joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5171de
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
cmp dword [0x4f2b84], 1
jne 0x51737a
push 0xc
push 0
lea eax, [ebp - 0x18]
push eax
call fcn.0050de68
add esp, 0xc
xor eax, dword [esp + 0x10]
xor eax, dword [esp + 0x10]
ror edx, 0
and edi, 0xffffffff
jns 0x517231
pushf
cmp ecx, dword [esp]
test edx, 0x51fa
push esi
add esi, 0x3aff
ror esi, 0x17
pop esi
popf
xchg ebx, ebx
js 0x517231
mov eax, 0x48e845c6
mov byte [ebp - 0x18], 0x48
mov byte [ebp - 0x13], 0x6d
mov byte [ebp - 0xe], 0x64
mov byte [ebp - 0x17], 0x6d
mov byte [ebp - 0x12], 0x42
mov byte [ebp - 0xd], 0
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x11], 0x6d
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x10], 0x6d
mov byte [ebp - 0x14], 0x62
mov byte [ebp - 0xf], 0x70
add eax, dword [esp]
sub eax, dword [esp]
sub ecx, 0
add ebx, 0x7848
sub ebx, 0x7848
jb 0x51727d
jl 0x51727a
jae 0x51727d
sub eax, 0x80e84d8a
jmp 0xe89efa87
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x13]
sub dl, 1
mov byte [ebp - 0x13], dl
mov al, byte [ebp - 0xe]
sub al, 1
mov byte [ebp - 0xe], al
mov cl, byte [ebp - 0x17]
sub cl, 1
mov byte [ebp - 0x17], cl
mov dl, byte [ebp - 0x12]
sub dl, 1
mov byte [ebp - 0x12], dl
mov al, byte [ebp - 0x16]
sub al, 1
mov byte [ebp - 0x16], al
mov cl, byte [ebp - 0x11]
sub cl, 1
mov byte [ebp - 0x11], cl
mov dl, byte [ebp - 0x15]
sub dl, 1
mov byte [ebp - 0x15], dl
mov al, byte [ebp - 0x10]
sub al, 1
mov byte [ebp - 0x10], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0xf]
sub dl, 1
mov byte [ebp - 0xf], dl
call fcn.00513dcd
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x5172f2
xor eax, eax
jmp 0x5173cb
shr ecx, 0
jb 0x5172f7
ja 0x51730e
pushf
add ebx, 0x3529
sub ebx, 0x3529
popf
xchg esi, eax
xchg esi, eax
jbe 0x51730e
mov edx, 0x50e8458d
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.005173f7
mov dword [ebp - 8], eax
push 0xc
push 0
lea edx, [ebp - 0x18]
push edx
call fcn.0050de68
add esp, 0xc
lea esp, [esp]
jl 0x517364
pushf
call 0x51733a
add esp, 4
jge 0x51733f
lea edi, [edi + 0xb11]
sub edi, 0xb11
xchg esi, ebx
xchg esi, ebx
popf
jl 0x517353
lea ebx, [ebx + 0x643d]
lea ebx, [ebx - 0x643d]
jle 0x517361
jge 0x517364
mov ebp, 0xf87d83
cmp dword [ebp - 8], 0
je 0x517374
mov eax, dword [ebp - 8]
mov dword [0x4f2b84], eax
jmp 0x517378
xor eax, eax
jmp 0x5173cb
jmp 0x517383
mov ecx, dword [0x4f2b84]
mov dword [ebp - 8], ecx
jno 0x517385
jl 0x517387
or eax, 0
js 0x5173a1
pushf
rol ebx, 0x1c
rol ebx, 4
dec ebx
inc ebx
popf
jmp 0x51739a
xchg edi, eax
xchg edi, eax
jns 0x51739e
jns 0x5173a1
mov ebp, 0x89f8558b
push ebp
cld
mov edx, dword [ebp - 8]
mov dword [ebp - 4], edx
lea esp, [esp]
jle 0x5173b4
mov edi, edi
jne 0x5173b0
jg 0x5173b4
mov ebp, 0xfc458bb3
mov eax, dword [ebp - 4]
push eax
call fcn.004ff307
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5297e1
Capabilities:
Encode data using xor

Disassembly:
daa
iretd
and ebp, edi
pop ss
adc al, 0x37
mov edi, 0x54b17ee6
push ecx
cld
mov ch, 0x27
sub al, 0xa6
jl 0x5297f7
int1
imul eax, ebx, 0x775a28a2
salc
mov byte [0xd6775a28], al
test dword [ebx + 0x6652a4c2], 0x2c31ea41
jne 0x529866
xor esp, dword [ebp - 0x61a3e6b0]
aaa
mov esi, 0xa23e75c0
adc dword [eax + 0x317b9ade], edx
pop edi
mov eax, dword [0x2d5e9610]
mov edi, 0xa3e129db
loope 0x5297c8
std
out dx, eax
mov byte [edi - 0x45], bl
xchg edi, eax
add eax, 0xecf49b73
call 0x9908e4ba
sti
outsb dx, byte [esi]
lds ebp, [esp + edx*4]
lodsb al, byte [esi]
mov ch, 0x71
stc
ficom word [ebx + eax*8 - 0x3d]
xor al, 0x4e
cld
sub cl, byte [esi - 0x45a2e9ec]
test byte [ecx - 0xeacf9ea], al
sbb eax, 0xc7088b55
ja 0x529823
invalid
and esp, dword [ebp + 0x673eda07]
pmuludq mm6, qword [ecx - 0xf]
inc byte [esi - 0x4f0523bb]
add dword [edx + ecx*4], 0xffffffb9
inc ebp
push ds
xchg ebp, eax
invalid
Function at 0x401ad0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x42c00c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
movzx eax, byte [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], ebx
push esi
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0xc], esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], edi
cmp ebx, 0xffffffff
je 0x401b62
push 0
push 0
xorps xmm0, xmm0
movq qword [ebp - 0x44], xmm0
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x401b58
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x401b62
