joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4043b0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xdc
mov eax, dword [0x41a040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.runtime
lea ecx, [ebp - 0xdc]
call fcn.00401d00
lea ecx, [ebp - 0xdc]
call fcn.00402d00
test eax, eax
je 0x4043ed
mov esi, 3
jmp 0x40450d
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_AttachConsole]
test eax, eax
je 0x4044a9
push 1
call fcn.00407e8d
push eax
push 0x4139fc
push 0x413a00
call fcn.00408040
push 2
call fcn.00407e8d
push eax
push 0x4139fc
push 0x413a00
call fcn.00408040
push 1
call fcn.00407e8d
push eax
call fcn.00407f11
mov esi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
add esp, 0x28
test eax, eax
js 0x40446d
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00404330
add esp, 8
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 0xf
cmova eax, dword [ebp - 0x1c]
push eax
push str.PYSTAND_STDOUT
call esi
lea ecx, [ebp - 0x1c]
call fcn.00401f40
push 0
call fcn.00407e8d
push eax
call fcn.00407f11
add esp, 8
test eax, eax
js 0x4044a9
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00404330
add esp, 8
lea eax, [ebp - 0x1c]
cmp dword [ebp - 8], 0xf
cmova eax, dword [ebp - 0x1c]
push eax
push str.PYSTAND_STDIN
call esi
lea ecx, [ebp - 0x1c]
call fcn.00401f40
push dword [section..data]
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xdc]
call fcn.004023c0
cmp dword [ebp - 8], 7
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0xdc]
cmova eax, dword [ebp - 0x1c]
push eax
call fcn.00403850
mov ecx, dword [ebp - 8]
mov esi, eax
cmp ecx, 7
jbe 0x40450d
mov edx, dword [ebp - 0x1c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x404503
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x40452b
push ecx
push edx
call fcn.00404650
add esp, 8
lea ecx, [ebp - 0xdc]
call fcn.004020d0
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040485e
mov esp, ebp
pop ebp
ret 0x10
call fcn.004079ef
int3

Function at 0x404fb1
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x404ff0
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x404ff0
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x404ff0
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x404ff0
cmp dword [ecx + 0x74], 0xe
jbe 0x404ff0
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x409c2e
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415208
push 0x415200
push str.FlsAlloc
push 0x1e
call fcn.00409b4c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409c62
push dword [ebp + 8]
mov ecx, esi
call dword [0x413150]
call esi
jmp 0x409c68
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x409cac
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x415218
push 0x415210
push str.FlsGetValue
push 0x20
call fcn.00409b4c
mov esi, eax
add esp, 0x10
test esi, esi
je 0x409ce3
push dword [ebp + 8]
mov ecx, esi
call dword [0x413150]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x40be25
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x40bec2
push ebx
push esi
call fcn.0040bdee
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0040bd37
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x40be6f
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40bec1
push edi
push eax
call fcn.0040a932
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x40be8f
call fcn.004099f9
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x40bec0
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0040bd37
add esp, 0x20
test eax, eax
jne 0x40beae
push edi
call fcn.004099f9
jmp 0x40beb6
push ebx
call fcn.004099f9
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x40fbf7
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x41b1a0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40fc37
cmp byte [ebx], 0xa
jne 0x40fc37
or byte [eax + edi + 0x28], 4
jmp 0x40fc3c
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x40fd3a
mov al, byte [edx]
cmp al, 0x1a
je 0x40fd1c
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x40fc6b
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x40fc90
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x40fc9a
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x40fc4d
jmp 0x40fd3a
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40fd17
cmp dword [ebp - 0xc], 0
je 0x40fd17
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x41b1a0]
test byte [eax + edi + 0x28], 0x48
je 0x40fcf1
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x40fcdc
mov byte [esi], dl
jmp 0x40fced
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x41b1a0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x40fd3a
