax, [ebp - 0xd8]
push eax
call fcn.00415b12
push 0x80090027
call dword [sym.imp.KERNEL32.dll_SetLastError]
push str.Encrypt_1_:_IV_has_not_been_set
lea ecx, [ebp - 0xe4]
call fcn.0040ec80
push 0x491ddc
lea eax, [ebp - 0xe4]
push eax
call fcn.00415b12
push 0x98
lea ecx, [ebp - 0xb0]
call fcn.004127f0
push 1
push 2
lea ecx, [ebp - 0xb0]
call fcn.0040e810
lea eax, [ebp - 0xb0]
mov byte [ebp - 4], 1
push str.Encrypt_1_:_CryptEncrypt_failed__
push eax
call fcn.0040e230
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 8
call esi
push eax
call fcn.00410f20
push eax
lea eax, [ebp - 0xb0]
push eax
call fcn.0040e230
add esp, 0xc
lea eax, [ebp - 0xb0]
push str.__0x
push eax
call fcn.0040e230
add esp, 8
mov ecx, eax
push 0x413500
call fcn.0040fbf0
mov ebx, eax
call esi
push eax
mov ecx, ebx
call fcn.0040f930
push 0x47fed0
push eax
call fcn.0040e230
add esp, 8
mov dword [edi], 0
lea eax, [ebp - 0x108]
lea ecx, [ebp - 0xb0]
push eax
call fcn.00413ce0
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00412990
push eax
lea ecx, [ebp - 0xf0]
call fcn.0040ec80
push 0x491ddc
lea eax, [ebp - 0xf0]
push eax
call fcn.00415b12
push 0
push 0
call fcn.00415b12
int3