joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x405660
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40566f
pop dword [ebp - 0x1c]
mov eax, 0x38c34537
sub eax, 0x3882eec8
sub dword [ebp - 0x1c], eax
push 0x40
push 0x1000
push 0x34ffe
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x1c]
call dword [eax]
mov ecx, 0x3727
mov ebx, eax
mov esi, 0x413bc4
add esi, dword [ebp - 0x1c]
mov edx, 0x475a1ba8
add edx, 0x8717859a
sub dword [ebp - 4], 0x6317b977
mov edi, dword [esi]
xor dword [ebp - 0x14], 0x675815be
xor edi, edx
mov dword [ebx], edi
mov dword [ebp - 0x18], 0x94b7997b
add ebx, 0x2019a078
add ebx, 0xdfe65f8c
add esi, 4
loop 0x4056bd
add eax, 0xcf6f
mov ebx, eax
add eax, 0xb0d8a9ec
add eax, 0x4f275619
mov ecx, 0x64fa3d6c
add ecx, 0x9b45c294
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x409607
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404f19
and dword [ebp - 4], 0
cmp dword [0x412990], 0
mov ebx, eax
jne 0x4096b8
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409769
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409769
push eax
call fcn.00405660
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x412990], eax
call esi
push eax
call fcn.00405660
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x412994], eax
call esi
push eax
call fcn.00405660
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x412998], eax
call esi
push eax
call fcn.00405660
pop ecx
mov dword [0x4129a0], eax
test eax, eax
je 0x4096b8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00405660
pop ecx
mov dword [0x41299c], eax
mov eax, dword [0x41299c]
cmp eax, ebx
je 0x409710
cmp dword [0x4129a0], ebx
je 0x409710
push eax
call fcn.00405660
push dword [0x4129a0]
mov esi, eax
call fcn.00405660
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409710
test edi, edi
je 0x409710
call esi
test eax, eax
je 0x409707
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409707
test byte [ebp - 0xc], 1
jne 0x409710
or dword [ebp + 0x10], 0x200000
jmp 0x409749
mov eax, dword [0x412994]
cmp eax, ebx
je 0x409749
push eax
call fcn.00405660
pop ecx
test eax, eax
je 0x409749
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409749
mov eax, dword [0x412998]
cmp eax, ebx
je 0x409749
push eax
call fcn.00405660
pop ecx
test eax, eax
je 0x409749
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x412990]
call fcn.00405660
pop ecx
test eax, eax
je 0x409769
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40976b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40199f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
test esi, esi
je 0x401a06
mov ecx, dword [esi + 0x60]
test ecx, ecx
je 0x401a06
cmp ecx, 0xffffffff
je 0x401a06
movzx eax, word [esi + 0x1e]
cmp dword [ebp + 0xc], eax
ja 0x4019f0
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, eax
test edi, edi
jne 0x401a15
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esi + 4]
push str.ERROR_kull_m_busylight_device_send_raw____device__u__WriteFile__0x_08x__n
call fcn.00409709
add esp, 0xc
jmp 0x401a15
push eax
push dword [ebp + 0xc]
push dword [esi + 4]
push str.ERROR_kull_m_busylight_device_send_raw____device__u__Size_is_not_valide__siz___u__max___u__n
call fcn.00409709
add esp, 0x10
jmp 0x401a15
push dword [esi + 4]
push str.ERROR_kull_m_busylight_device_send_raw____device__u__Invalid_Device_Busy_Handle_n
call fcn.00409709
pop ecx
pop ecx
mov eax, edi
pop edi
leave
ret

Function at 0x401a1a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
test esi, esi
je 0x401a98
mov eax, dword [esi + 0x60]
test eax, eax
je 0x401a98
cmp eax, 0xffffffff
je 0x401a98
movzx edi, word [esi + 0x1c]
push edi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebx], eax
test eax, eax
je 0x401aa7
push 0
push dword [ebp + 8]
push edi
push eax
push dword [esi + 0x60]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 4], eax
test eax, eax
je 0x401a87
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp eax, edi
je 0x401aa7
push edi
push eax
push str.ERROR_kull_m_busylight_device_read_raw____device__u___u_byte_s__readed___u_wanted_n
call fcn.00409709
add esp, 0xc
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebx], eax
mov eax, dword [ebp + 8]
and dword [eax], 0
jmp 0x401aa7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [esi + 4]
push str.ERROR_kull_m_busylight_device_read_raw____device__u__ReadFile__0x_08x__n
jmp 0x401a6d
push dword [esi + 4]
push str.ERROR_kull_m_busylight_device_read_raw____device__u__Invalid_Device_Busy_Handle_n