cmp byte [ebp - 1], 0xa
jne 0x40fd00
cmp esi, ebx
jne 0x40fd00
mov byte [esi], 0xa
jmp 0x40fd39
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040fb67
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x40fd3a
mov byte [esi], 0xd
jmp 0x40fd39
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x41b1a0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x40fd36
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x40fd3a
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40fd43
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x41b1a0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x40fd86
cmp word [esi], dx
jne 0x40fd86
or byte [edi + eax + 0x28], 4
jmp 0x40fd8b
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x40fec4
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x40fea4
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x40fdcd
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x40fe03
cmp eax, edx
jae 0x40fe0f
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x40fda5
jmp 0x40fec4
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40fea0
cmp dword [ebp - 0x14], 0
je 0x40fea0
mov eax, dword [ebx*4 + 0x41b1a0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x40fe78
mov cx, word [ebp - 4]
pop eax
cmp cx, ax
je 0x40febe
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x41b1a0]
push 0xa
mov byte [edi + eax + 0x2a], cl
mov eax, dword [ebx*4 + 0x41b1a0]
shr cx, 8
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x41b1a0]
pop ecx
mov byte [edi + eax + 0x2c], cl
jmp 0x40fec1
pop ebx
cmp word [ebp - 4], bx
jne 0x40fe89
cmp esi, dword [ebp + 0xc]
jne 0x40fe89
mov word [esi], bx
jmp 0x40fec1
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0040fb67
add esp, 0x10
cmp word [ebp - 4], bx
je 0x40fec4
push 0xd
jmp 0x40febd
mov ecx, dword [ebx*4 + 0x41b1a0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x40febb
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x40fec4
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x410535
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004104b1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4106ad
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4106ad
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x41065c
jg 0x41058e
test eax, eax
je 0x410652
push 1
push 0x1000
call fcn.0040999c
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4105b4
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x410649
push 0x8000
push ebx
call fcn.004088ea
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4105e0
jg 0x4105db
cmp ecx, 0x1000
jb 0x4105e0
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0040df26
add esp, 0x10
cmp eax, 0xffffffff
je 0x410625
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4105db
jl 0x41060c
test ecx, ecx
jne 0x4105cd
push dword [ebp - 0xc]
push ebx
call fcn.004088ea
push esi
call fcn.004099f9
add esp, 0xc
xor edi, edi
jmp 0x4106be
cmp byte [edi + 0x24], 0
je 0x41063c
cmp dword [edi + 0x20], 5
jne 0x41063c
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x410647
mov edi, dword [edi + 0x18]
jmp 0x410649
xor edi, edi
push esi
call fcn.004099f9
pop ecx
jmp 0x4106be
test ecx, ecx
jg 0x41061e
jl 0x41065c
test eax, eax
jae 0x41061e
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0040fb67
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x41067f
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x41061e
jmp 0x4106b6
push ebx
call fcn.0040c28f
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x41061e
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x4106be
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x4106bb
mov edi, dword [edi + 0x18]
jmp 0x4106be
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0040fb67
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4126a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4126cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4126cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x43b63b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x43b3c1
sub ecx, edi
and edi, ecx
call fcn.0043b669
or edi, edi
mov edi, ecx
xor dword [ebx], eax
push edi
pop edi
sub edi, 0x1565b0ce
inc ebx
dec ecx
or edi, edi
push edi
pop ecx
cmp ebx, esi
jne fcn.0043b63b
mov edi, 0x121cf2df
ret

Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x402349
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x4048c8
call fcn.00402ab4
push 1
call fcn.00402611
pop ecx
test al, al
jne 0x4021f2
push 7
call fcn.0040287f
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.004025dc