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x401bb8
test edi, edi
je 0x401b6c
mov dword [edi], 0
test esi, esi
je 0x401b76
mov dword [esi], 0
xor esi, esi
lea ecx, [ebp - 0x38]
call fcn.004016e0
test al, al
jne 0x401b8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x401ba3
mov eax, 0x51eb851f
mul dword [ebp - 0x18]
shr edx, 5
cmp edx, 2
je 0x401bb6
mov edi, 0x10dc
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 5
jl 0x401b78
jmp 0x401bb8
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 8]
test edi, edi
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.0040f2ed
mov esp, ebp
pop ebp
ret
Function at 0x401f30
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
mov eax, dword [0x42c00c]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
push 0x20
lea eax, [esp + 0x24]
xor esi, esi
push eax
mov edi, ecx
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x401ff6
cmp eax, 0x20
ja 0x401ff6
call fcn.004074f0
push esi
mov ebx, eax
mov dword [esp + 0x10], edx
lea eax, [esp + 0x14]
push eax
push 1
push str.D:P_A_CIOI_FA___SY__A_CIOI_FA___BA__A_CIOI_FRFX___BU_
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorA]
test eax, eax
je 0x401ff6
mov eax, dword [esp + 0x10]
push ebx
push dword [esp + 0x10]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x28]
push eax
push str._sTemp_asw._08x_08x
push edi
mov dword [esp + 0x28], 0xc
mov dword [esp + 0x30], esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401ffe
movzx eax, word [esp + 0x20]
push ebx
push dword [esp + 0x10]
push eax
push str._c:_asw._08x_08x
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401ffe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40200d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x64]
test esi, esi
pop edi
pop esi
sete al
pop ebx
xor ecx, esp
call fcn.0040f2ed
mov esp, ebp
pop ebp
ret
Function at 0x4020f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x42c00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
test ecx, ecx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, 0x400000
push 0x10
cmovne esi, ecx
mov dword [ebp - 0x18], edx
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4021ec
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4021ec
lea eax, [ebp - 0xc]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp - 0x14]
push eax
push 0x428018
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4021ec
mov ecx, dword [ebp - 0x14]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push 0x42801c
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
test ebx, ebx
je 0x4021af
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push str.StringFileInfo040904b0Edition
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4021af
push dword [ebp - 0x10]
call fcn.0041384c
add esp, 4
mov dword [ebx], eax
test edi, edi
je 0x4021d9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push str.StringFileInfo040904b0SubEdition
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x4021d9
push dword [ebp - 0x10]
push 0x40
push edi
call fcn.00413871
add esp, 0xc
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f2ed
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f2ed
mov esp, ebp
pop ebp
ret
Function at 0x406750
Capabilities:
Hash data via wincrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4217d0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x42c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x28], edx
mov esi, ecx
mov dword [ebp - 0x14], esi
mov ebx, dword [ebp + 0xc]
xorps xmm0, xmm0
mov edi, dword [ebp + 8]
mov dword [ebp - 0x14], esi
push 0x800c
test ebx, ebx
jne 0x4067de
lea ecx, [ebp - 0x24]
movlpd qword [ebp - 0x24], xmm0
call fcn.00406450
mov ecx, dword [ebp - 0x28]
push ebx
push edi
push ecx
mov dword [ebp - 4], ebx
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x406890
push esi
lea ecx, [ebp - 0x24]
call fcn.004073e0
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4067d6
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0x24]
jmp 0x406865
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], 0
movlpd qword [ebp - 0x1c], xmm0
call fcn.00406450
push 0
push ebx
push dword [ebp - 0x28]
mov dword [ebp - 4], 1
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4068b2
push 0
push 4
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4068d4
mov ecx, dword [ebp - 0x28]
sub edi, ebx
push 0
add ecx, 4
add ecx, ebx
lea eax, [edi - 4]
push eax
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x4068f6