call fcn.00409709
pop ecx
pop ecx
mov eax, dword [ebp - 4]
pop edi
leave
ret

Function at 0x401c3c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
mov byte [ebp - 4], bl
mov byte [ebp - 3], bl
mov byte [ebp - 2], bl
mov byte [ebp - 1], 0x80
jmp 0x401c83
mov eax, dword [esi + 0x70]
mov dword [esi + 0x6c], ebx
cmp eax, ebx
je 0x401c78
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esi + 0x70], ebx
cmp dword [ebp + 0xc], ebx
je 0x401c81
mov esi, dword [esi]
jmp 0x401c83
xor esi, esi
cmp esi, ebx
jne 0x401c63
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push 1
lea edx, [ebp - 8]
call fcn.00401bbc
pop ecx
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x402054
Capabilities:
Get common file path

Disassembly:
push esi
push 0x334
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
xor ecx, ecx
cmp esi, ecx
je 0x402140
push ebx
push edi
mov eax, 0x4000000
push 0x2a
lea edi, [esi + 4]
mov dword [edi], eax
mov dword [esi + 8], eax
pop eax
push dword [esp + 0x10]
mov word [esi + 0x24], ax
push ecx
push edi
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], ecx
call fcn.00401f3c
add esp, 0xc
test eax, eax
je 0x402125
lea ebx, [esi + 0x226]
push ebx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x402130
call fcn.00401c9d
test eax, eax
jl 0x402130
push dword [esp + 0x10]
lea ebx, [esi + 0x328]
push edi
push 0x401eb4
push 0x401e90
push 0x401e64
push fcn.00401e40
push 0x401e0f
push 0x401dde
push fcn.00401d7d
push 0x401d72
push 0x401d65
push fcn.00450de7
push ebx
call sub.Cabinet.dll_FCICreate
add esp, 0x34
mov dword [esi], eax
test eax, eax
jne 0x40213e
mov ebx, dword [ebx]
mov eax, ebx
call fcn.00401fe8
push eax
push ebx
push 0x4aae00
call fcn.00409709
add esp, 0xc
jmp 0x402130
push str.ERROR_kull_m_cabinet_create___Failed_to_initialize_the_cabinet_information_structure._n
call fcn.00409709
pop ecx
cmp dword [esi], 0
jne 0x40213e
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, eax
pop edi
pop ebx
mov eax, esi
pop esi
ret
Function at 0x40325b
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push edi
xor edi, edi
cmp dword [ebp + 8], 0x8000
mov dword [ebp - 0x14], edi
jne 0x4032d7
cmp dword [ebp + 0x18], 4
jne 0x40338a
lea eax, [ebp - 4]
push eax
push 0xffffff7c
call sub.cryptdll.dll_CDLocateCheckSum
test eax, eax
jl 0x40338a
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push edi
call dword [eax + 0xc]
test eax, eax
jl 0x40338a
push dword [ebp + 0xc]
mov eax, dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [eax + 0x10]
push dword [ebp + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp - 0x10]
call dword [eax + 0x14]
xor ecx, ecx
test eax, eax
setge cl
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
call dword [eax + 0x18]
jmp 0x40338a
push 0xf0000000
push 0x18
push edi
push edi
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x40338a
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x403380
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x403377
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push edi
lea eax, [ebp - 8]
push eax
push edi
push 2
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x403376
push ebx
push dword [ebp - 8]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, edi
je 0x403375
push edi
lea eax, [ebp - 8]
push eax
push ebx
push 2
push dword [ebp - 0xc]
call esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
cmp dword [ebp - 8], eax
jae 0x403361
mov eax, dword [ebp - 8]
push eax
push ebx
push dword [ebp + 0x14]
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
pop esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x14]
pop edi
leave
ret
Function at 0x403390
Capabilities:
Encrypt data using des via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov eax, 0x6603
push esi
lea ebx, [edi + 0xc]
cmp dword [ebp + 0xc], eax
je 0x4033fb
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x40341a
xor eax, eax
mov word [esi + 2], ax
mov eax, dword [ebp + 0xc]
push edi
push dword [ebp + 0x10]
mov dword [esi + 4], eax
lea eax, [esi + 0xc]
push eax
mov byte [esi], 8
mov byte [esi + 1], 2
mov dword [esi + 8], edi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push 0
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x40341a
cmp dword [ebp + 0x1c], 0
je 0x40341a
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
push dword [ebp + 0x10]
push eax
call fcn.00403b70
add esp, 0x18
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret

Function at 0x403421
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x11c
push ebx
push edi
mov edi, eax
cmp edi, dword [ebp + 0x7c]
sbb ebx, ebx
inc ebx
je 0x403443
push dword [ebp + 0x7c]
push dword [ebp + 0x74]
jmp 0x4034d3
push 0x40
lea eax, [ebp + 0x24]
push 0x36
push eax
call sub.msvcrt.dll_memset
push 0x40
lea eax, [ebp - 0x1c]
push 0x5c
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
test edi, edi
jbe 0x403484
mov eax, dword [ebp + 0x74]
push esi
lea edx, [ebp + 0x24]
lea esi, [ebp - 0x1c]
sub edx, eax
sub esi, eax
mov dword [ebp + 0x64], edi
mov cl, byte [eax]
xor byte [edx + eax], cl
xor byte [esi + eax], cl
inc eax
dec dword [ebp + 0x64]
jne 0x403475
pop esi
push edi
lea eax, [ebp - 0xb4]
push eax
push 0x40
lea eax, [ebp + 0x24]
push eax
push dword [ebp + 0x70]
call fcn.0040325b
add esp, 0x14
test eax, eax
je 0x4034de
push edi
lea eax, [ebp + edi - 0xb4]
push eax
push 0x40
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x70]
call fcn.0040325b
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x4034de
add edi, edi
cmp dword [ebp + 0x7c], edi
jae 0x4034cb
mov edi, dword [ebp + 0x7c]
push edi
lea eax, [ebp - 0xb4]
push eax
push dword [ebp + 0x78]
call sub.msvcrt.dll_memcpy
add esp, 0xc
pop edi
mov eax, ebx
pop ebx
add ebp, 0x68
leave
ret
Function at 0x403588
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
xor esi, esi
push 0xf0000000
push 0x18
push esi
mov dword [ebp - 0x28], eax
push esi
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x4036a3
push edi
mov edi, dword [ebp + 0xc]
push esi
lea eax, [ebp - 0x10]
push eax
push 0x100
push dword [ebp + 8]
push 0x6602
push dword [ebp - 0xc]
call fcn.00403390
add esp, 0x18
test eax, eax
je 0x403698
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp - 0x10]
push 0x8009
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40368f
push esi
lea eax, [ebp - 0x28]
push eax
push 5
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x403686
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x403686
mov edi, dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push esi
lea eax, [ebp - 8]
push eax
push esi
push 2
push dword [ebp - 4]
call edi
test eax, eax
je 0x403686
push ebx
push dword [ebp - 8]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
cmp ebx, esi
je 0x403685
push esi
lea eax, [ebp - 8]
push eax
push ebx
push 2
push dword [ebp - 4]
call edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
cmp dword [ebp - 8], eax
jae 0x403671
mov eax, dword [ebp - 8]
push eax
push ebx
push dword [ebp + 0x18]
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
mov eax, dword [ebp - 0x14]
pop esi
leave
ret
Function at 0x4036a9
Capabilities:
Create new key via cryptacquirecontext
Encode data using xor
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
push 0xf0000000
push 0x18
xor ebx, ebx
push ebx
mov edi, eax
push ebx
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x403853
lea eax, [ebp - 0x18]
push eax
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x403849
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 2
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x403840
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
lea eax, [edi + 4]
push eax
push 0x40
mov dword [ebp - 0x24], eax
call esi
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x40383f
push dword [ebp - 4]
push 0x40
call esi
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x403836
push dword [ebp - 4]
push 0x40
call esi
mov ebx, eax
test ebx, ebx
je 0x40382b
mov esi, dword [ebp - 0x10]
push edi
push dword [ebp + 0x14]
mov dword [ebp - 0x20], 1
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp dword [ebp + 0x20], 0
mov dword [ebp - 0xc], 1
jbe 0x403824
add edi, esi
mov eax, dword [ebp - 0xc]
bswap eax
mov dword [edi], eax
push dword [ebp - 4]
mov eax, dword [ebp + 8]
push ebx
push dword [ebp - 0x24]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00403588
push dword [ebp - 4]
push ebx
push dword [ebp - 8]
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0x18]
add esp, 0x24
cmp eax, 1
jbe 0x4037f7
dec eax
mov dword [ebp - 0x14], eax
push dword [ebp - 4]
mov eax, dword [ebp + 8]
push ebx
push dword [ebp - 4]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00403588
xor esi, esi
add esp, 0x18
cmp dword [ebp - 4], esi
jbe 0x4037dd
mov eax, dword [ebp - 8]
mov ecx, ebx
sub ecx, eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc esi
inc eax
cmp esi, dword [ebp - 4]