mov byte [ebp - 0x24], al
mov eax, dword [0x40641c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x4021eb
test eax, eax
jne 0x40225c
mov dword [0x40641c], ecx
push 0x40416c
push 0x40415c
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40223f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x402343
push 0x404158
push 0x404150
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x40641c], 2
jmp 0x402261
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.0040276e
pop ecx
call fcn.00402873
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x402291
push esi
call fcn.004026e1
pop ecx
test al, al
je 0x402291
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.00402aae
call esi
call fcn.00402879
mov esi, eax
cmp dword [esi], edi
je 0x4022af
push esi
call fcn.004026e1
pop ecx
test al, al
je 0x4022af
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
push edi
call sub.VCRUNTIME140.dll___telemetry_main_invoke_trigger
pop ecx
call fcn.00402994
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
push edi
call sub.VCRUNTIME140.dll___telemetry_main_return_trigger
pop ecx
call fcn.004029c7
test al, al
jne 0x4022e8
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x4022f1
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.0040278b
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x402343
call fcn.00402afa
ret
call fcn.00402063
jmp 0x4021d3

Function at 0x40b2d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi + 0x2c]
test al, al
pop ebp
test byte [esi - 0x75000000], bh
dec esi
add al, 0x33
rcl byte [ebx - 0x31], 0xf9
add dword [edi - 0x77], edx
inc ebp
cld
mov dl, 0x45
pxor mm5, mm0
fiadd dword [eax]
add ch, dl
mov edi, dword [esi + 0x3c]
or eax, 0x7e090ff8
add byte [eax], al
add byte [ebx - 0x7cc7a2], cl
push dword [esi + 0x3f]
test al, cl
aam 0xeb
dec ebp
mov eax, edi
mov edx, dword [esi + 4]
lea ecx, [ebp - 0x59]
push 0x31
push ecx
push eax
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test dword [esi - 0x3b74d08c], esp
cld
mov edx, dword [esi + 0x3f]
mov ecx, dword [esi + 0x54]
add esp, dword [eax - 0x7d]
rol dword [eax], 1
sub edi, eax
jmp 0x50d03d16
Function at 0x433005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x402238
Capabilities:
Encrypt data using dpapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20a8
call fcn.0043fb00
mov eax, dword [ebp + 8]
push ebx
push esi
xor ebx, ebx
mov dword [eax + 4], ebx
push edi
lea eax, [ebp - 0xa4]
call fcn.0040806c
push dword [ebp + 0xc]
push eax
call fcn.00408097
test eax, eax
je 0x4023df
lea edi, [ebp - 0xa4]
call fcn.0040832a
test eax, eax
je 0x4023df
push 0x44073c
call fcn.00408123
mov edx, eax
cmp edx, ebx
je 0x4023df
lea eax, [ebp - 0x5c]
call fcn.0040806c
mov ecx, dword [edx + 4]
mov eax, dword [edx + 8]
call fcn.00407990
push eax
or eax, 0xffffffff
lea edi, [ebp - 0x3c]
mov dword [ebp - 0x28], ebx
call fcn.004079fa
lea edi, [ebp - 0x5c]
call fcn.0040832a
test eax, eax
je 0x4023c7
push str.encrypted_key
call fcn.00408123
cmp eax, ebx
je 0x4023c7
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
call fcn.00407990
mov esi, 0xfff
push esi
mov edi, eax
lea eax, [ebp - 0x20a3]
push ebx
push eax
mov byte [ebp - 0x20a4], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x10a3]
push ebx
push eax
mov byte [ebp - 0x10a4], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x20a4]
push eax
push edi
call fcn.004076b8
add esp, 0xc
lea edi, [ebp - 0x10a4]
lea eax, [ebp - 0x20a4]
call fcn.0040134b
push 5
mov esi, eax
mov eax, edi
push str.DPAPI
push eax
call sub.msvcrt.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x4023c7
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
lea edi, [ebp - 8]
mov dword [ebp - 0xc], ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x109f]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
add esi, 0xfffffffb
cmp eax, ebx
mov dword [ebp - 0x14], esi
je 0x402381
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x14]
push ecx
call fcn.00404f88
jmp 0x402394
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.CRYPT32.dll_CryptUnprotectData]
cmp eax, ebx
je 0x4023c7
cmp dword [ebp - 8], ebx
je 0x4023c7
cmp dword [ebp - 0xc], 0x20
jb 0x4023be
mov esi, dword [ebp + 8]
push 0x20
push dword [ebp - 8]
lea eax, [esi + 8]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov dword [esi + 4], 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_LocalFree]
lea esi, [ebp - 0x24]
call fcn.0040d859
lea esi, [ebp - 0x3c]
call fcn.004079d5
lea esi, [ebp - 0x5c]
call fcn.004078af
lea esi, [ebp - 0x6c]
call fcn.0040d859
lea esi, [ebp - 0x84]