push esi
lea ecx, [ebp - 0x1c]
call fcn.004073e0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x406862
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x406872
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f2ed
mov esp, ebp
pop ebp
ret
push str.Unable_to_update_hash_context_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x38]
call fcn.00406250
push 0x42a6f8
lea eax, [ebp - 0x38]
push eax
call fcn.00410c7a
push str.Unable_to_update_hash_context_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x38]
call fcn.00406250
push 0x42a6f8
lea eax, [ebp - 0x38]
push eax
call fcn.00410c7a
push str.Unable_to_update_hash_context_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x38]
call fcn.00406250
push 0x42a6f8
lea eax, [ebp - 0x38]
push eax
call fcn.00410c7a
push str.Unable_to_update_hash_context_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x38]
call fcn.00406250
push 0x42a6f8
lea eax, [ebp - 0x38]
push eax
call fcn.00410c7a
int3
Function at 0x406e40
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421810
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x42c00c]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0
cmp edx, 0x40
jb 0x406f79
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x406f79
mov ebx, dword [edi + 0x3c]
test ebx, ebx
js 0x406f77
cmp edx, ebx
jb 0x406f77
mov esi, edx
lea ecx, [ebx + edi]
sub esi, ebx
cmp esi, 4
jb 0x406f77
cmp dword [ecx], 0x4550
jne 0x406f77
sub esi, 4
cmp esi, 0x14
jb 0x406f77
movzx eax, word [ecx + 4]
sub esi, 0x14
mov dword [ebp - 0x38], 0x14c
cmp ax, word [ebp - 0x38]
jne 0x406f07
cmp esi, 0xe0
jb 0x406f77
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x406f77
mov eax, dword [ecx + 0x98]
mov ecx, dword [ecx + 0x9c]
jmp 0x406f40
mov dword [ebp - 0x38], 0x8664
cmp ax, word [ebp - 0x38]
je 0x406f21
mov dword [ebp - 0x38], 0xaa64
cmp ax, word [ebp - 0x38]
jne 0x406f77
cmp esi, 0xf0
jb 0x406f77
mov eax, 0x20b
cmp word [ecx + 0x18], ax
jne 0x406f77
mov eax, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xac]
lea esi, [ecx + eax]
add ebx, 0x58
cmp esi, edx
ja 0x406f79
cmp esi, eax
jb 0x406f79
test eax, eax
jne 0x406f57
test ecx, ecx
cmove eax, edx
dec eax
xor ecx, ecx
nop word [eax + eax]
cmp eax, edx
jae 0x406f71
cmp byte [eax + edi], 0
jne 0x406f71
inc ecx
dec eax
cmp ecx, 8
jl 0x406f60
inc eax
mov dword [ebp - 0x1c], eax
jmp 0x406f79
xor ebx, ebx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x2c], 0
xorps xmm0, xmm0
lea ecx, [ebp - 0x34]
push eax
mov edx, edi
movq qword [ebp - 0x34], xmm0
call fcn.00406530
add esp, 4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
push ebx
push dword [ebp - 0x1c]
xorps xmm0, xmm0
mov dword [ebp - 0x20], 0
mov edx, edi
movq qword [ebp - 0x28], xmm0
call fcn.00406750
add esp, 8
push dword [ebp + 8]
lea edx, [ebp - 0x34]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.004069b0
mov ecx, dword [ebp - 0x28]
add esp, 4
mov bl, al
test ecx, ecx
je 0x407019
mov edx, dword [ebp - 0x20]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x406ffa
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407071
push edx
push ecx
call fcn.0040f81e
add esp, 8
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x407049
mov edx, dword [ebp - 0x2c]
mov eax, ecx
sub edx, ecx
cmp edx, 0x1000
jb 0x40703f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407076
push edx
push ecx
call fcn.0040f81e
add esp, 8
mov al, bl
jmp 0x407055
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0040f2ed
mov esp, ebp
pop ebp
ret
call fcn.00412f88
call fcn.00412f88
int3
Function at 0x407080
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421850
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x42c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov esi, ecx
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x407169
cmp dword [ebp - 0x14], 0
jl 0x4070e2
jg 0x4070d3
cmp dword [ebp - 0x18], 0x40000000
jbe 0x4070e2
push str.Unable_to_process_files_over_1GB_
push 0xdf
jmp 0x407175
push 0
push 0
push 0
push 2
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
test esi, esi
jne 0x407100
push str.Unable_to_open_file_mapping_
jmp 0x40716e
mov dword [ebp - 0x2c], esi
push 0
push 0
push 0
push 4
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
test edi, edi
jne 0x407126
push str.Unable_to_open_file_mapping_
jmp 0x40716e
mov dword [ebp - 0x30], edi
mov byte [ebp - 4], 1
mov ecx, edi
