joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002a880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
lea eax, [esp]
mov dword [esp], 0x776c6853
push eax
mov dword [esp + 0xa], 0x6c642e69
mov word [esp + 0xe], 0x6c
mov word [esp + 8], 0x7061
mov dword [esp + 0x12], 0x69466874
mov word [esp + 0x1d], 0x4173
mov word [esp + 0x10], 0x6150
mov dword [esp + 0x16], 0x7845656c
mov word [esp + 0x1a], 0x7369
mov byte [esp + 0x1c], 0x74
mov byte [esp + 0x1f], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1002a8ee
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10111a2c], eax
add esp, 0x1c
ret

Function at 0x1002c0f0
Capabilities:
Parse credit card information

Disassembly:
sub esp, 0x14
push ebx
mov bl, byte [ecx]
push ebp
xor ebp, ebp
mov dword [esp + 0xc], ecx
push edi
mov edi, edx
test bl, bl
je 0x1002c223
mov al, bl
push esi
nop dword [eax + eax]
cmp al, 0x24
je 0x1002c14c
cmp al, 0x26
je 0x1002c14c
cmp al, 0x2b
je 0x1002c14c
cmp al, 0x2c
je 0x1002c14c
cmp al, 0x2f
je 0x1002c14c
cmp al, 0x3a
je 0x1002c14c
cmp al, 0x3b
je 0x1002c14c
cmp al, 0x3d
je 0x1002c14c
cmp al, 0x3f
je 0x1002c14c
cmp al, 0x40
je 0x1002c14c
cmp al, 0x23
je 0x1002c14c
cmp al, 0x20
je 0x1002c14c
mov byte [edi], bl
mov ecx, 1
jmp 0x1002c1e9
movsx eax, al
push eax
lea eax, [esp + 0x20]
mov dword [esp + 0x23], 0x783230
push eax
push 0xffffffffffffffff
lea eax, [esp + 0x1c]
mov word [esp + 0x28], 0x2525
push 4
push eax
mov byte [esp + 0x32], 0x25
call fcn.10001c50
lea ecx, [esp + 0x24]
add esp, 0x14
xor esi, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002c183
sub ecx, edx
je 0x1002c1bd
nop
movsx eax, byte [esp + esi + 0x10]
push eax
call fcn.10061614
mov byte [esp + esi + 0x14], al
add esp, 4
lea eax, [esp + 0x10]
inc esi
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002c1b0
sub eax, edx
cmp esi, eax
jb 0x1002c190
push 0xffffffffffffffff
lea eax, [esp + 0x14]
push eax
mov eax, 0x800
sub eax, ebp
push eax
push edi
call fcn.10060a0b
lea ecx, [esp + 0x20]
add esp, 0x10
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002c1e0
sub ecx, edx
mov eax, ecx
add ebp, ecx
mov ecx, dword [esp + 0x14]
add eax, edi
inc ecx
mov edi, eax
mov dword [esp + 0x14], ecx
cmp ebp, 0x7ff
jae 0x1002c218
mov bl, byte [ecx]
mov al, bl
test bl, bl
jne 0x1002c110
pop esi
mov byte [edi], bl
pop edi
pop ebp
pop ebx
add esp, 0x14
ret
pop esi
pop edi
pop ebp
mov byte [eax], 0
pop ebx
add esp, 0x14
ret
mov byte [edi], 0
pop edi
pop ebp
pop ebx
add esp, 0x14
ret

Function at 0x1002c310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov word [esp + 4], 0x6c65
push eax
mov dword [esp + 0xb], 0x6c642e32
mov byte [esp + 0xa], 0x33
mov word [esp + 0xf], 0x6c
mov dword [esp + 4], 0x6e72654b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 0x10
ret
Function at 0x1002c380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov word [esp + 4], 0x6970
push eax
mov dword [esp + 0xd], 0x6c6c64
mov word [esp + 0xb], 0x2e32
mov dword [esp + 4], 0x61766441
mov byte [esp + 0xa], 0x33
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x10
ret

Function at 0x1002c400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
lea eax, [esp]
mov dword [esp + 7], 0x6c6c642e
push eax
mov dword [esp + 7], 0x69706177
mov word [esp + 5], 0x6c68
mov byte [esp + 4], 0x53
mov byte [esp + 0xf], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0xc
ret

Function at 0x1002c440
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
lea eax, [esp]
mov dword [esp + 6], 0x6c642e6e
push eax
mov dword [esp + 6], 0x6f697372
mov word [esp + 4], 0x6556
mov word [esp + 0xe], 0x6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0xc
ret