call fcn.004079d5
lea esi, [ebp - 0xa4]
call fcn.004078af
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x403306
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [esi], 0
jne 0x40339c
push edi
push 0x440c90
call fcn.00406828
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [esp], str.CryptAcquireContextW
push eax
mov dword [esi], eax
call edi
push str.CryptReleaseContext
push dword [esi]
mov dword [esi + 4], eax
call edi
push str.CryptCreateHash
push dword [esi]
mov dword [esi + 8], eax
call edi
push str.CryptGetHashParam
push dword [esi]
mov dword [esi + 0xc], eax
call edi
push str.CryptHashData
push dword [esi]
mov dword [esi + 0x10], eax
call edi
push str.CryptDestroyHash
push dword [esi]
mov dword [esi + 0x14], eax
call edi
push str.CryptDecrypt
push dword [esi]
mov dword [esi + 0x18], eax
call edi
push str.CryptDeriveKey
push dword [esi]
mov dword [esi + 0x1c], eax
call edi
push str.CryptImportKey
push dword [esi]
mov dword [esi + 0x20], eax
call edi
push str.CryptDestroyKey
push dword [esi]
mov dword [esi + 0x24], eax
call edi
mov dword [esi + 0x28], eax
pop edi
ret

Function at 0x40381d
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x300
push esi
mov esi, dword [ebp + 8]
call fcn.004036bf
cmp edi, dword [ebp + 0x14]
jae 0x403837
mov dword [ebp + 0x14], edi
push ebx
mov esi, 0xff
xor ebx, ebx
push esi
lea eax, [ebp - 0xff]
push ebx
push eax
mov byte [ebp - 0x100], bl
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x1ff]
push ebx
push eax
mov byte [ebp - 0x200], bl
call sub.msvcrt.dll_memset
push esi
lea eax, [ebp - 0x2ff]
push ebx
push eax
mov byte [ebp - 0x300], bl
call sub.msvcrt.dll_memset
push dword [ebp + 0x14]
lea eax, [ebp - 0x100]
push dword [ebp + 0x10]
push eax
call sub.msvcrt.dll_memcpy
push dword [ebp + 0x14]
lea eax, [ebp - 0x200]
push dword [ebp + 0x10]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0x3c
xor eax, eax
cmp edi, ebx
pop ebx
jbe 0x4038be
xor byte [ebp + eax - 0x100], 0x5c
xor byte [ebp + eax - 0x200], 0x36
inc eax
cmp eax, edi
jb 0x4038a9
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x300]
push eax
push dword [ebp + 0x1c]
lea eax, [ebp - 0x200]
push dword [ebp + 0x18]
push edi
push eax
mov eax, dword [ebp + 8]
push esi
call fcn.0040378f
cmp esi, 0x8003
jne 0x4038ec
push 0x10
pop eax
jmp 0x4038f3
mov eax, esi
call fcn.004036eb
push dword [ebp + 0x20]
push eax
lea eax, [ebp - 0x300]
push eax
push edi
lea eax, [ebp - 0x100]
push eax
mov eax, dword [ebp + 8]
push esi
call fcn.0040378f
pop esi
leave
ret 0x1c
Function at 0x403b2e
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
push ebx
push esi
push edi
push 0x14
pop edi
mov esi, eax
mov dword [ebp - 4], edi
call fcn.004036bf
mov eax, dword [ebp + 0xc]
cmp eax, edi
jae 0x403b51
mov dword [ebp - 4], eax
mov edi, 0xff
xor ebx, ebx
push edi
lea eax, [ebp - 0x203]
push ebx
push eax
mov byte [ebp - 0x204], bl
call sub.msvcrt.dll_memset
push edi
lea eax, [ebp - 0x103]
push ebx
push eax
mov byte [ebp - 0x104], bl
call sub.msvcrt.dll_memset
push edi
lea eax, [ebp - 0x303]
push ebx
push eax
mov byte [ebp - 0x304], bl
call sub.msvcrt.dll_memset
push dword [ebp - 4]
lea eax, [ebp - 0x204]
push dword [ebp + 0x10]
push eax
call sub.msvcrt.dll_memcpy
push dword [ebp - 4]
lea eax, [ebp - 0x104]
push dword [ebp + 0x10]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0x3c
xor eax, eax
cmp dword [ebp + 0xc], ebx
jbe 0x403bd8
xor byte [ebp + eax - 0x204], 0x5c
xor byte [ebp + eax - 0x104], 0x36
inc eax
cmp eax, dword [ebp + 0xc]
jb 0x403bc2
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x304]
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 0x104]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push eax
push edi
mov eax, esi
call fcn.0040378f
cmp edi, 0x8003
jne 0x403c0b
mov dword [ebp + 0x18], 0x10
jmp 0x403c15
mov eax, edi
call fcn.004036eb
mov dword [ebp + 0x18], eax
call fcn.004036bf
lea eax, [ebp + 0x10]
push eax
mov eax, dword [esi + 0x14]
push edi
push dword [esi]
call fcn.004033c7
test eax, eax
je 0x403c77
push dword [ebp + 0xc]
lea eax, [ebp - 0x204]
push eax
push dword [ebp + 0x10]
mov eax, dword [esi + 0x14]
call fcn.00403419
test eax, eax
je 0x403c6c
push dword [ebp + 0x18]
lea eax, [ebp - 0x304]
push eax
push dword [ebp + 0x10]
mov eax, dword [esi + 0x14]
call fcn.00403419
test eax, eax
je 0x403c6c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
xor ebx, ebx
inc ebx
mov dword [ecx], eax
jmp 0x403c77
push dword [ebp + 0x10]
mov eax, dword [esi + 0x14]
call fcn.00403440
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x18