mov edx, dword [ebp - 0x18]
push ebx
call fcn.00406e40
add esp, 4
mov bl, al
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f2ed
mov esp, ebp
pop ebp
ret
push str.Unable_to_determine_file_size_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x28]
call fcn.00406250
push 0x42a6f8
lea eax, [ebp - 0x28]
push eax
call fcn.00410c7a
int3
Function at 0x4072b0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x421888
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x84
mov eax, dword [0x42c00c]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x80], esi
mov dword [esi], 0
mov dword [ebp - 4], 0
movups xmm0, xmmword [0x428c58]
mov eax, dword [0x428c88]
mov dword [ebp - 0x48], eax
mov ax, word [0x428c8c]
movups xmmword [ebp - 0x78], xmm0
push 0x2a
movups xmm0, xmmword [0x428c68]
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push 0
movups xmmword [ebp - 0x68], xmm0
push eax
movups xmm0, xmmword [0x428c78]
movups xmmword [ebp - 0x58], xmm0
call fcn.00410b20
add esp, 0xc
call fcn.00406300
cmp eax, 0x5020000
jae 0x407363
push str.__Prototype_
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0xf0000040
push 0x18
lea eax, [ebp - 0x78]
push eax
push 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x4073b1
mov eax, dword [esi]
mov ecx, dword [ebp - 0x7c]
mov dword [esi], ecx
test eax, eax
je 0x407392
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040f2ed
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push str.Unable_to_acquire_cryptographic_provider_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x90]
call fcn.00406250
push 0x42a6f8
lea eax, [ebp - 0x90]
push eax
call fcn.00410c7a
int3

Function at 0x4074f0
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4218fc
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x42c00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x42d530]
cmp eax, dword [ecx + 4]
jle 0x40757f
push 0x42d530
call fcn.0040f72a
add esp, 4
cmp dword [0x42d530], 0xffffffff
jne 0x40757f
mov dword [ebp - 4], 0
mov ecx, 0x42d534
mov dword [0x42d534], 0
call fcn.004072b0
push 0x421c50
call fcn.0040fc19
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x42d530
call fcn.0040f6e0
add esp, 4
lea eax, [ebp - 0x18]
xorps xmm0, xmm0
push eax
push 8
push dword [0x42d534]
movlpd qword [ebp - 0x18], xmm0
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x4075bc
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f2ed
mov esp, ebp
pop ebp
ret
push str.Unable_to_generate_random_number_
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x28]
call fcn.00406250
push 0x42a6f8
lea eax, [ebp - 0x28]
push eax
call fcn.00410c7a
int3
Function at 0x411b30
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40f015
lea edi, [esi - 0xe015]
push edi
or ebp, 0xffffffff
jmp 0x411b52
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x411b59
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x411b48
mov eax, 1
add ebx, ebx
jne 0x411b6b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x411b60
jne 0x411b7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411b60
xor ecx, ecx
sub eax, 3
jb 0x411b90
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x411c02
mov ebp, eax
add ebx, ebx
jne 0x411b9b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x411ba8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x411bcc
inc ecx
add ebx, ebx
jne 0x411bb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x411bad
jne 0x411bc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x411bad
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x411bec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x411bdd
jmp 0x411b4e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x411bec
add edi, ecx
jmp 0x411b4e
pop esi
mov edi, esi
mov ecx, 0x1d0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x411c0a
cmp byte [edi], 0
jne 0x411c0a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x411c0f
lea edi, [esi + 0xf000]
mov eax, dword [edi]
or eax, eax
je 0x411c7e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x11000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x110b4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x411c3c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x110b8]
or eax, eax
je 0x411c78
mov dword [ebx], eax
add ebx, 4
jmp 0x411c59
call dword [esi + 0x110c8]
mov ebp, dword [esi + 0x110bc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x411cb2
sub esp, 0xffffff80
jmp 0x406058