jb 0x4037d1
cmp dword [ebp + 0x24], 0
je 0x4037f2
push dword [ebp - 4]
push dword [ebp - 8]
push ebx
call sub.msvcrt.dll_memcpy
add esp, 0xc
dec dword [ebp - 0x14]
jne 0x4037aa
mov esi, dword [ebp + 0x20]
cmp esi, dword [ebp - 4]
jb 0x403802
mov esi, dword [ebp - 4]
push esi
push dword [ebp - 8]
push dword [ebp + 0x1c]
call sub.msvcrt.dll_memcpy
add dword [ebp + 0x1c], esi
sub dword [ebp + 0x20], esi
add esp, 0xc
inc dword [ebp - 0xc]
cmp dword [ebp + 0x20], 0
ja 0x403770
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor ebx, ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x20]
pop edi
pop ebx
leave
ret
Function at 0x403892
Capabilities:
Encode data using xor
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push 0x10
mov esi, eax
xor ebx, ebx
pop edi
mov dword [ebp - 0xc], ebx
cmp esi, edi
jbe 0x4039ce
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptDuplicateKey]
test eax, eax
je 0x4039e4
push ebx
push dword [ebp + 0x10]
push 1
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x4039c3
lea ebx, [esi + 0xf]
shr ebx, 4
and esi, 0xf
je 0x4038eb
mov dword [ebp - 8], esi
jmp 0x4038f0
mov dword [ebp - 8], edi
mov esi, edi
cmp ebx, 2
jbe 0x403911
push 0
lea eax, [ebx - 2]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040385a
add esp, 0x10
test eax, eax
je 0x4039c3
lea edi, [ebx - 2]
shl edi, 4
add edi, dword [ebp + 0xc]
lea eax, [esi + 0x10]
push eax
lea eax, [ebp - 0x38]
push edi
push eax
call sub.msvcrt.dll_memcpy
mov dword [ebp - 4], 0x10
sub dword [ebp - 4], esi
push dword [ebp - 4]
lea eax, [ebp + esi - 0x28]
push 0
push eax
mov dword [ebp - 0x18], eax
call sub.msvcrt.dll_memset
add esp, 0x18
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x38]
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x4039c3
xor eax, eax
mov cl, byte [ebp + eax - 0x28]
xor byte [ebp + eax - 0x38], cl
inc eax
cmp eax, 0x10
jb 0x40396a
push dword [ebp - 4]
lea eax, [ebp + esi - 0x38]
push eax
push dword [ebp - 0x18]
call sub.msvcrt.dll_memcpy
push 0
push 1
lea eax, [ebp - 0x28]
push eax
push dword [ebp + 8]
call fcn.0040385a
add esp, 0x1c
mov dword [ebp - 0xc], eax
test eax, eax
je 0x4039c3
push dword [ebp - 8]
lea esi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp + 0xc]
movsd dword es:[edi], dword [esi]
shl ebx, 4
lea eax, [ebx + eax - 0x10]
push eax
movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x4039e4
jne 0x4039e4
push ebx
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040385a
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403ad5
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push 0xf0000000
push 0x18
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
xor esi, esi
mov dword [ebp - 0xc], 1
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x403b6a
push edi
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 0x10]
push 0x660e
push dword [ebp - 8]
push 0x10
pop edi
call fcn.00403390
add esp, 0x18
pop edi
test eax, eax
je 0x403b60
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x403b57
push dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
cmp dword [ebp + 0x18], ebx
je 0x403b4d
call fcn.004039ec
jmp 0x403b52
call fcn.00403892
mov esi, eax
add esp, 0xc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x403d6c
Capabilities:
Create new key via cryptacquirecontext
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 0xf0000000
push 0x18
xor esi, esi
push esi
push esi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x403dc9
lea eax, [ebp - 4]
push eax
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x403dbf
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push 2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0xc]
pop esi
leave
ret

Function at 0x403dcf
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0xf0000000
push 0x18
xor esi, esi
push esi
push esi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x403e35
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x403e2b
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0xc]
shr eax, 3
pop esi
leave
ret

Function at 0x403e3e
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push 0xf0000000
push 0x18
xor esi, esi
push esi
push esi
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 4
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x403ea4
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGenKey]
test eax, eax
je 0x403e9a
push esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0xc]
shr eax, 3
pop esi
leave
ret