Function at 0x1002c470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
mov dword [esp + 4], 0x61636f4c
push eax
mov esi, edx
mov dword [esp + 0xd], 0x6f6c6c41
mov word [esp + 0x11], 0x63
mov byte [esp + 0xc], 0x6c
call fcn.1002c310
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002c4b1
push esi
push 0
call eax
pop esi
add esp, 0xc
ret
xor eax, eax
pop esi
add esp, 0xc
ret

Function at 0x1002c520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 0x13], 0x41656c
push eax
mov esi, edx
mov word [esp + 0xc], 0x6946
mov edi, ecx
mov word [esp + 0xf], 0x4664
mov dword [esp + 0x12], 0x46747372
mov byte [esp + 0xe], 0x6e
mov byte [esp + 0x11], 0x69
mov byte [esp + 0x16], 0x69
call fcn.1002c310
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002c575
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x10
ret
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x10
ret

Function at 0x1002c580
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push esi
push edi
lea eax, [esp + 8]
mov word [esp + 8], 0x6946
push eax
mov esi, edx
mov word [esp + 0x12], 0x7478
mov edi, ecx
mov word [esp + 0xf], 0x4e64
mov word [esp + 0x17], 0x4165
mov word [esp + 0x14], 0x6946
mov byte [esp + 0xe], 0x6e
mov byte [esp + 0x11], 0x65
mov byte [esp + 0x19], 0
mov byte [esp + 0x16], 0x6c
call fcn.1002c310
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002c5df
push esi
push edi
call eax
pop edi
pop esi
add esp, 0x10
ret
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret

Function at 0x1002c5f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push esi
push edi
lea eax, [esp + 8]
mov word [esp + 0x10], 0x41
push eax
mov esi, edx
mov dword [esp + 0xf], 0x6c694679
mov edi, ecx
mov word [esp + 0xc], 0x6f43
mov byte [esp + 0xe], 0x70
mov byte [esp + 0x13], 0x65
call fcn.1002c310
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002c63a
push 0
push esi
push edi
call eax
pop edi
pop esi
add esp, 0xc
ret
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
Function at 0x1002cd00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, edx
mov esi, 1
call fcn.1002c380
mov edi, eax
test edi, edi
je 0x1002cd7e
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 0x79654b65
push eax
push edi
mov word [esp + 0x19], 0x6165
mov dword [esp + 0x14], 0x43676552
mov word [esp + 0x21], 0x4178
mov byte [esp + 0x1b], 0x74
mov byte [esp + 0x18], 0x72
mov byte [esp + 0x20], 0x45
mov byte [esp + 0x23], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002cd77
push 0
push dword [esp + 0x38]
push 0
push 0xf003f
push 0
push 0
push 0
push ebx
push 0x80000001
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x1002cd90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.1002c380
mov edi, eax
test edi, edi
je 0x1002ce06
lea eax, [esp + 0x10]
mov dword [esp + 0x19], 0x78456575
push eax
push edi
mov word [esp + 0x25], 0x41
mov word [esp + 0x1b], 0x6553
mov word [esp + 0x1e], 0x6156
mov byte [esp + 0x1d], 0x74
mov word [esp + 0x18], 0x6552
mov byte [esp + 0x1a], 0x67
mov byte [esp + 0x20], 0x6c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002cdff
push dword [esp + 0x30]
push dword [esp + 0x30]
push esi
push 0
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret

Function at 0x1002d050
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, edx
xor esi, esi
call fcn.1002c3c0
mov edi, eax
test edi, edi
je 0x1002d0cd
lea eax, [esp + 0xc]
mov dword [esp + 0xf], 0x70537465
push eax
push edi
mov word [esp + 0x1e], 0x6c61
mov dword [esp + 0x21], 0x65646c6f
mov word [esp + 0x1b], 0x6365
mov word [esp + 0x2a], 0x41
mov dword [esp + 0x25], 0x74615072
mov word [esp + 0x15], 0x4748
mov byte [esp + 0x20], 0x46
mov byte [esp + 0x14], 0x53
mov byte [esp + 0x1d], 0x69
mov byte [esp + 0x29], 0x68
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002d0c6
push esi
push 0x1a
push ebx
push esi
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x18
ret

Function at 0x1002d0e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push esi
push edi
mov esi, 0x80004005
call fcn.1002c3c0
mov edi, eax
test edi, edi
je 0x1002d147
lea eax, [esp + 8]
mov dword [esp + 0x15], 0x416874
push eax
push edi
mov dword [esp + 0x17], 0x7265646c
mov dword [esp + 0x10], 0x65474853
mov word [esp + 0x14], 0x4674
mov word [esp + 0x1b], 0x6150
mov byte [esp + 0x16], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002d140
push dword [esp + 0x28]
push 0
push 0
push 0x1a
push 0
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x1002d150
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
mov esi, 1
call fcn.1002c400
mov edi, eax
test edi, edi
je 0x1002d1bf
lea eax, [esp + 0x10]
mov word [esp + 0x11], 0x4748
push eax
push edi
mov dword [esp + 0x1e], 0x65756c61
mov word [esp + 0x1c], 0x5674
mov byte [esp + 0x18], 0x53
mov word [esp + 0x22], 0x41
mov byte [esp + 0x1b], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002d1b8
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x1002d1d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov ebx, edx
mov ebp, ecx
xor esi, esi
call fcn.1002c440
mov edi, eax
test edi, edi
je 0x1002d24d
lea eax, [esp + 0x10]
mov dword [esp + 0x21], 0x7a69536f
push eax
push edi
mov word [esp + 0x1b], 0x6946
mov dword [esp + 0x1d], 0x6556656c
mov word [esp + 0x18], 0x6547
mov dword [esp + 0x22], 0x6e6f6973
mov byte [esp + 0x21], 0x72
mov byte [esp + 0x1a], 0x74
mov word [esp + 0x26], 0x6e49
mov word [esp + 0x2e], 0x41
mov byte [esp + 0x28], 0x66
mov byte [esp + 0x2d], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002d246
push ebx
push ebp
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x1002d260
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
lea eax, [esp]
mov dword [esp], 0x4c746547
push eax
mov dword [esp + 0xc], 0x726f7272
mov dword [esp + 8], 0x45747361
mov byte [esp + 0x10], 0
call fcn.1002c310
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002d299
call eax
add esp, 0x10
ret
xor eax, eax
add esp, 0x10
ret

Function at 0x1002d2a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.1002c380
mov edi, eax
test edi, edi
je 0x1002d2f9
lea eax, [esp + 0xc]
mov dword [esp + 0x15], 0x747079
push eax
push edi
mov dword [esp + 0x15], 0x74707972
mov dword [esp + 0x19], 0x72636544
mov byte [esp + 0x14], 0x43
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002d2f2
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push esi
push esi
push esi
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x1002d310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.1002c380
mov edi, eax
test edi, edi
je 0x1002d376
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0x636e4574
push eax
push edi
mov word [esp + 0x15], 0x7972
mov dword [esp + 0x1d], 0x747079
mov byte [esp + 0x14], 0x43
mov byte [esp + 0x1c], 0x72
mov byte [esp + 0x17], 0x70
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002d36f
push dword [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x30]
push esi
push esi
push esi
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x1002d400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.1002c440
mov edi, eax
test edi, edi
je 0x1002d462
lea eax, [esp + 0xc]
mov dword [esp + 0x10], 0x79726575
push eax
push edi
mov dword [esp + 0x1c], 0x756c6156
mov dword [esp + 0x14], 0x51726556
mov word [esp + 0x20], 0x4165
mov byte [esp + 0x22], 0
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002d45b
push dword [esp + 0x24]
push dword [esp + 0x24]
push 0x10101c28
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x10
ret

Function at 0x1002d470
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call fcn.1002c380
mov edi, eax
test edi, edi
je 0x1002d4e8
lea eax, [esp + 0xc]
mov word [esp + 0x15], 0x7361
push eax
push edi
mov dword [esp + 0x16], 0x52747079
mov word [esp + 0x23], 0x6574
mov word [esp + 0x14], 0x7243
mov word [esp + 0x26], 0x74
mov word [esp + 0x20], 0x6f43
mov word [esp + 0x1a], 0x6c65
mov byte [esp + 0x25], 0x78
mov byte [esp + 0x1f], 0x65
mov byte [esp + 0x22], 0x6e
mov byte [esp + 0x1c], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1002d4e1
push esi
push ebx
call eax
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop edi
mov eax, esi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x1002d9f0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi

Disassembly:
sub esp, 0x38
push ebx
push 0xf0000000
push 0x18
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0
push eax
xor bl, bl
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1002dba5
mov eax, dword [esp + 0x4c]
mov ecx, 0x20
xorps xmm0, xmm0
mov dword [esp + 0x10], 0x208
mov dword [esp + 0x14], 0x6610
mov dword [esp + 0x18], 0x20
mov eax, dword [eax]
cmp eax, ecx
movups xmmword [esp + 0x1c], xmm0
cmovb ecx, eax
lea eax, [esp + 0x1c]
push ecx
push dword [esp + 0x4c]
movups xmmword [esp + 0x34], xmm0
push eax
call fcn.1004b030
add esp, 0xc
lea eax, [esp + 4]
push eax
push 1
push 0
push 0x2c
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x1002db98
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
lea eax, [esp + 0x4c]
push 0
push eax
push 4
push dword [esp + 0x14]
mov dword [esp + 0x5c], 1
call edi
test eax, eax
je 0x1002db88
push 0
lea eax, [esp + 0x14]
mov dword [esp + 0x54], 0
push eax
lea eax, [esp + 0x58]
mov dword [esp + 0x18], 4
push eax
push 8
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
test eax, eax
je 0x1002db88
mov edx, dword [esp + 0x50]
shr edx, 3
push esi
mov dword [esp + 0x54], edx
call fcn.1002c470
mov esi, eax
test esi, esi
je 0x1002db87
push dword [esp + 0x54]
push 0
push esi
call fcn.1004d430
add esp, 0xc
push 0
push esi
push 1
push dword [esp + 0x18]
call edi
test eax, eax
jne 0x1002db25
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1002db87
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [esp + 0x60]
mov esi, dword [esp + 0x50]
mov ebp, dword [esp + 0x5c]
mov ecx, dword [edi]
cmp ecx, dword [esi]
cmovae ecx, dword [esi]
push ecx
push dword [esp + 0x50]
push ebp
call fcn.1004b030
mov eax, dword [esi]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov dword [edi], eax
push edi
push ebp
sub esp, 8
call fcn.1002d2a0
add esp, 0x10
test eax, eax
jne 0x1002db6e
call fcn.1002d260
jmp 0x1002db86
mov eax, dword [edi]
sub eax, 0x10
push eax
lea eax, [ebp + 0x10]
push eax
push ebp
call fcn.1004aab0
add esp, 0xc
mov bl, 1
add dword [edi], 0xfffffff0
pop ebp
pop esi
mov eax, dword [esp + 8]
pop edi
test eax, eax
je 0x1002db98
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x1002dba5
call fcn.1002d470
mov al, bl
pop ebx
add esp, 0x38
ret 0x18
Function at 0x1002dbb0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi

Disassembly:
sub esp, 0x3c
push ebx
push 0xf0000000
push 0x18
push 0
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0
push eax
xor bl, bl
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1002dd60
mov eax, dword [esp + 0x50]
mov ecx, 0x20
xorps xmm0, xmm0
mov dword [esp + 0x14], 0x208
mov dword [esp + 0x18], 0x6610
mov dword [esp + 0x1c], 0x20
mov eax, dword [eax]
cmp eax, ecx
movups xmmword [esp + 0x20], xmm0
cmovb ecx, eax
lea eax, [esp + 0x20]
push ecx
push dword [esp + 0x50]
movups xmmword [esp + 0x38], xmm0
push eax
call fcn.1004b030
add esp, 0xc
lea eax, [esp + 4]
push eax
push 1
push 0
push 0x2c
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x1002dd53
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
lea eax, [esp + 0x50]
push 0
push eax
push 4
push dword [esp + 0x14]
mov dword [esp + 0x60], 1
call edi
test eax, eax
je 0x1002dd43
push 0
lea eax, [esp + 0x18]
mov dword [esp + 0x58], 0
push eax
lea eax, [esp + 0x5c]
mov dword [esp + 0x1c], 4
push eax
push 8
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
test eax, eax
je 0x1002dd43
mov edx, dword [esp + 0x54]
shr edx, 3
push esi
mov dword [esp + 0x58], edx
call fcn.1002c470
mov esi, eax
test esi, esi
je 0x1002dd42
push dword [esp + 0x58]
push 0
push esi
call fcn.1004d430
add esp, 0xc
push 0
push esi
push 1
push dword [esp + 0x18]
call edi
test eax, eax
jne 0x1002dce5
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1002dd42
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebp, dword [esp + 0x64]
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0x60]
mov ecx, dword [ebp]
cmp ecx, dword [edi]
cmovae ecx, dword [edi]
push ecx
push dword [esp + 0x54]
push esi
call fcn.1004b030
mov eax, dword [edi]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push dword [ebp]
push eax
push esi
sub esp, 8
call fcn.1002d310
add esp, 0x14
test eax, eax
jne 0x1002dd38
call fcn.1002d260
jmp 0x1002dd41
mov eax, dword [esp + 0x18]
mov bl, 1
mov dword [ebp], eax
pop ebp
pop esi
mov eax, dword [esp + 8]
pop edi
test eax, eax
je 0x1002dd53
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x1002dd60
call fcn.1002d470
mov al, bl
pop ebx
add esp, 0x3c
ret 0x18
Function at 0x1002dd70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ec00d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
lea ecx, [ebp - 0x30]
call fcn.10014600
lea edx, [ebp - 0x30]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.1002d790
lea ecx, [ebp - 0x30]
call fcn.10014480
lea ecx, [ebp - 0x48]
mov word [ebp - 0x14], 0x7265
mov word [ebp - 0x11], 0x726f
mov byte [ebp - 0x12], 0x72
mov byte [ebp - 0xf], 0
mov word [ebp - 0x18], 0x44
mov dword [ebp - 0x2b], 0x31353736
mov word [ebp - 0x2e], 0x4341
mov dword [ebp - 0x25], 0x32444244
mov word [ebp - 0x34], 0x4633
mov word [ebp - 0x20], 0x3142
mov word [ebp - 0x31], 0x3346
mov dword [ebp - 0x1d], 0x44453134
mov byte [ebp - 0x32], 0x37
mov byte [ebp - 0x2f], 0x42
mov word [ebp - 0x27], 0x3339
mov byte [ebp - 0x21], 0x38
mov byte [ebp - 0x2c], 0x36
mov byte [ebp - 0x1e], 0x46
mov byte [ebp - 0x19], 0x45
call fcn.10012610
mov byte [ebp - 4], 3
xor esi, esi
nop word [eax + eax]
mov al, byte [ebp + esi - 0x34]
lea ecx, [ebp - 0x48]
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push eax
call fcn.1001cea0
inc esi
cmp esi, 0x1d
jl 0x1002de30
lea ecx, [ebp - 0x54]
call fcn.1001cdb0
cmp eax, 9
jae 0x1002de5b
lea eax, [ebp - 0x14]
jmp 0x1002deac
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x38], 0x100
call fcn.1001cdb0
lea ecx, [ebp - 0x54]
mov dword [ebp + 8], eax
call fcn.1001cdb0
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x48]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp + 8]
push eax
push 0
call fcn.1001ce80
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
lea ecx, [ebp - 0x54]
call fcn.1001ce80
push eax
call fcn.1002d9f0
lea eax, [ebp - 0x154]
push eax
mov ecx, edi
call fcn.10014420
lea ecx, [ebp - 0x48]
call fcn.1001ce20
lea ecx, [ebp - 0x54]
call fcn.1001ce20
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x1002e440
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ec188
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
call fcn.10013710
lea ecx, [esi + 4]
call fcn.10013710
lea ecx, [esi + 8]
call fcn.10013710
lea ecx, [esi + 0xc]
call fcn.10013710
lea ecx, [esi + 0x10]
call fcn.10013710
lea ecx, [esi + 0x14]
call fcn.10013710
lea ecx, [esi + 0x18]
call fcn.10013710
lea ecx, [esi + 0x1c]
call fcn.10013710
lea ecx, [esi + 0x20]
call fcn.10013710
lea ecx, [esi + 0x24]
call fcn.10013710
lea ecx, [esi + 0x28]
call fcn.10013710
lea ecx, [esi + 0x2c]
call fcn.10013710
lea ecx, [esi + 0x30]
call fcn.10013710
lea ecx, [esi + 0x34]
call fcn.10013710
lea ecx, [esi + 0x38]
call fcn.10013710
lea ecx, [esi + 0x3c]
call fcn.10013710
lea ecx, [esi + 0x40]
call fcn.10013710
lea ecx, [esi + 0x44]
call fcn.10013710
lea ecx, [esi + 0x48]
call fcn.10013710
lea ecx, [esi + 0x4c]
call fcn.10013710
lea ecx, [esi + 0x50]
call fcn.10013710
lea ecx, [esi + 0x54]
call fcn.10013710
lea ecx, [esi + 0x58]
call fcn.10013710
lea ecx, [esi + 0x5c]
call fcn.10013710
lea ecx, [esi + 0x60]
call fcn.10013710
mov byte [ebp - 4], 0x19
mov dword [esi + 0x64], 0
push 0x100fd233
lea ecx, [esi + 0x68]
call fcn.10013ec0
lea eax, [ebp + 8]
mov byte [ebp - 4], 0x1a
push eax
lea ecx, [esi + 0x6c]
call fcn.10013f40
lea ecx, [ebp + 8]
mov byte [esi + 0x70], 1
call fcn.100135d0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4